Abnormal group determination method and device based on new pulling scene, equipment and medium

Abstract

The invention provides an abnormal group determination method and device based on a new pulling scene, equipment and a medium, and relates to the field of artificial intelligence, in particular to the field of heterogeneous graphs. According to the specific implementation scheme, user information of a second user is obtained; the second user represents a user invited by the first user, and the first user and the second user are in a one-to-many relationship; the user information represents attribute information of an account of the user; generating a user topological graph according to the user information of the plurality of second users; the user topological graph comprises a first node corresponding to a first user and a second node corresponding to a second user, and the user topological graph represents a connection relationship between the first node and the second node and a connection relationship between different first nodes; determining an abnormal group according to a connection relationship between nodes in the user topological graph; the abnormal group represents the group of the abnormal user in the new pulling scene. According to the invention, the connection relation in the topological graph is enriched, and the recognition precision of the abnormal group is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of heterogeneous graphs in the field of artificial intelligence, and in particular to a method, device, equipment and medium for determining abnormal groups based on a new user acquisition scenario. Background Art

[0002] For the user invitation scenario of attracting new users through activities, old users can invite new users to register accounts or participate in activities through social sharing, thereby obtaining invitation benefits.

[0003] However, in this scenario, it is easy for abnormal users such as black and gray users or fake users to obtain benefits as new users. Therefore, it is necessary to identify abnormal users such as black and gray users and fake users to ensure the smooth progress of the activity. Summary of the invention

[0004] The present disclosure provides a method, device, equipment and medium for determining an abnormal group based on a new user acquisition scenario.

[0005] According to a first aspect of the present disclosure, a method for determining an abnormal group based on a new user acquisition scenario is provided, comprising:

[0006] Obtaining user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account;

[0007] Generate a user topology map according to the user information of the plurality of second users; wherein the user topology map includes a first node corresponding to the first user and a second node corresponding to the second user, and the user topology map represents a connection relationship between the first node and the second node, and a connection relationship between different first nodes;

[0008] An abnormal group is determined according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of abnormal users in a new user acquisition scenario.

[0009] According to a second aspect of the present disclosure, a device for determining an abnormal group based on a new user acquisition scenario is provided, comprising:

[0010] An information acquisition unit, configured to acquire user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; and the user information represents attribute information of the user's account;

[0011] A graph generating unit, configured to generate a user topology graph according to user information of the plurality of second users; wherein the user topology graph includes a first node corresponding to a first user and a second node corresponding to a second user, and the user topology graph represents a connection relationship between the first node and the second node, and a connection relationship between different first nodes;

[0012] The group determination unit is used to determine an abnormal group according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of users with abnormalities in the new user acquisition scenario.

[0013] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0014] at least one processor; and

[0015] a memory communicatively coupled to the at least one processor;

[0016] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect of the present disclosure.

[0017] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method according to the first aspect of the present disclosure.

[0018] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, which implements the steps of the method described in the first aspect of the present disclosure when executed by a processor.

[0019] According to the technology disclosed in the present invention, the accuracy of identifying abnormal user groups is improved.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0022] Figure 1 It is a flowchart of a method for determining an abnormal group based on a new customer acquisition scenario provided according to an embodiment of the present disclosure;

[0023] Figure 2 is a schematic diagram of a user topology diagram provided according to an embodiment of the present disclosure;

[0024] Figure 3 It is a flowchart of a method for determining an abnormal group based on a new customer acquisition scenario provided according to an embodiment of the present disclosure;

[0025] Figure 4 It is a flowchart of a method for determining an abnormal group based on a new customer acquisition scenario provided according to an embodiment of the present disclosure;

[0026] Figure 5 It is a structural block diagram of a device for determining an abnormal group based on a new user acquisition scenario provided according to an embodiment of the present disclosure;

[0027] Figure 6 It is a structural block diagram of a device for determining an abnormal group based on a new user acquisition scenario provided according to an embodiment of the present disclosure;

[0028] Figure 7 is a block diagram of an electronic device for implementing the method for determining an abnormal group based on a new user acquisition scenario according to an embodiment of the present disclosure;

[0029] Figure 8 It is a block diagram of an electronic device used to implement the method for determining abnormal groups based on the new user acquisition scenario according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0031] New user acquisition through activities refers to activities that attract new users through social sharing and giving users certain rewards. In the user invitation scenario of new user acquisition through activities, it is easy for black and gray industry users to pretend to be new users. Therefore, it is necessary to identify black and gray industry users. Black and gray industry users can be considered as users who specialize in taking advantage of others. Since they can obtain benefits or profits in new user acquisition activities, black and gray industry users will invite or be invited in batches to obtain benefits.

[0032] At present, when identifying abnormal users, a graph association network in the form of a topological graph can be constructed based on the new user acquisition situation. There are multiple nodes in the topology, each node represents a user, and abnormal users are identified based on the attribute information of the node. However, in the currently used graph association network, the nodes are sparsely distributed, and there are many small graphs. The connectivity of the entire graph is relatively poor, which is not conducive to the overall identification of multiple abnormal users as a group, and the identification accuracy and efficiency are poor.

[0033] The present disclosure provides a method, device, equipment and medium for determining abnormal groups based on a new user acquisition scenario, which are applied to the heterogeneous graph field in the field of artificial intelligence to improve the accuracy and efficiency of identifying abnormal groups.

[0034] It should be noted that the model in this embodiment is not a model for a specific user and cannot reflect the personal information of a specific user. It should be noted that the data in this embodiment comes from a public data set.

[0035] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0036] In order to enable readers to more deeply understand the implementation principle of the present disclosure, the following Figure 1-Figure 8 The embodiment is further refined.

[0037] Figure 1 The flowchart of a method for determining an abnormal group based on a new user acquisition scenario according to an embodiment of the present disclosure is shown, which can be executed by a device for determining an abnormal group based on a new user acquisition scenario. Figure 1 As shown, the method comprises the following steps:

[0038] S101. Obtain user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account.

