Abnormal account determination method and device, terminal equipment and storage medium

Abstract

The embodiment of the invention is suitable for the technical field of computers, and provides an abnormal account determination method and device, terminal equipment and a storage medium, and the method comprises the steps: obtaining account features of each user account; generating an adjacency relation matrix according to each account feature; the adjacency relation matrix is used for representing the characteristic relation between the user accounts; grouping each user account based on the account feature of each user account and the adjacency relation matrix to obtain at least one account group; each account group at least comprises an account node representing a user account, and the account nodes with a characteristic relationship are connected through a node line; and determining an abnormal account group from all account groups according to a preset judgment rule. By adopting the method, the identification accuracy of the abnormal account can be improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a method, apparatus, terminal device and storage medium for determining an abnormal account. Background Art

[0002] With the development of network technology, in various industries and fields, there are often cases where multiple robot accounts (abnormal accounts) are used to spread bad information or illegally participate in activities to gain benefits.

[0003] At present, when identifying abnormal accounts, each account is usually initially identified using preset judgment rules, and then the accounts that meet the judgment rules are secondarily judged based on manual recognition.

[0004] However, as the number of user accounts increases and the account behaviors of user accounts become increasingly complex, the accuracy of this identification method is low and it requires a lot of time and labor costs. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, terminal device and storage medium for determining an abnormal account, which can solve the problem of low accuracy in identifying abnormal accounts in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for determining an abnormal account, the method comprising:

[0007] Get account characteristics for each user account;

[0008] Generate an adjacency matrix based on the characteristics of each account; the adjacency matrix is ​​used to represent the characteristic relationship between each user account;

[0009] Based on the account features of each user account and the adjacency relationship matrix, each user account is grouped to obtain at least one account group; each account group includes at least one account node representing the user account, and the account nodes with characteristic relationships are connected through node lines;

[0010] Determine abnormal account groups from all account groups based on preset judgment rules.

[0011] In a second aspect, an embodiment of the present application provides a device for determining an abnormal account, the device comprising:

[0012] An account feature acquisition module, used to obtain the account features of each user account;

[0013] The adjacency relationship matrix generation module is used to generate an adjacency relationship matrix according to the characteristics of each account; the adjacency relationship matrix is ​​used to characterize the characteristic relationship between each user account;

[0014] An account grouping module, used to group each user account based on the account features of each user account and the adjacency relationship matrix to obtain at least one account group; each account group includes at least one account node representing the user account, and the account nodes with characteristic relationships are connected by node lines;

[0015] The abnormal account group determination module is used to determine the abnormal account group from all account groups according to preset judgment rules.

[0016] In a third aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of the first aspect described above when executing the computer program.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method of the first aspect described above is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute the method of the first aspect.

[0019] Compared with the prior art, the embodiment of the present application has the following beneficial effects: after obtaining the account features of each user account, an adjacency relationship matrix that can characterize the feature relationship between each user account can be generated according to each account feature. Based on this, when each user account is grouped according to the corresponding feature relationship between each user account and the account features of the user account itself, the accuracy of grouping the user accounts can be improved, so that the multiple user accounts in each group of account groups have certain feature connections. That is, grouping based on the independent features of each user account and the relationship features with other user accounts can improve the grouping accuracy. Then, the overall grouping information in each account group can be identified based on the preset judgment rules to determine whether the account group is an abnormal account group. Furthermore, not only does it not need to judge each user account separately, which improves the judgment efficiency of abnormal accounts, but also because the multiple user accounts in each group of account groups have certain feature connections, it can also improve the accuracy of identifying multiple abnormal user accounts at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 This is a flowchart of an implementation method for determining an abnormal account provided by an embodiment of the present application;

[0022] Figure 2 This is a schematic diagram of an implementation method for generating an adjacency relationship matrix in a method for determining an abnormal account provided in an embodiment of the present application;

[0023] Figure 3 This is a schematic diagram of an application scenario of generating account groups in a method for determining abnormal accounts provided in an embodiment of the present application;

[0024] Figure 4 It is a structural diagram of an abnormal account determination device provided by an embodiment of the present application;

[0025] Figure 5 It is a structural diagram of a terminal device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0026] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0027] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0028] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0029] With the development of network technology, in various industries and fields, there are often cases where multiple robot accounts (abnormal accounts) are used to spread bad information or illegally participate in activities to gain benefits.

