A data detection method and apparatus, an electronic device, and a storage medium

Abstract

The specification discloses a data detection method and device, electronic equipment and storage medium, which can combine multimedia data sent by a user in various different forms through a to-be-detected object in a business platform for display to other users and portrait data of the user, such as basic information of the user, device information used by the user, and social information of the user in the business platform, directly detect the to-be-detected object, detect whether the to-be-detected object is an object with abnormal behavior, detect all business behaviors related to the to-be-detected object according to the detection result of whether the to-be-detected object has abnormal behavior, and avoid the situation that the user adopts various different countermeasures to evade detection due to detection of only the business behaviors of the to-be-detected object, thereby improving the accuracy of abnormal detection of the business behaviors of the to-be-detected object.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of data processing, and in particular, to a data detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] At present, in order to protect the account security of the account used by the user (such as: protecting the security of personal privacy data, protecting the security of account funds, etc.), each business platform can usually use a machine learning model to identify the content of the to-be-detected data, so as to obtain a detection result for indicating whether the to-be-detected data exists, such as: content induction, illegal content promotion, involvement in abnormal profit activities, etc., and then according to the detection result, the risk control can be performed on the account used by the user.

[0003] However, there are some users who constantly transform the to-be-detected data in various forms, thereby constantly evading the existing detection technology, and thus the existing detection method has poor effect on detecting abnormal data. For example, when the picture data corresponding to the avatar of the account used by the user is taken as the to-be-detected picture data, the user can rewrite the text for illegal content promotion contained in the to-be-detected picture data in handwriting on paper, and then take the photo containing the handwritten text for illegal content promotion as the avatar again by using the mobile phone, thereby evading detection. For another example, the similar characters and homophonic characters can be used to replace part of the content of the text for illegal content promotion, thereby evading detection, etc.

[0004] Therefore, how to improve the accuracy of abnormal detection on the to-be-detected data is a problem to be solved. SUMMARY

[0005] The present specification provides a data detection method, device, electronic equipment and storage medium to solve the problem of low detection efficiency in the prior art.

[0006] The present specification adopts the following technical solutions:

[0007] The present specification provides a data detection method, comprising:

[0008] Obtaining each to-be-detected data corresponding to a to-be-detected object and portrait data of the to-be-detected object, wherein the to-be-detected data is multimedia data displayed to other users based on the to-be-detected object;

[0009] For each to-be-detected data, a detection strategy matched with the to-be-detected data is determined from a plurality of preset detection strategies, so as to detect the to-be-detected data and obtain a detection result of whether the to-be-detected data is abnormal data;

[0010] inputting the detection result and the image data into a preset detection model, so that the detection model obtains a detection result of whether the to-be-detected object has an abnormal service behavior according to the detection result and the image data, as a target detection result;

[0011] performing a detection task according to the target detection result.

[0012] Optionally, a detection strategy matched with the to-be-detected data is determined from preset detection strategies, so as to detect the to-be-detected data and obtain a detection result of whether the to-be-detected data is abnormal data, and the detection result specifically includes:

[0013] If the data type of the to-be-detected data is a video type, a first detection strategy suitable for video type data detection is determined from preset detection strategies as the detection strategy matched with the to-be-detected data;

[0014] According to the first detection strategy, at least one frame of picture data is intercepted from the to-be-detected data as target picture data;

[0015] The target picture data is detected to obtain the detection result of whether the to-be-detected data is abnormal data.

[0016] Optionally, a detection strategy matched with the to-be-detected data is determined from preset detection strategies, so as to detect the to-be-detected data and obtain a detection result of whether the to-be-detected data is abnormal data, and the detection result specifically includes:

[0017] If the data type of the to-be-detected data is a picture type, a second detection strategy suitable for picture type data detection is determined from preset detection strategies as the detection strategy matched with the to-be-detected data;

[0018] According to the second detection strategy, the to-be-detected data is input into a preset picture recognition model, so that the picture recognition model determines an abnormal label matched with the to-be-detected data from preset abnormal labels as an abnormal label corresponding to the to-be-detected data, and different abnormal labels are used to represent different violation elements contained in the to-be-detected data;

[0019] According to the abnormal label corresponding to the to-be-detected data, the detection result of whether the to-be-detected data is abnormal data is obtained.

[0020] Optionally, before the to-be-detected data is input into the preset picture recognition model according to the second detection strategy, so that the picture recognition model determines the abnormal label matched with the to-be-detected data from the preset abnormal labels as the abnormal label corresponding to the to-be-detected data, the method further includes:

[0021] According to the second detection strategy, it is judged whether there is sample picture data matching the to-be-detected data in each sample picture data contained in a preset specified sample library;

[0022] If yes, a first reference abnormal label corresponding to the to-be-detected data is determined according to a preset abnormal label corresponding to the specified sample library;

[0023] According to the second detection strategy, the to-be-detected data is input into a preset picture recognition model, so that the picture recognition model determines an abnormal label matching the to-be-detected data from preset abnormal labels as an abnormal label corresponding to the to-be-detected data, and the abnormal label corresponding to the to-be-detected data is determined according to the first reference abnormal label and the second reference abnormal label.

[0024] According to the second detection strategy, the to-be-detected data is input into a preset picture recognition model, so that the picture recognition model determines an abnormal label matching the to-be-detected data from preset abnormal labels as an abnormal label corresponding to the to-be-detected data, and the abnormal label corresponding to the to-be-detected data is determined according to the first reference abnormal label and the second reference abnormal label.

[0025] According to the first reference abnormal label and the second reference abnormal label, the abnormal label corresponding to the to-be-detected data is determined.

[0026] Optionally, according to the abnormal label corresponding to the to-be-detected data, a detection result of whether the to-be-detected data is abnormal data is obtained, and the detection result of whether the to-be-detected data is abnormal data is obtained according to the detection result of detecting the specified detection data and the abnormal label corresponding to the to-be-detected data.

[0027] The specified detection data is extracted from the to-be-detected data, and the specified detection data includes text data and picture data corresponding to a picture area containing a two-dimensional code.

[0028] The specified detection data is detected, and a detection result of whether the to-be-detected data is abnormal data is obtained according to the detection result of detecting the specified detection data and the abnormal label corresponding to the to-be-detected data.

