Data detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a data detection method and device, electronic equipment and a storage medium. According to the embodiment of the invention, the object to be detected can be directly detected by combining the multimedia data, basic information of the user, equipment information used by the user, social information of the user in the business platform and other portrait data which are sent by the user through the object to be detected in various forms in the business platform and are used for being displayed to other users; therefore, all business behaviors related to the to-be-detected object can be detected according to the detection result of whether the to-be-detected object has the abnormal behavior or not; and the situation that the user adopts various different confrontation modes to avoid the detection due to the fact that only the business behavior of the to-be-detected object is detected can be avoided, so that the accuracy of carrying out anomaly detection on the business behavior of the to-be-detected object can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data detection method, device, electronic device and storage medium. Background Art

[0002] At present, in order to protect the account security of users (such as protecting personal privacy data security, protecting account funds security, etc.), various business platforms can usually use machine learning models to identify the content of the data to be detected, so as to obtain detection results indicating whether the data to be detected contains situations such as content misleading, illegal content promotion, and abnormal profit-making activities. Based on the detection results, risk control can be performed on the accounts used by users.

[0003] However, there are some users who constantly change the forms of the detection data to avoid the existing detection technology, which makes the existing detection method less effective in detecting abnormal data. For example: when the image data corresponding to the avatar of the account used by the user is used as the image data to be detected, the user can rewrite the text used to promote illegal content contained in the image data to be detected on paper in handwriting, and use a mobile phone to take a photo, and use the photo containing the handwritten text used to promote illegal content as the avatar again, so as to avoid detection. For another example: you can use similar characters or homophones to replace part of the content in the text used to promote illegal content, so as to avoid detection, etc.

[0004] Therefore, how to improve the accuracy of anomaly detection for the data to be detected is an urgent problem to be solved. Summary of the invention

[0005] This specification provides a data detection method, device, electronic device and storage medium to solve the problem of low detection efficiency in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This specification provides a data detection method, including:

[0008] Acquire each piece of data to be detected corresponding to the object to be detected and the portrait data of the object to be detected, wherein each piece of data to be detected is multimedia data displayed to other users based on the object to be detected;

[0009] For each data to be detected, a detection strategy matching the data to be detected is determined from various preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data;

[0010] Inputting the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior according to the detection result and the portrait data as a target detection result;

[0011] Execute a detection task according to the target detection result.

[0012] Optionally, determining a detection strategy that matches the data to be detected from various preset detection strategies to detect the data to be detected and obtaining a detection result of whether the data to be detected is abnormal data specifically includes:

[0013] If the data type of the data to be detected is a video type, then determining a first detection strategy applicable to video type data detection from various preset detection strategies as a detection strategy matching the data to be detected;

[0014] According to the first detection strategy, intercepting at least one frame of image data from the data to be detected as target image data;

[0015] The target image data is detected to obtain a detection result of whether the data to be detected is abnormal data.

[0016] Optionally, determining a detection strategy that matches the data to be detected from various preset detection strategies to detect the data to be detected and obtaining a detection result of whether the data to be detected is abnormal data specifically includes:

[0017] If the data type of the data to be detected is a picture type, determining a second detection strategy applicable to picture type data detection from various preset detection strategies as a detection strategy matching the data to be detected;

[0018] According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label matching the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, and different abnormal labels are used to represent different illegal elements contained in the data to be detected;

[0019] According to the abnormal label corresponding to the data to be detected, a detection result of whether the data to be detected is abnormal data is obtained.

[0020] Optionally, before inputting the data to be detected into a preset image recognition model according to the second detection strategy so that the image recognition model determines an abnormal label matching the data to be detected from preset abnormal labels as the abnormal label corresponding to the data to be detected, the method further includes:

[0021] According to the second detection strategy, determining whether there is sample image data matching the data to be detected among the sample image data included in the preset designated sample library;

[0022] If yes, determining a first reference abnormal label corresponding to the data to be detected according to the preset abnormal label corresponding to the designated sample library;

[0023] According to the second detection strategy, the data to be detected is input into a preset image recognition model so that the image recognition model determines an abnormal label matching the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, specifically including:

[0024] According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as a second reference abnormal label;

[0025] An abnormal label corresponding to the data to be detected is determined according to the first reference abnormal label and the second reference abnormal label.

[0026] Optionally, obtaining a detection result of whether the data to be detected is abnormal data according to the abnormal label corresponding to the data to be detected specifically includes:

[0027] Extracting designated detection data from the data to be detected, wherein the designated detection data includes: text data and image data corresponding to the image area containing the QR code;

[0028] The designated detection data is detected, and a detection result of whether the data to be detected is abnormal data is obtained according to the detection result of the designated detection data and the abnormal label corresponding to the data to be detected.

[0029] Optionally, determining a detection strategy that matches the data to be detected from various preset detection strategies to detect the data to be detected and obtaining a detection result of whether the data to be detected is abnormal data specifically includes:

[0030] If the data type of the data to be detected is a text type, then determining a third detection strategy suitable for text type data detection from various preset detection strategies as a detection strategy matching the data to be detected;

[0031] According to the third detection strategy, at least one detection operation is performed on the data to be detected. For each detection operation, the detection result after the data to be detected is detected by the detection operation is used as the detection result corresponding to the detection operation, wherein different detection operations have different detection effects on the same illegal text;

[0032] According to the detection result corresponding to each detection operation, it is determined whether the data to be detected is a detection result of abnormal data.

