Abnormal access object identification method and device, equipment, medium and program product

Abstract

The invention discloses an abnormal access object recognition method and device, equipment, a medium and a program product, and belongs to the field of object recognition, and the abnormal access object recognition method comprises the steps: obtaining a basic attribute feature, an internet behavior feature and a position behavior feature of each user in a first user set; inputting the basic attribute feature, the internet behavior feature and the position behavior feature of each user into a susceptible crowd classification model, and determining susceptible crowds and non-susceptible crowds in the first user set; obtaining a first access object list accessed by the susceptible crowd and a second access object list accessed by the non-susceptible crowd; based on the first access object list and the second access object list, a target abnormal access object is determined, and the target abnormal access object comprises a fraud website and / or a fraud application program. Potential fraud websites and / or fraud application programs can be effectively discriminated, and the recognition rate of the fraud websites and / or fraud application programs is increased.

Description

Technical Field

[0001] The present application belongs to the field of object identification, and in particular, relates to a method, device, equipment, medium and program product for identifying abnormal access objects. Background Art

[0002] With the popularization of smart phones and broadband networks, various illegal applications and websites have become important tools for fraud. Internet fraud has shown a trend of diversification, expansion of fraud amounts, and universalization of the victim population, which has had a serious impact on the property safety of the people.

[0003] In order to identify and combat various fraudulent websites and applications, existing technical solutions and means focus on the websites and applications themselves, and conduct various related identifications for discrimination, including: 1) identification through domain name URLs; 2) querying domain name registration; 3) URL domain name collection search; 4) whether sensitive information such as bank cards need to be entered; 5) National Anti-Fraud Center application risk query; 6) extracting suspected website fingerprint features and official fingerprint features for identification; 7) deep semantic understanding of websites or applications for identification, etc. However, the identification work from the fraudulent websites and applications themselves has the limitation of insufficient proactive or targeted coverage, and cannot accurately identify potential fraudulent websites and applications. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device, medium and program product for identifying abnormal access objects, which can identify potential fraudulent websites and / or fraudulent applications and improve the recognition rate of fraudulent websites and / or fraudulent applications.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal access objects, the method comprising:

[0006] Obtaining basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each user in the first user set;

[0007] Input the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user into the susceptible population classification model to determine the susceptible population and the non-susceptible population in the first user set, the susceptible population classification model is obtained by training the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, the target time period being the time period corresponding to the deceived user from the first visit to the abnormal object to the last time of being deceived;

[0008] Obtain a first access object list visited by a susceptible population and a second access object list visited by a non-susceptible population;

[0009] Based on the first access object list and the second access object list, a target abnormal access object is determined, where the target abnormal access object includes a fraudulent website and / or a fraudulent application.

[0010] In some embodiments of the present application, the training method of the susceptible population classification model includes:

[0011] Extracting basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set during their respective corresponding target time periods, and basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set during the longest target time period T;

[0012] Generate a training data set containing positive and negative samples based on the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in the corresponding target time period and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T;

[0013] The preset classification model is trained based on the training data set to obtain a classification model for susceptible populations.

[0014] In some embodiments of the present application, extracting basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods, and extracting basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T includes:

[0015] Obtain an exception access object set, the exception access object set including multiple exception access objects;

[0016] Acquire a second set of users who have accessed the abnormal access objects in the abnormal access object set;

[0017] Utilizing a deep packet inspection server, parsing the O-domain log, extracting the location state sequence, action state sequence, and abnormal object state sequence of each deceived user in the second user set in the respective corresponding target time period, the O-domain log including network data;

[0018] Obtain a third user set within the longest target time period T from the deep packet inspection server, and use the deep packet inspection server to parse the O domain log to extract the position state sequence, action state sequence, and normal object state sequence of each non-deceived user in the third user set within the longest target time period T;

[0019] Determine the online behavior characteristics of each deceived user based on the action state sequence and abnormal object state sequence of each deceived user, determine the location behavior characteristics of each deceived user based on the location state sequence of each deceived user, determine the online behavior characteristics of each non-deceived user based on the action state sequence and normal object state sequence of each non-deceived user, and determine the location behavior characteristics of each non-deceived user based on the location state sequence of each non-deceived user;

[0020] The deep packet inspection server is used to parse the B domain data to extract basic attribute characteristics of each deceived user in the second user set and basic attribute characteristics of each non-deceived user in the third user set. The B domain data includes user data.

