Object recognition method, apparatus, device, and medium

Abstract

The present disclosure provides an object recognition method, device, equipment and medium, wherein the object recognition method comprises: obtaining a first service feature of each first candidate object using a first application program, and a second service feature of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different; determining a first reference object from the plurality of first candidate objects according to the first service feature; determining a second reference object from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object; determining a derivative operation behavior feature of the second reference object using a service provided by the first application program, obtaining a to-be-analyzed association feature of the second reference object; and determining whether the second reference object is a second target object and determining whether the first reference object is a first target object according to the to-be-analyzed association feature, thereby solving the technical problem that the object recognition is not accurate in the prior art.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of Internet security, and particularly relates to an object identification method and device, equipment and medium. BACKGROUND

[0002] With the rise of mobile Internet, the fraud mode has been converted from telephone fraud to Internet fraud. In the related technology, the hit rate of identifying objects (for example, fraud-related users) based on a voice model is low, and the operation behavior of the objects on the Internet is not considered.

[0003] In this way, the object identification is not accurate enough. SUMMARY

[0004] The present disclosure aims to at least partially solve one of the technical problems in the related art.

[0005] To this end, the present disclosure provides an object identification method and device, an electronic device, a non-transitory computer-readable storage medium storing computer instructions, and a computer program product, to accurately identify objects.

[0006] To achieve the above purpose, the first aspect of the present disclosure provides an object identification method, comprising: obtaining a first service feature of each first candidate object using a first application program, and a second service feature of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different; determining a first reference object from a plurality of first candidate objects according to the first service feature; determining a second reference object from a plurality of second candidate objects according to the first service feature and the second service feature of the first reference object; determining a derivative operation behavior feature of the second reference object using a service provided by the first application program, to obtain a to-be-analyzed association feature of the second reference object; and determining whether the second reference object is a second target object and determining whether the first reference object is a first target object according to the to-be-analyzed association feature.

[0007] To achieve the above object, the second aspect of the present disclosure provides an object identification device, comprising: an acquisition module configured to acquire a first service feature of each first candidate object using a first application program and a second service feature of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different; a first determination module configured to determine a first reference object from the plurality of first candidate objects according to the first service feature; a second determination module configured to determine a second reference object from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object; a third determination module configured to determine a derivative operation behavior feature of the second reference object using a service provided by the first application program, and obtain a to-be-analyzed association feature of the second reference object; and a fourth determination module configured to determine whether the second reference object is a second target object and whether the first reference object is a first target object according to the to-be-analyzed association feature.

[0008] The third aspect of the present disclosure provides an electronic device, comprising: a processor and a memory connected with the processor; the memory stores computer execution instructions; and the processor executes the computer execution instructions stored in the memory to implement the method described above.

[0009] The fourth aspect of the present disclosure provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method described above.

[0010] The fifth aspect of the present disclosure provides a computer program product, comprising a computer program, wherein the computer program is executed by the processor to implement the method described above.

[0011] The object recognition method, device, electronic device, non-transitory computer-readable storage medium storing computer instructions, and computer program product provided by the present disclosure obtain a first service feature of each first candidate object using a first application, and a second service feature of each second candidate object using the first application, wherein the first candidate object and the second candidate object are different, determine a first reference object from the plurality of first candidate objects according to the first service feature, determine a second reference object from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object, determine a derivative operation behavior feature of the second reference object using a service provided by the first application, obtain a to-be-analyzed association feature of the second reference object, and determine the derivative operation behavior feature of the second reference object using the service provided by the first application, obtain the to-be-analyzed association feature of the second reference object. Since the multi-dimensional features of the first candidate object and the second candidate object are detected respectively, and the first target object and the second target object are identified based on the detected first service feature, second service feature, and to-be-analyzed association feature, the object can be accurately identified.

[0012] Additional aspects and advantages of the present disclosure will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0013] The above and / or additional aspects and advantages of the present disclosure will become apparent and be readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0014] Figure 1 is a flowchart of an object recognition method according to an embodiment of the present disclosure;

[0015] Figure 2 is a flowchart of an object recognition method according to another embodiment of the present disclosure;

[0016] Figure 3 is a structural diagram of an object recognition device according to an embodiment of the present disclosure;

[0017] Figure 4 shows a block diagram of an exemplary electronic device suitable for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure are described in detail below with reference to the attached drawings, wherein the same or similar components are denoted by the same or similar reference numerals, and therefore repeated description is omitted. The embodiments described below are examples for explaining the present disclosure, and are not intended to be limiting of the present disclosure.

[0019] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the present disclosure are authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of the country and region.

[0020] Figure 1 FIG. 1 is a flow diagram of an object recognition method according to an embodiment of the present disclosure.

[0021] The present embodiment takes an object recognition method configured in an object recognition device as an example. In the present embodiment, the object recognition method can be configured in an object recognition device. The object recognition device can be arranged in a server or an electronic device, and the present disclosure is not limited in this regard.

[0022] It should be noted that the execution subject of the present embodiment can be, for example, a central processing unit (CPU) in a server or an electronic device in hardware, and a related background service in a server or an electronic device in software, and the present disclosure is not limited in this regard.

