Method and device for identifying risk users in social contact process, equipment and medium
By performing feature extraction and common feature analysis on social behavior data, combining risk audit models, identifying and classifying social risk users, the problem of low recognition efficiency of risk users in the existing technology is solved, and security and identification efficiency are improved.
Patent Information
- Application Number
- CN202411418000.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-11
- Publication Date
- 2025-02-07
AI Technical Summary
The prior art is not efficient when identifying risky users in the social process and it is difficult to effectively identify and isolate users with risk attributes of black and gray products.
By obtaining social behavior data of target network users, performing feature extraction and common feature analysis, inputting a risk audit model to determine the social risk level, and determining the risk type based on the level.
It improves the recognition efficiency of risk users in social activities, reduces the probability of missed review of black and gray products, and enhances the security and social ecology of network communication.
Smart Images
Figure CN119398496A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present disclosure relate to the technical field of risky user identification, and in particular, to a method, apparatus, device, and medium for identifying risky users in a social process. Background Art
[0002] With the continuous updating of network technology, social activities can realize online user interaction, and each network user can communicate with other network users on the online platform. However, if there are risky users in the social process, especially users with risk attributes of black and gray industries, the security of network communication and the social ecology will undoubtedly be damaged.
[0003] In the related art, when risky users are identified, the social information content of network users is mainly used to distinguish whether the network users are risky users. For example, the information content sent by network users is collected, and the risk of the content in the information is used to identify whether the network users are risky users. If the information content contains risky information, the network user is considered to be a risky user.
[0004] However, the risk identification efficiency is not high using the existing identification methods. Summary of the invention
[0005] The embodiments described herein provide a method, apparatus, device, and medium for identifying risky users in a social process, which overcome the above-mentioned problems.
[0006] In a first aspect, according to the content of the present disclosure, a method for identifying risky users in a social process is provided, comprising:
[0007] Acquire social behavior data of a target network user during a social process, wherein the social behavior data of the target network user is used to describe social violation data obtained by performing abnormal identification on historical social behaviors of the target network user;
[0008] Extracting features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user;
[0009] Inputting the behavior characteristic data corresponding to the target network user into a risk audit model, and determining the social risk level of the target network user based on the output result of the risk audit model;
[0010] Determining the social risk type of the target network user based on the social risk level of the target network user;
[0011] The social risk types of the target network user include: a first type and a second type, wherein the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user.
[0012] Optionally, the extracting features of the social behavior data of the target network user to obtain the behavior feature data corresponding to the target network user includes:
[0013] Performing common feature analysis on the social behavior data of the target network user to obtain social commonality data under different social dimensions;
[0014] Behavioral features are extracted from social commonality data under different social dimensions to obtain behavioral feature data corresponding to the target network user.
[0015] Optionally, the obtaining of social behavior data of the target network user during the social process includes:
[0016] Obtain audit violation data of the target network user;
[0017] Performing data cleaning on the audit violation data of the target network user to obtain the social behavior data of the target network user during the social process;
[0018] The data cleaning process is used to make a violation determination on the audit violation data of the target network user, so as to remove the social compliance data in the audit violation data of the target network user.
[0019] Optionally, before inputting the behavior characteristic data corresponding to the target network user into a risk audit model and determining the social risk level of the target network user based on an output result of the risk audit model, the method further includes:
[0020] Acquire social behavior data of sample network users, where the social behavior data of the sample network users is used to describe social violation data obtained by performing abnormal identification on historical social behaviors of the sample network users;
[0021] Extracting features from the social behavior data of the sample network users to obtain behavior feature data corresponding to the sample network users;
[0022] Training a preset network model based on the behavioral feature data corresponding to the sample network users to obtain the risk audit model;
[0023] Among them, the risk audit model includes: a first network branch, a second network branch and a third network branch. The first network branch is used to divide the behavioral feature data corresponding to the sample network users into label rules, the second network branch is used to set risk values for different label rules obtained by division, and the third network branch is used to predict social risk levels according to different risk values.