[0030] For example, in the logistics industry, logistics companies may offer discounts to new users or customers with large shipping needs. For example, they may offer discounts on shipping costs. At this time, some groups may use multiple robot accounts to participate in the above discounts and resell for profit.

[0031] At present, when identifying abnormal accounts, we usually use preset judgment rules (for example, whether it is written into the blacklist, or whether the IP address is abnormal when participating in promotional activities) to conduct preliminary identification of each account. Then, we conduct a secondary judgment on the accounts that meet the judgment rules based on manual identification.

[0032] However, as the number of user accounts increases and the account behaviors of user accounts become increasingly complex, this detection method has low accuracy and requires a lot of time and labor costs.

[0033] Based on this, in order to improve the accuracy of identifying abnormal accounts, an embodiment of the present application provides a method for determining abnormal accounts, which can be applied to terminal devices such as tablet computers, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, etc. The embodiment of the present application does not impose any restrictions on the specific type of terminal devices.

[0034] See also Figure 1 , Figure 1 The following is a flowchart of an implementation method of an abnormal account determination method provided by an embodiment of the present application, and the method includes the following steps:

[0035] S101. Obtain account characteristics of each user account.

[0036] In one embodiment, the user account may be a mobile phone number, a WeChat account, or a login account used when participating in an activity, and is not limited thereto. The account feature may be used to characterize the behavior of the user account when participating in an activity.

[0037] Specifically, the above-mentioned user account behavior may include, but is not limited to, user ID, IP address when participating in activities, device ID of the device used, network information (e.g., WIFI address), mobile phone number or virtual mobile phone number, participating channel, referrer, participating time, historical delivery volume, historical number of participating activities, etc. Based on this, account features can be abstract data extracted based on behavior, which can be represented in the form of numbers or matrices.

[0038] It should be noted that for each activity, the authorization rules required for participating in the activity can be pre-set. That is, when a user participates in an activity, the activity organizer needs to be authorized so that the activity organizer can obtain the above account features.

[0039] In this embodiment, the above account features may mainly include the IP address when participating in the activity, the device ID of the device used, network information, and the features of the recommender and other attributes. It is understandable that when there are groups of users participating in the activity, the IP address, device ID, network information, and recommender are usually consistent in the user accounts of the groups. Therefore, the account features based on these multiple attributes are involved in the subsequent steps, which can improve the accuracy of grouping user accounts.

[0040] S102. Generate an adjacency relationship matrix according to the characteristics of each account; the adjacency relationship matrix is ​​used to represent the characteristic relationship between each user account.

[0041] In one embodiment, when the account features of any two user accounts are the same or similar, it can be determined that there is a feature relationship between the two user accounts, and then an adjacency relationship matrix of the two user accounts with respect to attributes can be generated.

[0042] Among them, the similarity between the two account features can be determined according to the existing vector similarity calculation formula, and then when the similarity is greater than the preset similarity, it is determined that the two account features are similar, which will not be described in detail.

[0043] In this embodiment, based on the above explanation of account characteristics, it can be known that when the account characteristics of corresponding attributes such as IP address, device ID, network information and recommender are consistent, it can be determined that there is a characteristic relationship between two user accounts, and then an adjacency relationship matrix of the two user accounts regarding the attributes is generated.

[0044] In a specific embodiment, the Figure 2 The steps S201-S203 shown generate the above adjacency matrix, which is described in detail as follows:

[0045] S201. For all account features corresponding to any attribute, if any two account features satisfy preset feature rules, a preset first matrix is ​​generated; the first matrix is ​​used to represent the user accounts corresponding to the two account features, respectively, and there is a feature relationship in the attributes.

[0046] S202. If any two account features do not satisfy the preset feature rules, a preset second matrix is ​​generated; the second matrix is ​​used to represent the user accounts corresponding to the two account features, and there is no feature relationship in attributes.

[0047] In one embodiment, the preset feature rules corresponding to different attributes are usually different, and this is not limited. Exemplarily, in this embodiment, the account features of various attributes obtained in S101 can be represented by text, numbers or letters. Therefore, it can be considered that among the account features of various attributes, when the account features are letters or numbers, if the letters or numbers of the two account features are the same, it can be considered that there is a feature relationship in the attributes (i.e., the preset feature rules are met). And, when the account features are in text, if the text similarity of the two account features is greater than the preset similarity, it can be considered that there is a feature relationship in the attributes (i.e., the preset feature rules are met).

[0048] The first matrix and the second matrix can be set according to actual conditions, and there is no limitation on this. For example, the first matrix can be Aij=1, and the second matrix can be Aij=0.