[0021] In some embodiments of the present application, a training data set containing positive and negative samples is generated based on the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set in the corresponding target time period and the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, including:

[0022] The basic attribute features, Internet behavior features, and location behavior features are normalized according to the longest target time period T to form M-dimensional features, where M is a positive integer;

[0023] Based on the preset positive and negative sample ratio, a training data set with a total sample data volume of T*M is constructed.

[0024] In some embodiments of the present application, determining a target abnormal access object based on the first access object list and the second access object list includes:

[0025] Filtering based on the first access object list and the second access object list to obtain a third access object list that meets a preset condition;

[0026] Performing a record query on each access object in the third access object list to determine the query result of each access object;

[0027] The access object whose query result is that it fails the record query is determined as the target abnormal access object.

[0028] In some embodiments of the present application, screening is performed based on the first access object list and the second access object list to obtain a third access object list that meets a preset condition, including:

[0029] Filter out the intersection of the first access object list and the second access object list from the first access object list to obtain a third access object list;

[0030] or,

[0031] The access objects in the second access object list are sorted from most to least according to the number of visits to obtain a sorted second access object list; and the access objects that are on the first access object list and rank at the top of a preset proportion in the sorted second access object list are filtered out from the first access object list to obtain a third access object list.

[0032] In some embodiments of the present application, after determining the access object whose query result is that it fails the record query as the target abnormal access object, the method further includes:

[0033] Add the target exception access object to the exception access object collection.

[0034] In a second aspect, an embodiment of the present application provides a device for identifying abnormal access objects, the device comprising:

[0035] A first acquisition module, used to acquire basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user in the first user set;

[0036] A first determination module is used to input the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user into a susceptible population classification model to determine susceptible populations and non-susceptible populations in the first user set, wherein the susceptible population classification model is obtained by training the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, wherein the target time period is the time period corresponding to the deceived user from the first visit to the abnormal object to the last deception;

[0037] A second acquisition module is used to acquire a first access object list accessed by the susceptible population and a second access object list accessed by a non-susceptible population;

[0038] The second determination module is used to determine target abnormal access objects based on the first access object list and the second access object list, where the target abnormal access objects include fraudulent websites and / or fraudulent applications.

[0039] In a third aspect, an embodiment of the present application provides a device for identifying abnormal access objects, the device comprising: a processor and a memory storing computer program instructions;

[0040] When the processor executes computer program instructions, the method for identifying abnormal access objects of any of the above embodiments is implemented.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the method for identifying abnormal access objects of any of the above embodiments is implemented.

[0042] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method for identifying abnormal access objects of any of the above embodiments.

[0043] According to the method, device, equipment, medium and program product for identifying abnormal access objects provided by the embodiments of the present application, the user's basic attribute characteristics, online behavior characteristics and location behavior characteristics are analyzed by the susceptible population classification model to determine whether the user is a susceptible population or a non-susceptible population. The target abnormal access object can be determined through the first access object list accessed by the susceptible population and the second access object list accessed by the non-susceptible population, wherein the target abnormal access object includes fraudulent websites and / or fraudulent applications. In this way, by analyzing the access of susceptible populations to fraudulent websites and / or fraudulent applications, potential fraudulent websites and / or fraudulent applications can be effectively identified, and the recognition rate of fraudulent websites and / or fraudulent applications can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 A schematic diagram of the structure of a system for identifying abnormal access objects provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of a method for identifying abnormal access objects provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of another method for identifying abnormal access objects provided in an embodiment of the present application;

[0048] Figure 4 A flowchart of another method for identifying abnormal access objects provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of a device for identifying abnormal access objects provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the structure of a device for identifying abnormal access objects provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0052] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0053] With the popularization of smart phones and broadband networks, various illegal applications and websites have become important tools for fraud. Internet fraud has shown a trend of diversification, expansion of fraud amounts, and universalization of the victim population, which has had a serious impact on the property safety of the people.