[0033] Optionally, performing a detection task according to the target detection result specifically includes:

[0034] If it is determined according to the target detection result that the object to be detected has abnormal business behavior, a node matching the object to be detected is determined from the pre-constructed subject relationship diagram as the first target node corresponding to the object to be detected;

[0035] Determine from the subject relationship graph other nodes whose connection relationship with the first target node meets a preset condition as second target nodes;

[0036] A detection task is performed according to the first target node and the second target node.

[0037] Optionally, a subject relationship diagram is constructed, specifically including:

[0038] Obtain historical test results of historical data to be tested corresponding to each object;

[0039] Based on the historical detection results, nodes of various types are determined, and based on the nodes of various types, a subject relationship diagram is constructed. In the subject relationship diagram, nodes of various types include: nodes for representing objects, nodes for representing historical data to be detected, nodes for representing sources of historical data to be detected, and nodes for representing abnormal types corresponding to historical detection results.

[0040] Optionally, obtaining each piece of to-be-detected data corresponding to the to-be-detected object specifically includes:

[0041] The data released by the object to be detected through different information release channels are obtained as the data to be detected.

[0042] This specification provides a data detection device, including:

[0043] An acquisition module, used to acquire each piece of to-be-detected data corresponding to the to-be-detected object and portrait data of the to-be-detected object, wherein each piece of to-be-detected data is multimedia data displayed to other users based on the to-be-detected object;

[0044] The detection module is used to determine, for each data to be detected, a detection strategy that matches the data to be detected from various preset detection strategies, so as to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data;

[0045] A determination module, used to input the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior according to the detection result and the portrait data, as a target detection result;

[0046] An execution module is used to execute the detection task according to the target detection result.

[0047] Optionally, the detection module is specifically configured to, if the data type of the data to be detected is a video type, determine, from various preset detection strategies, a first detection strategy applicable to video type data detection as a detection strategy matching the data to be detected;

[0048] According to the first detection strategy, intercepting at least one frame of image data from the data to be detected as target image data;

[0049] The target image data is detected to obtain a detection result of whether the data to be detected is abnormal data.

[0050] Optionally, the detection module is specifically configured to, if the data type of the data to be detected is a picture type, determine, from various preset detection strategies, a second detection strategy applicable to picture type data detection as a detection strategy matching the data to be detected;

[0051] According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, and different abnormal labels are used to characterize different illegal elements contained in the data to be detected; according to the abnormal label corresponding to the data to be detected, a detection result of whether the data to be detected is abnormal data is obtained.

[0052] Optionally, the detection module is specifically used to determine, according to the second detection strategy, whether there is sample image data matching the data to be detected among the sample image data included in the preset designated sample library;

[0053] If yes, determining a first reference abnormal label corresponding to the data to be detected according to the preset abnormal label corresponding to the designated sample library;

[0054] According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as a second reference abnormal label;

[0055] An abnormal label corresponding to the data to be detected is determined according to the first reference abnormal label and the second reference abnormal label.

[0056] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data detection method is implemented.

[0057] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned data detection method when executing the program.

[0058] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0059] In the data detection method provided in the present specification, first, each data to be detected corresponding to the object to be detected and the portrait data of the object to be detected are obtained, each data to be detected is multimedia data displayed to other users based on the object to be detected, and for each data to be detected, a detection strategy matching the data to be detected is determined from various preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data, and the detection result and the portrait data are input into a preset detection model so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior as a target detection result based on the detection result and the portrait data, and executes the detection task according to the target detection result.

[0060] It can be seen from the above method that the ordinary accounts, public accounts, groups, mini-programs, merchant accounts, etc. used by users on the business platform can be used as objects to be detected, and the multimedia data sent by users in various forms through the objects to be detected in the business platform for display to other users and the user's basic information, the device information used by the user, the user's social information in the business platform and other portrait data can be combined to directly detect whether the object to be detected is an object with abnormal behavior. Therefore, all business behaviors involved in the object to be detected can be detected based on the detection result of whether the object to be detected has abnormal behavior, and the situation where users adopt various different confrontational methods to evade detection due to only detecting the business behavior of the object to be detected can be avoided, thereby improving the accuracy of abnormal detection of business behaviors of the object to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The exemplary embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification.

[0062] In the figure:

[0063] Figure 1 A flowchart of a data detection method provided in this specification;

[0064] Figure 2 A schematic diagram of a process for detecting data to be detected provided in this specification;

[0065] Figure 3 A schematic diagram of a process for obtaining target detection results provided in this specification;

[0066] Figure 4 A schematic diagram of the subject relationship diagram provided in this specification;

[0067] Figure 5 A schematic diagram of the connection relationship provided in this specification;

[0068] Figure 6 A schematic diagram of a data detection device provided in this specification;

[0069] Figure 7 A method corresponding to the Figure 1 Schematic diagram of an electronic device. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0071] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0072] In business risk control scenarios, some risky users usually mutate the illegal content in different forms in order to circumvent the abnormal detection methods set by the business platform. For example, they change "website" to "net", or "com" to wait.

[0073] In addition, risky users can also display illegal content to other users through a variety of different channels, for example, through the avatar, nickname, etc. of the account used on the business platform, to display illegal content to other users. Another example is: through the remarks information under the transfer function provided by the business platform, to display illegal content to other users.