[0024] Optionally, inputting the behavior characteristic data corresponding to the target network user into a risk audit model, and determining the social risk level of the target network user based on an output result of the risk audit model includes:
[0025] Inputting the behavior feature data corresponding to the target network user into the first network branch in the risk audit model to obtain corresponding multiple risk label rules;
[0026] Inputting the plurality of risk label rules into the second network branch in the risk audit model to obtain a plurality of corresponding risk label values;
[0027] The plurality of risk tag values are input into the third network branch in the risk audit model to obtain the social risk level of the target network user.
[0028] Optionally, the behavior characteristic data corresponding to the sample network user includes: a plurality of characteristic sub-data;
[0029] The method further comprises:
[0030] The characteristic sub-data triggering the preset risk rules in the behavior characteristic data corresponding to the sample network users are stored in the risk pool;
[0031] Based on the characteristic sub-data included in the risk pool, the risk audit model is updated to optimize the risk audit model.
[0032] Optionally, determining the social risk type of the target network user based on the social risk level of the target network user includes:
[0033] If the social risk level of the target network user meets the preset level condition, determining that the social risk type of the target network user is the first type;
[0034] If the social risk level of the target network user does not meet the preset level condition, it is determined that the social risk type of the target network user is the second type.
[0035] In a second aspect, according to the content of the present disclosure, a device for identifying risky users in a social process is provided, comprising:
[0036] An acquisition module is used to acquire social behavior data of a target network user during a social process, wherein the social behavior data of the target network user is used to describe social violation data obtained by performing abnormal identification on the historical social behavior of the target network user;
[0037] An extraction module, used to extract features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user;
[0038] A first determination module, configured to input the behavior characteristic data corresponding to the target network user into a risk audit model, and determine the social risk level of the target network user based on an output result of the risk audit model;
[0039] A second determination module, configured to determine a social risk type of the target network user based on the social risk level of the target network user;
[0040] The social risk types of the target network user include: a first type and a second type, wherein the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user.
[0041] In a third aspect, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of the method for identifying risky users in a social process in any of the above embodiments are implemented.
[0042] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for identifying risky users in a social process in any of the above embodiments are implemented.
[0043] The method for identifying risky users in a social process provided by the embodiment of the present application obtains the social behavior data of the target network user in the social process, and the social behavior data of the target network user is used to describe the social violation data obtained by abnormal identification of the historical social behavior of the target network user; the social behavior data of the target network user is subjected to feature extraction to obtain the behavior feature data corresponding to the target network user; the behavior feature data corresponding to the target network user is input into the risk audit model, and the social risk level of the target network user is determined based on the output result of the risk audit model; based on the social risk level of the target network user, the social risk type of the target network user is determined; wherein the social risk type of the target network user includes: a first type and a second type, the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user. In this way, by extracting the behavior feature data of the target network user from the social violation data of the target network user, and determining the social risk level of the target network user through the risk audit model, and then determining the corresponding social risk type through the social risk level, the efficiency of identifying risky users in social activities can be effectively improved, and the probability of missed review of black and gray industries can be reduced.
[0044] The above description is only an overview of the technical solution of the embodiment of the present application. In order to more clearly understand the technical means of the embodiment of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments will be briefly described below. It should be noted that the drawings described below only relate to some embodiments of the present disclosure, but are not intended to limit the present disclosure, wherein:
[0046] Figure 1 It is a flowchart of a method for identifying risky users in a social process provided by the present disclosure.
[0047] Figure 2 It is a structural schematic diagram of a device for identifying risky users in a social process provided by the present disclosure.
[0048] Figure 3 It is a structural schematic diagram of a computer device provided by the present disclosure.
[0049] It should be noted that the elements in the drawings are schematic and not drawn to scale. DETAILED DESCRIPTION
[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work also fall within the scope of protection of the present disclosure.