[0054] In order to identify and combat various fraudulent websites and applications, existing technical solutions and means focus on the websites and applications themselves, and conduct various related identifications for identification, including:

[0055] 1) Identify through domain name URL; 2) Check domain name record; 3) Search for URL domain name collection; 4) Whether sensitive information such as bank card needs to be entered; 5) National Anti-Fraud Center application risk query; 6) Extract suspected website fingerprint features and official fingerprint features for further analysis; 7) Perform deep semantic understanding of websites or applications for identification, etc. However, the identification work based on the fraudulent websites and applications themselves has the limitation of insufficient proactive or targeted coverage, and cannot accurately identify potential fraudulent websites and applications.

[0056] In order to solve the above problems, the embodiments of the present application provide a method, device, equipment, medium and program product for identifying abnormal access objects, which can identify potential fraudulent websites and / or fraudulent applications and improve the recognition rate of fraudulent websites and / or fraudulent applications.

[0057] Before introducing the abnormal access object identification method, device, equipment, medium and program product of the present application, a system for identifying abnormal access objects is first introduced. Figure 1 A structural diagram of the abnormal access object identification system provided in the embodiment of the present application. The abnormal access object identification system includes: an abnormal access object directory unit 101, a deep message detection server 102, a feature constructor 103, an O domain data unit 104, a B domain data unit 105, a classification model server 106, an access object data unit 107, a large disk comparison server 108, a suspected abnormal access object data unit 109 and a record verification query server 110, wherein the abnormal access object directory unit 101 stores a set of abnormal access objects, the deep message detection server 102 is used to parse the O domain data and the B domain data, and the feature constructor 103 is used to obtain the basic attribute features of each user, the upper The network behavior characteristics and location behavior characteristics, the classification model server 106 trains the susceptible population classification model and identifies the susceptible population and the non-susceptible population, the access object data unit 107 is used to store the access objects of the susceptible population and the non-susceptible population, the large-scale comparison server 108 is used to determine the third access object list containing suspected abnormal access objects based on the first access object list of the susceptible population and the second access object list of the non-susceptible population, the suspected abnormal access object data unit 109 is used to store the suspected abnormal access objects, and the filing verification query server 110 is used to perform filing verification query on the suspected abnormal access objects to determine the abnormal access objects.

[0058] Figure 2 A flowchart of a method for identifying abnormal access objects provided in an embodiment of the present application;

[0059] Next, combine Figure 2 The following describes a method for identifying an abnormal access object provided by an embodiment of the present application. The method for identifying an abnormal access object includes:

[0060] S210, obtaining basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each user in the first user set;

[0061] S220, inputting each user's basic attribute characteristics, online behavior characteristics, and location behavior characteristics into a susceptible population classification model, determining susceptible populations and non-susceptible populations in the first user set, based on training of the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods, and the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, where the target time period is the time period corresponding to the deceived user's first visit to the abnormal object to the last time he was deceived;

[0062] S230, obtaining a first access object list accessed by a susceptible population and a second access object list accessed by a non-susceptible population;

[0063] S240, determining target abnormal access objects based on the first access object list and the second access object list, where the target abnormal access objects include fraudulent websites and / or fraudulent applications.

[0064] According to the method for identifying abnormal access objects provided in the embodiment of the present application, by analyzing the basic attribute characteristics, online behavior characteristics and location behavior characteristics of the user through the susceptible population classification model, it is possible to determine whether the user is a susceptible population or a non-susceptible population, and through the first access object list accessed by the susceptible population and the second access object list accessed by the non-susceptible population, the target abnormal access object can be determined, wherein the target abnormal access object includes fraudulent websites and / or fraudulent applications. In this way, by analyzing the access of susceptible populations to fraudulent websites and / or fraudulent applications, potential fraudulent websites and / or fraudulent applications can be effectively identified, and the recognition rate of fraudulent websites and / or fraudulent applications can be improved.

[0065] Regarding the above S210, the first user set may be Internet users within a set time window [T1, T2] (eg, 22:00-06:00), or other time periods, which is not limited in this application.