[0074] Therefore, it is particularly important to effectively detect different forms of illegal content displayed by risky users to other users through different channels in order to protect the security of accounts used by other users of the business platform.

[0075] Figure 1 A flow chart of a data detection method provided in this specification includes the following steps:

[0076] S100: Acquire various data to be detected corresponding to the object to be detected and portrait data of the object to be detected, wherein the various data to be detected are multimedia data displayed to other users based on the object to be detected.

[0077] In this specification, the business platform can obtain multimedia data displayed by the user to other users based on the object to be detected as the data to be detected corresponding to the object to be detected, so that the data to be detected corresponding to the object to be detected can be detected to obtain the detection result of whether the data to be detected corresponding to the object to be detected is abnormal data, and then the detection result of whether the data to be detected corresponding to the object to be detected is abnormal data can be combined with the portrait data of the object to be detected to detect the object to be detected to determine whether the object to be detected has abnormal business behavior, and based on the detection result of whether the object to be detected has abnormal business behavior, the business behavior of the object to be detected and the business behavior of other objects that have a correlation with the object to be detected are detected.

[0078] In the above content, the object to be detected can be selected by the business platform from various objects. Specifically, the business platform can randomly sample various objects at specified time periods to extract at least some objects from various objects as the object to be detected. Of course, when the business platform receives violation information uploaded by the user through the account used by the user to prove that other users have violated the rules, the object corresponding to the other user on the business platform corresponding to the above violation information can be used as the above object to be detected.

[0079] In the above content, the objects can be different entities registered and used by users in the business platform, such as: accounts, merchants, groups, mini programs, life accounts, etc.

[0080] In the above content, the data to be detected may be various data released by the object to be detected in different information release ways, for example: picture data used as an avatar of the object to be detected and released by the avatar function provided by the business platform for the account used by the user, user note data for display to other users and released by the personal information note function provided by the business platform for the account used by the user, instant messaging information sent by the instant messaging function provided by the business platform to the user, transfer note data sent by the note function in the transfer business initiated by the business platform for the object to be detected, etc.

[0081] In the above content, the portrait data of the object to be detected can be a collection of feature data of the object to be detected in the business platform. The above portrait data may include: basic data of the object to be detected (for example: name, registration time, remarks, login location, etc.), hardware device data bound to the object to be detected (for example: device model, device operating system, device access frequency, etc.), historical violation records of the object to be detected (for example: complaint records, business platform violation detection records, etc.), historical penalty records of the object to be detected (for example: restriction of some rights, etc.), transfer records of the object to be detected, social relationship data of the object to be detected (for example: social network structure, interaction behavior records with other objects), etc.

[0082] In this specification, the execution entity used to implement the data detection method may refer to a designated device such as a server set up on a business platform, or may refer to a terminal device such as a desktop computer or a laptop computer. For the sake of ease of description, the data detection method provided in this specification is described below using the server as the execution entity as an example.

[0083] S102: for each data to be detected, a detection strategy matching the data to be detected is determined from various preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data.

[0084] It can be seen from the above content that the data to be detected corresponding to the object to be detected obtained by the server can be multimedia data in different forms, and these multimedia data may contain illegal content after being transformed in different forms (such as: replacement of similar-sounding characters, replacement of similar-shaped characters, replacement of handwriting, etc.). Therefore, after obtaining the data to be detected, the server can determine the detection strategy that matches each data to be detected from the preset detection strategies according to the data type of each data to be detected, so as to detect each data to be detected and obtain the detection result of whether each data to be detected is abnormal data, wherein the above data types include: video type, picture type, text type, etc., the following combined Figure 2The method for detecting the data to be detected of each data type mentioned above is described in detail.

[0085] Figure 2 This is a schematic diagram of the process of detecting the data to be detected provided in this specification.

[0086] Combination Figure 2 It can be seen that if the data type of the data to be detected is a video type, the server can determine the first detection strategy suitable for video type data detection from the preset detection strategies as the detection strategy that matches the data to be detected, and according to the first detection strategy, intercept at least one frame of image data from the data to be detected as the target image data, so as to detect the target image data and obtain the detection result of whether the data to be detected is abnormal data.

[0087] The method for the server to extract the image data from the data to be detected can be set according to actual needs, for example, by extracting key frames from the data to be detected through a preset neural network model as the extracted image data. Another example is: uniformly extracting at least part of the frames from the data to be detected at a fixed interval or a fixed frame rate as the extracted image data, etc.

[0088] If the data type of the data to be detected is a picture type, the server can determine, from the preset detection strategies, a second detection strategy suitable for picture type data detection as a detection strategy that matches the data to be detected, so that the data to be detected can be input into the preset picture recognition model according to the second detection strategy, so that the picture recognition model determines, from the preset abnormal labels, an abnormal label that matches the data to be detected as the abnormal label corresponding to the data to be detected. Different abnormal labels are used to characterize different illegal elements contained in the data to be detected. According to the abnormal label corresponding to the data to be detected, a detection result of whether the data to be detected is abnormal data is obtained.

[0089] Among them, the above-mentioned abnormal labels can be labels corresponding to risk abnormalities involved in the data to be detected in historical detections, for example: abnormal labels containing abnormal image elements (that is, when the data to be detected contains image elements corresponding to gambling tools or other illegal contents, it can be considered that the data to be detected contains abnormal labels corresponding to abnormal image elements). Another example: abnormal labels containing misleading text content (that is, when the data to be detected contains illegal text content such as: "Add me v, make a lot of money", it can be considered that the data to be detected contains abnormal labels corresponding to misleading text content).

