Method, device and equipment for identifying abnormal sharing of account number and storage medium
By obtaining the target account's device geolocation within a preset time period, determining the number of reference locations, and using thresholds to judge abnormal sharing, the problem of unreasonable sharing by member accounts is solved, improving identification accuracy and account security.
Patent Information
- Application Number
- CN202411091974.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-09
- Publication Date
- 2025-12-12
- Estimated Expiration
- 2044-08-09
AI Technical Summary
Existing technologies are insufficient to effectively identify inappropriate sharing of member accounts, leading to account security issues.
By obtaining the geographical locations of multiple devices logged into by the target account within a preset time period, the number of reference locations is determined, and a preset threshold is used to determine whether the account has any abnormal sharing.
It improves the accuracy of identifying abnormal account sharing, prevents accounts from being used illegally, and protects account security.
Smart Images

Figure CN119051921B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present disclosure relates to the technical field of account sharing identification, and in particular to a method and device for identifying abnormal sharing of an account, equipment and a storage medium. BACKGROUND
[0002] In real life, users often share their member accounts registered on video, music and other platforms to others. However, there are unreasonable sharing, i.e. abnormal sharing, in these sharing, such as sharing to too many other users, which will lead to account security problems. In order to ensure account security, it is necessary to identify unreasonable sharing of users, therefore, how to identify unreasonable sharing of a member account is a technical problem to be solved. SUMMARY
[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a method and device for identifying abnormal sharing of an account, equipment and a storage medium.
[0004] In a first aspect, the present disclosure provides a method for identifying abnormal sharing of an account, the method comprising:
[0005] obtaining geographical positions of a plurality of devices logged in with a target account within a preset time period;
[0006] determining a number of reference positions of the target account based on the geographical positions within the preset time period;
[0007] in response to the number of reference positions exceeding a preset threshold, determining that the target account has abnormal sharing.
[0008] Optionally, the determining the number of reference positions of the target account based on the geographical positions within the preset time period comprises:
[0009] dividing devices containing the same geographical position within the preset time period into the same group to obtain at least one device group;
[0010] determining the number of device groups as the number of reference positions.
[0011] Optionally, the dividing devices containing the same geographical position within the preset time period into the same group to obtain at least one device group comprises:
[0012] for each device, taking the geographical position of the device within the preset time period as a node, connecting the nodes to generate a position line graph or a point graph of the device;
[0013] merge the position line graphs and / or point graphs containing the same nodes to generate a connected graph;
[0014] determine the number of the connected graphs as the number of the device groups.
[0015] Optionally, the determining the number of the reference locations of the target account based on the geographic locations in the preset time period comprises:
[0016] determining, for any of the geographic locations, a number of times of browsing a target resource platform through the target account at the geographic location in the preset time period; and determining a geographic location with a number of times exceeding a preset number of times as a reference location.
[0017] Optionally, the determining the number of the reference locations of the target account based on the geographic locations in the preset time period comprises:
[0018] determining, for any of the geographic locations, a total time length of browsing a target resource platform through the target account at the geographic location in the preset time period;
[0019] determining a geographic location with a total time length exceeding a preset time length as a reference location.
[0020] Optionally, the method further comprises:
[0021] in response to the target account having abnormal sharing, performing at least one of the following operations:
[0022] setting a state of the target account as a prohibited use state;
[0023] performing a logout operation on the target account logged in on one or more of the devices.
[0024] In a second aspect, the embodiments of the present disclosure provide a device for identifying abnormal sharing of an account, comprising:
[0025] an acquisition module configured to acquire geographic locations of a plurality of devices logged in with a target account in a preset time period;
[0026] a first determination module configured to determine a number of reference locations of the target account based on the geographic locations in the preset time period;
[0027] a second determination module configured to determine, in response to the number of the reference locations exceeding a preset threshold, that the target account has abnormal sharing.
[0028] Optionally, the first determination module is configured to:
[0029] devices containing the same geographical position in the preset time period are divided into the same group, to obtain at least one device group;
[0030] The number of the device groups is determined as the number of reference positions.