[0049] Specifically, for the account feature whose attribute is the IP address, when it is detected that the IP address of user account i is consistent with the IP address of user account j, the first matrix generated can be Aij=1. And, when it is detected that the IP address of user account i is inconsistent with the IP address of user account j, the second matrix generated can be Aij=0. Among them, A represents the attribute of IP address. Then, after constructing the above first matrix or second matrix for each user account pairwise, the target relationship matrix A corresponding to the attribute of IP address can be obtained. * At this time, the target relationship matrix A * It can be used to characterize the characteristic relationship between attributes (IP addresses) of all user accounts.

[0050] For example, if the number of user accounts is n, then the target relationship matrix A * The specifics can be as follows:

[0051]

[0052] It should be noted that in the actual generated target relationship matrix A * In the above, A11, A12, ..., Ann will be specific values ​​0 or 1.

[0053] Similarly, for account features of other attributes, the method of establishing the target relationship matrix can be the same as the above method of establishing the target relationship matrix A. * That is, for the account features of device ID and network information, the first matrix or the second matrix can be generated based on whether the device ID between two user accounts is the same, and then the target relationship matrix B corresponding to the device ID is generated based on the first matrix and the second matrix of all user accounts corresponding to the device ID. *And, according to whether the network information between the two user accounts is the same, the first matrix or the second matrix is ​​generated, and then, based on the first matrix and the second matrix of all user accounts corresponding to the network information, the target relationship matrix C corresponding to the network information is generated. * .

[0054] It should be noted that when generating the first matrix and the second matrix with the attribute of the recommender, if the user account corresponding to the recommender of user account i is j, the generated first matrix may be Dij = 1. However, if there is no user account corresponding to the recommender of user account i among all the user accounts participating in the activity, the generated second matrix may be Di = 0.

[0055] S203: Generate an adjacency matrix according to the first matrix and the second matrix corresponding to all attributes.

[0056] In one embodiment, for the first matrix and the second matrix corresponding to any attribute, it has been explained above that a target relationship matrix corresponding to the attribute for all user accounts can be constructed based on the first matrix and the second matrix corresponding to the attribute. Based on this, an adjacency relationship matrix can be generated according to the target relationship matrices corresponding to all attributes. At this time, the adjacency relationship matrix can comprehensively represent the characteristic relationship between each user account in multiple dimensions.

[0057] Specifically, the target relationship matrix corresponding to all attributes can be summed up to obtain the adjacency relationship matrix. * , B * , C * and D * After that, its adjacency matrix can be as follows:

[0058]

[0059] Wherein, Emn represents the characteristic relationship between all attributes of the mth user account and the nth user account. Wherein, Emn=Amn+Bmn+Cmn+Dmn.

[0060] It should be noted that due to the adjacency matrix E * It is obtained by adding up the account features corresponding to multiple attributes, and the dimensions of account features between different attributes are usually different. Therefore, in order to quantify the characteristic relationship between the account features corresponding to each attribute, the adjacency matrix E can be * Each value in is normalized to unify the dimension, and then the subsequent steps are performed.

[0061] The normalization processing methods include, but are not limited to, maximum normalization, minimum normalization, etc., which are not limited thereto.

[0062] S103. Group each user account based on the account features of each user account and the adjacency relationship matrix to obtain at least one account group; each account group includes at least one account node representing the user account, and the account nodes with feature relationships are connected through node lines.

[0063] In one embodiment, each account feature and adjacency matrix may be input into a pre-trained graph network model to group each user account, wherein the graph network model may be a GraphSage model.

[0064] It should be noted that if there is no pre-trained graph network model, each account feature and adjacency matrix can be input as training data into the initial graph network model for training to obtain a trained graph network model. At this time, after the training is completed, the trained graph network model will output the predicted label of each user account. At this time, each user account can be grouped based on the predicted label. For example, user accounts with the same predicted label can be grouped as one account.

[0065] Furthermore, if there is a pre-trained graph network model, each account feature and adjacency relationship moment can be directly input into the graph network model to obtain the predicted label of each user account. Then, each user account can be grouped based on the predicted label.

[0066] The predicted label may be a label predicting that the user account is an abnormal user account, or a label predicting that the user account is a normal user account; or a label predicting the identity of the user corresponding to the user account, or a label in the field of work, for example, a label such as a student, a teacher, or a person engaged in work.