[0051] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by a person skilled in the art to which the subject matter of the present disclosure belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the specification and the relevant art, and will not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. As used herein, a statement that two or more parts are "connected" or "coupled" together shall mean that the parts are joined together directly or through one or more intermediate components.
[0052] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase "embodiments" in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.
[0053] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists, A and B exist at the same time, and B exists. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship. Terms such as "first" and "second" are only used to distinguish one component (or a part of a component) from another component (or another part of a component).
[0054] In the description of the present application, unless otherwise specified, "plurality" means more than two (including two), and similarly, "multiple groups" means more than two groups (including two).
[0055] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.
[0056] Figure 1 is a flow chart of a method for identifying risky users in a social process provided by an embodiment of the present disclosure, such as Figure 1As shown in FIG. 1 , the specific process of the method for identifying risky users in the social process includes:
[0057] S110, obtaining social behavior data of target network users during the social process.
[0058] The social behavior data of the target network user is used to describe the social violation data obtained by performing anomaly identification on the historical social behavior of the target network user.
[0059] In some embodiments, obtaining the social behavior data of the target network user during the social process includes:
[0060] Acquire audit violation data of target network users; perform data cleaning on the audit violation data of target network users to obtain social behavior data of target network users during the social process.
[0061] Among them, the audit violation data of the target network user includes: social data of the target network user violating the behavioral norms or behavioral rules set in the social platform (this data is obtained from the platform's internal audit), violation data returned by third-party technical equipment when auditing the target network user's social data (such as the number of abnormal equipment, abnormal IP, illegal content, sensitive word triggering data, etc.), and social data of the target network user reported by other network users.
[0062] It should be noted that social platforms have established internal audit and machine audit rules for user registration, login, software use, etc., and provide a reporting portal. Violations of the rules and reports will be returned to the review background.
[0063] Since it has not yet been determined whether the data contained in the acquired audit violation data of the target network user is indeed violation data, it is necessary to perform data cleaning on the audit violation data of the target network user.
[0064] Data cleaning processing can be used to perform secondary violation determination on the audit violation data of the target network user to remove the social compliance data in the audit violation data of the target network user. For example, a trigger word for compliance data can be set, and the data contained in the audit violation data of the target network user can be matched with the trigger word, and the data matching the trigger word can be removed.
[0065] Therefore, by removing the social compliance data from the audit violation data of the target network user, it is convenient to ensure the accuracy of the violation data in the audit violation data of the target network user.
[0066] S120: Extract features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user.
[0067] Among them, the behavior characteristic data corresponding to the target network user may include: data corresponding to login and registration behavior and data corresponding to platform usage behavior. Login and registration behavior may include: login device, information registration, login IP; the data corresponding to login and registration behavior may include: login method, registration time, download channel, registration gender, etc. Usage behavior may include: recharge, identity authentication, social interaction, content release; the data corresponding to usage behavior may include: recharge amount, social interaction content, user attention, etc.
[0068] In some embodiments, feature extraction is performed on the social behavior data of the target network user to obtain the behavior feature data corresponding to the target network user, including:
[0069] The common characteristics of the social behavior data of the target network users are analyzed to obtain the common social data under different social dimensions; the behavior characteristics of the common social data under different social dimensions are extracted to obtain the corresponding behavior characteristic data of the target network users.
[0070] Among them, the common characteristics analysis is performed on the social behavior data of the target network users to extract the commonalities of different data included in the social behavior data of the target network users, so as to obtain social commonality data under different social dimensions.
[0071] Behavioral characteristics may include but are not limited to: a large number of new followers within a preset time period, batch message sending, whether the registration IP is consistent with the login IP, whether the authentication is passed, etc.
[0072] Therefore, by performing common feature analysis on the social behavior data of the target network users, we can obtain the social common data under different social dimensions, and then extract the behavioral features of the social common data under different social dimensions, so as to obtain the common behavioral feature data under multiple dimensions corresponding to the target network users.
[0073] S130: Inputting the behavior characteristic data corresponding to the target network user into the risk review model, and determining the social risk level of the target network user based on the output result of the risk review model.