[0031] Optionally, the first determining module is configured to:
[0032] For each device, the geographical position of the device in the preset time period is taken as a node, the node is connected, and a position line graph or a point graph of the device is generated;
[0033] Position line graphs and / or point graphs containing the same node are merged to generate a connected graph;
[0034] The number of the connected graph is taken as the number of the device groups.
[0035] Optionally, the first determining module is configured to:
[0036] For any geographical position, the number of times of browsing the target resource platform through the target account at the geographical position in the preset time period is determined; and the geographical position with the number of times exceeding a preset number of times is determined as a reference position.
[0037] Optionally, the first determining module is configured to:
[0038] For any geographical position, the total time length of browsing the target resource platform through the target account at the geographical position in the preset time period is determined;
[0039] The geographical position with the total time length exceeding a preset time length is determined as a reference position.
[0040] Optionally, the device for identifying abnormal sharing of an account further can include an executing module configured to:
[0041] In response to the target account existing abnormal sharing, at least one operation as follows is performed:
[0042] The state of the target account is set as a prohibited use state;
[0043] The target account logged in on one or more devices is logged out.
[0044] In a third aspect, an embodiment of the present disclosure provides a computer device, including:
[0045] a memory;
[0046] a processor; and
[0047] a computer program;
[0048] The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to the first aspect.
[0049] In a fourth aspect, the present disclosure provides a computer readable storage medium, having stored thereon a computer program, the computer program being executed by a processor to implement the method according to the first aspect.
[0050] The method and device for identifying abnormal sharing of an account provided by the embodiments of the present disclosure can improve the accuracy of identification of abnormal sharing of an account. BRIEF DESCRIPTION OF DRAWINGS
[0051] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.
[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.
[0053] Figure 1 is a flowchart of a method for identifying abnormal sharing of an account provided by the embodiments of the present disclosure;
[0054] Figure 2 is a flowchart of a method for dividing device groups provided by the embodiments of the present disclosure;
[0055] Figure 3 is a node graph provided by the embodiments of the present disclosure;
[0056] Figure 4 is a node connection schematic diagram provided by the embodiments of the present disclosure;
[0057] Figure 5 is a schematic diagram of a connected graph provided by the embodiments of the present disclosure;
[0058] Figure 6 is a structural schematic diagram of a device for identifying abnormal sharing of an account provided by the embodiments of the present disclosure;
[0059] Figure 7 is a structural schematic diagram of a computer device provided by the embodiments of the present disclosure. DETAILED DESCRIPTION
[0060] In order to more clearly understand the above-mentioned purposes, features and advantages of the present disclosure, the solutions of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.
[0061] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present disclosure, but the present disclosure can also be implemented in other different manners from those described herein; obviously, the embodiments described in the specification are only a part of the embodiments of the present disclosure, and not all the embodiments.
[0062] Taking a member account of a video playing platform as an example, in practice, in order to meet the reasonable sharing demand of the member account, unreasonable sharing demand (such as sharing to a large number of other users for use) is limited, generally, the number of login / use devices of the member account is limited, or the use location of the member account within a period of time is limited. However, a user can have multiple devices (mobile phone / tablet / computer / car machine / smart home, etc.), and can also travel across regions, in actual application, the reasonable use of the member user can be mistakenly hurt.
[0063] In view of the above problems, the embodiments of the present disclosure provide a method for identifying abnormal sharing of an account, which judges whether the target account exists abnormal sharing by the number of reference locations (which can be exemplarily understood as the geographic locations where the total residence time of the device logged in with the target account within a preset time period or the number of times or the total time of browsing the target resource platform through the target account exceeds the corresponding threshold) of the target account, thereby improving the accuracy of identifying abnormal sharing of the account.
[0064] The solutions provided by the embodiments of the present disclosure will be described below in combination with exemplary embodiments.
[0065] Exemplarily, Figure 1 is a flowchart of a method for identifying abnormal sharing of an account provided by the embodiments of the present disclosure. The method can be executed by a computer device, which can be a server such as a video playing platform or an audio playing platform, but is not limited to the devices listed here, but can be any device with communication and data processing capabilities. As shown in Figure 1 The method provided by the embodiments of the present disclosure can include the following steps 101-103.