[0090] In actual application scenarios, some image elements are difficult to identify or prone to identification errors. For example, the image element corresponding to a tofu block is easily identified as the image element corresponding to mahjong. In this case, the server can build a designated sample library for the above-mentioned difficult-to-identify image elements, for example, saving image data that does not contain abnormal image elements but is easily identified as containing abnormal image elements to the above-mentioned designated sample library. Another example is: saving image data that contains abnormal image elements but is easily identified as not containing abnormal image elements to the above-mentioned designated sample library.

[0091] It should be noted that the server can construct one of the two types of designated sample libraries mentioned above according to actual needs. Of course, the server can also construct the two different designated sample libraries mentioned above at the same time, as the first designated sample library and the second designated sample library, and determine the abnormal label corresponding to each designated sample library for each designated sample library. For example, the abnormal label corresponding to the first designated sample library composed of each type of image data that does not contain abnormal picture elements but is easily identified as containing abnormal picture elements can be set to a white label, and the abnormal label corresponding to the second designated sample library composed of image data that contains abnormal picture elements but is easily identified as not containing abnormal picture elements can be set to the abnormal label corresponding to the illegal content involved in the image data contained in the second designated sample library.

[0092] It should be noted that there may be multiple second designated sample libraries, wherein different second designated sample libraries are used to store image data involving different illegal contents. In other words, all image data involving one illegal content can be uniformly saved in one second designated sample library, and the abnormal label corresponding to the second sample library can be set to the abnormal label corresponding to the illegal content.

[0093] Furthermore, when it is necessary to detect the data to be detected, the server can determine, based on the second detection strategy, whether there is sample image data matching the data to be detected among the sample image data contained in the preset designated sample library; if so, determine the first reference abnormality label corresponding to the data to be detected based on the abnormality label corresponding to the preset designated sample library, so that the data to be detected can be input into the preset image recognition model according to the second detection strategy, so that the image recognition model determines the abnormality label matching the data to be detected from the preset abnormality labels as the second reference abnormality label, and then determine the abnormality label corresponding to the data to be detected based on the first reference abnormality label and the second reference abnormality label.

[0094] In the above content, if there is sample picture data whose similarity with the data to be detected exceeds a preset threshold among the sample picture data included in the preset designated sample library, the sample picture data can be used as sample picture data matching the data to be detected.

[0095] In the above content, if the first reference abnormal label and the second reference abnormal label are inconsistent, the server may use the first reference abnormal label as the determined abnormal label corresponding to the data to be detected.

[0096] Of course, if the first reference exception label and the second reference exception label are inconsistent, the server may also send the above-mentioned first reference exception label, the above-mentioned second reference exception label and the data to be detected to the designated terminal device, so that the user using the above-mentioned designated terminal device can determine the exception label corresponding to the data to be detected based on the first reference exception label and the second reference exception label and return it.

[0097] In addition, since the image-type data to be detected may also contain situations such as: image QR codes for accessing illegal content, text data containing illegal content, etc., in order to further improve the accuracy of detection of image-type data to be detected, the server can also extract specified detection data from the data to be detected, and then detect the specified detection data, and obtain the detection result of whether the data to be detected is abnormal data based on the detection result of the specified detection data and the abnormal label corresponding to the data to be detected, wherein the above-mentioned specified detection data may include: text data, image data corresponding to the image area containing the QR code.

[0098] It is worth noting that when the data type of the data to be detected is a video type, when the server detects the target image data to obtain a detection result of whether the data to be detected is abnormal data, the method for the server to detect the target image data can be set according to actual needs, for example: comparing the target image data with the preset abnormal image data to determine whether there is abnormal image data matching the target image data among the preset abnormal image data. If so, the server can determine whether the data to be detected is a detection result of abnormal data based on the detection result corresponding to the abnormal image data matching the target image data.

[0099] Of course, the server may also detect the target image data according to the second detection strategy described above to obtain a detection result of the target image data, so as to obtain a detection result of whether the data to be detected is abnormal data.

[0100] If the data type of the data to be detected is a text type, the server can determine a third detection strategy suitable for text type data detection from the preset detection strategies as the detection strategy matching the data to be detected, so that at least one detection operation can be performed on the data to be detected according to the third detection strategy. For each detection operation, the detection result of the data to be detected after the detection operation is performed on the data to be detected is used as the detection result corresponding to the detection operation. Then, based on the detection result corresponding to each detection operation, it can be determined whether the data to be detected is a detection result of abnormal data, wherein different detection operations have different detection effects on the same illegal text.

[0101] In the above content, the detection operations may include: keyword library matching detection, text recognition model detection, variant adversarial detection, promotion and diversion model detection, link detection, etc. The following is a detailed description of each detection operation.

[0102] When performing keyword matching detection on the data to be detected, the server can determine whether there are keywords matching the data to be detected among the keywords contained in the preset keyword library. If so, the detection result corresponding to the detection operation can be determined based on the abnormal label corresponding to the keyword matching the data to be detected, wherein the above-mentioned keywords can be words that are pre-saved in the keyword library and are prone to recognition errors.

[0103] When performing text recognition model detection on the data to be detected, the server can input the data to be detected into a preset text recognition model, so that the text recognition model determines the abnormal label that matches the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, and then obtains the detection result of whether the data to be detected is abnormal data based on the abnormal label corresponding to the data to be detected.