[0039] For example, in an activity to attract new users, a first user can invite a second user to participate in the activity. The first user is an old user, that is, the user who sends the invitation, and the second user is a new user, that is, the user who accepts the invitation. A first user can invite one or more second users to register a new account, that is, the first user and the second user are in a one-to-N relationship, where N is a natural number greater than or equal to 1.

[0040] After the second user accepts the invitation of the first user, the user information of the second user can be obtained. The user information can represent the attribute information of the user's account. The attribute information can refer to the device, network data and other information of the second user's account. For example, the user information can include the size of the SD (Secure Digital) card, the number of boot times, whether it is a vest number, a virtual mobile phone number, an Internet of Things account, whether it hits the preset device security factor, whether it is a risky IP (Internet Protocol), etc. The user information of the second user can be obtained in real time or at a fixed time. In this embodiment, it is not necessary to obtain the user information of the first user.

[0041] For each first user, the correspondence between the first user and the second user can be recorded, and the user information of multiple second users corresponding to the first user can be obtained, and the user information of multiple second users corresponding to multiple first users can be obtained. After obtaining the user information of the second user, the user information can also be preprocessed, for example, data sorting or cleaning can be performed. In this embodiment, the preprocessing method is not specifically limited.

[0042] S102. Generate a user topology map based on user information of multiple second users; wherein the user topology map includes a first node corresponding to the first user and a second node corresponding to the second user, and the user topology map represents the connection relationship between the first node and the second node, and the connection relationship between different first nodes.

[0043] Exemplarily, after obtaining user information of multiple second users, a user topology map can be constructed based on the user information of these second users. The user topology map may include multiple nodes, and the nodes in the user topology map may be divided into first nodes and second nodes, the first node represents the first user, and the second node represents the second user. There may be multiple first nodes and multiple second nodes in the user topology map, and there may be a connection relationship between the first node and the second node, and there may also be a connection relationship between different first nodes.

[0044] According to the corresponding relationship between the first user and the second user, the first node of the first user may be edge-connected with the corresponding second node of the second user, that is, different second nodes may be connected to the same first node.

[0045] The second users may be grouped according to the first users to which they correspond, and each first user corresponds to a group of second users. Based on the user information of the second users in each group, it is determined whether the second users in each group are similar. For example, if there is similar user information between two groups, the second users in the two groups are similar. If the second users in the two groups are similar, a connection may be made between the first nodes of the first users in the two groups.

[0046] That is to say, it is possible to determine whether the first nodes of different first users can be edge-connected based on the user information of the second users corresponding to different first users, thereby enriching the connection relationship in the user topology graph and improving the recognition accuracy of abnormal groups.

[0047] In this embodiment, the user topology map includes a third node, the third node represents the identification information of the device of the user's login account, and the first node and the second node are both edge-connected with the corresponding third node; the method also includes: if it is determined that the identification information of the devices of the accounts logged in by different users is the same identification information, the third nodes corresponding to different users are edge-connected.

[0048] Specifically, the user topology graph may further include a third node, which may represent the identification information of the device of the user's login account, that is, the active account of the user logged in with the device. The first user and the second user both have the identification information of the device of their own login account, that is, the first node and the second node both have their own third nodes, and may have an edge connection with their own third nodes.

[0049] Different user accounts may use the same device to log in. For example, if the same device is reset, the device can log in different user accounts. Therefore, the identification information of the device of the account logged in by different users may be the same identification information.

[0050] The first node and the second node are both user-type nodes, and the user-type nodes are edge-connected with the third node. If nodes of different user types correspond to the same identification information, the third nodes corresponding to these user-type nodes may also be edge-connected.

[0051] The beneficial effect of such a setting is that by adding nodes of device types, a heterogeneous graph is constructed, the information and connection relationships in the graph are enriched, the omission of identification of abnormal users is avoided, and the identification accuracy of abnormal groups is improved.

[0052] In this embodiment, the user topology map includes a fourth node, which represents the user's redemption path for the promotional benefits. The promotional benefits represent the benefits issued to the first user or the second user in the new user acquisition scenario. The first node and the second node are both edge-connected with the corresponding fourth node; the method also includes: if it is determined that the redemption paths for the promotional benefits of different users are the same redemption path, the fourth nodes corresponding to different users are edge-connected.

[0053] Specifically, the user topology diagram may also include a fourth node, which may represent the user's redemption path for the promotional benefits, that is, where the user will redeem the promotional benefits. For example, if the promotional benefits are specific physical objects, the redemption path may be redeemed to a specific geographical location; for another example, if the promotional benefits are currency, the redemption path may be withdrawn to a financial account. Both the inviting user and the invited user can obtain the promotional benefits. Both the first user and the second user may have their own redemption paths for the promotional benefits, that is, both the first node and the second node may have their own fourth nodes, and may have edge connections with their own fourth nodes.

[0054] Different user accounts may correspond to the same redemption path, for example, different user accounts withdraw promotional benefits to the same financial account. The first node and the second node are both user-type nodes, and the user-type node is edge-connected to the fourth node. If nodes of different user types correspond to the same redemption path, the fourth nodes corresponding to these user-type nodes can also be edge-connected.

[0055] The beneficial effect of such a setting is that by adding nodes of the redemption path type, a heterogeneous graph is constructed, the information and connection relationships in the graph are enriched, the omission of the identification of abnormal users is avoided, and the identification accuracy of abnormal groups is improved.

[0056] S103: Determine an abnormal group according to the connection relationship between nodes in the user topology graph; wherein the abnormal group represents a group of abnormal users in the new user acquisition scenario.