[0067] It is understandable that the role of the prediction tag is to cluster all user accounts, connecting multiple user accounts with certain characteristic relationships through node lines as an account group. Therefore, in this embodiment, the category of the prediction tag is not limited.

[0068] Among them, when training the model based on the account features and adjacency matrix of each user account, it is necessary to pre-process each account feature first to transform it into a feature vector that can be recognized by the machine. Specifically, the account features can be first processed by data cleaning, deduplication, and missing data filling. Then, the account features that have undergone the above processing are normalized, continuous features are discretized, categorical features are encoded, features are fused, and correlation is calculated, etc., without limitation.

[0069] Among them, data cleaning is used to remove erroneous data in account features. For example, for account features corresponding to IP addresses, if the format of the IP address does not meet the preset standard format, the account features will be deleted. Deduplication of account features can be considered as deleting all user accounts with the same account features. And, for filling missing data, preset values ​​can be used for filling. Alternatively, all non-missing account features corresponding to the attribute can be determined first, and then the average value of the non-missing account features can be used for filling, and there is no limitation on this.

[0070] In one embodiment, continuous feature discretization includes but is not limited to unsupervised discretization methods and supervised discretization methods, which are not described in detail. Classification feature encoding processing is used to encode account features and generate feature vectors that can be understood by the neural network model. Among them, the encoding method includes but is not limited to one hot encoding (One Hot) and cell encoding (Celluar Encoding), which are not limited.

[0071] The above-mentioned feature fusion can be to fuse the account features processed as above with the account features, and to fuse the account features with the adjacency matrix. The fusion methods include but are not limited to feature concatenation, feature summation (mean, pooling, weighted summation), etc., which are not limited to this. The above-mentioned correlation calculation is to calculate the degree of association between the account features and the labels, which is used to characterize the relationship between the account features of multiple attributes and the predicted labels. The calculation method can use the Pearson coefficient, or the multi-label k-nearest neighbor method, which is not limited to this.

[0072] It should be noted that the predicted label can be obtained directly from the output of the trained graph network model when training the graph network model; or the predicted label of each user account can be obtained by re-inputting each account feature and adjacency relationship matrix into the trained graph network model, and there is no limitation on this.

[0073] It should be added that the above embodiment is an example of clustering and grouping multiple user features at the same time. However, in actual applications, after obtaining the trained graph network model, there may be a scenario where only a single user account needs to be clustered and grouped. In this case, an adjacency matrix cannot be generated for a single user account. Therefore, an adjacency matrix can be generated based on the account features of a single user account and the account features of multiple user accounts (i.e., the user accounts in step S101) used when training the graph network model to perform account grouping.

[0074] In one embodiment, referring to Figure 3 , Figure 3: is a schematic diagram of an application scenario for generating account groups in an abnormal account determination method provided in an embodiment of the present application. For ease of explanation, the number of user accounts is 7, and they are represented by a, b, c, d, e, f and g respectively. The adjacency matrix between the 7 user accounts can be as follows: Figure 3 E shown * matrix. Figure 3 The data included in the dataset S are the account features of all user accounts. Specifically, S i ={S iA , S iB , ..., S iN}; where S i S represents the account characteristics of multiple attributes of the i-th user account. iA Represents the account feature corresponding to attribute A in the i-th user account.

[0075] Based on this, we get the adjacency matrix E * After the dataset S is obtained, it can be simultaneously input into the graph network model to obtain Figure 3 The account groups shown. Figure 3 For example, there are 4 account groups, account group R1 contains account nodes represented by user accounts a, b and c, and they are connected by node lines; account group R2 contains only one account node represented by user account d; account group R3 contains only one account node represented by user account f; account group R4 contains account nodes represented by user accounts e and g, and they are connected by node lines. When two account nodes are connected by a node line, it can be considered that there is a strong characteristic relationship between the two accounts.

[0076] S104. Determine abnormal account groups from all account groups according to preset judgment rules.

[0077] In one embodiment, the above-mentioned preset judgment rules may include multiple judgment rules such as judgment based on the number of node lines in the account grouping, judgment based on the number of account nodes, and judgment based on the number of known abnormal user accounts, etc., and there is no limitation on this.

[0078] Specifically, the abnormal account grouping can be determined by setting the following judgment rules:

[0079] The first preset judgment rule:

[0080] For each account group, a first number of account nodes in the account group may be obtained. Then, based on the first number, a first preset number of account groups are determined as abnormal account groups. The first number of account nodes in each abnormal account group is greater than the first number of account nodes in the normal account group.