[0023] As shown in FIG. 1, the object recognition method comprises the following steps. Figure 1

[0024] S101: Obtain a first service feature of each first candidate object using a first application program and a second service feature of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different.

[0025] The candidate object can be, for example, a user object using a first application program in an electronic device. The first candidate object can be, for example, a candidate object initiating a service provided by the first application program. The number of first candidate objects can be one or more. The second candidate object can be, for example, a candidate object passively using a service provided by the first application program. The number of second candidate objects can also be one or more, and the present disclosure is not limited in this regard.

[0026] The communication mode of the first application program can be an over-the-top (OTT) communication mode. Thus, the object using the application program in the OTT communication mode can be effectively identified.

[0027] ​The first candidate object can use a service provided by a first application installed in the electronic device on the first side, and a service use feature generated by the first candidate object using the service provided by the first application on the first side can be referred to as a first service feature. Correspondingly, the second candidate object can use the service provided by the first application installed in the electronic device on the second side, and a service use feature generated by the second candidate object using the service provided by the first application on the second side can be referred to as a second service feature.

[0028] In some embodiments, the first service feature can include at least one of the following: service identification information; service start time; service end time; service use frequency; service use duration; service use success rate; identification information of the candidate object; and device type to which the candidate object belongs. Thus, the representation accuracy of the service use feature generated by the first candidate object using the service provided by the first application on the first side can be effectively improved, and the object recognition accuracy can be further improved.

[0029] The service identification information may, for example, be information such as the name of the first application. The identification information of the candidate object included in the first service feature may, for example, be the user mobile phone number of the first candidate object. The device type to which the candidate object belongs included in the first service feature may, for example, be the device type of the device used by the first candidate object. For example, the device is produced by which manufacturer, and the like, which are not limited.

[0030] In some embodiments, the second service feature can include at least one of the following: service identification information; service start time; service end time; service use frequency; service use duration; service use success rate; identification information of the candidate object; and device type to which the candidate object belongs. Thus, the representation accuracy of the service use feature generated by the second candidate object using the service provided by the first application on the second side can be effectively improved, and the object recognition accuracy can be further improved.

[0031] The service identification information may, for example, be information such as the name of the first application. The identification information of the candidate object included in the second service feature may, for example, be the user mobile phone number of the second candidate object. The device type to which the candidate object belongs included in the second service feature may, for example, be the device type of the device used by the second candidate object. For example, the device is produced by which manufacturer, and the like, which are not limited.

[0032] S102: determining a first reference object from the plurality of first candidate objects according to the first service feature.

[0033] The first reference object refers to a first candidate object that is more likely to be a first target object. The first target object may, for example, be a fraud user, which is not limited.

[0034] After the first service features of each first candidate object are identified, the first reference object can be identified from the plurality of first candidate objects by referring to the first service features.

[0035] In some embodiments, the service usage frequency, the service usage duration, the service usage success rate, the identification information of the candidate object, and the device type to which the candidate object belongs can be compared with some threshold values, and the first candidate object to which the first service feature that meets the threshold values belongs can be taken as the first reference object. Alternatively, the various possible first service features can be processed using an artificial intelligence method to determine the first reference object from the plurality of first candidate objects according to the first service features. Alternatively, the first reference object can be determined from the plurality of first candidate objects according to the first service features in combination with any other possible method, and no limitation is imposed.

[0036] S103: determining a second reference object from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object.

[0037] The second reference object refers to a second candidate object that is more likely to be a second target object. The second target object is, for example, a deceived user, and no limitation is imposed.

[0038] As can be seen, the first reference object and the second reference object can have a certain correlation.

[0039] After the first reference object is identified from the plurality of first candidate objects, the second reference object can be determined from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object.

[0040] Since the first reference object is a first candidate object that is more likely to be a first target object, the first service feature and the second service feature of the first reference object can be used to analyze whether the second candidate object is the second reference object.

[0041] In some embodiments, the correlation between the first service feature and the second service feature of the first reference object can be analyzed, and the second reference object can be identified from the plurality of second candidate objects by referring to the correlation. Alternatively, the second reference object can be determined from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object in combination with an artificial intelligence method. Alternatively, the second reference object can be determined from the plurality of second candidate objects according to the first service feature and the second service feature of the first reference object in combination with any other possible method, and no limitation is imposed.

[0042] S104: determining a derivative operation behavior feature of the service provided by the first application program used by the second reference object to obtain a to-be-analyzed correlation feature of the second reference object.

[0043] The to-be-analyzed correlation feature is used to represent a derived operation behavior feature of the second reference object using the service provided by the first application. The derived operation behavior is, for example, that the second reference object accepts chat, conference, remote control, and transfer based on the first application. The to-be-analyzed correlation feature can be used to represent the foregoing derived operation behavior of the second reference object.

[0044] In some embodiments, the derived operation behavior of the second reference object on the Internet based on the first application can be detected to determine the to-be-analyzed correlation feature, or the operation log of the second reference object using the first application can be statistically analyzed to determine the to-be-analyzed correlation feature, or any other possible way can be used to determine the derived operation behavior feature of the second reference object using the service provided by the first application, and no limitation is made in this regard.