[0057] Exemplarily, the node information corresponding to each node in the user topology map is obtained, and the node information may be user information, identification information, or redemption path, etc. For example, the first node and the second node correspond to user information, the third node corresponds to the identification information of the device, and the fourth node corresponds to the redemption path of the promotion benefit. The user information corresponding to the second node is directly obtained, and the user information corresponding to the first node can be obtained based on the user information of the corresponding second node. For example, multiple second nodes corresponding to the first node can be determined, and the user information of these multiple second nodes can be used together as the user information of the first node.

[0058] According to the connection relationship between the nodes in the user topology diagram and the node information of each node, abnormal users are determined, and multiple abnormal users are grouped into abnormal groups. Abnormal users refer to users who are abnormal in the new user acquisition scenario. For example, abnormal users can be black and gray users or fake users. For example, according to the user information corresponding to the second node, the second user corresponding to the second node is determined to be a risky IP, and the second user is an abnormal user. According to the connection relationship, the first user connected to the second user is also determined as an abnormal user, and other second users connected to the first user can also be abnormal users, and these abnormal users are regarded as an abnormal group.

[0059] If there are third nodes and fourth nodes in the user topology graph, after determining an abnormal user, determine the nodes of the user type that are connected to the same third node or the same fourth node as the node of the abnormal user, and determine the nodes of the user type that are determined as abnormal users, thereby treating these abnormal users as an abnormal group.

[0060] Figure 2 A schematic diagram of a user topology diagram provided for an embodiment of the present disclosure. Figure 2In the example, the first users include A, B, and C. The second users corresponding to user A are A1 and A2, the second users corresponding to user B are B1, B2, and B3, and the second users corresponding to user C are C1 and C2. The device corresponding to user A is S1, the device corresponding to user B is S2, and the device corresponding to user C is S3. The devices corresponding to users A1, A2, and B1 are S4, the device corresponding to user B2 is S5, the device corresponding to user B3 is S6, the device corresponding to user C1 is S7, and the device corresponding to user C2 is S8. The exchange path corresponding to user A is L1, the exchange path corresponding to user B is L2, the exchange path corresponding to user C is L3, the exchange path corresponding to user A1 is L4, the exchange path corresponding to users A2, B1, and B2 is L5, the exchange path corresponding to users B3 and C1 is L6, and the exchange path corresponding to user C2 is L7.

[0061] Among them, there is an edge connection between the first nodes of A and B. The second nodes corresponding to A1, A2, and B1 can be connected to a third node respectively, and then the three third nodes are connected by edges, or the three second nodes can be directly connected to a third node of S4. The second nodes corresponding to A2, B1, and B2 can be connected to a fourth node of L5 respectively, and then the three fourth nodes are connected by edges, or the three second nodes can be directly connected to a fourth node of L5. The second nodes corresponding to B3 and C1 can be connected to a fourth node respectively, and then the two fourth nodes are connected by edges, or the two second nodes can be directly connected to a fourth node of L6. If B1 is determined to be an abnormal user, then according to Figure 2 The connection relationship in Figure 2 All users in the group can be identified as an abnormal group, or users who have a direct connection with B1 and users who share devices and / or redemption paths with B1 can be identified as abnormal users in an abnormal group. The user who has a direct connection with B1 is B, the users who share devices with B1 are A1 and A2, and the users who share redemption paths with B1 are A2 and B2, that is, B1, B, A1, A2, B2 can be identified as an abnormal group.

[0062] In the disclosed embodiment, the user information of the invited second user is obtained. A first user can invite multiple second users. According to the user information of the multiple second users, the relevant information of the first user can be determined, so that the first nodes corresponding to different first users are connected, and the first node of the first user and the second node of the second user can be connected to generate a user topology map. According to the connection relationship between the nodes in the user topology map, an abnormal group composed of multiple abnormal users can be determined. The overall determination of abnormal cheating gangs is achieved, and the efficiency of abnormal identification is improved. By connecting the first nodes, the connection relationship in the user topology map can be enriched, the omission of abnormal identification can be avoided, and the accuracy of abnormal identification can be improved.

[0063] Figure 3 A flowchart of a method for determining an abnormal group based on a new user acquisition scenario provided in an embodiment of the present disclosure.

[0064] In this embodiment, a user topology map is generated based on user information of multiple second users, including: for each first user, determining multiple second users corresponding to the first user; determining user information of the first user based on user information of the multiple second users; and generating a user topology map based on the correspondence between the first user and the second users, and the user information of each first user.

[0065] like Figure 3 As shown, the method comprises the following steps:

[0066] S301. Obtain user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account.

[0067] Exemplarily, this step may refer to the above-mentioned step S101 and will not be described in detail.

[0068] S302: For each first user, determine a plurality of second users corresponding to the first user.

[0069] Exemplarily, there may be multiple first users, each of which may correspond to multiple second users. For each first user, the second users invited by the first user are determined, and the corresponding relationship between the first user and the second user is stored, thereby obtaining multiple second users corresponding to the first user.

[0070] S303: Determine user information of the first user according to user information of multiple second users.

[0071] Exemplarily, for multiple second users corresponding to the first user, user information of the second users is determined. Based on the user information of the second users, the user information of the first user is determined. For example, the user information of the second users may be merged into the user information of the first user, or the user information of the second users may be screened to screen out the user information of the first user. Different first users correspond to different second users, that is, each first user may correspond to different user information.

[0072] In this embodiment, determining the user information of the first user according to the user information of the plurality of second users includes: aggregating the user information of the plurality of second users to obtain the user information of the first user.

[0073] Specifically, user information of multiple second users corresponding to the first user is determined, the user information is aggregated, and the aggregated user information is determined as the user information of the first user. For example, the user information of each second user includes information on the number of times the computer has been powered on, and the information on the number of times the computer has been powered on corresponding to each second user is aggregated to obtain information on the number of times the computer has been powered on corresponding to the first user.