[0066] Step 101, obtaining geographic locations of multiple devices logged in with a target account within a preset time period.
[0067] The target account referred to in the embodiments of the present disclosure can be exemplarily understood as a member account registered by a user on a target resource platform (such as a video playing platform, a music playing platform and other various platforms), which can be understood as a paid account or an account enjoying special benefits. The target account can include a level attribute, and the benefits of target accounts of different member levels can be different.
[0068] The plurality of devices referred to in the embodiments of the present disclosure can include all or part of the devices that have logged in or logged in the target account in a preset time period. The device can be a fixed device such as a television, a sound box, a smart home, etc.; or a mobile device such as a mobile phone, a tablet computer, a car machine, a notebook computer, etc. The preset time period can be exemplarily understood as a period of time in the past, such as the past one month, one week, etc., but is not limited to the time periods listed here. In fact, the preset time period can be set as needed, and does not have to be limited to a certain fixed time period.
[0069] The geographical position of the plurality of devices that have logged in the target account in the preset time period can be understood as the position of the device when logging in or using the target account in the preset time period, or can also be understood as the position of the device when the target account is in a logged-in state. The position can be understood as a specific positioning position point or a region, a city or a province, etc. In order to facilitate understanding, the geographical position referred to in the embodiments of the present disclosure can be exemplarily understood as the city where the device is located when the target account is in a logged-in state.
[0070] It should be noted that the geographical position of the device that has logged in the target account in the preset time period can be one or more. For example, Figure 1 is a target account usage table provided by the embodiments of the present disclosure. As shown in Figure 1 , there are 8 devices that have logged in the target account in the preset time period, which are devices a, b, c, d, e, f, g and h. Among them, the city where device a is located when using the target account in the past 30 days (i.e. the geographical position of device a) is city A, the city where device b is located when using the target account in the past 30 days is city B, and so on. Figure 2The possible scenarios are that device a is used in the first residence; devices b and c are used in cities 2 and 3 in the past 30 days, which means that devices b and c are taken by the person in the first residence to cities 2 and 3 for use; device d is used in cities 4, 5, 6 and 7 in the past 30 days, which means that device d is taken by another person in the first residence to cities 4, 5, 6 and 7 for use; device e is used in city 8 in the past 30 days, which means that device e is used in the second residence; device f is used in cities 8 and 9 in the past 30 days, which means that device f is taken by the person in the second residence to city 9 for use; device g is used in cities 8 and 10 in the past 30 days, which means that device g is taken by the person in the second residence to city 10 for use; and device h is used in city 11 in the past 30 days, which means that device h is used in the third residence. Of course Figure 2 The use of the target account is only an example and is not limited.
[0071] Table 1
[0072]
[0073] In some example embodiments, the geographic locations of the devices logged in with the target account can be collected from the devices. The specific collection method can be set as needed, and the embodiments of the present disclosure are not limited.
[0074] In step 102, the number of reference locations of the target account is determined based on the geographic locations in the preset time period.
[0075] In an embodiment, the reference location can be understood as a geographic location that uses the target account to browse the target resource platform more than a preset number of times in a preset time period. That is, in an example, for any geographic location of a plurality of devices logged in with the target account in a preset time period, the total number of times that the devices browse the target resource platform through the target account at the geographic location can be determined, and the geographic location with a total number of times exceeding the preset number of times is determined as the reference location, and thus the number of reference locations is obtained.
[0076] Or in another embodiment, the reference location can also be understood as a geographic location where the total duration of using the target account to browse the target resource platform exceeds the preset duration within the preset time period, that is, in another example, for any geographic location of the plurality of devices logged in with the target account within the preset time period, the total duration of the devices browsing the target resource platform through the target account at the geographic location can be determined, and the geographic location where the total duration exceeds the preset duration is determined as the reference location, and then the number of reference locations is obtained. For example, in the example shown in Table 1, it is assumed that the durations of devices a, b, c, and d using the target account to browse the target resource platform in city 1 within the preset time period are 10 hours, 2 hours, 3 hours, and 4 hours, respectively. The total duration of devices a, b, c, and d using the target account to browse the target resource platform in city 1 is 19 hours. Among them, the duration of a single device browsing the target resource platform at a certain geographic location within the preset time period can be understood as the sum of the times of using the target account to browse the target resource platform at the geographic location by the device multiple times.