[0029] Optionally, a detection strategy matching the to-be-detected data is determined from preset detection strategies to detect the to-be-detected data, and a detection result of whether the to-be-detected data is abnormal data is obtained.

[0030] If the data type of the to-be-detected data is a text type, a third detection strategy suitable for text type data detection is determined as the detection strategy matching the to-be-detected data from the preset detection strategies.

[0031] According to the third detection strategy, at least one detection operation is performed on the to-be-detected data, and for each detection operation, a detection result obtained by detecting the to-be-detected data through the detection operation is taken as a detection result corresponding to the detection operation, wherein different detection operations have different detection effects on the same rule text.

[0032] Based on the detection results corresponding to each detection operation, determine whether the data to be detected is abnormal data.

[0033] Optionally, based on the target detection result, a detection task is performed, specifically including:

[0034] If, based on the target detection results, it is determined that the object to be detected has abnormal business behavior, then a node matching the object to be detected is determined from the pre-constructed subject relationship graph and used as the first target node corresponding to the object to be detected.

[0035] Other nodes whose connection relationships with the first target node satisfy preset conditions are identified from the subject relationship diagram and designated as second target nodes;

[0036] Execute the detection task based on the first target node and the second target node.

[0037] Optionally, construct a subject relationship diagram, specifically including:

[0038] Obtain the historical detection results of the historical data to be detected for each object;

[0039] Based on the historical detection results, nodes of various types are identified, and a subject relationship graph is constructed based on the nodes of various types. In the subject relationship graph, the nodes of various types include: nodes representing objects, nodes representing historical data to be detected, nodes representing the source of historical data to be detected, and nodes representing the anomaly type corresponding to the historical detection results.

[0040] Optionally, obtain the detection data corresponding to the object to be detected, specifically including:

[0041] The data published by the object to be detected through different information publishing channels are obtained as the data to be detected.

[0042] This specification provides a data detection device, including:

[0043] The acquisition module is used to acquire each piece of data to be detected corresponding to the object to be detected and the profile data of the object to be detected. The piece of data to be detected is multimedia data displayed to other users based on the object to be detected.

[0044] The detection module is used to determine the detection strategy that matches the data to be detected from the preset detection strategies for each data to be detected, so as to detect the data to be detected and obtain the detection result of whether the data to be detected is abnormal data.

[0045] determining a detection result of whether the to-be-detected object has an abnormal service behavior according to the detection result and the image data, as a target detection result;

[0046] performing a detection task according to the target detection result.

[0047] Optionally, the detection module is specifically configured to, if the data type of the to-be-detected data is a video type, determine a first detection strategy suitable for video type data detection from the preset detection strategies as the detection strategy matched with the to-be-detected data.

[0048] According to the first detection strategy, at least one frame of picture data is intercepted from the to-be-detected data as target picture data.

[0049] The target picture data is detected to obtain a detection result of whether the to-be-detected data is abnormal data.

[0050] Optionally, the detection module is specifically configured to, if the data type of the to-be-detected data is a picture type, determine a second detection strategy suitable for picture type data detection from the preset detection strategies as the detection strategy matched with the to-be-detected data.

[0051] According to the second detection strategy, the to-be-detected data is input into a preset picture recognition model, so that the picture recognition model determines an abnormal label matched with the to-be-detected data from the preset abnormal labels as an abnormal label corresponding to the to-be-detected data, different abnormal labels are used to represent different violation elements contained in the to-be-detected data, and a detection result of whether the to-be-detected data is abnormal data is obtained according to the abnormal label corresponding to the to-be-detected data.

[0052] Optionally, the detection module is specifically configured to, according to the second detection strategy, judge whether there is sample picture data matched with the to-be-detected data in each sample picture data contained in a preset specified sample library.

[0053] If yes, a first reference abnormal label corresponding to the to-be-detected data is determined according to a preset abnormal label corresponding to the specified sample library.

[0054] According to the second detection strategy, the to-be-detected data is input into a preset picture recognition model, so that the picture recognition model determines an abnormal label matched with the to-be-detected data from the preset abnormal labels as a second reference abnormal label.

[0055] According to the first reference abnormal label and the second reference abnormal label, a determination is made on an abnormal label corresponding to the to-be-detected data.

[0056] The present specification provides a computer-readable storage medium, which stores a computer program, and the computer program, when executed by a processor, implements the above-mentioned data detection method.

[0057] The present specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned data detection method when executing the program.

[0058] The above-mentioned at least one technical solution adopted by the present specification can achieve the following beneficial effects:

[0059] In the data detection method provided by the present specification, first, each to-be-detected data corresponding to a to-be-detected object and portrait data of the to-be-detected object are obtained, each to-be-detected data is multimedia data exhibited to other users based on the to-be-detected object, for each to-be-detected data, a detection strategy matched with the to-be-detected data is determined from preset detection strategies, so as to detect the to-be-detected data and obtain a detection result of whether the to-be-detected data is abnormal data, the detection result and the portrait data are input into a preset detection model, so that the detection model obtains a detection result of whether the to-be-detected object has an abnormal business behavior according to the detection result and the portrait data, as a target detection result, and a detection task is executed according to the target detection result.

[0060] As can be seen from the above method, the ordinary account, public account, group, applet, merchant account, etc. used by a user on a business platform can be taken as a to-be-detected object, and the multimedia data sent by the user in various forms on the business platform for exhibition to other users and the portrait data of the user, such as basic information of the user, device information used by the user, and social information of the user on the business platform, are combined to directly detect the to-be-detected object, so as to detect whether the to-be-detected object has an abnormal behavior, thereby the detection result of whether the to-be-detected object has an abnormal behavior can be used to detect all business behaviors related to the to-be-detected object, and the situation that the user uses various different countermeasures to evade detection can be avoided due to detection only on the business behaviors of the to-be-detected object, and thus the accuracy of abnormal detection on the business behaviors of the to-be-detected object can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0061] The accompanying drawings, which are included to provide a further understanding of the present specification, constitute a part of the present specification, and the illustrative embodiments of the present specification and their descriptions serve to explain the present specification, and do not constitute improper limitations on the present specification. In the drawings:

[0062] In the figure:

[0063] Figure 1 is a schematic flowchart of a data detection method provided in this specification;

[0064] Figure 2 is a schematic diagram of the process of detecting the data to be detected provided in this specification;

[0065] Figure 3 is a schematic diagram of the process of obtaining the target detection result provided in this specification;

[0066] Figure 4 is a schematic diagram of the subject relationship diagram provided in this specification;

[0067] Figure 5 is a schematic diagram of the connection relationship provided in this specification;

[0068] Figure 6 is a schematic diagram of a data detection device provided in this specification;

[0069] Figure 7 is provided in this specification corresponding to Figure 1 schematic diagram of the electronic device. Detailed Description of the Preferred Embodiments

[0070] To make the objectives, technical solutions and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with the specific embodiments of this specification and the corresponding drawings. Apparently, the described embodiments are only a part of the embodiments of this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this specification.