[0081] Specifically, all account groups can be sorted from large to small based on the first number, and then the account groups ranked in the first N and the Nth are determined as abnormal account groups, and other account groups can be considered as normal account groups. N is the first preset number.

[0082] It should be noted that the first preset number can be a pre-set number or a number determined according to the total number of account groups. Specifically, 1% of the total number of account groups (if it is not an integer, it can be rounded down or rounded up, and the number is at least 1) can be determined as the first preset number. Furthermore, based on the first preset number determined in this way, abnormal account groups can be reasonably determined from multiple account groups.

[0083] For example, Figure 3 For example, since there are 4 account groups, 1% thereof is 0.04. Therefore, the first preset number can be set to 1. Among the 4 account groups, the first number of account nodes contained in account group R1 is 3, which is the largest number. Therefore, account group R1 can be considered as an abnormal account group.

[0084] The second preset judgment rule:

[0085] For each account group, the second number of node lines included in the account group may be obtained first, and then, when the second number corresponding to the account group is greater than the second preset number, the account group is determined to be an abnormal group.

[0086] It is understandable that the user account that normally participates in the activity is usually not closely related to the characteristics of other user accounts. Therefore, the account node of the user account that normally participates in the activity usually does not have a node line connection with the account nodes of other user accounts, or the second number of node lines that exist is small.

[0087] Based on this, in the account grouping, if there is at least one account node corresponding to a second number of node lines greater than the second preset number, it can be considered that in the account grouping, nearly every account node has a characteristic relationship with the account nodes whose node lines are greater than the second preset number. Therefore, it can be considered that the user accounts represented by the account nodes whose node lines are greater than the second preset number are abnormal user accounts. At this time, in the account grouping, when there is a node line between the account node corresponding to nearly every user account and the account node corresponding to the abnormal user account, it can be considered that there are account features corresponding to certain attributes between nearly every user account, which are the same as the account features corresponding to the abnormal account or have a strong characteristic relationship. For example, the recommenders are all users corresponding to the abnormal user accounts. Based on this, it can be considered that each account node connected to the node corresponding to the abnormal user account is also an abnormal account node. Furthermore, it can be determined that the account grouping is an abnormal account grouping.

[0088] For example, Figure 3 For example, the second preset number can be 1. Among the 4 account groups, the second number of node lines corresponding to each account node contained in account group R1 is 2, which is greater than the second preset number. In addition, there are no node lines in account groups R2 and R3, and the number of node lines in account group R4 is 1, which is less than or equal to 1. Therefore, account group R1 can be considered as an abnormal account group.

[0089] The third preset judgment rule:

[0090] For each account group, the second number of node lines included in the account group may be obtained first, and then the second number of node lines corresponding to each account node in the account group may be obtained. After that, the target account nodes whose second number in the account group is greater than the third preset number are determined, and the third number of the target account nodes and the total number of account nodes in the account group are counted. Finally, when the ratio of the third number to the total number is greater than the preset ratio, the account group is determined to be an abnormal account group.

[0091] It should be noted that, for the third preset judgment rule, the third preset number may be smaller than the second preset number. For example, the second preset number may be 50, the third preset number may be 5, and the preset ratio may be 60%.

[0092] Based on the above description, it can be known that the account nodes of user accounts that normally participate in the activity usually do not have node line connections with the account nodes of other user accounts, or the second number of node lines that exist is small. Based on this, when the second number of node lines of the target account node is greater than a certain number (the third preset number) but less than the second preset number, it can be considered that the user account corresponding to the target account node may be a suspected abnormal user account. At this time, in order to be able to further accurately determine the account grouping, it can also be determined based on whether the ratio of the third number of target account nodes to the total number of account nodes in the account grouping is greater than the preset ratio.

[0093] It is understandable that when the ratio of the third number of target account nodes to the total number of account nodes in the account group is greater than the preset ratio, it can be considered that there are more suspected abnormal user accounts in the account group. Based on this, when the ratio is greater than the preset ratio, the account group can be determined to be an abnormal account group.

[0094] In another embodiment, there may be an abnormal user account among the multiple user accounts in the above step S101 that has been identified as abnormal by the staff. At this time, when each user account is grouped, an abnormal account node of the abnormal user account pair will exist in the account group.