[0074] Aggregation processing rules can be preset, and different aggregation processing rules can be preset for different information in user information. For example, for information on the number of power-on times, the aggregation rule can be to add up the number of power-on times of multiple second users as the information on the number of power-on times of the first user; or, it can be to take the minimum number of power-on times of multiple users as the information on the number of power-on times of the first user. For information on whether it is a risky IP, if the IPs of most second users are risky IPs, then the IP of the first user is a risky IP. In this embodiment, the preset aggregation processing rules are not specifically limited.

[0075] The beneficial effect of such a setting is that there will be similarities between multiple second users invited by the same first user, and the characteristics of the first user can be summarized based on the user information of the multiple second users, which is convenient for subsequently enriching the number of edge connections based on the characteristics of each first user and improving the recognition accuracy of abnormal groups.

[0076] S304: Generate a user topology map according to the correspondence between the first users and the second users and the user information of each first user.

[0077] Exemplarily, determining the correspondence between each first user and second user means determining which second users the first user has successfully invited. If the second user accepts the invitation of the first user, then there is a correspondence between the first user and the second user.

[0078] The user topology graph includes multiple nodes and the connection relationship between each node. According to the determined first user and second user, the nodes in the user topology graph can be determined, each first user corresponds to a first node, and each second user corresponds to a second node. According to the corresponding relationship between the first user and the second user, and the user information of each first user, the edge connection between different nodes can be constructed. For example, the edge connection between different first nodes, the edge connection between different second nodes, and the edge connection between the first node and the second node can be constructed. According to the connection relationship between each node, a complete user topology graph is generated.

[0079] In this embodiment, it is not necessary to obtain the user information of the first user. The features of the first user can be extracted based on the user information of multiple second users, thereby enriching the connection relationship in the user topology graph and improving the accuracy and efficiency of anomaly identification.

[0080] In this embodiment, a user topology map is generated based on the correspondence between the first user and the second user, and the user information of each first user, including: constructing an edge connection between the first node and the second node based on the correspondence between the first user and the second user; constructing an edge connection between different first nodes based on the user information of each first user; and generating a user topology map based on the edge connection between the first node and the second node, and the edge connection between different first nodes.

[0081] Specifically, the correspondence between the first user and the second user is determined. According to the correspondence between the first user and the second user, the connection relationship between the first node and the second node can be determined, and the nodes of the two users with the corresponding relationship are connected by edges.

[0082] According to the user information of each first user, the connection relationship between different first nodes can be determined. For example, multiple first nodes with the same user information can be edge-connected. According to the connection relationship between the first node and the second node, and the connection relationship between different first nodes, a user topology graph is generated.

[0083] The beneficial effect of this setting is that there are edge connections between new users and old users, and there can also be edge connections between different old users, which improves the connectivity of the user topology graph, facilitates the transmission and sharing of information in the graph, and improves the identification accuracy of abnormal groups.

[0084] In this embodiment, edge connections between different first nodes are constructed based on user information of each first user, including: clustering each first user based on the user information of each first user to obtain at least one cluster; wherein the cluster includes at least one first user; and edge connections are performed on the first nodes corresponding to the first users in the cluster.

[0085] Specifically, it is determined whether edge connections need to be established between different first nodes according to the user information of each first user. If yes, edge connections between different first nodes are established; if no, edge connections between different first nodes are not established.

[0086] Based on the user information of each first user, clustering processing is performed on these first users. For example, the K-means algorithm can be used to cluster the user information, and the user information of multiple first users is clustered into cluster clusters, that is, the first users corresponding to the user information are clustered into cluster clusters. Multiple cluster clusters can be obtained, and each cluster cluster can include at least one first user. For example, the first users include A, B, C, D, and E. A and B can be divided into one cluster cluster, and C, D, and E can be divided into one cluster cluster.

[0087] The first users in each cluster have similarity, that is, the user information corresponding to the first users in a cluster has similarity. When clustering, the similarity between the user information of different first users can be calculated. If the similarity is higher than a preset similarity threshold, the different first users are classified into the same cluster.

[0088] After the cluster is determined, the first node corresponding to the first user in the cluster is edge-connected, that is, the edge connection between the first nodes is realized. For example, the first nodes of A and B can be edge-connected, and the first nodes of C, D, and E can be edge-connected.

[0089] The beneficial effect of such a setting is that similar first nodes are connected by edges, the number of edges in the user topology graph is enriched, the connectivity of the user topology graph is improved, the omission of abnormal users in abnormal groups is avoided, and the recognition accuracy of abnormal groups is improved.

[0090] S305. Determine an abnormal group according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of abnormal users in the new user acquisition scenario.

[0091] Exemplarily, this step may refer to the above-mentioned step S103 and will not be described in detail.

[0092] In the disclosed embodiment, the user information of the invited second user is obtained. A first user can invite multiple second users. According to the user information of the multiple second users, the relevant information of the first user can be determined, so that the first nodes corresponding to different first users are connected, and the first node of the first user and the second node of the second user can be connected to generate a user topology map. According to the connection relationship between the nodes in the user topology map, an abnormal group composed of multiple abnormal users can be determined. The overall determination of abnormal cheating gangs is achieved, and the efficiency of abnormal identification is improved. By connecting the first nodes, the connection relationship in the user topology map can be enriched, the omission of abnormal identification can be avoided, and the accuracy of abnormal identification can be improved.

[0093] Figure 4 A flowchart of a method for determining an abnormal group based on a new user acquisition scenario provided in an embodiment of the present disclosure.

[0094] In this embodiment, abnormal groups are determined based on the connection relationship between nodes in the user topology map, including: determining the abnormal confidence of the nodes in the user topology map based on user information corresponding to the nodes in the user topology map; wherein the abnormal confidence represents the possibility that the user corresponding to the node is an abnormal user; determining positive sample users based on the abnormal confidence of the nodes in the user topology map; wherein the positive sample users represent the abnormal users obtained by the initial screening; and determining abnormal groups based on the user information of the positive sample users and the connection relationship between the nodes in the user topology map.