[0077] Alternatively, in yet another embodiment, the number of reference locations can also be understood as the number of groups of devices logged in with the target account within the preset time period, wherein the devices in the same device group contain the same geographic location within the preset time period. That is, in an embodiment, the devices containing the same geographic location within the preset time period can be divided into the same group to obtain at least one device group, and then the number of the device groups is determined as the number of reference locations. For example, in the example shown in Table 1, devices a, b, c, and d belong to one device group, devices e, f, and g belong to another device group, and device h belongs to a device group alone, that is, the devices using the target account in the example shown in Table 1 can be divided into three device groups, and the number of reference locations is 3.
[0078] Step 103, in response to the number of reference locations exceeding the preset threshold, determining that the target account exists abnormal sharing.
[0079] In the embodiments of the present disclosure, the preset threshold values of target accounts of different levels can be the same or different. For example, in a feasible embodiment, the preset threshold value and the member level of the target account can be positively correlated, that is, the higher the member level of the target account, the greater the value of the preset threshold value. For example, the preset threshold value corresponding to a low-level account can be m, and the preset threshold value corresponding to a high-level account can be n, m and n are positive integers. The preset threshold value corresponding to n is greater than m.
[0080] Still taking Table 1 as an example, it is assumed that the preset threshold corresponding to the member level of the target account in Table 1 is 2, and in the example shown in Table 1, the device group has three, that is, the reference position has three, which exceeds the preset threshold, and at this time it can be determined that the target account in Table 1 has abnormal sharing. Of course, this is only an example for illustration, and is not the only limitation.
[0081] In some embodiments, when the target account has abnormal sharing, at least one of the following operations can be performed: setting the state of the target account to a prohibited use state, and performing a logout operation on the target account logged in on one or more devices (which can be all devices or a part of devices logged in with the target account in a preset time period).
[0082] Setting the state of the target account to a prohibited use state can be understood as permanently prohibiting the use of the target account, or prohibiting the use of the target account for a preset time, such as one month, but not limited to one month.
[0083] The logout operation is performed on the target account logged in on one or more devices. For example, it can be performed on a device that has browsed the target resource platform through the target account less than a preset number of times in a preset time period (such as the past month, but not limited to one month), or it can also be performed on a device that has browsed the target resource platform through the target account for a total time less than a preset time in a preset time period. Of course, this is only an example for illustration and is not the only limitation. In fact, the device performing the logout operation can be set as needed, and does not have to be limited to one or more devices. In the embodiments of the present disclosure, the number of reference positions of the target account is determined based on the geographical positions of the target account in a preset time period by obtaining the geographical positions of a plurality of devices logged in with the target account in the preset time period, and when the number of reference positions exceeds a preset threshold, it is determined that the target account has abnormal sharing, which can improve the accuracy of account abnormal sharing identification.
[0084] In some embodiments, Figure 2 is a flowchart of a method for dividing a device group provided by the embodiments of the present disclosure. As Figure 2 shown, in an embodiment, the method for dividing a device group can include steps 301-303.
[0085] Step 301, for each device, the geographical position of the device in a preset time period is taken as a node, the nodes are connected, and a position line graph or a point graph of the device is generated.
[0086] Step 302, the position line graphs and / or point graphs containing the same nodes are merged to generate a connected graph.
[0087] Step 303, the number of connected graphs is taken as the number of device groups.
[0088] Still taking Table 1 as an example, it is assumed that the geographic positions of the devices logged in with the target account in the preset time period are specified as cities. Each geographic position can be taken as a node, and a node graph as shown in Figure 3 is obtained.
[0089] Further, Figure 4 is a node connection schematic diagram provided by an embodiment of the present disclosure, as shown in Figure 4 After obtaining the node corresponding to each device, for each device, the node corresponding to the device can be connected to obtain a position line graph or a point graph corresponding to the device.