[0095] However, if all account groups with abnormal account nodes are determined as abnormal account groups, there may be a large recognition error. Based on this, in this embodiment, the fourth number of abnormal account nodes in each account group can also be counted. If the fourth number is greater than the fourth preset number, it can be considered that there are more abnormal account nodes in the account group, and other account nodes in the account group have corresponding characteristic relationships with the abnormal account nodes. Based on this, when the fourth number is greater than the fourth preset number, it can be considered that the account group is an abnormal account group.

[0096] It should be noted that, when there are abnormal user accounts in the multiple user accounts in step S101 that have been identified as abnormal by the staff, the adjacency relationship matrix generated in step S102 will include the characteristic relationship between the user account and the known abnormal user account. Based on this, when grouping the accounts by the account characteristics of each user account and the characteristic relationship between the user account and the abnormal user account, it is possible to identify whether the user account is an abnormal user account in multiple dimensions, thereby improving the accuracy of identifying the abnormal user account.

[0097] If it is detected that a user account is determined to be an abnormal user account when participating in other activities, it may also be determined to be an abnormal user account when participating in the current activity.

[0098] In another embodiment, when the account group includes abnormal account nodes corresponding to known abnormal user accounts, the shortest connection distance between each account node and the abnormal account node can also be confirmed. If the shortest connection distance is less than a preset connection distance, the account node can be considered as a suspected account node. Then, the abnormal number of suspected abnormal account nodes and known abnormal accounts is counted, and if the ratio of the abnormal number to the total number of account nodes in the account group is greater than a preset ratio, the account group is determined to be an abnormal account.

[0099] The connection distance can be represented by the node line between the account node and the abnormal account node. Figure 3 Taking the R1 account grouping as an example, if a is an abnormal account node, the node line between b and a can be 1 (the number of node lines between b→a is 1). At this time, the connection distance can also be considered to be 1. And, the connection line between b and a can also be 2 (the number of node lines between b→c→a is 2). At this time, the connection distance can also be considered to be 2. In this embodiment, the shortest connection distance 1 is used for characterization.

[0100] It is understandable that if the shortest connection distance between the account node and the abnormal account node is smaller, it indicates that the characteristic relationship between the account node and the abnormal account node is stronger. Therefore, it can be considered that the account node is more likely to be a suspected abnormal account node. At this time, the more the number of suspected abnormal account nodes, the greater the ratio of the number of abnormalities to the total number obtained in the end. Based on this, when the ratio is greater than the preset ratio, it can be determined that the account grouping is an abnormal account grouping.

[0101] In summary, these are multiple preset judgment rules for judging abnormal account groups. Among them, for the above multiple judgment rules, when an account group is determined to be an abnormal account group by any of the above preset judgment rules, the account group can be considered to be an abnormal account group, and at this time, each user account in the abnormal account group can be considered to be an abnormal user account.

[0102] In one embodiment, after obtaining the above abnormal account grouping, the staff may further perform secondary identification on each abnormal user account in the abnormal account grouping to further improve the identification accuracy of the abnormal account.

[0103] In this embodiment, after obtaining the account features of each user account, an adjacency relationship matrix that can characterize the feature relationship between each user account can be generated based on each account feature. Based on this, when each user account is grouped according to the corresponding feature relationship between each user account and the account features of the user account itself, the accuracy of grouping the user accounts can be improved, so that multiple user accounts in each account grouping have certain feature connections. That is, grouping based on the independent features of each user account and the relationship features with other user accounts can improve the grouping accuracy. Then, the overall grouping information in each account grouping can be identified based on the preset judgment rules to determine whether the account grouping is an abnormal account grouping. Furthermore, not only does it not need to judge each user account separately, which improves the judgment efficiency of abnormal accounts, but also because multiple user accounts in each account grouping have certain feature connections, it can also improve the accuracy of identifying multiple abnormal user accounts at the same time.

[0104] See also Figure 4 , Figure 4 1 is a structural block diagram of an abnormal account determination device provided in an embodiment of the present application. The abnormal account determination device in this embodiment includes modules for executing Figure 1 and Figure 3 For details, please refer to the steps in the corresponding embodiment. Figure 1 and Figure 3 as well as Figure 1 and Figure 3 For the convenience of explanation, only the parts related to this embodiment are shown. Figure 4 , the abnormal account determination device 400 may include: an account feature acquisition module 410, an adjacency matrix generation module 420, an account grouping module 430 and an abnormal account group determination module 440, wherein:

[0105] The account feature acquisition module 410 is used to acquire the account features of each user account.

[0106] The adjacency relationship matrix generation module 420 is used to generate an adjacency relationship matrix according to the characteristics of each account; the adjacency relationship matrix is ​​used to represent the characteristic relationship between each user account.