[0071] The technical solutions provided in each embodiment of this specification will be described in detail below with reference to the drawings.

[0072] In the business risk control scenario, there are some risk users who, in order to avoid the anomaly detection methods set by the business platform, usually can make different forms of variants of the illegal content. For example, change "website" to "網", and for another example, change "com" to etc.

[0073] In addition, risk users can also display the illegal content to other users through a variety of different channels. For example, display the illegal content to other users through the avatar, nickname, etc. of the account used on the business platform. For another example, display the illegal content to other users through the note information under the transfer function provided by the business platform, etc.

[0074] Therefore, effectively detecting different forms of violation content exhibited by a risk user to other users through different channels is particularly important for protecting the security of accounts used by other users of the business platform.

[0075] Figure 1 For a flowchart of a data detection method provided in the present specification, the following steps are included:

[0076] S100: Obtain each to-be-detected data corresponding to a to-be-detected object and portrait data of the to-be-detected object, wherein each to-be-detected data is multimedia data exhibited by the to-be-detected object to other users.

[0077] In the present specification, a business platform can obtain multimedia data exhibited by a user to other users based on a to-be-detected object as each to-be-detected data corresponding to the to-be-detected object, so that each to-be-detected data corresponding to the to-be-detected object can be detected to obtain a detection result of whether each to-be-detected data corresponding to the to-be-detected object is abnormal data, and then the detection result of whether each to-be-detected data corresponding to the to-be-detected object is abnormal data and the portrait data of the to-be-detected object can be combined to detect the to-be-detected object, so as to determine whether the to-be-detected object has an abnormal business behavior, and the business behavior of the to-be-detected object and the business behavior of other objects associated with the to-be-detected object can be detected according to the detection result of whether the to-be-detected object has an abnormal business behavior.

[0078] In the above content, the to-be-detected object can be selected from each object by the business platform. Specifically, the business platform can randomly sample each object every specified time period to extract at least part of the objects from each object as the to-be-detected object. Of course, when the business platform receives violation information uploaded by a user through an account used by the user to prove that other users have violated rules, the business platform can take the object corresponding to the other user in the business platform as the to-be-detected object.

[0079] In the above content, the object can be different subjects registered and used by the user in the business platform, such as an account, a merchant, a group, an applet, a life number, etc.

[0080] In the foregoing, the to-be-detected data can be various data published by the to-be-detected object in different information publishing manners, for example, picture data used as a head portrait of the to-be-detected object published by the head portrait function provided by the business platform for the account used by the user, user remark data published by the personal information remark function provided by the business platform for the account used by the user and used for display to other users, instant messaging information sent by the instant messaging function provided by the business platform for the user, transfer remark data sent by the remark function in the transfer service initiated by the to-be-detected object, and the like.

[0081] In the foregoing, the portrait data of the to-be-detected object can be a collection of feature data of the to-be-detected object in the business platform, and the portrait data can include: basic data (for example, name, registration time, remark information, login location, and the like) of the to-be-detected object, hardware device data (for example, device model, device operating system, device access frequency, and the like) bound by the to-be-detected object, historical violation records (for example, complaint records, business platform violation detection records, and the like) of the to-be-detected object, historical punishment records (for example, limitation of part of rights, and the like) of the to-be-detected object, transfer records of the to-be-detected object, social relationship data (for example, social network structure, interaction behavior records between the to-be-detected object and other objects) of the to-be-detected object, and the like.

[0082] In the present specification, the execution subject for implementing the data detection method can be a specified device such as a server arranged in the business platform, or a terminal device such as a desktop computer or a notebook computer. For ease of description, the server is taken as an example of the execution subject, and the data detection method provided in the present specification is described below.

[0083] S102: For each to-be-detected data, a detection strategy matched with the to-be-detected data is determined from the preset detection strategies, so as to detect the to-be-detected data and obtain a detection result of whether the to-be-detected data is abnormal data.

[0084] As can be seen from the foregoing, the to-be-detected data corresponding to the to-be-detected object obtained by the server can be multimedia data in different forms, and the multimedia data can contain violation content transformed by different forms (for example, similar character replacement, similar word replacement, and handwriting replacement). Therefore, after obtaining the to-be-detected data, the server can determine, according to a data type of each to-be-detected data, a detection strategy matched with each to-be-detected data from the preset detection strategies, so as to detect each to-be-detected data and obtain a detection result of whether each to-be-detected data is abnormal data, where the data type includes a video type, a picture type, and a text type. Figure 2The method for detecting each type of data to be detected is described in detail.

[0085] Figure 2 The schematic diagram of the process for detecting the data to be detected is provided in the specification.

[0086] In combination Figure 2 As can be seen, if the data type of the data to be detected is a video type, the server can determine a first detection strategy suitable for video type data detection as a detection strategy matched with the data to be detected from the preset detection strategies, and according to the first detection strategy, at least one frame of picture data is extracted from the data to be detected as target picture data, so as to detect the target picture data to obtain the detection result of whether the data to be detected is abnormal data.

[0087] The extraction method of the server for extracting picture data from the data to be detected can be set according to actual needs, for example, a preset neural network model is used to extract a key frame from the data to be detected as the extracted picture data. For another example, at least part of the frames are uniformly extracted from the data to be detected at a fixed interval or a fixed frame rate as the extracted picture data, etc.