[0095] like Figure 4 As shown, the method comprises the following steps:

[0096] S401. Obtain user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account.

[0097] Exemplarily, this step may refer to the above-mentioned step S101 and will not be described in detail.

[0098] S402. Generate a user topology map based on user information of multiple second users; wherein the user topology map includes a first node corresponding to the first user and a second node corresponding to the second user, and the user topology map represents the connection relationship between the first node and the second node, and the connection relationship between different first nodes.

[0099] Exemplarily, this step may refer to the above-mentioned step S102 and will not be described in detail.

[0100] S403: Determine the abnormality confidence of the node in the user topology map according to the user information corresponding to the node in the user topology map; wherein the abnormality confidence represents the possibility that the user corresponding to the node is an abnormal user.

[0101] Exemplarily, node information corresponding to a node in a user topology graph is determined, the nodes in the user topology graph include a first node and a second node, and user information corresponding to the first node and user information corresponding to the second node in the user topology graph are determined. If the user topology graph also includes a third node and a fourth node, identification information of a device corresponding to the third node and redemption path information of a promotion benefit corresponding to the fourth node may also be determined.

[0102] A determination rule of abnormal confidence is preset, and the abnormal confidence represents the possibility that the user corresponding to the node is an abnormal user. The higher the abnormal confidence, the higher the possibility that the user is an abnormal user. For example, the preset determination rule of abnormal confidence may be that the fewer the number of power-on times in the user information, the higher the abnormal confidence. In this embodiment, the preset determination rule of abnormal confidence is not specifically limited.

[0103] For each node in the user topology graph, an abnormal confidence can be determined. For example, for a user type node, the abnormal confidence can be determined based on the user information, thereby determining the possibility that the user corresponding to the node is an abnormal user. For a device type or redemption path type node, the abnormal confidence can be determined based on the node information, thereby determining the possibility that the user corresponding to the user type node connected to the node is an abnormal user.

[0104] S404: Determine positive sample users according to the abnormal confidence of the nodes in the user topology graph; wherein the positive sample users represent the abnormal users obtained by the initial screening.

[0105] Exemplarily, positive sample users can be determined from all users based on the abnormal confidence of each node, and the positive sample users are users determined to be abnormal users. For example, a confidence threshold is set in advance, and after obtaining the abnormal confidence corresponding to each node, the obtained abnormal confidence is compared with the confidence threshold, and the user corresponding to the abnormal confidence greater than the confidence threshold is determined as a positive sample user. One or more positive sample users can be determined.

[0106] S405: Determine an abnormal group based on the user information of the positive sample users and the connection relationship between the nodes in the user topology graph.

[0107] Exemplarily, the user information of the positive sample user is determined, and one or more abnormal groups are determined based on the connection relationship between the user information of the positive sample user and the nodes in the user topology graph, and each abnormal group may include one or more positive sample users. For example, the similarity between the user information of the positive sample user and the user information of other users may be determined, and users whose user information is similar to that of the positive sample user and who have a connection relationship with the node of the positive sample user are formed into an abnormal group.

[0108] In this embodiment, the abnormal users are first determined based on the abnormal confidence, and then other abnormal users are found in the user topology map, so as to determine the final cheating gang, that is, the abnormal group. The overall determination of the abnormal group is achieved, so as to prevent and crack down on the black and gray users, and facilitate the maintenance of the normal operation of the new user acquisition activities.

[0109] In this embodiment, abnormal groups are determined based on user information of positive sample users and the connection relationship between nodes in the user topology graph, including: based on the user information of the positive sample users, semi-supervised learning processing is performed on a preset initial model to obtain a graph neural network model; wherein the graph neural network model is used to perform feature extraction processing on the user information of the node to determine whether the user corresponding to the node is an abnormal user; if the user corresponding to the node in the user topology graph is determined to be an abnormal user based on the graph neural network model, a feature vector of the abnormal user is obtained; wherein the feature vector is vector data obtained by performing feature extraction processing on the user information by the graph neural network model; based on the connection relationship between the nodes in the user topology graph, the feature vectors of the abnormal users are clustered to obtain abnormal groups.

[0110] Specifically, an initial model is pre-constructed, and the initial model can be a neural network model, for example, a HetGNN (Heterogeneous Graph Neural Network) model can be used. The user information of the positive sample user is used as input data and input into the initial model, and semi-supervised learning is performed on the initial model so that the initial model extracts features from the input data, and the output data can characterize the positive sample user as an abnormal user. The initial model after semi-supervised learning is determined as the final graph neural network model, and the graph neural network model can perform feature extraction processing on the input data and output a conclusion on whether the user is an abnormal user. In this embodiment, the processing process of semi-supervised learning is not specifically limited.

[0111] After obtaining the learned graph neural network model, the node information corresponding to each node in the user topology graph can be input into the graph neural network model. For example, the user information of the user type node can be input into the graph neural network model to determine whether the user corresponding to the user type node is an abnormal user. The node information of the non-user type node can also be input into the graph neural network model to determine whether the user corresponding to the user type node connected to the node is an abnormal user.

[0112] If the user is determined to be an abnormal user according to the graph neural network model, the feature vector obtained when the graph neural network model extracts features from the input data is obtained, that is, the feature vector corresponding to the abnormal user is obtained. In this embodiment, the feature vector may be an embedding vector.

[0113] According to the connection relationship between the nodes in the user topology graph, the feature vectors of abnormal users are clustered, and the abnormal users corresponding to the feature vectors clustered into a cluster are determined as abnormal users in an abnormal group. For example, the similarity of the feature vectors of each abnormal user can be determined. If there are at least two abnormal users with high similarity and direct edge connection, the at least two abnormal users can be clustered into a cluster. Alternatively, if one user is determined to be an abnormal user and the other user is not an abnormal user, but the two users are edge-connected, the user who is not an abnormal user can also be included in the abnormal group.