[0074] Among them, the risk audit model is used to output the corresponding social risk level according to the input behavioral characteristic data, that is, the input of the risk audit model is the behavioral characteristic data of a network user, and the output is the social risk level of the network user.
[0075] For example, multiple social risk levels of network users can be set in the risk review model, such as level one social risk, level two social risk and level three social risk. The social risk of level one social risk is lower than that of level two social risk, and the social risk of level two social risk is lower than that of level three social risk.
[0076] In some embodiments, before inputting the behavior characteristic data corresponding to the target network user into the risk audit model and determining the social risk level of the target network user based on the output result of the risk audit model, the method further includes:
[0077] Acquire social behavior data of sample network users; perform feature extraction on the social behavior data of sample network users to obtain behavior feature data corresponding to the sample network users; train a preset network model based on the behavior feature data corresponding to the sample network users to obtain a risk review model.
[0078] The social behavior data of the sample network users is used to describe the social violation data obtained by performing anomaly identification on the historical social behaviors of the sample network users.
[0079] Acquiring the social behavior data of the sample network users may include: acquiring the audit violation data of the sample network users; performing data cleaning processing on the audit violation data of the sample network users to obtain the social behavior data of the sample network users.
[0080] Among them, the audit violation data of sample network users include: social data of sample network users violating the behavioral norms or behavioral rules set in the social platform (this data is obtained from the platform's internal audit), violation data returned by third-party technical equipment auditing the social data of sample network users (such as the number of abnormal equipment, abnormal IP, illegal content, sensitive word triggering data, etc.), and social data of sample network users reported by other network users.
[0081] Data cleaning processing can be used to perform secondary violation determination on the audit violation data of sample network users to remove social compliance data from the audit violation data of sample network users. For example, trigger words for compliance data can be set, and the data contained in the audit violation data of sample network users can be matched with the trigger words, and the data matching the trigger words can be removed.
[0082] The risk audit model includes: a first network branch, a second network branch and a third network branch. The first network branch is used to divide the behavioral feature data corresponding to the sample network users into label rules, the second network branch is used to set risk values for different label rules obtained by division, and the third network branch is used to predict the social risk level according to different risk values.
[0083] Therefore, a specific risk audit model is constructed through the behavioral characteristic data of network users, risk label values and risk label rules, which facilitates the accurate prediction of the social risk level of network users.
[0084] In some embodiments, the behavior characteristic data corresponding to the target network user is input into the risk audit model, and the social risk level of the target network user is determined based on the output result of the risk audit model, including:
[0085] The behavioral feature data corresponding to the target network user is input into the first network branch of the risk audit model to obtain the corresponding multiple risk label rules; the multiple risk label rules are input into the second network branch of the risk audit model to obtain the corresponding multiple risk label values; the multiple risk label values are input into the third network branch of the risk audit model to obtain the social risk level of the target network user.
[0086] The risk label rule may be a combination rule composed of multiple behavior feature data, that is, the risk label rule includes multiple behavior feature data, and accordingly, the behavior feature data included in different risk label rules are different. The risk label may be an identification name of a risk label rule.
[0087] For example, the behavioral characteristic data of a group of illegal users are summarized as follows: sending messages in batches, inconsistency between registered IP and login IP, abnormal SIM card status. These characteristic data can constitute a risk label rule, and the name of the rule, such as "IP abnormality", can be used as a risk label.
[0088] The second network branch in the risk audit model can be assigned different risk label values according to different risk label rules, and one risk label rule corresponds to one risk label value. Specifically, the risk label value corresponding to a risk label rule can be set according to each behavior feature data included in the risk label rule and the preset verification rule (which can be the verification condition / condition of a single data formulated by the platform). If a behavior feature data meets the preset verification rule, it corresponds to one risk value, and if a behavior feature data does not meet the preset verification rule, it corresponds to another risk value; finally, the sum of the risk values of each behavior feature data is the risk label value corresponding to the risk label rule.