[0088] If the data type of the data to be detected is a picture type, the server can determine a second detection strategy suitable for picture type data detection as a detection strategy matched with the data to be detected from the preset detection strategies, so that the data to be detected can be input into a preset picture recognition model according to the second detection strategy, so that the picture recognition model determines an abnormal label matched with the data to be detected as an abnormal label corresponding to the data to be detected from the preset abnormal labels, different abnormal labels are used to represent different illegal elements contained in the data to be detected, and the detection result of whether the data to be detected is abnormal data is obtained according to the abnormal label corresponding to the data to be detected.

[0089] The abnormal label can be a label corresponding to a risk abnormality involved in the historical detection data to be detected, for example, an abnormal label containing an abnormal picture element (i.e., when the data to be detected contains picture elements corresponding to gambling or other illegal content, it can be considered that the data to be detected contains an abnormal label corresponding to an abnormal picture element). For another example, an abnormal label containing inducible text content (i.e., when the data to be detected contains illegal text content such as "add me v, make big money", it can be considered that the data to be detected contains an abnormal label corresponding to inducible text content).

[0090] In actual application scenarios, there are also some picture elements that are difficult to identify or prone to identification errors, for example: the picture element corresponding to the tofu block is easily identified as the picture element corresponding to mahjong. At this time, the server can construct a specified sample library for the above-mentioned difficult-to-identify picture elements, for example: save the picture data that does not contain abnormal picture elements but is easily identified as containing abnormal picture elements to the above-mentioned specified sample library. For another example: save the picture data containing abnormal picture elements but easily identified as not containing abnormal picture elements to the above-mentioned specified sample library.

[0091] It should be noted that the server can construct one of the above-mentioned two specified sample libraries according to actual needs. Of course, the server can also construct the above-mentioned two different specified sample libraries at the same time as the first specified sample library and the second specified sample library, and determine the abnormal label corresponding to each specified sample library, for example: the first specified sample library formed by each picture data that does not contain abnormal picture elements but is easily identified as containing abnormal picture elements can be set as the white label, and the second specified sample library formed by the picture data containing abnormal picture elements but easily identified as not containing abnormal picture elements can be set as the abnormal label corresponding to the illegal content involved in the picture data contained in the second specified sample library.

[0092] It should be noted that the above-mentioned second specified sample library can be multiple, wherein different second specified sample libraries are used to save picture data related to different illegal content, in other words, picture data related to a kind of illegal content can be uniformly saved in a second specified sample library, and the abnormal label corresponding to the second sample library is set as the abnormal label corresponding to the illegal content.

[0093] Further, when it is necessary to detect the to-be-detected data, the server can determine whether there is sample picture data matching the to-be-detected data in each sample picture data contained in the preset specified sample library according to the second detection strategy. If yes, the first reference abnormal label corresponding to the to-be-detected data is determined according to the abnormal label corresponding to the preset specified sample library, so that the to-be-detected data can be input into the preset picture recognition model according to the second detection strategy, so that the picture recognition model determines the abnormal label matching the to-be-detected data from the preset abnormal labels as the second reference abnormal label, and then the abnormal label corresponding to the to-be-detected data can be determined according to the first reference abnormal label and the second reference abnormal label.

[0094] In the above, if the preset designated sample library contains sample picture data that has a similarity to the to-be-detected data exceeding a preset threshold, the sample picture data can be used as sample picture data matching the to-be-detected data.

[0095] In the above, if the first reference abnormal label and the second reference abnormal label are inconsistent, the server can use the first reference abnormal label as the determined abnormal label corresponding to the to-be-detected data.

[0096] Of course, if the first reference abnormal label and the second reference abnormal label are inconsistent, the server can also send the first reference abnormal label, the second reference abnormal label, and the to-be-detected data to the designated terminal device, so that a user using the designated terminal device determines the abnormal label corresponding to the to-be-detected data according to the first reference abnormal label and the second reference abnormal label and returns.

[0097] In addition, since the to-be-detected data of the picture type can also contain, for example, a picture two-dimensional code for accessing illegal content, text data containing illegal content, and the like, in order to further improve the accuracy of detecting the to-be-detected data of the picture type, the server can also extract designated detection data from the to-be-detected data, and then detect the designated detection data, and obtain the detection result of whether the to-be-detected data is abnormal data according to the detection result of detecting the designated detection data and the abnormal label corresponding to the to-be-detected data, wherein the designated detection data can include text data and picture data corresponding to a picture area containing a two-dimensional code.

[0098] It should be noted that when the data type of the to-be-detected data is a video type, the server detects the target picture data to obtain the detection result of whether the to-be-detected data is abnormal data. The method for detecting the target picture data by the server can be set according to actual needs, for example, comparing the target picture data with preset abnormal picture data to determine whether there is abnormal picture data matching the target picture data in the preset abnormal picture data. If so, the server can determine the detection result of whether the to-be-detected data is abnormal data according to the detection result corresponding to the abnormal picture data matching the target picture data.

[0099] Of course, the server can also detect the target picture data according to the second detection strategy to obtain the detection result of the target picture data, so as to obtain the detection result of whether the to-be-detected data is abnormal data.

[0100] If the data type of the to-be-detected data is a text type, the server can determine a third detection strategy suitable for text type data detection from the preset detection strategies as a detection strategy matched with the to-be-detected data, so that the third detection strategy can be used to perform at least one detection operation on the to-be-detected data. For each detection operation, the detection result of the to-be-detected data detected by the detection operation is taken as the detection result corresponding to the detection operation. Then, the detection result of whether the to-be-detected data is abnormal data can be determined according to the detection result corresponding to each detection operation. Different detection operations have different detection effects on the same rule-breaking text.

[0101] In the above, the detection operation can include keyword library matching detection, text recognition model detection, variant confrontation detection, promotion and drainage model detection, link detection, etc. Each detection operation will be described in detail below.

[0102] When the keyword matching detection is performed on the to-be-detected data, the server can determine whether there is a keyword matched with the to-be-detected data in each keyword contained in the preset keyword library. If yes, the detection result corresponding to the detection operation can be determined according to the abnormal label corresponding to the keyword matched with the to-be-detected data. The keyword mentioned above can be a word prone to recognition errors and saved in the keyword library in advance.