[0104] When performing variant adversarial detection on the data to be detected, the server can determine the basic text features of the data to be detected based on the number of various types of characters contained in the data to be detected, where the types of characters include Chinese characters, English, numbers, etc. The method by which the server determines the basic text features of the data to be detected based on the number of various types of characters contained in the data to be detected can be to input the number of various types of characters contained in the data to be detected into a preset feature extraction model, so that the feature extraction model determines the basic text features of the data to be detected based on the proportion of the number of various types of characters contained in the data to be detected, and then determine the detection result corresponding to the data to be detected based on the basic text features of the data to be detected.

[0105] Furthermore, the server may also input the data to be detected into a preset deformation recognition model so that the deformation recognition model recognizes the data to be detected to determine whether the data to be detected contains the detection results of the phonetic-changed characters or the text-changed characters corresponding to the illegal content.

[0106] In addition, the server may also input the data to be detected into a preset deformation detection model, so that the deformation detection model performs semantic analysis on the data to be detected to determine whether the data to be detected contains a detection result of deformation content.

[0107] Furthermore, the server can determine the detection result corresponding to the data to be detected based on the basic text features of the data to be detected, the detection result of whether the data to be detected contains the phonetic or text-changed characters corresponding to the illegal content, and the detection result of whether the data to be detected contains the deformed content, and fuse them to obtain the fused detection result as the detection result corresponding to the variant adversarial detection of the data to be detected.

[0108] When performing promotion and traffic model detection on the data to be detected, the server can input the data to be detected into a preset promotion and traffic detection model, so that the promotion and traffic detection model performs detection based on the data to be detected to obtain a detection result of whether the data to be detected contains promotion and traffic content.

[0109] When performing link detection on the data to be detected, the server can extract the text data corresponding to the link from the data to be detected, and then determine whether there is an abnormal link matching the text data corresponding to the above link in the preset abnormal link library. If so, the detection result of whether the data to be detected has an illegal link can be obtained based on the abnormal label of the abnormal link matching the text data corresponding to the above link.

[0110] If not, the server can input the text data corresponding to the link into a preset link detection model, so that the link detection model can detect the text data corresponding to the link and obtain a detection result of whether the text data corresponding to the link has any abnormality, and can obtain the content of the web page opened after accessing the link, and obtain a detection result of whether the text data corresponding to the link has any abnormality based on the content of the web page opened after accessing the link. In addition, if the text data corresponding to the above-mentioned link has any abnormality, the server can also save the text data corresponding to the above-mentioned link in the above-mentioned abnormal link library.

[0111] It should be noted that, in the above content, there may be multiple methods for the server to determine whether the data to be detected is a detection result of abnormal data according to the detection result corresponding to each detection operation.

[0112] For example: the detection result corresponding to each detection operation is input into a preset attention model, so that the attention model determines the attention weight corresponding to the detection result corresponding to each detection operation, and determines whether the data to be detected is a detection result of abnormal data based on the attention weight corresponding to the detection result corresponding to each detection operation.

[0113] For another example: for the detection result corresponding to each detection operation, the number of other detection operations whose corresponding detection results are consistent with the detection result corresponding to the detection operation is used as the confidence of the detection result corresponding to the detection operation, and then according to the confidence of the detection data corresponding to each detection operation, it is possible to determine whether the data to be detected is the detection result of abnormal data.

[0114] It is worth noting that when the data type of the data to be detected is a picture type and the server needs to detect the designated detection data contained in the data to be detected, the server can compare the target picture data with the preset abnormal designated detection data to determine whether there is abnormal designated detection data matching the designated detection data in the preset abnormal designated detection data. If so, the server can determine whether the data to be detected is the detection result of abnormal data based on the detection result corresponding to the abnormal designated detection data matching the designated detection data.

[0115] Of course, if the specified detection data obtained above is text data, the server can also detect the specified detection data according to the third detection strategy mentioned above to obtain the detection result of the specified detection data to obtain the detection result of whether the data to be detected is abnormal data.

[0116] S104: Input the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior based on the detection result and the portrait data, as a target detection result.

[0117] From the above content, it can be seen that the server can use the data published by the object to be detected through different information publishing channels as each data to be detected, and perform detection to obtain the detection result of each data to be detected published by the object to be detected, and then obtain the detection result of whether the object to be detected has abnormal business behavior according to the detection result of each data to be detected published by the object to be detected, as the target detection result, specifically as follows Figure 3 shown.

[0118] Figure 3 A schematic diagram of the process of obtaining target detection results provided in this specification.

[0119] Combination Figure 3It can be seen that the server can input the detection results of each data to be detected and the portrait data of the object to be detected into a preset detection model, so that the detection model can obtain the detection result of whether the object to be detected has abnormal business behavior based on each detection result and portrait data, as the target detection result.

[0120] S106: Execute a detection task according to the target detection result.

[0121] Furthermore, if the server determines, based on the target detection result, that the object to be detected has abnormal business behavior, the server can determine, based on the target detection result, a strategy that matches the target detection result from the preset risk control strategies as the target risk control strategy, and perform business risk control on the object to be detected according to the target risk control strategy.

[0122] In actual application scenarios, the abnormal business behaviors of the object to be detected can be divided into many types, for example: participating in illegal business, promoting illegal business, etc. Based on this, the above-mentioned detection model can also determine the probability of the object to be detected having this abnormal business behavior according to each detection result and portrait data for each abnormal business behavior, and obtain the detection result of the abnormal business behavior of the object to be detected based on the probability of the object to be detected having this abnormal business behavior.