[0045] S105: Determine whether the second reference object is the second target object and whether the first reference object is the first target object according to the to-be-analyzed correlation feature.

[0046] After the to-be-analyzed correlation feature of the second reference object is determined, whether the second reference object is the second target object and whether the first reference object is the first target object can be determined based on the to-be-analyzed correlation feature.

[0047] In this embodiment, the first business feature of each first candidate object using the first application and the second business feature of each second candidate object using the first application are obtained, the first candidate object and the second candidate object are different, the first reference object is determined from the plurality of first candidate objects according to the first business feature, the second reference object is determined from the plurality of second candidate objects according to the first business feature and the second business feature of the first reference object, the derived operation behavior feature of the second reference object using the service provided by the first application is determined, the to-be-analyzed correlation feature of the second reference object is obtained, and the derived operation behavior feature of the second reference object using the service provided by the first application is determined, the to-be-analyzed correlation feature of the second reference object is obtained. Since the multi-dimensional features of the first candidate object and the second candidate object are detected respectively, and the first target object and the second target object are identified based on the detected first business feature, second business feature, and to-be-analyzed correlation feature, accurate object identification can be effectively achieved.

[0048] Figure 2 is a flowchart of an object identification method according to another embodiment of the present disclosure.

[0049] As shown in Figure 2 , the object identification method comprises:

[0050] S201: Obtain a first service feature of each first candidate object using a first application program, and a second service feature of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different, and the communication mode of the first application program is an over-the-top (OTT) mode based on Internet communication.

[0051] In an example, the Internet behavior features of each candidate object can be collected and analyzed through deep packet inspection (DPI) signaling, and the corresponding service features can be obtained by analysis.

[0052] In an example, the first application program is, for example, a video call software provided by a mobile phone, and no limitation is made to the first application program.

[0053] In an example, the service features (including dialing, ending, and other processes) can be quickly obtained through sample dialing, data cleaning, rule extraction, machine learning algorithms, and other technical means, and the associated features such as chat, conference, remote control, and transfer can be obtained. In addition, various features recognized can be configured into DPI service identification rules to support subsequent object identification processes.

[0054] S202: Determine a first service feature that meets a first condition from a plurality of first service features.

[0055] After the first service features of each first candidate object are determined, each first service feature can be compared with the first condition, and the first service feature that meets the first condition can be identified from the plurality of first service features.

[0056] In some embodiments, the first service feature that meets the first condition includes the following: the device type to which the first candidate object belongs is a target type; the service usage frequency is greater than a frequency threshold; the service usage time length is greater than a first time length threshold; and the service usage success rate is less than a success rate threshold. Thus, the accuracy of identifying the first reference object can be improved.

[0057] In an example, a first reference user set (containing one or more first reference users) can be output according to the frequency (an optional example of the service usage frequency), the time length (an optional example of the service usage time length), and the success rate (an optional example of the service usage success rate) of using the first application program by a user. Thus, by first screening the first reference user set, the amount of data for subsequent analysis can be greatly reduced, and the target object identification efficiency can be improved. The first reference user at least meets the following conditions:

[0058] The device type to which the first candidate object belongs is a target type;

[0059] The frequency of using the first application program is greater than a threshold 1 (an optional example of the frequency threshold).

[0060] a duration of using the first application is greater than a threshold 2 (one optional example of the first duration threshold);

[0061] a success rate of using the first application is lower than a threshold 3 (one optional example of the success rate threshold).

[0062] S203: taking the first candidate object to which the first business feature meeting the first condition belongs as the first reference object.

[0063] After determining the first business feature meeting the first condition from the plurality of first candidate objects, the first candidate object to which the first business feature meeting the first condition belongs can be taken as the first reference object. Thus, the first reference user can be accurately and efficiently identified.

[0064] In some embodiments, the first business feature and the second business feature can further include identification information of the candidate object, business identification information, a business start time, and a business end time. The identification information of the candidate object can be, for example, a user mobile phone number of the first candidate object or a user mobile phone number of the second candidate object. The business identification information can be, for example, a name of the first application or a name of a service provided by the first application. The business identification information can be represented as “app”. The identification information of the candidate object can be represented as “msisdn” or “International Mobile Subscriber Identity (IMSI)”. The business start time in the first business feature can be represented as starttime1, the business end time in the first business feature can be represented as endtime1, the business start time in the second business feature can be represented as starttime2, the business end time in the second business feature can be represented as endtime2, the identification information of the candidate object in the first business feature can be represented as IMSI1, and the identification information of the candidate object in the second business feature can be represented as IMSI2. This is not limited.

[0065] S204: determining a second business feature meeting a second condition with the first business feature.

[0066] In this embodiment, after the first reference object is identified, the first business feature of the first reference object and the second business features of the second candidate objects can be compared and analyzed to identify the second business feature meeting the second condition from the plurality of second business features.

[0067] The second condition can be a threshold condition for determining that the first reference object and the second reference object have a strong connection.

[0068] For example, if the second condition is met between the first service feature of the first reference object (e.g., a fraud user) and the second service feature of the second candidate object, it means that there is a greater possibility that the second candidate object is the second target object (e.g., a cheated user), and the second candidate object can be taken as the second reference object, and whether the second reference object is determined to be the second target object is further analyzed subsequently.