[0114] The beneficial effect of this setting is that the confidence screening rules are used to obtain positive sample users, and the graph neural network algorithm is used for semi-supervised learning to improve the calculation accuracy of the model. By clustering the feature vectors and combining the connection relationship of the user topology graph, the recognition accuracy of abnormal groups is improved to avoid missing abnormal users in abnormal groups.

[0115] In this embodiment, feature vectors of abnormal users are clustered according to the connection relationship between nodes in the user topology map to obtain abnormal groups, including: according to the connection relationship between nodes in the user topology map, feature vectors of abnormal users are clustered to obtain at least one candidate group; if, based on user information of abnormal users in the candidate group, it is determined that the candidate group meets a preset abnormal screening condition, the candidate group is determined to be an abnormal group.

[0116] Specifically, firstly, the feature vectors of abnormal users are clustered according to the connection relationship between the nodes in the user topology graph, and the clusters obtained by clustering are determined as candidate groups, and multiple candidate groups can be obtained.

[0117] Anomaly screening conditions are pre-set and used to screen candidate groups. The anomaly screening conditions can be set based on expert experience. For example, the anomaly screening conditions can be to determine the proportion of virtual mobile phone numbers, risky IPs, fewer boot times, smaller SD cards, weak security factors, etc. in the candidate group. If the calculated proportion is greater than the preset proportion threshold, it is determined that the candidate group meets the preset anomaly screening conditions and the candidate group is the final anomaly group.

[0118] That is to say, based on the user information of abnormal users in the candidate group, it is determined whether the candidate group meets the abnormal screening conditions. If so, the candidate group is determined to be a real abnormal group; if not, the candidate group is determined not to be an abnormal group. For example, the IP address corresponding to each abnormal user in the candidate group is determined, and the proportion of risky IPs is determined. If the proportion is greater than the preset proportion threshold, the candidate group is determined to be an abnormal group.

[0119] The beneficial effect of this arrangement is that the suspicious cheating groups are first identified, and then the final cheating groups are determined based on expert experience or preset conditions, thereby improving the accuracy of determining abnormal groups.

[0120] In the disclosed embodiment, the user information of the invited second user is obtained. A first user can invite multiple second users. According to the user information of the multiple second users, the relevant information of the first user can be determined, so that the first nodes corresponding to different first users are connected, and the first node of the first user and the second node of the second user can be connected to generate a user topology map. According to the connection relationship between the nodes in the user topology map, an abnormal group composed of multiple abnormal users can be determined. The overall determination of abnormal cheating gangs is achieved, and the efficiency of abnormal identification is improved. By connecting the first nodes, the connection relationship in the user topology map can be enriched, the omission of abnormal identification can be avoided, and the accuracy of abnormal identification can be improved.

[0121] Figure 5 This is a structural block diagram of a device for determining abnormal groups based on a new user acquisition scenario provided by an embodiment of the present disclosure. For ease of explanation, only the parts related to the embodiment of the present disclosure are shown. Figure 5 The device 500 for determining abnormal groups based on the new user acquisition scenario includes: an information acquisition unit 501 , a graph generation unit 502 and a group determination unit 503 .

[0122] The information acquisition unit 501 is used to acquire user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account;

[0123] A graph generating unit 502 is configured to generate a user topology graph according to the user information of the plurality of second users; wherein the user topology graph includes a first node corresponding to the first user and a second node corresponding to the second user, and the user topology graph represents a connection relationship between the first node and the second node, and a connection relationship between different first nodes;

[0124] The group determination unit 503 is used to determine an abnormal group according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of abnormal users in the new user acquisition scenario.

[0125] Figure 6 A structural block diagram of a device for determining an abnormal group based on a new user acquisition scenario provided by an embodiment of the present disclosure, such as Figure 6 As shown, the device 600 for determining abnormal groups based on the new user acquisition scenario includes an information acquisition unit 601, a graph generation unit 602 and a group determination unit 603, wherein the graph generation unit 602 includes a user determination module 6021, an information determination module 6022 and a graph generation module 6023.

[0126] A user determination module 6021, configured to determine, for each first user, a plurality of second users corresponding to the first user;

[0127] An information determination module 6022, configured to determine the user information of the first user based on the user information of multiple second users;

[0128] The graph generating module 6023 is used to generate the user topology graph according to the corresponding relationship between the first users and the second users, and the user information of each of the first users.

[0129] In one example, the information determination module 6022 includes:

[0130] The information aggregation submodule is used to aggregate the user information of multiple second users to obtain the user information of the first user.

[0131] In one example, the graph generation module 6023 includes:

[0132] A first construction submodule, configured to construct an edge connection between the first node and the second node according to the corresponding relationship between the first user and the second user;

[0133] A second construction submodule, configured to construct edge connections between different first nodes according to the user information of each of the first users;

[0134] The graph generation submodule is used to generate the user topology graph according to the edge connection between the first node and the second node, and the edge connection between the different first nodes.

[0135] In one example, the second construction submodule is specifically used for:

[0136] Clustering each of the first users according to the user information of each of the first users to obtain at least one cluster; wherein the cluster includes at least one first user;

[0137] Perform edge connection on the first node corresponding to the first user in the cluster.

[0138] In one example, the group determination unit 603 includes:

[0139] A confidence determination module, used to determine the abnormal confidence of a node in the user topology map according to user information corresponding to the node in the user topology map; wherein the abnormal confidence represents the possibility that the user corresponding to the node is an abnormal user;

[0140] A positive sample determination module, used to determine positive sample users according to the abnormal confidence of the nodes in the user topology graph; wherein the positive sample users represent the abnormal users obtained by the initial screening;

[0141] The group determination module is used to determine the abnormal group according to the user information of the positive sample users and the connection relationship between the nodes in the user topology graph.