[0089] Thus, the risk label rules are defined for the behavior feature data corresponding to the target network user through the first branch in the risk audit model, the risk label value is determined according to the defined risk label rules according to the second branch, and the social risk level of the target network user is determined based on multiple risk label values according to the third branch.
[0090] In some embodiments, the behavior characteristic data corresponding to the sample network user includes: a plurality of characteristic sub-data.
[0091] The method of this embodiment also includes:
[0092] The characteristic sub-data that triggers the preset risk rules in the behavioral characteristic data corresponding to the sample network users are stored in the risk pool; based on the characteristic sub-data included in the risk pool, the risk audit model is updated to optimize the risk audit model.
[0093] The risk pool includes: multiple characteristic sub-data that meet the preset risk rules. By conducting risk screening on each characteristic sub-data included in the risk pool, and obtaining risk audit results (such as whether the characteristic sub-data is risk data, the ban rate, or the number of banned users), the risk audit model is optimized according to the risk audit results.
[0094] Model optimization for the risk audit model is to expand or narrow the scope of risk labeling rules.
[0095] For example, if the number of users with violations under a certain risk tag is small but the amount of user data is large, the audit scope of the risk tag rules corresponding to the risk tag will be narrowed to reduce the audit workload; if the number of users with violations is large, the audit scope of the risk tag rules corresponding to the risk tag will be expanded to prevent missed inspections; if the amount of illegal user data is small, the risk tag itself can be modified. This makes it easier to quickly locate risky user groups and improve risk audit efficiency.
[0096] It should be noted that the risk label rules are adjusted and optimized based on the number of registered users and the proportion of illegal users among the registered users. If the number of registered users under a certain risk label rule is relatively small, the feature combination in a risk label rule will be reduced or the risk label rule will be modified, that is, the scope will be expanded to increase the number of registered users; if the proportion of illegal users among the registered users is too low, the corresponding risk label rule will be directly offline.
[0097] S140: Determine the social risk type of the target network user based on the social risk level of the target network user.
[0098] The target network user's social risk type includes: the first type and the second type, the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user. That is, if the target network user's social risk type is the first type, it means that the target network user is a social risk user, and will affect the normal social interaction of other network users in social activities; if the target network user's social risk type is the second type, it means that the target network user is a normal social user, and will not affect the normal social interaction of other network users in social activities or the impact on the normal social interaction of other network users is negligible.
[0099] In some embodiments, determining the social risk type of the target network user based on the social risk level of the target network user includes:
[0100] If the social risk level of the target network user meets the preset level condition, the social risk type of the target network user is determined to be the first type; if the social risk level of the target network user does not meet the preset level condition, the social risk type of the target network user is determined to be the second type.
[0101] In combination with the above examples, the social risk level of the target network user may be level one social risk, level two social risk, and level three social risk, and the preset level condition may be: level three risk level. Then, when the social risk level of the target network user is level one social risk or level two social risk, it is considered that the social risk level of the target network user does not meet the preset level condition, and the social risk type of the target network user is determined to be the second type; when the social risk level of the target network user is level three social risk, it is considered that the social risk level of the target network user meets the preset level condition, and the social risk type of the target network user is determined to be the first type.
[0102] Therefore, by matching the social risk level of the target network user with the preset level conditions, it is convenient to effectively determine the social risk type of the target network user.
[0103] In this embodiment, by obtaining the social behavior data of the target network user during the social process, the social behavior data of the target network user is used to describe the social violation data obtained by abnormal identification of the historical social behavior of the target network user; feature extraction is performed on the social behavior data of the target network user to obtain the behavior feature data corresponding to the target network user; the behavior feature data corresponding to the target network user is input into the risk audit model, and the social risk level of the target network user is determined based on the output result of the risk audit model; based on the social risk level of the target network user, the social risk type of the target network user is determined; wherein the social risk type of the target network user includes: a first type and a second type, the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user. In this way, by extracting the behavior feature data of the target network user from the social violation data of the target network user, and determining the social risk level of the target network user through the risk audit model, and then determining the corresponding social risk type through the social risk level, the efficiency of identifying risky users in social activities is effectively improved, and the probability of missed review of black and gray industries is reduced.