[0090] Still further, Figure 5 is a schematic diagram of a connected graph provided by an embodiment of the present disclosure, as shown in Figure 5 After obtaining the position line graph or the point graph corresponding to each device, the position line graphs and / or the point graphs containing the same nodes can be merged to generate a connected graph, so that each connected graph corresponds to a device group, and the number of connected graphs is taken as the number of device groups.
[0091] Based on the generation method of the connected graph, the geographic positions of the devices logged in with the target account in the preset time period are taken as nodes, the connected graph is generated based on the nodes corresponding to each device, the number of connected graphs is taken as the number of device groups, and then the number of device groups is taken as the number of reference positions, so that the accuracy of the determination of the number of reference positions can be improved. Further, accurate basis is provided for the identification of abnormal sharing of an account, and the accuracy of the identification of abnormal sharing of an account is improved.
[0092] Figure 6 is a structural schematic diagram of an apparatus for identifying abnormal sharing of an account provided by an embodiment of the present disclosure. The apparatus can be understood as the computer device in the above embodiments or part of the functional modules in the computer device.
[0093] As shown in Figure 6 , the apparatus 70 for identifying abnormal sharing of an account provided by an embodiment of the present disclosure can include:
[0094] The acquisition module 71 is configured to acquire geographic positions of a plurality of devices logged in with a target account in a preset time period.
[0095] The first determination module 72 is configured to determine the number of reference positions of the target account based on the geographic positions in the preset time period.
[0096] The second determination module 73 is configured to determine that the target account has abnormal sharing in response to the number of reference positions exceeding a preset threshold.
[0097] Optionally, the first determining module is configured to:
[0098] devices containing the same geographical position in the preset time period are divided into the same group to obtain at least one device group;
[0099] The number of the device groups is determined as the number of reference positions.
[0100] Optionally, the first determining module is configured to:
[0101] For each device, the geographical position of the device in the preset time period is taken as a node, the nodes are connected to generate a position line graph or a point graph of the device;
[0102] Position line graphs and / or point graphs containing the same node are merged to generate a connected graph;
[0103] The number of the connected graph is taken as the number of the device groups.
[0104] Optionally, the first determining module is configured to:
[0105] For any geographical position, the number of times of browsing the target resource platform through the target account at the geographical position in the preset time period is determined; the geographical position with the number of times exceeding a preset number of times is determined as a reference position.
[0106] Optionally, the first determining module is configured to:
[0107] For any geographical position, the total time length of browsing the target resource platform through the target account at the geographical position in the preset time period is determined;
[0108] The geographical position with the total time length exceeding a preset time length is determined as a reference position.
[0109] Optionally, the device for identifying abnormal sharing of an account further can comprise an executing module configured to:
[0110] In response to the target account existing abnormal sharing, at least one of the following operations is performed:
[0111] The state of the target account is set as a prohibited use state;
[0112] The target account logged in on one or more devices is logged out.
[0113] The device provided in the embodiments of the present disclosure can execute the method of any one of the above-mentioned method embodiments, and has similar implementation modes and beneficial effects, which will not be described here again.
[0114] Figure 7A structural schematic diagram of a computer device embodiment provided by an embodiment of the present disclosure is shown in FIG. 1. As shown in FIG. 1, the computer device includes a memory 121 and a processor 122. Figure 7 The memory 121 is configured to store programs. In addition to the programs described above, the memory 121 can also be configured to store various other data to support operations on the computer device. Examples of the data include instructions of any application or method for operating on the computer device, contact data, phonebook data, messages, pictures, videos, etc.
[0115] The memory 121 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.
[0116] The processor 122 is coupled with the memory 121 and executes programs stored in the memory 121 to:
[0117] acquire geographic locations of a plurality of devices logged in with a target account within a preset time period;
[0118] determine a number of reference locations of the target account based on the geographic locations within the preset time period;
[0119] determine that the target account has abnormal sharing in response to the number of reference locations exceeding a preset threshold.
[0120] Further, as shown in FIG. 1, the computer device can further include a communication component 123, a power supply component 124, an audio component 125, a display 126, and other components. Only part of the components are shown in FIG. 1 schematically, and it does not mean that the computer device only includes the components shown in FIG. 1.