[0142] In one example, the group determination module includes:

[0143] A model learning submodule is used to perform semi-supervised learning processing on a preset initial model according to the user information of the positive sample user to obtain a graph neural network model; wherein the graph neural network model is used to perform feature extraction processing on the user information of the node to determine whether the user corresponding to the node is an abnormal user;

[0144] A feature acquisition submodule, for obtaining a feature vector of the abnormal user if the user corresponding to the node in the user topology graph is determined to be an abnormal user according to the graph neural network model; wherein the feature vector is vector data obtained by performing feature extraction processing on user information by the graph neural network model;

[0145] The feature clustering submodule is used to perform clustering processing on the feature vectors of the abnormal users according to the connection relationship between the nodes in the user topology graph to obtain the abnormal group.

[0146] In one example, the feature clustering submodule is specifically used to:

[0147] According to the connection relationship between the nodes in the user topology graph, clustering is performed on the feature vectors of the abnormal users to obtain at least one candidate group;

[0148] If it is determined that the candidate group meets a preset abnormal screening condition according to the user information of the abnormal users in the candidate group, the candidate group is determined to be the abnormal group.

[0149] In one example, the user topology graph includes a third node, the third node represents identification information of a device for a user to log in to an account, and the first node and the second node are both edge-connected to the corresponding third node; the device further includes:

[0150] The device determining unit is used to connect the third nodes corresponding to the different users by edges if it is determined that the identification information of the devices of the accounts logged in by different users is the same identification information.

[0151] In one example, the user topology graph includes a fourth node, the fourth node represents a user's redemption path for a promotion benefit, the promotion benefit represents a benefit issued to a first user or a second user in a new user acquisition scenario, and the first node and the second node are both edge-connected to the corresponding fourth node; the device further includes:

[0152] The path determination unit is configured to connect the fourth nodes corresponding to the different users by edges if it is determined that the redemption paths for the promotional benefits of different users are the same redemption path.

[0153] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device.

[0154] Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of the present disclosure. The electronic device may be a terminal device, a processor or a server. Figure 7 As shown, the electronic device 70 includes: at least one processor 702; and a memory 701 communicatively connected to the at least one processor 702; wherein the memory stores instructions executable by the at least one processor 702, and the instructions are executed by the at least one processor 702 so that the at least one processor 702 can execute the method for determining abnormal groups based on the new user acquisition scenario disclosed in the present invention.

[0155] The electronic device 70 further includes a receiver 703 and a transmitter 704. The receiver 703 is used to receive instructions and data sent by other devices, and the transmitter 704 is used to send instructions and data to external devices.

[0156] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0157] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0158] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0159] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0160] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0161] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as a determination method for an abnormal group based on a new scene. For example, in some embodiments, a determination method for an abnormal group based on a new scene may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the determination method for an abnormal group based on a new scene described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured in any other appropriate manner (eg, by means of firmware) to execute a method for determining an abnormal group based on a new user acquisition scenario.

[0162] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0163] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0164] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0165] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0166] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0167] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0168] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0169] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for determining an abnormal group based on a new user acquisition scenario, comprising: Obtaining user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; the user information represents attribute information of the user's account; Generate a user topology map according to the user information of the plurality of second users; wherein the user topology map includes a first node corresponding to the first user and a second node corresponding to the second user, and the user topology map represents a connection relationship between the first node and the second node, and a connection relationship between different first nodes; An abnormal group is determined according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of abnormal users in the new user acquisition scenario.

2. The method according to claim 1, wherein: The generating a user topology map according to the user information of the plurality of second users includes: For each first user, determining a plurality of second users corresponding to the first user; Determining user information of the first user based on user information of multiple second users; The user topology map is generated according to the corresponding relationship between the first users and the second users, and the user information of each of the first users.

3. The method according to claim 2, wherein: The determining the user information of the first user according to the user information of the plurality of second users includes: The user information of the plurality of second users is aggregated to obtain the user information of the first user.

4. The method according to claim 2 or 3, wherein: The generating the user topology map according to the correspondence between the first user and the second user and the user information of each of the first users includes: According to the corresponding relationship between the first user and the second user, an edge connection is constructed between the first node and the second node; Building edge connections between different first nodes according to the user information of each of the first users; The user topology graph is generated according to the edge connection between the first node and the second node, and the edge connection between the different first nodes.

5. The method according to claim 4, wherein: The step of constructing edge connections between different first nodes according to the user information of each of the first users includes: Clustering each of the first users according to the user information of each of the first users to obtain at least one cluster; wherein the cluster includes at least one first user; Perform edge connection on the first node corresponding to the first user in the cluster.

6. The method according to claim 5, wherein: The determining of the abnormal group according to the connection relationship between the nodes in the user topology graph includes: Determine the abnormality confidence of the node in the user topology map according to the user information corresponding to the node in the user topology map; wherein the abnormality confidence represents the possibility that the user corresponding to the node is an abnormal user; According to the abnormal confidence of the nodes in the user topology graph, positive sample users are determined; wherein the positive sample users represent the abnormal users obtained by the initial screening; The abnormal group is determined according to the user information of the positive sample users and the connection relationship between the nodes in the user topology graph.

7. The method according to claim 6, wherein: The determining the abnormal group according to the user information of the positive sample user and the connection relationship between the nodes in the user topology graph includes: According to the user information of the positive sample user, a semi-supervised learning process is performed on the preset initial model to obtain a graph neural network model; wherein the graph neural network model is used to perform feature extraction processing on the user information of the node to determine whether the user corresponding to the node is an abnormal user; If it is determined that the user corresponding to the node in the user topology graph is an abnormal user according to the graph neural network model, a feature vector of the abnormal user is obtained; wherein the feature vector is vector data obtained by performing feature extraction processing on user information by the graph neural network model; According to the connection relationship between the nodes in the user topology graph, the feature vectors of the abnormal users are clustered to obtain the abnormal group.