[0069] In some embodiments, the second service feature satisfying the second condition includes the following: the business identification information in the second service feature is the same as the business identification information in the first service feature; the business start time in the second service feature is later than the business start time in the first service feature; the business start time in the second service feature is earlier than the business end time in the first service feature; the time difference between the business start time in the second service feature and the business start time in the first service feature is less than a second time threshold; and the absolute value of the time difference between the business end time in the second service feature and the business end time in the first service feature is less than a third time threshold. In this way, by analyzing whether the second condition is met between the first service feature and the second service feature, the second reference object can be identified to support, thereby effectively improving the accuracy of the second reference object identification.

[0070] For example, the first reference object identified can be determined according to the time correlation to determine a second reference user set (which can contain one or more second reference users). Assuming that the business start time of the first reference object IMSI1 is starttime1, the business end time is endtime1, the business start time of the second candidate object IMSI2 is starttime2, and the business end time is endtime2, the second service feature of the second candidate object IMSI2 and the first service feature of the first reference object IMSI1 are determined to meet the time correlation between the second candidate object IMSI2 and the first reference object IMSI1, and the second candidate object IMSI2 can be taken as the second reference object under the following conditions. The following conditions include:

[0071] (1) The second candidate object IMSI2 and the first reference object IMSI1 use the first application.

[0072] (2) starttime2>starttime1, that is, the start time of the second candidate object IMSI2 using the first application is later than the start time of the first reference object IMSI1 using the first application.

[0073] (3)starttime2 < endtime2, i.e., the start time of the second candidate object IMSI2 using the first application is earlier than the end time of the first reference object IMSI1 using the first application.

[0074] (4)starttime2 - starttime1 < threshold4 (an optional example of the second duration threshold), i.e., the start time of the second candidate object IMSI2 using the first application is less than a specified threshold4, which is small, such as 1s (second), from the start time of the first reference object IMSI1 using the first application, indicating that the second candidate object IMSI2 and the first reference object IMSI1 use the first application time close.

[0075] (5)|endtime2 - endtime1| < threshold5 (an optional example of the third duration threshold), i.e., the end time of the second candidate object IMSI2 using the first application is less than a specified threshold5, which is small, such as 1s, from the end time of the first reference object IMSI1 using the first application, indicating that the second candidate object IMSI2 and the first reference object IMSI1 use the first application time close.

[0076] S205: Taking the second candidate object to which the second service feature satisfying the second condition in the plurality of second candidate objects as the second reference object.

[0077] After determining the second service feature satisfying the second condition with the first service feature, the second candidate object to which the second service feature satisfying the second condition in the plurality of second candidate objects can be directly taken as the second reference object.

[0078] In some embodiments, after identifying the second reference object, the identification of the first reference object can also be determined based on the identified one or more second reference objects to realize backtracking analysis of the identification accuracy of the first reference object.

[0079] In some embodiments, the first regional information of the first reference object can be determined according to the identification information of the candidate object in the first service feature, and the second regional information of each second reference object can be determined, and the distribution feature of the plurality of second regional information can be determined, and it is determined that the distribution feature satisfies the third condition; wherein the distribution feature satisfies the third condition, including: the proportion of the target second regional information in the plurality of second regional information is greater than the proportion threshold, wherein the target second regional information is the second regional information different from the first regional information.

[0080] Wherein, the first regional information, for example, the region to which the first reference object belongs. The second regional information, for example, the region to which the second reference object belongs.

[0081] The third condition is that the first reference object is determined to satisfy a threshold condition of detection accuracy.

[0082] That is, if the proportion of the second regional information that is different from the first regional information in the plurality of second regional information is greater than a proportion threshold (for example, threshold 6), it indicates that the first reference object has a high probability of being the first target object, and the first reference object can be retained and the subsequent step is triggered. If the proportion of the second regional information that is different from the first regional information in the plurality of second regional information is less than or equal to the proportion threshold (for example, threshold 6), it indicates that the first reference object is not highly likely to be the first target object, and the first reference object can be removed, and the next first reference object is analyzed, which is not limited.

[0083] For example, the distribution characteristics of the second reference object can be analyzed, and the distribution characteristics are counted according to the mapping of the IMSI2 of the second reference object to the corresponding city (an optional example of the second regional information). If the proportion of the out-of-province (city) number is greater than threshold 6 (that is, the regions to which the second reference object and the first reference object belong are different), it is determined that the first reference object has a high probability of being the first target object, and the next step is triggered. Otherwise, the first reference object is removed.

[0084] S206: Determine the derivative operation behavior characteristics of the second reference object using the service provided by the first application program to obtain the to-be-analyzed association characteristics of the second reference object.

[0085] The description of step S206 can be specifically referred to the above embodiments, which will not be repeated here.

[0086] S207: Determine whether the second reference object is the second target object and whether the first reference object is the first target object according to the to-be-analyzed association characteristics.