[0103] When the text recognition model detection is performed on the to-be-detected data, the server can input the to-be-detected data into the preset text recognition model, so that the text recognition model determines an abnormal label matched with the to-be-detected data from the preset abnormal labels as the abnormal label corresponding to the to-be-detected data. Then, the detection result of whether the to-be-detected data is abnormal data can be obtained according to the abnormal label corresponding to the to-be-detected data.

[0104] When the variant confrontation detection is performed on the to-be-detected data, the server can determine the text basic feature of the to-be-detected data according to the number of various types of characters contained in the to-be-detected data. The types of characters include Chinese characters, English, numbers, etc. The server can input the number of various types of characters contained in the to-be-detected data into the preset feature extraction model, so that the feature extraction model determines the text basic feature of the to-be-detected data according to the proportion of the number of various types of characters contained in the to-be-detected data. Then, the detection result corresponding to the to-be-detected data can be determined according to the text basic feature of the to-be-detected data.

[0105] Further, the server can also input the to-be-detected data into a preset deformation identification model, so that the deformation identification model identifies the to-be-detected data, to determine a detection result of whether the to-be-detected data contains a phonetic variant word or a morphological variant word corresponding to the illegal content.

[0106] In addition, the server can also input the to-be-detected data into a preset deformation detection model, so that the deformation detection model performs semantic analysis on the to-be-detected data, to determine a detection result of whether the to-be-detected data contains deformation content.

[0107] Further, the server can fuse the detection result of whether the to-be-detected data contains the phonetic variant word or the morphological variant word corresponding to the illegal content, the detection result of whether the to-be-detected data contains the deformation content, and the detection result of whether the to-be-detected data corresponds to the abnormal data, to obtain a fused detection result as a detection result of the variant adversarial detection on the to-be-detected data.

[0108] When the to-be-detected data is detected by the promotion and flow model, the server can input the to-be-detected data into a preset promotion and flow detection model, so that the promotion and flow detection model detects the to-be-detected data to obtain a detection result of whether the to-be-detected data contains promotion and flow content.

[0109] When the to-be-detected data is detected by the link, the server can extract text data corresponding to the link from the to-be-detected data, and then can determine whether an abnormal link matching the text data corresponding to the link exists in a preset abnormal link library. If yes, a detection result of whether the to-be-detected data contains illegal links can be obtained according to an abnormal label of the abnormal link matching the text data corresponding to the link.

[0110] If no, the server can input the text data corresponding to the link into a preset link detection model, so that the link detection model detects the text data corresponding to the link to obtain a detection result of whether the text data corresponding to the link is abnormal. In addition, the server can obtain the webpage content opened after accessing the link, and obtain a detection result of whether the text data corresponding to the link is abnormal according to the webpage content opened after accessing the link. In addition, if the text data corresponding to the link is abnormal, the server can also save the text data corresponding to the link into the abnormal link library.

[0111] It should be noted that in the above content, the server can determine the detection result of whether the to-be-detected data is abnormal data according to the detection result of each detection operation.

[0112] For example, the detection result corresponding to each detection operation is input into the preset attention model, so that the attention model determines the attention weight corresponding to the detection result corresponding to each detection operation, and determines whether the to-be-detected data is abnormal data according to the attention weight corresponding to the detection result corresponding to each detection operation.

[0113] For example, for the detection result corresponding to each detection operation, the number of other detection operations whose corresponding detection result is consistent with the detection result corresponding to the detection operation is taken as the confidence of the detection result corresponding to the detection operation, and then the confidence of the detection data corresponding to each detection operation can be used to determine the detection result of whether the to-be-detected data is abnormal data.

[0114] It is worth noting that when the data type of the to-be-detected data is a picture type, and the server needs to detect the specified detection data contained in the to-be-detected data, the server can compare the target picture data with the preset abnormal specified detection data to determine whether there is abnormal specified detection data matching the specified detection data in the preset abnormal specified detection data. If yes, the server can determine whether the to-be-detected data is abnormal data according to the detection result corresponding to the abnormal specified detection data matching the specified detection data.

[0115] Of course, if the specified detection data is text data, the server can also detect the specified detection data according to the third detection strategy described above to obtain the detection result of the specified detection data, so as to obtain the detection result of whether the to-be-detected data is abnormal data.

[0116] S104: input the detection result and the portrait data into the preset detection model, so that the detection model obtains the detection result of whether the to-be-detected object has abnormal business behavior according to the detection result and the portrait data, as the target detection result.

[0117] From the above content, it can be seen that the server can take each data published by the to-be-detected object through different information publishing channels as each to-be-detected data, and detect to obtain the detection result of each to-be-detected data published by the to-be-detected object. Then, the detection result of whether the to-be-detected object has abnormal business behavior can be obtained according to the detection result of each to-be-detected data published by the to-be-detected object, as the target detection result, as shown in Figure 3

[0118] Figure 3 The schematic diagram of the target detection result provided in the present specification.

[0119] In combination with Figure 3 ​It can be seen that the server can input the detection result of each to-be-detected data and the portrait data of the to-be-detected object into the preset detection model, so that the detection model obtains, according to each detection result and the portrait data, a detection result of whether the to-be-detected object has an abnormal business behavior as a target detection result.

[0120] S106: Perform a detection task according to the target detection result.

[0121] Further, if the server determines, according to the target detection result, that the to-be-detected object has an abnormal business behavior, the server can determine, according to the target detection result, a strategy matching the target detection result from the preset risk control strategy as a target risk control strategy, and perform business risk control on the to-be-detected object according to the target risk control strategy.

[0122] In actual application scenarios, the abnormal business behavior of the to-be-detected object can be divided into multiple types, for example, participating in illegal business, promoting illegal business, and the like. Based on this, the detection model described above can determine, for each type of abnormal business behavior, a probability that the to-be-detected object has the type of abnormal business behavior according to each detection result and the portrait data, and obtain a detection result of the type of abnormal business behavior that the to-be-detected object has according to the probability that the to-be-detected object has the type of abnormal business behavior.