[0121] Figure 7 Figure 7 Figure 7
[0122] The communication component 123 is configured to facilitate wired or wireless communication between the computer device and other devices. The computer device can access wireless networks based on communication standards such as WiFi, 2G, or 3G, or a combination thereof. In an exemplary embodiment, the communication component 123 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 123 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
[0123] The power component 124 provides power to various components of the computer device. The power component 124 can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the computer device.
[0124] The audio component 125 is configured to output and / or input audio signals. For example, the audio component 125 includes a microphone (MIC) that is configured to receive an external audio signal when the computer device is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 121 or transmitted via the communication component 123. In some embodiments, the audio component 125 also includes a speaker for outputting audio signals.
[0125] The display 126 includes a screen, which can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a slide, and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touching or a sliding action, but also detect duration and pressure related to the touching or sliding action.
[0126] In addition, the embodiments of the present disclosure further provide a computer-readable storage medium, having stored thereon a computer program, which is executed by a processor to implement the method for identifying abnormal sharing of an account according to the above-described embodiments.
[0127] The exemplary embodiments of the present disclosure further provide a computer program product, including a computer program, wherein the computer program is executed by a processor of a computer to cause the computer to perform the method for identifying abnormal sharing of an account according to the above-described embodiments.
[0128] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0129] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for identifying abnormal sharing by an account, characterized in that, The method includes: Obtain the geographic location of multiple devices logged into the target account within a preset time period; Based on the geographical location within the preset time period, determine the number of reference locations for the target account; If the number of reference locations exceeds a preset threshold, it is determined that the target account has engaged in abnormal sharing. Determining the number of reference locations for the target account based on the geographical location within the preset time period includes: Devices that share the same geographical location within the preset time period are grouped into the same group to obtain at least one device group; The number of the device groups is determined as the number of reference locations; The step of grouping devices that share the same geographical location within the preset time period into the same group to obtain at least one device group includes: For each device, the geographical location of the device within the preset time period is used as a node, and the nodes are connected to generate a location line map or dot map of the device; Merge location line graphs and / or point graphs containing the same nodes to generate a connected graph; The number of connected graphs is taken as the number of device groups.
2. The method according to claim 1, characterized in that, The step of determining the number of reference locations for the target account based on the geographical location within the preset time period further includes: For any given geographical location, determine the number of times the target resource platform is browsed through the target account within the preset time period at that geographical location; geographical locations where the number of browsing sessions exceeds the preset number are determined as reference locations.
3. The method according to claim 1, characterized in that, The step of determining the number of reference locations for the target account based on the geographical location within the preset time period further includes: For any given geographical location, determine the total duration of browsing the target resource platform through the target account at that geographical location within the preset time period; Geographic locations whose total duration exceeds a preset duration are designated as reference locations.
4. The method according to claim 1, characterized in that, The method further includes: In response to abnormal sharing by the target account, perform at least one of the following operations: Set the target account to a disabled status; Logout operation is performed on the target account logged in on one or more of the devices.
5. A device for identifying abnormal sharing by an account, characterized in that, include: The acquisition module is used to acquire the geographical locations of multiple devices logged into the target account within a preset time period; The first determining module is used to determine the number of reference locations of the target account based on the geographical location within the preset time period; The second determining module is used to determine that the target account has abnormal sharing in response to the number of reference locations exceeding a preset threshold; The first determining module is used to group devices that have the same geographical location within the preset time period into the same group to obtain at least one device group; and to determine the number of device groups as the number of reference locations; The first determining module is used to, for each device, take the geographical location of the device within the preset time period as a node, connect the nodes to generate a location line map or point map of the device; merge the location line maps and / or point maps containing the same nodes to generate a connected graph; and take the number of the connected graphs as the number of the device groups.
6. A computer device, wherein, include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the method as described in any one of claims 1-4.
7. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-4.
Citation Information
Patent Citations
Method and system for detecting abnormal login of mail based on IP address
CN109218170A
Abnormal account determination method and device and storage medium
CN113810328A