[0087] In some embodiments, in the process of determining whether the second reference object is the second target object according to the to-be-analyzed association characteristics, the reference association characteristics can be obtained, wherein the reference association characteristics represent the derivative operation behavior characteristics of the second target object using the service provided by the first application program, and the second reference object is determined to be the second target object according to the to-be-analyzed association characteristics and the reference association characteristics.

[0088] The reference correlation feature can be represented as a set A (N1, N2, N3, N4, N5, N6), representing the derived operation behaviors of the second target object in an ordered manner. N1 is used to represent that the second target object has a download online lending APP behavior; N2 represents that the second target object has a download online meeting APP behavior; N3 represents that the second target object has an online meeting behavior; N4 represents that the second target object has a friend adding behavior; N5 represents that the second target object has an online lending APP opening behavior; and N6 represents that the second target object has an online transfer behavior. It should be noted that the positive order set A can include the above 6 behavior elements, but is not limited to the above behavior elements, and can be adjusted according to actual conditions.

[0089] In some embodiments, the correlation feature to be analyzed can also be represented based on an ordered set, and the behavior elements contained in the ordered set can be personalized based on the derived operation behaviors of the second reference user, and no limitation is made to this.

[0090] In some embodiments, in the process of determining whether the second reference object is the second target object based on the correlation feature to be analyzed and the reference correlation feature, the total number of behaviors of all derived operation behaviors of the correlation feature to be analyzed and the reference correlation feature can be determined, and a coincidence factor can be determined based on the total number of behaviors and the number of behaviors contained in the reference correlation feature. The ordered rate sum of the derived operation behaviors shared by the correlation feature to be analyzed and the reference correlation feature, and the number of behaviors of the shared derived operation behaviors, determine an order factor, and determine whether the second reference object is the second target object based on the coincidence factor and the order factor. Therefore, the second reference object can be accurately and quickly analyzed and determined to be the second target object, and the analysis accuracy is improved.

[0091] The correlation feature to be analyzed can be represented as set B, and the reference correlation feature can be represented as set A.

[0092] In an example, a coincidence factor and an order factor can be introduced to represent the probability that the second reference object is the second target object, P j =a*t1+b*t2. Wherein t1 represents the coincidence factor, t2 is the order factor, a and b are adjustment factors, and the adjustment factors represent the proportion of the coincidence factor and the order factor. Assuming that a=b=1 / 2, a and b can be adjusted according to actual conditions, and a+b=1. Assuming that the total number of second reference objects in the second reference object set is H, and the probability of each second reference object is P j , then the probability that the first reference object is the first target object is:

[0093]

[0094] Wherein, the user internet service behavior (one optional example of the derived operation behavior contained in the to-be-analyzed associated feature) can be represented as set B, the number of common behavior records in set A and set B is E1 (one optional example of the total number of behaviors of all derived operation behaviors), the number of set A behavior records is E2 (one optional example of the number of behaviors contained in the reference associated feature), set C is defined as the common behaviors in set A and set B (one optional example of the common derived operation behaviors), the sum of the ordered rates of each behavior in set C is F1, and the number of behavior records is F2 (one optional example of the number of behaviors of the common derived operation behaviors). The number of records whose occurrence time is earlier than the record of behavior i on the left side of behavior i in set C is L i , and the number of records whose occurrence time is later than the record of behavior i on the right side of behavior i in set C is R i . The coincidence factor is defined as t1=E1 / E2; the greater the coincidence factor, the more the user service behavior conforms to the behavior characteristics of the cheated user, and the greater the suspected cheating probability. The ordered factor is defined as t2=F1 / F2; the greater the ordered factor, the more similar the user service behavior is to the behavior of the cheated user, and the greater the suspected cheating probability. Wherein, when the number of C behavior records is F2>1, the ordered rate of behavior i in set C is represented as:

[0095] G i =(L i +R i ) / (F2-1)

[0096] When the number of C behavior records is F2=1, i=1, the ordered rate G i＝ 1.

[0097] The sum of the ordered rates of set C can be represented as:

[0098] Therefore, assuming that set B (N2, N4, N1, N3), set A and B have common behaviors C (N2, N4, N1, N3), and there are 4 common records, then E1=4, E2=6, F2=4, the coincidence factor t1=E1 / E2=4 / 6=2 / 3. Wherein, behavior N2, L2=0, R2=2, the ordered rate G 2＝(0+2) / 3=2 / 3, specifically, the number of records on the left of the behavior N2 is 0, the number of records on the right is 3, and the occurrence time of the behaviors N4 and N3 is later than that of N2. Therefore, the order rate of the behavior N2 is (0+2) / 3=2 / 3, the following idea is the same, and the same is true for the behavior N4, L4=1, R4=0, the order rate G4=(1+0) / 3=1 / 3; the behavior N1, L1=1, R1=0, the order rate G1=(0+1) / 3=1 / 3; the behavior N3, L3=2, R3=0, the order rate G3=(2+0) / 3=2 / 3; the order factor t2=F1 / F2=(G1+G2+G3+G4) / F2=(2 / 3+1 / 3+1 / 3+2 / 3) / 4=1 / 2.