[0123] It should be noted that in actual scenarios, to-be-detected objects with abnormalities are often gathered, that is, to-be-detected objects with abnormalities are not single but multiple to-be-detected objects with abnormalities form a group and jointly perform illegal business behaviors, for example, multiple to-be-detected objects with abnormalities jointly promote a certain illegal business behavior. For another example, multiple to-be-detected objects with abnormalities jointly participate in an illegal business behavior.

[0124] Therefore, multiple to-be-detected objects with abnormalities often have strong correlations, for example, multiple to-be-detected objects with abnormalities are in the same network environment (such as using the same wireless fidelity (wifi)), and for another example, the types of hardware devices bound by multiple to-be-detected objects with abnormalities are the same.

[0125] Based on this, the server can further obtain historical detection results of historical to-be-detected data corresponding to each object, determine each type of node according to the historical detection results, and construct a subject relationship graph according to each type of node, as shown in Figure 4 .

[0126] Figure 4 A schematic diagram of a subject relationship graph provided in the present specification.

[0127] In combination with Figure 4It can be seen that in the subject relationship graph, the types of nodes include: nodes for representing objects, nodes for representing historical data to be detected, nodes for representing sources of historical data to be detected (i.e., information publishing channels publishing historical data to be detected), nodes for representing abnormal types corresponding to historical detection results, and nodes for representing reporting events initiated by some objects to report that other objects have illegal business behaviors, wherein edges between nodes for representing objects and nodes for representing historical data to be detected are used to represent that historical data to be detected corresponding to the nodes for representing historical data to be detected connected by the edges are published by objects corresponding to the nodes for representing objects connected by the edges, edges between nodes for representing sources of historical data to be detected and nodes for representing historical data to be detected are used to represent that historical data to be detected corresponding to the nodes for representing historical data to be detected connected by the edges are published through information publishing channels corresponding to the nodes for representing sources of historical data to be detected connected by the edges, edges between nodes for representing abnormal types corresponding to historical detection results and nodes for representing historical data to be detected are used to represent that historical data to be detected corresponding to the nodes for representing historical data to be detected connected by the edges are illegal behaviors involving abnormal types corresponding to the nodes for representing abnormal types corresponding to historical detection results connected by the edges, and edges between nodes for representing reporting events initiated by some objects to report that other objects have illegal business behaviors and nodes for representing objects are used to represent that objects corresponding to the nodes for representing objects connected by the edges are related persons of reporting events corresponding to the nodes for representing reporting events initiated by some objects to report that other objects have illegal business behaviors connected by the edges.

[0128] Of course, the server can also determine a node matching the object to be detected from the pre-constructed subject relationship graph as a first target node corresponding to the object to be detected, and determine other nodes from the subject relationship graph that have a connection relationship with the first target node satisfying a preset condition as second target nodes, so that the detection task can be performed according to the first target node and the second target nodes. The above-mentioned preset condition can be constructed in advance according to the association features between the portrait data of the objects with abnormal business behaviors detected historically, for example: the login locations in the portrait data of the objects corresponding to two nodes for representing objects are the same, and for another example: the hardware devices bound in the portrait data of the objects corresponding to two nodes for representing objects are the same.

[0129] For ease of understanding, the following will be combined with Figure 5 The determination method of the above-mentioned second target node will be described in detail.

[0130] Figure 5 The schematic diagram of the connection relationship provided in the present description.

[0131] In combination withFigure 5 As can be seen, when the object A is a node corresponding to a reporter of a report event of a violation of business behavior initiated by other objects, and it is determined that the data 1 published by the object A is abnormal data, it can be determined that the object B using the same wifi as the object A is likely to have abnormal business behavior. At this time, the node corresponding to the object B in the subject relationship graph can be taken as a second target node.

[0132] Further, the server can take the object corresponding to each second target node as a to-be-detected object, and detect each to-be-detected object corresponding to each second target node by the above method to obtain a detection result for each to-be-detected object corresponding to each second target node.

[0133] Further, the server can perform business risk control on each second target node according to the detection result for each to-be-detected object corresponding to each second target node.

[0134] Of course, the server can also send the detection results of the first target node and the second target node to a target terminal device. The target terminal device can be a terminal device used by law enforcement personnel.

[0135] As can be seen from the above, the server can directly detect the to-be-detected object by combining the ordinary account, public account, group, applet, and merchant account used by the user in the business platform as the to-be-detected object, and the multimedia data sent by the user in various forms in the business platform for showing to other users, and the portrait data of the user's basic information, device information used by the user, and social information of the user in the business platform, to detect whether the to-be-detected object is an object with abnormal behavior, so as to detect all business behaviors involved in the to-be-detected object according to the detection result of whether the to-be-detected object has abnormal behavior, and avoid the situation that the user uses various different countermeasures to evade detection by only detecting the business behavior of the to-be-detected object, thereby improving the accuracy of abnormal detection of the business behavior of the to-be-detected object.

[0136] In addition, the server can also determine other objects having an association relationship with the object with abnormal business behavior as new to-be-detected objects according to the preset subject relationship graph, and further detect them, thereby improving the accuracy of abnormal detection of the business behavior of the to-be-detected object.

[0137] The above is a data detection method provided by one or more embodiments of the present specification. Based on the same idea, the present specification also provides a corresponding data detection device, such as Figure 6as shown.

[0138] Figure 6 A schematic diagram of a data detection device is provided in the present specification, comprising:

[0139] The acquisition module 601 is configured to acquire each to-be-detected data corresponding to a to-be-detected object and portrait data of the to-be-detected object, wherein each to-be-detected data is multimedia data exhibited to other users based on the to-be-detected object;

[0140] The detection module 602 is configured to determine, for each to-be-detected data, a detection strategy matched with the to-be-detected data from preset detection strategies, to detect the to-be-detected data, and obtain a detection result of whether the to-be-detected data is abnormal data.

[0141] The determination module 603 is configured to input the detection result and the portrait data into a preset detection model, to enable the detection model to obtain a detection result of whether the to-be-detected object has an abnormal business behavior according to the detection result and the portrait data, as a target detection result.

[0142] The execution module 604 is configured to execute a detection task according to the target detection result.

[0143] Optionally, the detection module 602 is specifically configured to, if a data type of the to-be-detected data is a video type, determine a first detection strategy suitable for video type data detection as the detection strategy matched with the to-be-detected data from the preset detection strategies; acquire at least one frame of picture data from the to-be-detected data as target picture data according to the first detection strategy; and detect the target picture data to obtain the detection result of whether the to-be-detected data is abnormal data.