[0123] It should be noted that in actual scenarios, abnormal objects to be detected are often clustered, that is, abnormal objects to be detected often do not appear alone, but multiple abnormal objects to be detected form a group and jointly perform illegal business behaviors. For example, a certain illegal business behavior has multiple abnormal objects to be detected that jointly promote the illegal business behavior. Another example: multiple abnormal objects to be detected jointly participate in an illegal business behavior.

[0124] Therefore, there is often a strong correlation between multiple abnormal objects to be detected, for example: multiple abnormal objects to be detected are in the same network environment (such as: using the same wireless fidelity (Wireless Fidelity, wifi)), for example: multiple abnormal objects to be detected are bound to the same type of hardware devices, etc.

[0125] Based on this, the server can also obtain the historical detection results of the historical data to be detected corresponding to each object, determine the nodes of each type according to the historical detection results, and construct the subject relationship diagram according to the nodes of each type, as shown in the following figure: Figure 4 shown.

[0126] Figure 4 A schematic diagram of the subject relationship diagram provided in this specification.

[0127] Combination Figure 4It can be seen that in the subject relationship diagram, various types of nodes include: nodes for representing objects, nodes for representing historical data to be detected, nodes for representing the source of historical data to be detected (i.e., the information release channel for publishing historical data to be detected), nodes for representing abnormal types corresponding to historical detection results, and nodes for representing reporting events initiated by some objects to report the existence of illegal business behaviors of other objects. Among them, the edge between the node for representing the object and the node for representing the historical data to be detected is used to represent that the historical data to be detected corresponding to the node for representing the historical data to be detected connected by the edge is released by the object corresponding to the node for representing the object connected by the edge, and the edge between the node for representing the source of historical data to be detected and the node for representing the historical data to be detected is used to represent the node for representing the historical data to be detected connected by the edge. The historical data to be detected corresponding to the data node is released through the information release channel corresponding to the node connected by the edge for representing the source of the historical data to be detected. The edge between the node used to represent the abnormal type corresponding to the historical detection result and the node used to represent the historical data to be detected is used to characterize that the historical data to be detected corresponding to the node connected by the edge for representing the historical data to be detected is a violation of the abnormal type corresponding to the node connected by the edge for representing the abnormal type corresponding to the historical detection result. The edge between the node used to represent the reporting event initiated by some objects to report the existence of illegal business behaviors of other objects and the node used to represent the object is used to characterize that the object corresponding to the node connected by the edge is a related party of the reporting event corresponding to the node connected by the edge for representing the reporting event initiated by some objects to report the existence of illegal business behaviors of other objects.

[0128] Of course, the server can also determine the node that matches the object to be detected from the pre-constructed subject relationship diagram as the first target node corresponding to the object to be detected, and determine other nodes from the subject relationship diagram whose connection relationship with the first target node meets the preset conditions as the second target node, so that the detection task can be performed according to the first target node and the second target node. The above-mentioned preset conditions can be constructed in advance based on the correlation features between the portrait data of each object with abnormal business behavior detected historically, for example: the login address in the portrait data of the object corresponding to the two nodes used to represent the object is the same, etc., and another example: the hardware devices bound in the portrait data of the object corresponding to the two nodes used to represent the object are the same, etc.

[0129] For ease of understanding, the following combination Figure 5 , the method for determining the second target node mentioned above is described in detail.

[0130] Figure 5 A schematic diagram of the connection relationship provided in this specification.

[0131] Combination Figure 5 It can be seen that when object A is a related party of the reporting event corresponding to the node of the reporting event initiated by other objects to report illegal business behavior, and when it is determined that the data 1 released by object A is abnormal data, it can be determined that object B using the same wifi as object A may have abnormal business behavior. At this time, the node corresponding to object B in the subject relationship diagram can be used as the second target node.

[0132] Furthermore, the server may use the object corresponding to each second target node as the object to be detected, and detect the object to be detected corresponding to each second target node through the above method to obtain a detection result for the object to be detected corresponding to each second target node.

[0133] Furthermore, after obtaining the detection result of the object to be detected corresponding to each second target node, the server can perform business risk control on each second target node according to the detection result of the object to be detected corresponding to each second target node.

[0134] Of course, the server may also send the detection results of the first target node and the second target node to the target terminal device, where the target terminal device may be a terminal device used by law enforcement personnel.

[0135] From the above content, it can be seen that the server can directly detect the object to be detected by taking the ordinary accounts, official accounts, groups, mini-programs, merchant accounts, etc. used by the user on the business platform as the objects to be detected, and combining the multimedia data sent by the user in various forms in the business platform through the object to be detected for display to other users with the user's basic information, the device information used by the user, the user's social information in the business platform and other portrait data to detect whether the object to be detected is an object with abnormal behavior. Therefore, all business behaviors involved in the object to be detected can be detected based on the detection result of whether the object to be detected has abnormal behavior, and the situation where users adopt various different confrontational methods to evade detection due to only detecting the business behavior of the object to be detected can be avoided, thereby improving the accuracy of abnormal detection of business behaviors of the object to be detected.

[0136] In addition, the server can also determine other objects that have an association relationship with the object with abnormal business behavior based on the preset subject relationship diagram as new objects to be detected, and further detect them, thereby improving the accuracy of anomaly detection for the business behavior of the objects to be detected.