[0066] The deep packet inspection server can be used to parse the O domain logs to obtain the user's time-space related location state sequence, action state sequence and access object state sequence, where the location state sequence includes traveling, residence, workplace, etc., the action state sequence includes making a call, call status, download registration, registration activation SMS, payment startup, payment verification SMS, etc., and the access object state sequence includes daily accessible time, daily online accessible time, daily offline inaccessible time, etc. The action state sequence and access object state sequence are used as online behavior features, and the location state sequence is used as location behavior features.

[0067] The O domain is the operation domain, the data domain of the operation support system. The O domain contains network data, such as signaling, alarms, faults, network resources, etc. By parsing the O domain log, we can obtain the user's time-space related location state sequence, action state sequence and access object state sequence.

[0068] Basic attribute characteristics include age, gender, occupation, etc. The deep packet inspection server can be used to parse the B domain data to obtain the user's basic attribute characteristics.

[0069] Among them, domain B is the business domain, the data domain of the business support system. Domain B contains user data and business data, such as user consumption habits, terminal information, ARPU (average revenue per user, Average Revenue PerUser) grouping, business content, business target population, etc. By analyzing domain B data, the basic attribute characteristics of users can be obtained.

[0070] Regarding the above S220, since the susceptible population classification model is based on the basic attribute characteristics, Internet behavior characteristics and location behavior characteristics of each deceived user in the second user set during their respective corresponding target time periods and the basic attribute characteristics, Internet behavior characteristics and location behavior characteristics of each non-deceived user in the third user set during the longest target time period T, the users in the first user set can be classified based on the susceptible population classification model to obtain susceptible population and non-susceptible population, that is, potential deceived users and non-deceived users.

[0071] Regarding the above S230, since the susceptible population and the non-susceptible population are obtained by analyzing the user's online behavior, after determining the susceptible population and the non-susceptible population, a first access object list visited by the susceptible population and a second access object list visited by the non-susceptible population can be obtained. The access objects may include websites and / or applications, and then the abnormal access objects are determined based on the first access object list and the second access object list. Specifically, the first access object list and the second access object list can be obtained by analyzing the user's online log.

[0072] Regarding the above S240, after the first access object list and the second access object list are obtained, a target abnormal access object may be determined based on the first access object list and the second access object list.

[0073] Specifically, the first access object list and the second access object list may be screened to obtain a third access object list that meets a preset condition;

[0074] Performing a record query on each access object in the third access object list to determine the query result of each access object;

[0075] The access object whose query result is that it fails the record query is determined as the target abnormal access object.

[0076] The method of screening the first access object list and the second access object list to obtain a third access object list that meets a preset condition includes:

[0077] Filter out the intersection of the first access object list and the second access object list from the first access object list to obtain a third access object list;

[0078] or,

[0079] The access objects in the second access object list are sorted from most to least according to the number of visits to obtain a sorted second access object list; and the access objects that are on the first access object list and rank at the top of a preset proportion in the sorted second access object list are filtered out from the first access object list to obtain a third access object list.

[0080] In this way, the large-scale comparison server can be used to compare and calculate the first access object list and the second access object list, and the objects in the first access object list that have been visited by non-susceptible people can be filtered out, and the remaining ones can be used as the third access object list. For the filtered access objects, since non-susceptible people have also visited these access objects, the probability that these access objects are abnormal is small. Therefore, these access objects are filtered out, and only those objects that have not been visited by non-susceptible people are concerned.

[0081] It is also possible to filter out the first preset proportion of the access objects in the second access object list that have been visited by non-susceptible populations in the first access object list, and use the rest as the third access object list, where the preset proportion can be 95%, for example, and can be set as needed. The remaining 5% of the access objects are visited less frequently by non-susceptible populations and have lower reference value, so they can be considered not to be normal access objects. Therefore, access objects that exist in the first access object list and are in the last 5% of the second access object list can be exempted from filtering.

[0082] After obtaining the third access object list, the registration verification query server can be used to conduct a registration query on each website and / or application in the third access object list in the ICP / IP address / domain name information registration management system, and check whether the website content is consistent with the registered subject. If it fails the registration query or the registration information is inconsistent, it will be determined as a fraudulent website and / or fraudulent application.