[0099] Therefore, the probability that the second reference object is the second target object (for example, the probability that the second reference object is the cheated user) P j =a*t1+b*t2=2 / 3*1 / 2+1 / 2*1 / 2=7 / 12, and the probability P j of each second reference object is calculated in the same way, and the probability that the first reference object is the first target object (for example, the probability that the first reference object is the cheated user) P is further calculated.

[0100] In this embodiment, the first business features of each first candidate object using the first application program and the second business features of each second candidate object using the first application program are obtained, the first candidate object and the second candidate object are different, the first reference object is determined from the plurality of first candidate objects according to the first business features, the second reference object is determined from the plurality of second candidate objects according to the first business features and the second business features of the first reference object, the derived operation behavior features of the first reference object and the second reference object using the service provided by the first application program are respectively determined, the first association features of the first reference object and the second association features of the second reference object are obtained, and whether the first reference object is the first target object and whether the second reference object is the second target object are determined according to the first association features and the second association features. Since the multi-dimensional features of the first candidate object and the second candidate object are detected respectively, and the first target object and the second target object are identified based on the first business features, the second business features, the first association features, and the second association features obtained by detection, the object can be accurately identified. By determining the first business features satisfying the first condition from the plurality of first business features, and taking the first candidate object to which the first business features satisfying the first condition belong in the plurality of first candidate objects as the first reference object, the accuracy of identifying the first reference object can be improved. Whether the second condition is satisfied between the first business features and the second business features can be analyzed to support identifying the second reference object, so that the accuracy of identifying the second reference object can be effectively improved.

[0101] Figure 3 FIG. 1 is a structural schematic diagram of an object identification device according to an embodiment of the present disclosure.

[0102] As shown in FIG. 1, the object identification device 30 comprises: Figure 3

[0103] The acquisition module 301 is configured to acquire the first business features of each first candidate object using the first application program and the second business features of each second candidate object using the first application program, wherein the first candidate object and the second candidate object are different.

[0104] The first determination module 302 is configured to determine the first reference object from the plurality of first candidate objects according to the first business features.

[0105] The second determination module 303 is configured to determine the second reference object from the plurality of second candidate objects according to the first business features and the second business features of the first reference object.

[0106] The third determination module 304 is configured to determine the derived operation behavior features of the second reference object using the service provided by the first application program, and obtain the to-be-analyzed association features of the second reference object. ​

[0107] The fourth determining module 305 is configured to determine whether the second reference object is the second target object and whether the first reference object is the first target object according to the to-be-analyzed correlation feature of the second reference object.

[0108] It should be noted that the foregoing explanation and description of the object recognition method also applies to the object recognition apparatus of this embodiment, which will not be described here again.

[0109] In this embodiment, the first business feature of each first candidate object using the first application program and the second business feature of each second candidate object using the first application program are obtained, the first candidate object and the second candidate object are different, the first reference object is determined from the plurality of first candidate objects according to the first business feature, the second reference object is determined from the plurality of second candidate objects according to the first business feature and the second business feature of the first reference object, the derivative operation behavior feature of the second reference object using the service provided by the first application program is determined, the to-be-analyzed correlation feature of the second reference object is obtained, and the derivative operation behavior feature of the second reference object using the service provided by the first application program is determined, the to-be-analyzed correlation feature of the second reference object is obtained. Since the multi-dimensional features of the first candidate object and the second candidate object are detected respectively, and the first target object and the second target object are identified based on the first business feature, the second business feature, and the to-be-analyzed correlation feature obtained by detection, the object can be accurately identified.

[0110] Figure 4 A block diagram illustrating an exemplary electronic device suitable for use in implementing embodiments of the present disclosure is shown. Figure 4 The electronic device 12 shown is merely one example and should not be taken as limiting the scope of functionality or use of embodiments of the present disclosure.

[0111] As shown in Figure 4 The electronic device 12 is in the form of a general computing device. Components of the electronic device 12 can include, but are not limited to, one or more processors or processing units 16, memory 28, and a bus 18 that connects different system components, including the memory 28 and the processing unit 16.

[0112] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration bus, a processor or local bus using any of a variety of bus architectures. By way of example, these architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0113] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that is accessible by electronic device 12 and includes both volatile and non-volatile media, removable and non-removable media.

[0114] Memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. Electronic device 12 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (not shown and typically called a "hard drive"). Figure 4

[0115] Although Figure 4 not shown in FIG. 1, a disk drive, an optical disk drive and / or a tape drive, a flash memory or other similar medium can also be used. In these instances, each can also be connected to bus 18 by one or more data media interfaces. The drives and their associated computer system readable media provide nonvolatile storage of computer-executable instructions, program modules, and data structures used in the example embodiments.

[0116] ​Program / utility 40 having a set of program modules 42 can be stored in memory 28 by way of example, such program modules 42 include an operating system, one or more application programs, other program modules, and program data, each or some combination thereof, which can include implementation of the network environment in each or some combination of the examples. Program modules 42 generally carry out the functions and / or methodologies of embodiments described in the present disclosure.