8. The method according to claim 7, wherein: The step of clustering the feature vectors of the abnormal users according to the connection relationship between the nodes in the user topology graph to obtain the abnormal group includes: According to the connection relationship between the nodes in the user topology graph, clustering is performed on the feature vectors of the abnormal users to obtain at least one candidate group; If it is determined that the candidate group meets a preset abnormal screening condition according to the user information of the abnormal users in the candidate group, the candidate group is determined to be the abnormal group.

9. The method according to any one of claims 1 to 8, wherein the user topology graph includes a third node, the third node represents identification information of a device of a user login account, and the first node and the second node are both connected to the corresponding third node by an edge; the method further comprises: If it is determined that the identification information of the devices of the accounts logged in by different users is the same identification information, the third nodes corresponding to the different users are edge-connected.

10. The method according to any one of claims 1 to 9, wherein the user topology graph includes a fourth node, the fourth node represents a user's redemption path for promotional benefits, the promotional benefits represent benefits issued to the first user or the second user in a new user acquisition scenario, and the first node and the second node are both edge-connected to the corresponding fourth node; the method further comprises: If it is determined that the redemption paths for the promotional benefits of different users are the same redemption path, the fourth nodes corresponding to the different users are edge-connected.

11. A device for determining an abnormal group based on a new user acquisition scenario, comprising: An information acquisition unit, configured to acquire user information of a second user; wherein the second user represents a user invited by the first user, and one first user corresponds to multiple second users; and the user information represents attribute information of the user's account; A graph generating unit, configured to generate a user topology graph according to user information of the plurality of second users; wherein the user topology graph includes a first node corresponding to a first user and a second node corresponding to a second user, and the user topology graph represents a connection relationship between the first node and the second node, and a connection relationship between different first nodes; The group determination unit is used to determine an abnormal group according to the connection relationship between the nodes in the user topology graph; wherein the abnormal group represents a group of users with abnormalities in the new user acquisition scenario.

12. The device according to claim 11, wherein The graph generating unit comprises: A user determination module, configured to determine, for each first user, a plurality of second users corresponding to the first user; An information determination module, configured to determine user information of the first user based on user information of a plurality of second users; The graph generating module is used to generate the user topology graph according to the corresponding relationship between the first users and the second users and the user information of each of the first users.

13. The device according to claim 12, wherein: The information determination module comprises: The information aggregation submodule is used to aggregate the user information of multiple second users to obtain the user information of the first user.

14. The device according to claim 12 or 13, wherein: The graph generation module comprises: A first construction submodule, configured to construct an edge connection between the first node and the second node according to the corresponding relationship between the first user and the second user; A second construction submodule, configured to construct edge connections between different first nodes according to the user information of each of the first users; The graph generation submodule is used to generate the user topology graph according to the edge connection between the first node and the second node, and the edge connection between the different first nodes.

15. The device according to claim 14, wherein: The second construction submodule is specifically used for: Clustering each of the first users according to the user information of each of the first users to obtain at least one cluster; wherein the cluster includes at least one first user; Perform edge connection on the first node corresponding to the first user in the cluster.

16. The device according to claim 15, wherein: The group determination unit includes: A confidence determination module, used to determine the abnormal confidence of a node in the user topology map according to user information corresponding to the node in the user topology map; wherein the abnormal confidence represents the possibility that the user corresponding to the node is an abnormal user; A positive sample determination module, used to determine positive sample users according to the abnormal confidence of the nodes in the user topology graph; wherein the positive sample users represent the abnormal users obtained by the initial screening; The group determination module is used to determine the abnormal group according to the user information of the positive sample users and the connection relationship between the nodes in the user topology graph.

17. The device according to claim 16, wherein: The group determination module includes: A model learning submodule is used to perform semi-supervised learning processing on a preset initial model according to the user information of the positive sample user to obtain a graph neural network model; wherein the graph neural network model is used to perform feature extraction processing on the user information of the node to determine whether the user corresponding to the node is an abnormal user; A feature acquisition submodule, for obtaining a feature vector of the abnormal user if the user corresponding to the node in the user topology graph is determined to be an abnormal user according to the graph neural network model; wherein the feature vector is vector data obtained by performing feature extraction processing on user information by the graph neural network model; The feature clustering submodule is used to perform clustering processing on the feature vectors of the abnormal users according to the connection relationship between the nodes in the user topology graph to obtain the abnormal group.

18. The device according to claim 17, wherein: The feature clustering submodule is specifically used for: According to the connection relationship between the nodes in the user topology graph, clustering is performed on the feature vectors of the abnormal users to obtain at least one candidate group; If it is determined that the candidate group meets a preset abnormal screening condition according to the user information of the abnormal users in the candidate group, the candidate group is determined to be the abnormal group.

19. The device according to any one of claims 11 to 18, wherein the user topology graph includes a third node, the third node represents identification information of a device for a user to log in to an account, and the first node and the second node are both connected to the corresponding third node by an edge; the device further comprises: The device determining unit is used to connect the third nodes corresponding to the different users by edges if it is determined that the identification information of the devices of the accounts logged in by different users is the same identification information.

20. The device according to any one of claims 11 to 19, wherein the user topology graph includes a fourth node, the fourth node represents a user's redemption path for promotional benefits, the promotional benefits represent benefits issued to a first user or a second user in a new user acquisition scenario, and the first node and the second node are both edge-connected to the corresponding fourth node; the device further comprises: The path determination unit is configured to connect the fourth nodes corresponding to the different users by edges if it is determined that the redemption paths for the promotional benefits of different users are the same redemption path.

21. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 10.

22. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-10.

23. A computer program product, wherein: The invention comprises a computer program, which implements the steps of the method according to any one of claims 1 to 10 when being executed by a processor.

Images