[0083] Figure 3A flowchart of another method for identifying abnormal access objects provided in an embodiment of the present application;

[0084] Combination Figure 3 In some embodiments of the present application, the training method of the susceptible population classification model includes:

[0085] S310, extracting the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set within their respective corresponding target time periods, and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set within the longest target time period T.

[0086] S320, generating a training data set containing positive and negative samples based on the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set during their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set during the longest target time period T.

[0087] Specifically, the classification model server may normalize the basic attribute features, the online behavior features, and the location behavior features according to the longest target time period T to form M-dimensional features, where M is a positive integer;

[0088] Based on the preset positive and negative sample ratio, a training data set with a total sample data volume of T*M is constructed.

[0089] Among them, for features that cannot be normalized, NULL values ​​are used for filling.

[0090] The preset positive and negative sample ratio can be 1:1.

[0091] S330, training a preset classification model based on the training data set to obtain a susceptible population classification model.

[0092] Specifically, the classification model server can construct an LSTM-based autoencoder, obtain data from the training data set for training based on a preset batch strategy, and use the mean square error as the loss function to perform convergence iterations to form an LSTM model. Based on the trained LSTM model, each sample in the training set is traversed, and the prediction and loss are recorded to obtain the prediction threshold range, so as to select a suitable threshold, thereby constructing a binary classification task model and forming a susceptible population classification model.

[0093] Figure 4 A flowchart of another method for identifying abnormal access objects provided in an embodiment of the present application;

[0094] Combination Figure 4In some embodiments of the present application, extracting the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set in the respective corresponding target time period and the basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T may include:

[0095] S410, obtaining an abnormal access object set, wherein the abnormal access object set includes a plurality of abnormal access objects.

[0096] Specifically, the names, domain names or URLs of fraudulent websites and / or fraudulent applications can be obtained from the Ministry of Public Security, the Cyberspace Administration of China, the Ministry of Industry and Information Technology or business systems, and a directory of fraudulent websites and / or fraudulent applications can be generated as a set of abnormal access objects.

[0097] S420: Acquire a second set of users who have accessed the abnormal access objects in the abnormal access object set.

[0098] Specifically, the deep message inspection server can be used to parse the O domain log, obtain the set of all user mobile phone numbers that have visited the fraudulent websites or fraudulent applications of the abnormal access object set as the second user set, and pass it to the feature constructor.

[0099] S430, using a deep packet inspection server, parse the O domain log to extract the location state sequence, action state sequence and abnormal object state sequence of each deceived user in the second user set during their respective corresponding target time periods, the O domain log including network data.

[0100] The target time period is the time period from when the deceived user first accesses the abnormal object to when he / she is deceived for the last time.

[0101] Specifically, the feature constructor extracts, for each mobile phone number in the second user set, from the deep message inspection server the time-space related behavior sequence from the first visit to the fraudulent website or application to the last time being deceived (including but not limited to location state sequence (traveling, residence, workplace), action state sequence (making calls, call status, downloading and registering, registration activation SMS, initiating payment, payment verification SMS, etc.), application / website state sequence (daily accessible time period, daily online accessible time, daily offline inaccessible time, etc.)), and counts the time interval with the largest time span in the time-space related behavior sequence in the second user set as the longest target time period T.

[0102] S440, obtaining a third user set within the longest target time period T from the deep packet inspection server, and using the deep packet inspection server, parsing the O domain log to extract the position state sequence, action state sequence and normal object state sequence of each non-deceived user in the third user set within the longest target time period T.

[0103] Specifically, the feature constructor obtains the deduplicated user set of the general population in the time segment according to the set ratio strategy (for example, 1:1) from the deep packet inspection server according to the time interval with the largest time span in the time-space related behavior sequence in the second user set, that is, the third user set (which has no intersection with the second user set), and constructs the time-space related behavior sequence of the third user set in the time segment according to S330.

[0104] S450, determine the online behavior characteristics of each deceived user based on the action state sequence and abnormal object state sequence of each deceived user, determine the location behavior characteristics of each deceived user based on the location state sequence of each deceived user, determine the online behavior characteristics of each non-deceived user based on the action state sequence and normal object state sequence of each non-deceived user, and determine the location behavior characteristics of each non-deceived user based on the location state sequence of each non-deceived user.