[0144] Optionally, the detection module 602 is specifically configured to, if a data type of the to-be-detected data is a picture type, determine a second detection strategy suitable for picture type data detection as the detection strategy matched with the to-be-detected data from the preset detection strategies; input the to-be-detected data into a preset picture recognition model according to the second detection strategy, to enable the picture recognition model to determine an abnormal label matched with the to-be-detected data as an abnormal label corresponding to the to-be-detected data from preset abnormal labels, wherein different abnormal labels are used to represent different violation elements contained in the to-be-detected data; and obtain the detection result of whether the to-be-detected data is abnormal data according to the abnormal label corresponding to the to-be-detected data.

[0145] Optionally, the detection module 602 is specifically configured to determine, according to the second detection strategy, whether there is sample picture data matching the to-be-detected data in each sample picture data contained in a preset specified sample library; if yes, determine a first reference abnormal label corresponding to the to-be-detected data according to a preset abnormal label corresponding to the specified sample library; input the to-be-detected data into a preset picture recognition model according to the second detection strategy, so that the picture recognition model determines an abnormal label matching the to-be-detected data from each preset abnormal label as a second reference abnormal label; and determine an abnormal label corresponding to the to-be-detected data according to the first reference abnormal label and the second reference abnormal label.

[0146] Optionally, the detection module 602 is specifically configured to extract specified detection data from the to-be-detected data, wherein the specified detection data includes text data and picture data corresponding to a picture area containing a two-dimensional code; and perform detection on the specified detection data, and obtain a detection result of whether the to-be-detected data is abnormal data according to a detection result of performing detection on the specified detection data and the abnormal label corresponding to the to-be-detected data.

[0147] Optionally, the detection module 602 is specifically configured to, if the data type of the to-be-detected data is a text type, determine a third detection strategy suitable for text type data detection from each detection strategy as a detection strategy matching the to-be-detected data; perform at least one detection operation on the to-be-detected data according to the third detection strategy, and for each detection operation, take a detection result of performing detection on the to-be-detected data through the detection operation as a detection result corresponding to the detection operation, wherein different detection operations have different detection effects on the same rule-violating text; and determine a detection result of whether the to-be-detected data is abnormal data according to the detection result corresponding to each detection operation.

[0148] Optionally, the execution module 604 is specifically configured to, if it is determined that the to-be-detected object has an abnormal business behavior according to the target detection result, determine a node matching the to-be-detected object from a pre-constructed subject relationship graph as a first target node corresponding to the to-be-detected object; determine other nodes from the subject relationship graph, wherein a connection relationship between the first target node and the other nodes satisfies a preset condition, as second target nodes; and perform a detection task according to the first target node and the second target nodes.

[0149] Optionally, the apparatus further includes a construction module 605.

[0150] The construction module 605 is specifically configured to acquire historical detection results of historical to-be-detected data corresponding to each object, determine each type of node according to the historical detection results, and construct a subject relationship graph according to the each type of node, wherein each type of node in the subject relationship graph includes a node for representing an object, a node for representing historical to-be-detected data, a node for representing a source of the historical to-be-detected data, and a node for representing an abnormal type corresponding to a historical detection result.

[0151] Optionally, the acquisition module 601 is specifically configured to acquire each data published by the to-be-detected object through different information publishing channels as each to-be-detected data.

[0152] The specification also provides a computer readable storage medium, which stores a computer program, and the computer program can be used to execute the data detection method described above. Figure 1 The specification also provides a data detection method.

[0153] The specification also provides a computer readable storage medium, which stores a computer program, and the computer program can be used to execute the data detection method described above. Figure 7 The specification also provides an electronic device corresponding to the data detection method described above. Figure 1 The specification also provides an electronic device corresponding to the data detection method described above. Figure 7 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course, can also include other hardware required by a business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the data detection method described above. Figure 1 Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as a logic device or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or a logic device.

[0154] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0155] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0156] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0157] For the sake of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of the units can be implemented in one or more software and / or hardware in implementing the present specification.

[0158] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system, or a computer program product. Therefore, the present specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0159] The specification is presented with reference to flow diagrams and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0160] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0161] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. ​ The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0162] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0163] The memory can include non-persistent memory and / or storage mechanisms such as, for example, random access memory (RAM), non-volatile memory (NVM), and / or a persistent memory such as, for example, read-only memory (ROM) or flash memory. The memory is an example of computer-readable media.

[0164] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0165] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that processes, methods, articles or devices that comprise a list of elements do not only include those elements, but also other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0166] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer-usable program code.

[0167] The present specification can be described in the general context of computer-executable instructions, such as program modules, executed by computers. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0168] The various embodiments in the specification are described in progressive manner, and the same or similar parts among the various embodiments can be mutually referred to, and each embodiment focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0169] The above merely describes the embodiments of the present specification and is not intended to limit the present specification. The present specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A data detection method, comprising: Acquire the detection data corresponding to the object to be detected and the profile data of the object to be detected. The detection data is multimedia data displayed to other users based on the object to be detected. For each piece of data to be detected, a detection strategy that matches the data to be detected is determined from the preset detection strategies to detect the data and obtain the detection result of whether the data to be detected is abnormal data. The detection results and the profile data are input into a preset detection model so that the detection model can obtain a detection result of whether the object to be detected has abnormal business behavior based on the detection results and the profile data, which is used as the target detection result; Based on the target detection results, execute the detection task.

2. The method as described in claim 1, wherein a detection strategy matching the data to be detected is determined from a set of preset detection strategies, and the data to be detected is then detected to obtain a detection result indicating whether the data to be detected is abnormal, specifically includes: If the data to be detected is of the video type, then the first detection strategy suitable for video type data detection is determined from the preset detection strategies as the detection strategy that matches the data to be detected. According to the first detection strategy, at least one frame of image data is extracted from the data to be detected as the target image data; The target image data is inspected to obtain a detection result indicating whether the data to be detected is abnormal.