[0117] Electronic device 12 can also communicate with one or more external devices 14 such as a keyboard or pointing device, a display 24, etc. one or more devices that enable a human user to interact with electronic device 12 and / or one or more devices that enable electronic device 12 to communicate with one or more other computing devices. Such communication can occur via input / output (I / O) interface 22. Still yet, electronic device 12 can communicate with one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through network adapter 20. As an example, network adapter 20 can include a modem, a network card (wireless or wired), or other well-known interface devices. As depicted, network adapter 20 communicates with the other

[0118] Processing unit 16 executes various program applications and data processing by running programs stored in memory 28, such as implementing the object recognition method mentioned in the foregoing embodiments.

[0119] To implement the above embodiments, the present disclosure further provides an electronic device, comprising: a processor, and a memory connected with the processor in communication; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided by the foregoing embodiments.

[0120] To implement the above embodiments, the present disclosure further provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, the computer execution instructions are executed by a processor to implement the method provided by the foregoing embodiments.

[0121] To implement the above embodiments, the present disclosure further provides a computer program product, comprising a computer program, the computer program is executed by a processor to implement the method provided by the foregoing embodiments.

[0122] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the present disclosure comply with relevant laws and regulations and do not violate public order and good customs.

[0123] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and not shared or sold outside these legitimate uses. In addition, such collection / sharing should be carried out after the user's informed consent is received, including but not limited to informing the user to read the user agreement / user notice before the user uses the function, and signing the agreement / authorization including authorization of relevant user information. In addition, any necessary steps should be taken to protect and secure access to such personal information data and ensure that other people with access to personal information data comply with their privacy policies and processes.

[0124] The present disclosure contemplates that user-selectable options for blocking use of, or access to, personal information data can be provided. That is, the present disclosure contemplates that hardware and / or software components could be provided that restrict access to such personal information data. For example, in the case of user information data, the present disclosure contemplates providing a user with controls over the use of their personal information data by the present disclosure. In some embodiments, a user can use such controls to make sure that no personal information data about them is collected. In other embodiments, a user can use such controls to make sure that there is no future collection of personal information data. In yet other embodiments, a user can use such controls to remove all their personal information data from the present disclosure.

[0125] In the foregoing various embodiments described, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific feature, structure, material or characteristic described in connection with this embodiment or example is included in at least one embodiment or example of the present disclosure. In the description of the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples, without contradiction.

[0126] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise explicitly specified.

[0127] Any processes or methods described in the flowcharts or otherwise described herein can be understood as representing modules, segments, or portions of code that include one or more executable instructions for implementing specific logic functions (or steps) and / or can be implemented entirely in hardware. The various embodiments of the present disclosure can include additional or fewer steps or methods as desired for a given implementation. The various steps or methods can be implemented in software, firmware, hardware, or a combination thereof. The order in which the steps or methods are described is not intended to be construed as a limitation, but is presented for purposes of illustration and explanation. Accordingly, it should be understood that every step or method described herein can be repeated, omitted, or combined with other steps or methods as desired for a given implementation.

[0128] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logic functions, and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor- containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be a product of the manufacturing and / or processing, and can be a machine-readable storage medium (alternatively, "computer-readable storage medium"). The computer-readable medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber (optical), and a portable compact disc read-only memory (CDROM). Note that the computer-readable medium can even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via the optical scan of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in the computer memory.

[0129] It should be understood that aspects of the present disclosure can be implemented in hardware, software, firmware, or combinations thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. As such, in some embodiments, specifically tailored machine or computer program product executable instructions (e.g., software or firmware) are used to program the instruction execution system to perform the steps or methods described above. If implemented in hardware, specifically tailored machine or computer program product executable instructions (e.g., software or firmware) can be used to program the hardware to perform the steps or methods described above, as in another embodiment. The hardware can be implemented as a special purpose machine or computer program product that is specifically tailored to perform the steps or methods described above. The hardware can be implemented using any of the following technologies, which are all well known in the art: a discrete logic circuit having logic gates for implementing logic functions upon data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), or other suitable technology.

[0130] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiment method can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0131] In addition, each functional unit in each embodiment of the present disclosure can be integrated into one processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The integrated module can be realized in the form of hardware or in the form of a software functional module. When the integrated module is realized in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0132] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present disclosure have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present disclosure, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present disclosure.

Claims

1. An object recognition method characterized by, The method comprises the following steps: obtaining a first service feature of each first candidate object using a first application and a second service feature of each second candidate object using the first application, wherein the first candidate object and the second candidate object are not the same; determining a first reference object from a plurality of the first candidate objects according to the first service feature; determining a second reference object from a plurality of the second candidate objects according to the first service feature of the first reference object and the second service feature; determining a derivative operation behavior feature of the second reference object using a service provided by the first application to obtain a to-be-analyzed correlation feature of the second reference object; and determining whether the second reference object is a second target object and determining whether the first reference object is a first target object according to the to-be-analyzed correlation feature; determining whether the second reference object is a second target object according to the to-be-analyzed correlation feature, comprising: obtaining a reference correlation feature, wherein the reference correlation feature represents a derivative operation behavior feature of the second target object using a service provided by the first application; determining a total number of behaviors of all derivative operation behaviors of the to-be-analyzed correlation feature and the reference correlation feature; determining a coincidence factor according to the total number of behaviors and a number of behaviors contained in the reference correlation feature; determining an ordered factor according to a sum of ordered rates of derivative operation behaviors shared by the to-be-analyzed correlation feature and the reference correlation feature and a number of behaviors of the shared derivative operation behaviors, wherein the ordered rate of behavior i in set C is represented as: G i = (L i + R i ) / (F2-1); Wherein, the to-be-analyzed association feature is represented as set B, the reference association feature is represented as set A, set C is defined as the common behaviors in set A and set B, the number of behaviors in set C that have a record time earlier than the record time of behavior i on the left side of behavior i is L i , the number of behaviors in set C that have a record time later than the record time of behavior i on the right side of behavior i is R i , the number of behavior records of each behavior in set C is F2, and the sum of the order rates is F1 ; determining whether the second reference object is a second target object according to the coincidence factor and the ordered factor.