[0137] The above is a data detection method provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding data detection device, such as Figure 6shown.

[0138] Figure 6 A schematic diagram of a data detection device provided in this specification includes:

[0139] An acquisition module 601 is used to acquire each piece of data to be detected corresponding to the object to be detected and portrait data of the object to be detected, wherein each piece of data to be detected is multimedia data displayed to other users based on the object to be detected;

[0140] The detection module 602 is used to determine, for each data to be detected, a detection strategy that matches the data to be detected from various preset detection strategies, so as to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data;

[0141] The determination module 603 is used to input the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior according to the detection result and the portrait data, as a target detection result;

[0142] The execution module 604 is used to execute the detection task according to the target detection result.

[0143] Optionally, the detection module 602 is specifically used to, if the data type of the data to be detected is a video type, determine, from the preset detection strategies, a first detection strategy suitable for video type data detection as a detection strategy matching the data to be detected; according to the first detection strategy, intercept at least one frame of image data from the data to be detected as target image data; and detect the target image data to obtain a detection result of whether the data to be detected is abnormal data.

[0144] Optionally, the detection module 602 is specifically used to, if the data type of the data to be detected is a picture type, determine from the preset detection strategies a second detection strategy suitable for picture type data detection as a detection strategy matching the data to be detected; according to the second detection strategy, input the data to be detected into a preset picture recognition model, so that the picture recognition model determines from the preset abnormal labels an abnormal label matching the data to be detected as the abnormal label corresponding to the data to be detected, and different abnormal labels are used to characterize different illegal elements contained in the data to be detected; according to the abnormal label corresponding to the data to be detected, obtain a detection result of whether the data to be detected is abnormal data.

[0145] Optionally, the detection module 602 is specifically used to determine, according to the second detection strategy, whether there is sample image data matching the data to be detected among the sample image data contained in the preset designated sample library; if so, determine the first reference abnormality label corresponding to the data to be detected according to the abnormality label corresponding to the preset designated sample library; according to the second detection strategy, input the data to be detected into a preset image recognition model, so that the image recognition model determines the abnormality label matching the data to be detected from the preset abnormality labels as the second reference abnormality label; and determine the abnormality label corresponding to the data to be detected according to the first reference abnormality label and the second reference abnormality label.

[0146] Optionally, the detection module 602 is specifically used to extract specified detection data from the data to be detected, and the specified detection data includes: text data, image data corresponding to an image area containing a QR code; detect the specified detection data, and obtain a detection result of whether the data to be detected is abnormal data based on the detection result of the specified detection data and the abnormal label corresponding to the data to be detected.

[0147] Optionally, the detection module 602 is specifically used to, if the data type of the data to be detected is a text type, determine from the preset detection strategies a third detection strategy suitable for text type data detection as a detection strategy matching the data to be detected; according to the third detection strategy, perform at least one detection operation on the data to be detected, and for each detection operation, use the detection result of the data to be detected after the detection operation is performed on the data to be detected as the detection result corresponding to the detection operation, wherein different detection operations have different detection effects on the same illegal text; and determine whether the data to be detected is a detection result of abnormal data based on the detection result corresponding to each detection operation.

[0148] Optionally, the execution module 604 is specifically used to, if it is determined according to the target detection result that the object to be detected has abnormal business behavior, determine a node that matches the object to be detected from a pre-constructed subject relationship diagram as the first target node corresponding to the object to be detected; determine other nodes from the subject relationship diagram whose connection relationship with the first target node meets preset conditions as the second target node; and execute the detection task according to the first target node and the second target node.

[0149] Optionally, the device further comprises: a construction module 605;

[0150] The construction module 605 is specifically used to obtain historical detection results of historical data to be detected corresponding to each object; determine various types of nodes based on the historical detection results, and construct a subject relationship diagram based on the various types of nodes. In the subject relationship diagram, various types of nodes include: nodes for representing objects, nodes for representing historical data to be detected, nodes for representing sources of historical data to be detected, and nodes for representing abnormal types corresponding to historical detection results.

[0151] Optionally, the acquisition module 601 is specifically used to acquire various data released by the object to be detected through different information release channels as various data to be detected.

[0152] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A data detection method is provided.

[0153] This manual also provides Figure 7 The one shown corresponds to Figure 1 A schematic diagram of the electronic device. Figure 7 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0154] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0155] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0156] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0157] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0158] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0159] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0160] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0161] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0162] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0163] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0164] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0166] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0168] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0169] The above are only embodiments of this specification and are not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. A data detection method, comprising: Acquire each piece of data to be detected corresponding to the object to be detected and the portrait data of the object to be detected, wherein each piece of data to be detected is multimedia data displayed to other users based on the object to be detected; For each data to be detected, a detection strategy matching the data to be detected is determined from various preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data; Inputting the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior according to the detection result and the portrait data as a target detection result; Execute a detection task according to the target detection result.

2. The method according to claim 1, wherein a detection strategy matching the data to be detected is determined from the preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data, specifically comprising: If the data type of the data to be detected is a video type, then determining a first detection strategy applicable to video type data detection from various preset detection strategies as a detection strategy matching the data to be detected; According to the first detection strategy, intercepting at least one frame of image data from the data to be detected as target image data; The target image data is detected to obtain a detection result of whether the data to be detected is abnormal data.