3. The method as described in claim 1, wherein a detection strategy matching the data to be detected is determined from a set of preset detection strategies, and the data to be detected is then detected to obtain a detection result indicating whether the data to be detected is abnormal, specifically includes: If the data to be detected is of image type, then from the preset detection strategies, the second detection strategy suitable for image type data detection is determined as the detection strategy that matches the data to be detected. According to the second detection strategy, the data to be detected is input into a preset image recognition model so that the image recognition model can determine the abnormal label that matches the data to be detected from the preset abnormal labels, and use it as the abnormal label corresponding to the data to be detected. Different abnormal labels are used to characterize different illegal elements contained in the data to be detected. Based on the anomaly label corresponding to the data to be detected, the detection result of whether the data to be detected is abnormal is obtained.

4. The method as described in claim 3, further comprising, before inputting the data to be detected into a preset image recognition model according to the second detection strategy, so that the image recognition model determines an anomaly label matching the data to be detected from a preset set of anomaly labels as the anomaly label corresponding to the data to be detected, the method further comprising: According to the second detection strategy, it is determined whether there is sample image data that matches the data to be detected in each sample image data contained in the preset specified sample library; If so, then the first reference anomaly label corresponding to the data to be detected is determined according to the anomaly label corresponding to the specified sample library in the preset. According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines the anomaly label that matches the data to be detected from a preset set of anomaly labels, which is then used as the anomaly label corresponding to the data to be detected. Specifically, this includes: According to the second detection strategy, the data to be detected is input into a preset image recognition model so that the image recognition model can determine the abnormal label that matches the data to be detected from the preset abnormal labels, and use it as the second reference abnormal label. Based on the first reference anomaly label and the second reference anomaly label, the anomaly label corresponding to the data to be detected is determined.

5. The method as described in claim 3, wherein the detection result of whether the data to be detected is abnormal is obtained based on the abnormal label corresponding to the data to be detected, specifically including: Extract specified detection data from the data to be detected. The specified detection data includes: text data and image data corresponding to the image area containing the QR code. The specified detection data is detected, and based on the detection results of the specified detection data and the abnormal label corresponding to the data to be detected, a detection result is obtained as to whether the data to be detected is abnormal data.

6. The method as described in claim 1, wherein a detection strategy matching the data to be detected is determined from a set of preset detection strategies, and the data to be detected is then detected to obtain a detection result indicating whether the data to be detected is abnormal, specifically includes: If the data to be detected is of text type, then from the preset detection strategies, the third detection strategy suitable for detecting text type data is determined as the detection strategy that matches the data to be detected. According to the third detection strategy, at least one detection operation is performed on the data to be detected. For each detection operation, the detection result after the detection of the data to be detected by the detection operation is taken as the detection result corresponding to the detection operation. Different detection operations have different detection effects on the same illegal text. Based on the detection results corresponding to each detection operation, determine whether the data to be detected is abnormal data.

7. The method as described in claim 1, wherein a detection task is performed based on the target detection result, specifically including: If, based on the target detection results, it is determined that the object to be detected has abnormal business behavior, then a node matching the object to be detected is determined from the pre-constructed subject relationship graph and used as the first target node corresponding to the object to be detected. Other nodes whose connection relationships with the first target node satisfy preset conditions are identified from the subject relationship diagram and designated as second target nodes; Execute the detection task based on the first target node and the second target node.

8. The method as described in claim 7, wherein constructing the principal relationship diagram specifically includes: Obtain the historical detection results of the historical data to be detected for each object; Based on the historical detection results, nodes of various types are identified, and a subject relationship graph is constructed based on the nodes of various types. In the subject relationship graph, the nodes of various types include: nodes representing objects, nodes representing historical data to be detected, nodes representing the source of historical data to be detected, and nodes representing the anomaly type corresponding to the historical detection results.

9. The method according to any one of claims 1 to 8, wherein obtaining the detection data corresponding to the object to be detected specifically includes: The data published by the object to be detected through different information publishing channels are obtained as the data to be detected.

10. A data detection device, comprising: The acquisition module is used to acquire each piece of data to be detected corresponding to the object to be detected and the profile data of the object to be detected. The piece of data to be detected is multimedia data displayed to other users based on the object to be detected. The detection module is used to determine the detection strategy that matches the data to be detected from the preset detection strategies for each data to be detected, so as to detect the data to be detected and obtain the detection result of whether the data to be detected is abnormal data. The determination module is used to input the detection results and the profile data into a preset detection model, so that the detection model can obtain a detection result of whether the object to be detected has abnormal business behavior based on the detection results and the profile data, and use it as the target detection result; The execution module is used to perform detection tasks based on the target detection results.

11. The apparatus of claim 10, wherein the detection module is specifically configured to, if the data type of the data to be detected is video, determine a first detection strategy suitable for detecting video data from a set of preset detection strategies as a detection strategy that matches the data to be detected. According to the first detection strategy, at least one frame of image data is extracted from the data to be detected as the target image data; The target image data is inspected to obtain a detection result indicating whether the data to be detected is abnormal.

12. The apparatus of claim 10, wherein the detection module is specifically configured to, if the data type of the data to be detected is an image type, determine a second detection strategy suitable for detecting image type data from a set of preset detection strategies as a detection strategy that matches the data to be detected; According to the second detection strategy, the data to be detected is input into a preset image recognition model, so that the image recognition model determines the abnormal label that matches the data to be detected from the preset abnormal labels, and uses it as the abnormal label corresponding to the data to be detected. Different abnormal labels are used to characterize different illegal elements contained in the data to be detected. Based on the abnormal label corresponding to the data to be detected, the detection result of whether the data to be detected is abnormal is obtained.

13. The apparatus of claim 12, wherein the detection module is specifically used to determine, according to the second detection strategy, whether there is sample image data in each sample image data contained in the preset specified sample library that matches the data to be detected; If so, then the first reference anomaly label corresponding to the data to be detected is determined according to the anomaly label corresponding to the specified sample library in the preset. According to the second detection strategy, the data to be detected is input into a preset image recognition model so that the image recognition model can determine the abnormal label that matches the data to be detected from the preset abnormal labels, and use it as the second reference abnormal label. Based on the first reference anomaly label and the second reference anomaly label, the anomaly label corresponding to the data to be detected is determined.

14. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 9.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 9.

Images