2. The method of claim 1, wherein, The communication mode of the first application is an over-the-top (OTT) mode based on the Internet.

3. The method of claim 1, wherein, The first service feature and the second service feature respectively comprise at least one of the following: service identification information; service start time; service end time; service use frequency; service use duration; service use success rate; identification information of a candidate object; device type to which a candidate object belongs.

4. The method of claim 1, wherein, The determination of the first reference object from a plurality of the first candidate objects according to the first service feature comprises: determining a first service feature satisfying a first condition from a plurality of the first service features; regarding a first candidate object to which the first service feature satisfying the first condition belongs in a plurality of the first candidate objects as the first reference object; wherein the first service feature satisfying the first condition comprises the following: the device type to which the first candidate object belongs is a target type; the service use frequency is greater than a frequency threshold value; the service use duration is greater than a first duration threshold value; the service use success rate is less than a success rate threshold value.

5. The method of claim 1, wherein, The determination of the second reference object from a plurality of the second candidate objects according to the first service feature of the first reference object and the second service feature comprises: determining a second service feature satisfying a second condition with the first service feature; regarding a second candidate object to which the second service feature satisfying the second condition belongs in a plurality of the second candidate objects as the second reference object; The second service feature meeting the second condition includes the following items: The service identification information in the second service feature is the same as the service identification information in the first service feature; The service start time in the second service feature is later than the service start time in the first service feature; The service start time in the second service feature is earlier than the service end time in the first service feature; The time length difference between the service start time in the second service feature and the service start time in the first service feature is less than a second time length threshold; The absolute value of the time length difference between the service end time in the second service feature and the service end time in the first service feature is less than a third time length threshold.

6. The method of claim 1, wherein, Before the determining the derivative operation behavior feature of the second reference object using the service provided by the first application, the method further includes: determining the first regional information of the first reference object according to the identification information of the candidate object in the first service feature; determining the second regional information of each second reference object, and determining the distribution feature of the plurality of second regional information; determining that the distribution feature meets a third condition; The distribution feature meeting the third condition includes: The proportion of the target second regional information in the plurality of second regional information is greater than a proportion threshold, wherein the target second regional information is different from the first regional information.

7. An object recognition apparatus characterized by comprising: The apparatus includes: an acquisition module configured to acquire the first service feature of each first candidate object using a first application, and the second service feature of each second candidate object using the first application, wherein the first candidate object and the second candidate object are different; a first determination module configured to determine a first reference object from the plurality of first candidate objects according to the first service feature; a second determination module configured to determine a second reference object from the plurality of second candidate objects according to the first service feature of the first reference object and the second service feature; a third determination module configured to determine a derivative operation behavior feature of the second reference object using a service provided by the first application, to obtain a to-be-analyzed association feature of the second reference object; a fourth determination module configured to determine whether the second reference object is a second target object and whether the first reference object is a first target object according to the to-be-analyzed association feature; determining whether the second reference object is a second target object according to the to-be-analyzed association feature includes: acquiring a reference association feature, wherein the reference association feature represents a derivative operation behavior feature of the second target object using a service provided by the first application; determining the total number of behaviors of all derivative operations of the to-be-analyzed association feature and the reference association feature; determining a coincidence factor according to the total number of behaviors and the number of behaviors contained in the reference association feature; According to the sum of the ordered rates of the derived operation behaviors shared by the to-be-analyzed association features and the reference association features and the number of behaviors of the derived operation behaviors shared by the to-be-analyzed association features and the reference association features, an order factor is determined; wherein the ordered rate of behavior i in set C is represented as: G i = (L i + R i ) / (F2-1); Wherein, the to-be-analyzed association feature is represented as set B, the reference association feature is represented as set A, set C is defined as the common behaviors in set A and set B, the number of behaviors in set C that have a record time earlier than the record time of behavior i on the left side of behavior i is L i , the number of behaviors in set C that have a record time later than the record time of behavior i on the right side of behavior i is R i , the number of behavior records of each behavior in set C is F2, and the sum of the order rates is F1 ; According to the coincidence factor and the order factor, it is determined whether the second reference object is a second target object.

8. An electronic device, comprising: The method comprises: a processor, and a memory connected to the processor in communication; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by the processor to implement the method according to any one of claims 1-6.

10. A computer program product, characterised in that, The computer program is executed by the processor to implement the method according to any one of claims 1-6.

Images