[0105] Specifically, the action state sequence and abnormal object state sequence of the deceived user are characteristics of the user's Internet access, so they are classified as the user's Internet access behavior characteristics. The location state sequence of the deceived user is a characteristic of the user's location, so it is classified as the user's location behavior characteristics. The characteristics of the non-deceived user are classified in the same way.

[0106] S460, using a deep message inspection server, parse the B domain data to extract basic attribute characteristics of each deceived user in the second user set with location behavior characteristics and basic attribute characteristics of each non-deceived user in the third user set, where the B domain data includes user data.

[0107] Specifically, by using a deep message inspection server to parse domain B data, the age, gender, and occupation of each deceived user and each non-deceived user can be obtained, which can be determined as basic attribute features. Of course, the basic attribute features can also include other user features, such as user education level, etc. This application does not limit this.

[0108] In this way, by using the deep message inspection server, the O domain logs and B domain data can be analyzed to accurately obtain the characteristics of all aspects of the deceived users and the non-deceived users. After obtaining the basic attribute characteristics, Internet behavior characteristics and location behavior characteristics of the deceived users and the non-deceived users, the feature constructor passes them to the classification model server for model training.

[0109] In some embodiments of the present application, after determining the access object whose query result is that it fails the record query as the target abnormal access object, the method for identifying the abnormal access object further includes:

[0110] Add the target exception access object to the exception access object collection.

[0111] In this way, by continuously adding the identified target abnormal access objects to the abnormal access object set, the abnormal access object set can be iteratively updated for further early warning processing.

[0112] Figure 5 A schematic diagram of the structure of a device for identifying abnormal access objects provided in an embodiment of the present application;

[0113] Combination Figure 5 , introduces an abnormal access object identification device provided in an embodiment of the present application, and the abnormal access object identification device includes:

[0114] The first acquisition module 501 is used to acquire basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user in the first user set;

[0115] The first determination module 502 is used to input the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user into a susceptible population classification model to determine susceptible populations and non-susceptible populations in the first user set, wherein the susceptible population classification model is obtained by training the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, wherein the target time period is the time period corresponding to the deceived user from the first visit to the abnormal object to the last time of being deceived;

[0116] The second acquisition module 503 is used to acquire a first access object list accessed by the susceptible population and a second access object list accessed by a non-susceptible population;

[0117] The second determination module 504 is used to determine target abnormal access objects based on the first access object list and the second access object list, where the target abnormal access objects include fraudulent websites and / or fraudulent applications.

[0118] In some embodiments of the present application, the apparatus for identifying abnormal access objects further includes: a training module, the training module including:

[0119] A feature extraction unit, used to extract basic attribute features, online behavior features and location behavior features of each deceived user in the second user set in the respective corresponding target time period, and basic attribute features, online behavior features and location behavior features of each non-deceived user in the third user set in the longest target time period T;

[0120] A sample generating unit, for generating a training data set including positive and negative samples based on the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in the respective corresponding target time period and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T;

[0121] The training unit is used to train a preset classification model based on a training data set to obtain a susceptible population classification model.

[0122] In some embodiments of the present application, the feature extraction unit is specifically used to:

[0123] Obtain an exception access object set, the exception access object set including multiple exception access objects;

[0124] Acquire a second set of users who have accessed the abnormal access objects in the abnormal access object set;

[0125] Utilizing a deep packet inspection server, parsing the O-domain log, extracting the location state sequence, action state sequence, and abnormal object state sequence of each deceived user in the second user set in the respective corresponding target time period, the O-domain log including network data;

[0126] Obtain a third user set within the longest target time period T from the deep packet inspection server, and use the deep packet inspection server to parse the O domain log to extract the position state sequence, action state sequence, and normal object state sequence of each non-deceived user in the third user set within the longest target time period T;

[0127] Determine the online behavior characteristics of each deceived user based on the action state sequence and abnormal object state sequence of each deceived user, determine the location behavior characteristics of each deceived user based on the location state sequence of each deceived user, determine the online behavior characteristics of each non-deceived user based on the action state sequence and normal object state sequence of each non-deceived user, and determine the location behavior characteristics of each non-deceived user based on the location state sequence of each non-deceived user;

[0128] The deep packet inspection server is used to parse the B domain data to extract basic attribute characteristics of each deceived user in the second user set and basic attribute characteristics of each non-deceived user in the third user set. The B domain data includes user data.