[0107] The account grouping module 430 is used to group each user account based on the account characteristics of each user account and the adjacency relationship matrix to obtain at least one account group; each account group includes at least one account node representing the user account, and the account nodes with characteristic relationships are connected by node lines.

[0108] The abnormal account group determination module 440 is used to determine the abnormal account group from all account groups according to a preset judgment rule.

[0109] In one embodiment, the user account includes account features of multiple attributes; the adjacency matrix generation module 420 is further used to:

[0110] For all account features corresponding to any attribute, if any two account features satisfy the preset feature rules, a preset first matrix is ​​generated; the first matrix is ​​used to represent the user accounts corresponding to the two account features, and there is a feature relationship in the attributes; if any two account features do not satisfy the preset feature rules, a preset second matrix is ​​generated; the second matrix is ​​used to represent the user accounts corresponding to the two account features, and there is no feature relationship in the attributes; based on the first matrix and the second matrix corresponding to all attributes, an adjacency relationship matrix is ​​generated.

[0111] In one embodiment, the adjacency matrix generation module 420 is further used to:

[0112] According to all the first matrices and second matrices corresponding to each attribute, a target relationship matrix corresponding to the attribute is generated; the target relationship matrix is ​​used to characterize the characteristic relationship between the attributes of each user account; the target relationship matrices corresponding to all attributes are summed up to obtain an adjacency relationship matrix.

[0113] In one embodiment, the account grouping module 430 is further configured to:

[0114] Input each account feature and adjacency relationship matrix into the initial graph network model for training to obtain a trained graph network model; obtain the predicted label of each user account output by the trained graph network model; and group each user account based on the predicted label.

[0115] In one embodiment, the abnormal account grouping determination module 440 is further configured to:

[0116] For each account group, a first number of account nodes in the account group is obtained; based on the first number, a first preset number of account groups are determined as abnormal account groups; the first number of account nodes in each abnormal account group is greater than the first number of account nodes in the normal account group.

[0117] In one embodiment, the abnormal account grouping determination module 440 is further configured to:

[0118] For each account group, a second number of node lines corresponding to each account node in the account group is obtained; if the second number corresponding to an account node is greater than a second preset number, the account group is determined to be an abnormal group.

[0119] In one embodiment, the abnormal account grouping determination module 440 is further configured to:

[0120] For each account grouping, obtain the second number of node lines corresponding to each account node in the account group; determine the target account nodes in the account group whose second number is greater than the third preset number; count the third number of target account nodes and the total number of account nodes in the account group; if the ratio of the third number to the total number is greater than the preset ratio, determine that the account grouping is an abnormal account grouping.

[0121] When it is understood that Figure 4 In the structural block diagram of the abnormal account determination device shown, each module is used to execute Figure 1 and Figure 3 The steps in the corresponding embodiments, and for Figure 1 and Figure 3 Each step in the corresponding embodiment has been explained in detail in the above embodiment. Figure 1 and Figure 3 as well as Figure 1 and Figure 3 The relevant descriptions in the corresponding embodiments are not repeated here.

[0122] Figure 5 1 is a block diagram of a terminal device provided by an embodiment of the present application. Figure 5 As shown, the terminal device 500 of this embodiment includes: a processor 510, a memory 520, and a computer program 530 stored in the memory 520 and executable on the processor 510, such as a program of the abnormal account determination method. When the processor 510 executes the computer program 530, the steps in each embodiment of the abnormal account determination method described above are implemented, such as Figure 1 Alternatively, the processor 510 implements the above when executing the computer program 530 Figure 4 The functions of each module in the corresponding embodiment are, for example, Figure 4 For details on the functions of modules 410 to 440, please refer to Figure 4 Related description in the corresponding embodiment.

[0123] Exemplarily, the computer program 530 may be divided into one or more modules, one or more modules are stored in the memory 520, and are executed by the processor 510 to implement the abnormal account determination method provided in the embodiment of the present application. One or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 530 in the terminal device 500. For example, the computer program 530 may implement the abnormal account determination method provided in the embodiment of the present application.