3. The method according to claim 1, wherein a detection strategy matching the data to be detected is determined from the preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data, specifically comprising: If the data type of the data to be detected is a picture type, determining a second detection strategy applicable to picture type data detection from various preset detection strategies as a detection strategy matching the data to be detected; According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label matching the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, and different abnormal labels are used to represent different illegal elements contained in the data to be detected; According to the abnormal label corresponding to the data to be detected, a detection result of whether the data to be detected is abnormal data is obtained.

4. The method of claim 3, before inputting the data to be detected into a preset image recognition model according to the second detection strategy so that the image recognition model determines an abnormal label matching the data to be detected from preset abnormal labels as the abnormal label corresponding to the data to be detected, the method further comprises: According to the second detection strategy, determining whether there is sample image data matching the data to be detected among the sample image data included in the preset designated sample library; If yes, determining a first reference abnormal label corresponding to the data to be detected according to the preset abnormal label corresponding to the designated sample library; According to the second detection strategy, the data to be detected is input into a preset image recognition model so that the image recognition model determines an abnormal label matching the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, specifically including: According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as a second reference abnormal label; An abnormal label corresponding to the data to be detected is determined according to the first reference abnormal label and the second reference abnormal label.

5. The method according to claim 3, obtaining a detection result of whether the data to be detected is abnormal data according to the abnormal label corresponding to the data to be detected, specifically comprises: Extracting designated detection data from the data to be detected, wherein the designated detection data includes: text data and image data corresponding to the image area containing the QR code; The designated detection data is detected, and a detection result of whether the data to be detected is abnormal data is obtained according to the detection result of the designated detection data and the abnormal label corresponding to the data to be detected.

6. The method according to claim 1, wherein a detection strategy matching the data to be detected is determined from the preset detection strategies to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data, specifically comprising: If the data type of the data to be detected is a text type, then determining a third detection strategy suitable for text type data detection from various preset detection strategies as a detection strategy matching the data to be detected; According to the third detection strategy, at least one detection operation is performed on the data to be detected. For each detection operation, the detection result after the data to be detected is detected by the detection operation is used as the detection result corresponding to the detection operation, wherein different detection operations have different detection effects on the same illegal text; According to the detection result corresponding to each detection operation, it is determined whether the data to be detected is a detection result of abnormal data.

7. The method according to claim 1, performing a detection task according to the target detection result, specifically comprising: If it is determined according to the target detection result that the object to be detected has abnormal business behavior, a node matching the object to be detected is determined from the pre-constructed subject relationship diagram as the first target node corresponding to the object to be detected; Determine from the subject relationship graph other nodes whose connection relationship with the first target node meets a preset condition as second target nodes; A detection task is performed according to the first target node and the second target node.

8. The method according to claim 7, constructing a subject relationship diagram, specifically comprising: Obtain historical test results of historical data to be tested corresponding to each object; Based on the historical detection results, nodes of various types are determined, and based on the nodes of various types, a subject relationship diagram is constructed. In the subject relationship diagram, nodes of various types include: nodes for representing objects, nodes for representing historical data to be detected, nodes for representing sources of historical data to be detected, and nodes for representing abnormal types corresponding to historical detection results.

9. The method according to any one of claims 1 to 8, wherein obtaining each piece of data to be detected corresponding to the object to be detected comprises: The data released by the object to be detected through different information release channels are obtained as the data to be detected.

10. A data detection device, comprising: An acquisition module, used to acquire each piece of to-be-detected data corresponding to the to-be-detected object and portrait data of the to-be-detected object, wherein each piece of to-be-detected data is multimedia data displayed to other users based on the to-be-detected object; The detection module is used to determine, for each data to be detected, a detection strategy that matches the data to be detected from various preset detection strategies, so as to detect the data to be detected and obtain a detection result of whether the data to be detected is abnormal data; A determination module, used to input the detection result and the portrait data into a preset detection model, so that the detection model obtains a detection result of whether the object to be detected has abnormal business behavior according to the detection result and the portrait data, as a target detection result; An execution module is used to execute the detection task according to the target detection result.

11. The device according to claim 10, wherein the detection module is specifically configured to, if the data type of the data to be detected is a video type, determine a first detection strategy applicable to video type data detection from various preset detection strategies as a detection strategy matching the data to be detected; According to the first detection strategy, intercepting at least one frame of image data from the data to be detected as target image data; The target image data is detected to obtain a detection result of whether the data to be detected is abnormal data.

12. The device according to claim 10, wherein the detection module is specifically configured to, if the data type of the data to be detected is a picture type, determine a second detection strategy applicable to picture type data detection from various preset detection strategies as a detection strategy matching the data to be detected; According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as the abnormal label corresponding to the data to be detected, and different abnormal labels are used to characterize different illegal elements contained in the data to be detected; according to the abnormal label corresponding to the data to be detected, a detection result of whether the data to be detected is abnormal data is obtained.

13. The device according to claim 12, wherein the detection module is specifically used to determine whether there is sample image data matching the data to be detected among the sample image data contained in the preset designated sample library according to the second detection strategy; If yes, determining a first reference abnormal label corresponding to the data to be detected according to the preset abnormal label corresponding to the designated sample library; According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines an abnormal label that matches the data to be detected from the preset abnormal labels as a second reference abnormal label; An abnormal label corresponding to the data to be detected is determined according to the first reference abnormal label and the second reference abnormal label.

14. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 9.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 9 when executing the program.

Images