[0129] In some embodiments of the present application, the sample generation unit is specifically used to:

[0130] The basic attribute features, Internet behavior features, and location behavior features are normalized according to the longest target time period T to form M-dimensional features, where M is a positive integer;

[0131] Based on the preset positive and negative sample ratio, a training data set with a total sample data volume of T*M is constructed.

[0132] In some embodiments of the present application, the second determining module 504 includes:

[0133] A screening unit, screening based on the first access object list and the second access object list to obtain a third access object list that meets a preset condition;

[0134] A query unit, performing a record query on each access object in the third access object list to determine a query result for each access object;

[0135] The determination unit determines the access object whose query result is that it fails the record query as the target abnormal access object.

[0136] In some embodiments of the present application, the screening unit is specifically used for:

[0137] Filter out the intersection of the first access object list and the second access object list from the first access object list to obtain a third access object list;

[0138] or,

[0139] The access objects in the second access object list are sorted from most to least according to the number of visits to obtain a sorted second access object list; and the access objects that are on the first access object list and rank at the top of a preset proportion in the sorted second access object list are filtered out from the first access object list to obtain a third access object list.

[0140] In some embodiments of the present application, the apparatus for identifying abnormal access objects further includes:

[0141] Add a module to add the target exception access object to the exception access object collection.

[0142] According to the device for identifying abnormal access objects provided by the embodiment of the present application, the user's basic attribute characteristics, online behavior characteristics, and location behavior characteristics are analyzed by the susceptible population classification model to determine whether the user is a susceptible population or a non-susceptible population. The target abnormal access object can be determined through the first access object list accessed by the susceptible population and the second access object list accessed by the non-susceptible population, wherein the target abnormal access object includes fraudulent websites and / or fraudulent applications. In this way, by analyzing the access of susceptible populations to fraudulent websites and / or fraudulent applications, potential fraudulent websites and / or fraudulent applications can be effectively identified, and the recognition rate of fraudulent websites and / or fraudulent applications can be improved.

[0143] Figure 6 A schematic diagram of the structure of a device for identifying abnormal access objects provided in an embodiment of the present application;

[0144] The device for identifying abnormal access objects may include a processor 601 and a memory 602 storing computer program instructions.

[0145] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0146] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0147] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0148] The processor 601 implements the method for identifying abnormal access objects in the above embodiment by reading and executing computer program instructions stored in the memory 602 .

[0149] In one example, the device for identifying abnormal access objects may further include a communication interface 603 and a bus 610. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0150] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0151] Bus 610 includes hardware, software or both, and the parts of the determination equipment of the base station configuration parameters are coupled to each other. For example, but not limitation, the bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 610 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0152] The abnormal access object identification device executes the abnormal access object identification method in the embodiment of the present application, thereby achieving Figure 2 , Figure 3 , Figure 4 Identify methods for abnormal access to objects.

[0153] In addition, in combination with the method for identifying abnormal access objects in the above embodiments, the present application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the methods for identifying abnormal access objects in the above embodiments is implemented.

[0154] In combination with the method for identifying abnormal access objects in the above embodiments, an embodiment of the present application also provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method for identifying abnormal access objects in any of the above embodiments.

[0155] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0156] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0157] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0158] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0159] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for identifying abnormal access objects, characterized in that: The method comprises: Obtaining basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each user in the first user set; Input the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user into a susceptible population classification model to determine susceptible populations and non-susceptible populations in the first user set, wherein the susceptible population classification model is obtained by training the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T, wherein the target time period is the time period corresponding to the deceived user from the first visit to the abnormal object to the last time of being deceived; Acquire a first access object list accessed by the susceptible population and a second access object list accessed by the non-susceptible population; Based on the first access object list and the second access object list, a target abnormal access object is determined, and the target abnormal access object includes a fraudulent website and / or a fraudulent application.