[0124] The terminal device 500 may include, but is not limited to, a processor 510 and a memory 520. Those skilled in the art will appreciate that Figure 5It is only an example of the terminal device 500 and does not constitute a limitation of the terminal device 500. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0125] The processor 510 may be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, off-the-shelf programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0126] The memory 520 may be an internal storage unit of the terminal device 500, such as a hard disk or memory of the terminal device 500. The memory 520 may also be an external storage device of the terminal device 500, such as a plug-in hard disk, a smart memory card, a flash memory card, etc. equipped on the terminal device 500. Furthermore, the memory 520 may also include both an internal storage unit of the terminal device 500 and an external storage device.

[0127] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to execute the abnormal account determination method in each of the above embodiments.

[0128] An embodiment of the present application provides a computer program product. When the computer program product runs on a terminal device, the terminal device executes the abnormal account determination method in each of the above embodiments.

[0129] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for determining abnormal accounts, characterized in that: The method comprises: Get account characteristics for each user account; Generate an adjacency relationship matrix according to each of the account features; the adjacency relationship matrix is ​​used to characterize the feature relationship between each of the user accounts; Based on the account features of each user account and the adjacency relationship matrix, each user account is grouped to obtain at least one account group; each account group includes at least one account node representing the user account, and the account nodes having the feature relationship are connected by node lines; An abnormal account group is determined from all the account groups according to a preset judgment rule.

2. The method according to claim 1, characterized in that The user account includes account characteristics of multiple attributes; The step of generating an adjacency matrix according to each of the account features includes: For all account features corresponding to any attribute, if any two account features satisfy the preset feature rule, a preset first matrix is ​​generated; the first matrix is ​​used to represent the user accounts corresponding to the two account features, respectively, and there is a feature relationship on the attribute; If any two account features do not satisfy the preset feature rule, a preset second matrix is ​​generated; the second matrix is ​​used to represent the user accounts corresponding to the two account features, respectively, and there is no feature relationship in the attributes; The adjacency relationship matrix is ​​generated according to the first matrix and the second matrix corresponding to all the attributes respectively.

3. The method according to claim 2, characterized in that The step of generating the adjacency matrix according to the first matrix and the second matrix respectively corresponding to all the attributes includes: Generate a target relationship matrix corresponding to each attribute according to all the first matrices and the second matrices corresponding to each attribute; the target relationship matrix is ​​used to characterize the characteristic relationship between each of the user accounts and the attributes; The target relationship matrices corresponding to all the attributes are summed up to obtain the adjacency relationship matrix.

4. The method according to claim 1, characterized in that The step of grouping each of the user accounts based on the account characteristics of each of the user accounts and the adjacency relationship matrix to obtain at least one account group includes: Inputting each of the account features and the adjacency relationship matrix into an initial graph network model for training to obtain a trained graph network model; Obtaining a predicted label for each of the user accounts output by the trained graph network model; Each of the user accounts is grouped based on the predicted label.

5. The method according to any one of claims 1 to 4, characterized in that: The determining of abnormal account groups from all the account groups according to a preset judgment rule includes: For each of the account groups, obtaining a first number of the account nodes in the account group; Based on the first number, a first preset number of account groups are determined as the abnormal account groups; the first number of the account nodes in each of the abnormal account groups is greater than the first number of the account nodes in the normal account groups.

6. The method according to any one of claims 1 to 4, characterized in that: The determining of abnormal account groups from all the account groups according to a preset judgment rule includes: For each of the account groups, obtaining a second number of node lines corresponding to each of the account nodes in the account group; If the second number corresponding to the account node is greater than the second preset number, the account group is determined to be an abnormal group.

7. The method according to any one of claims 1 to 4, characterized in that: The determining of abnormal account groups from all the account groups according to a preset judgment rule includes: For each of the account groups, obtaining a second number of node lines corresponding to each of the account nodes in the account group; Determine the target account nodes in the account group whose second number is greater than a third preset number; Counting a third number of the target account nodes and a total number of the account nodes in the account group; If the ratio of the third number to the total number is greater than a preset ratio, the account group is determined to be the abnormal account group.

8. An abnormal account identification device, characterized in that: The device comprises: An account feature acquisition module, used to obtain the account features of each user account; An adjacency relationship matrix generation module, used to generate an adjacency relationship matrix according to each of the account characteristics; the adjacency relationship matrix is ​​used to characterize the characteristic relationship between each of the user accounts; An account grouping module, configured to group each of the user accounts based on the account characteristics of each of the user accounts and the adjacency relationship matrix to obtain at least one account group; each of the account groups includes at least one account node representing the user account, and the account nodes having the characteristic relationship are connected by node lines; The abnormal account group determination module is used to determine the abnormal account group from all the account groups according to a preset judgment rule.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images