2. The method for identifying abnormal access objects according to claim 1, characterized in that: The training method of the susceptible population classification model includes: Extracting basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each deceived user in the second user set during their respective corresponding target time periods, and basic attribute characteristics, online behavior characteristics, and location behavior characteristics of each non-deceived user in the third user set during the longest target time period T; Generate a training data set containing positive and negative samples based on the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in the respective corresponding target time period and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T; A preset classification model is trained based on the training data set to obtain the susceptible population classification model.

3. The method for identifying abnormal access objects according to claim 2, characterized in that: The extracting of basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in the respective corresponding target time period and basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T includes: Acquire an abnormal access object set, wherein the abnormal access object set includes multiple abnormal access objects; Acquire the second set of users who have accessed the abnormal access objects in the abnormal access object set; Utilizing a deep packet inspection server, parsing the O-domain log, extracting a location state sequence, an action state sequence, and an abnormal object state sequence of each deceived user in the second user set within the respective corresponding target time period, wherein the O-domain log includes network data; Obtaining the third user set within the longest target time period T from the deep packet inspection server, and using the deep packet inspection server, parsing the O domain log to extract the position state sequence, action state sequence, and normal object state sequence of each non-deceived user in the third user set within the longest target time period T; Determine the online behavior characteristics of each deceived user according to the action state sequence and abnormal object state sequence of each deceived user, determine the location behavior characteristics of each deceived user according to the location state sequence of each deceived user, determine the online behavior characteristics of each non-deceived user according to the action state sequence and normal object state sequence of each non-deceived user, and determine the location behavior characteristics of each non-deceived user according to the location state sequence of each non-deceived user; The deep packet inspection server is used to parse the B domain data to extract basic attribute characteristics of each deceived user in the second user set and basic attribute characteristics of each non-deceived user in the third user set, wherein the B domain data includes user data.

4. The method for identifying abnormal access objects according to claim 3, characterized in that: The generating of a training data set containing positive and negative samples based on the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in the respective corresponding target time period and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in the longest target time period T comprises: The basic attribute features, Internet behavior features, and location behavior features are normalized according to the longest target time period T to form M-dimensional features, where M is a positive integer; Based on the preset positive and negative sample ratio, a training data set with a total sample data volume of T*M is constructed.

5. The method for identifying abnormal access objects according to claim 1, characterized in that: The determining a target abnormal access object based on the first access object list and the second access object list includes: Filtering based on the first access object list and the second access object list to obtain a third access object list that meets a preset condition; Perform a record query on each access object in the third access object list to determine a query result for each access object; The access object whose query result is that it fails the record query is determined as the target abnormal access object.

6. The method for identifying abnormal access objects according to claim 5, characterized in that: The screening based on the first access object list and the second access object list to obtain a third access object list that meets a preset condition includes: Filtering out the intersection of the first access object list and the second access object list from the first access object list to obtain the third access object list; or, The access objects in the second access object list are sorted from most to least according to the number of visits to obtain a sorted second access object list; and the access objects on the first access object list and ranked at the top of a preset proportion in the sorted second access object list are filtered out from the first access object list to obtain the third access object list.

7. The method for identifying abnormal access objects according to claim 5, characterized in that: After determining the access object whose query result is that it fails the record query as the target abnormal access object, the method further includes: The target exception access object is added to the exception access object set.

8. A device for identifying abnormal access objects, characterized in that: The device comprises: A first acquisition module, used to acquire basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user in the first user set; A first determination module is used to input the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each user into a susceptible population classification model to determine susceptible populations and non-susceptible populations in the first user set, wherein the susceptible population classification model is obtained by training the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each deceived user in the second user set in their respective corresponding target time periods and the basic attribute characteristics, online behavior characteristics and location behavior characteristics of each non-deceived user in the third user set in a longest target time period T, wherein the target time period is the time period corresponding to the deceived user from the first visit to the abnormal object to the last deception; A second acquisition module is used to acquire a first access object list accessed by the susceptible population and a second access object list accessed by the non-susceptible population; The second determination module is used to determine target abnormal access objects based on the first access object list and the second access object list, and the target abnormal access objects include fraudulent websites and / or fraudulent applications.

9. A device for identifying abnormal access objects, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for identifying abnormal access objects according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method for identifying abnormal access objects according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method for identifying abnormal access objects as described in any one of claims 1 to 7.

Images