[0104] In addition, after determining the social risk type of the target network user, risk management and control can be performed for different social risk types. For example, when determining that the social risk type of the target network user is the first type, it is considered that the target network user has a greater impact in normal social activities, and operations such as blocking and suspicious prompt marking can be performed on the target network user; when determining that the social risk type of the target network user is the second type, it is considered that the target network user has a smaller impact in normal social activities, and operations such as mandatory authentication can be performed on the target network user.
[0105] If the target network user is marked as a suspect, it is determined that the target network user is identified as a suspect. For the target network user, subsequent data monitoring or regular review can be performed to facilitate regular monitoring of the risk level of the suspect user to ensure the social security of other network users in social activities.
[0106] Figure 2 This is a schematic diagram of the structure of a device for identifying risky users in a social process provided by this embodiment. The device for identifying risky users in a social process may include: an acquisition module 210, an extraction module 220, a first determination module 230 and a second determination module 240.
[0107] The acquisition module 210 is used to acquire the social behavior data of the target network user during the social process. The social behavior data of the target network user is used to describe the social violation data obtained by performing abnormal identification on the historical social behavior of the target network user.
[0108] The extraction module 220 is used to extract features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user.
[0109] The first determination module 230 is used to input the behavior characteristic data corresponding to the target network user into the risk review model, and determine the social risk level of the target network user based on the output result of the risk review model.
[0110] The second determination module 240 is configured to determine the social risk type of the target network user based on the social risk level of the target network user.
[0111] The social risk types of the target network users include: a first type and a second type, the first type is used to describe the social type corresponding to the social risk users, and the second type is used to describe the social type corresponding to the non-social risk users.
[0112] In this embodiment, optionally, the extraction module 220 is specifically used to:
[0113] The common characteristics of the social behavior data of the target network users are analyzed to obtain the common social data under different social dimensions; the behavior characteristics of the common social data under different social dimensions are extracted to obtain the corresponding behavior characteristic data of the target network users.
[0114] In this embodiment, optionally, the acquisition module 210 is specifically configured to:
[0115] Acquire audit violation data of target network users; perform data cleaning on the audit violation data of target network users to obtain social behavior data of target network users during social interaction; wherein the data cleaning is used to make violation determinations on the audit violation data of target network users to remove social compliance data from the audit violation data of target network users.
[0116] In this embodiment, optionally, it also includes: a model training module.
[0117] A model training module is used to obtain social behavior data of sample network users, the social behavior data of sample network users is used to describe social violation data obtained by abnormal identification of historical social behaviors of sample network users; feature extraction is performed on the social behavior data of sample network users to obtain behavior feature data corresponding to the sample network users; a preset network model is trained based on the behavior feature data corresponding to the sample network users to obtain a risk audit model; wherein the risk audit model includes: a first network branch, a second network branch and a third network branch, the first network branch is used to perform label rule division on the behavior feature data corresponding to the sample network users, the second network branch is used to set risk values for different label rules obtained by division, and the third network branch is used to predict social risk levels according to different risk values.
[0118] In this embodiment, optionally, the first determining module 230 is specifically configured to:
[0119] The behavioral feature data corresponding to the target network user is input into the first network branch of the risk audit model to obtain the corresponding multiple risk label rules; the multiple risk label rules are input into the second network branch of the risk audit model to obtain the corresponding multiple risk label values; the multiple risk label values are input into the third network branch of the risk audit model to obtain the social risk level of the target network user.
[0120] In this embodiment, optionally, the behavior characteristic data corresponding to the sample network user includes: a plurality of characteristic sub-data.
[0121] Also includes: Model optimization module.
[0122] The model optimization module is used to store the characteristic sub-data that triggers the preset risk rules in the behavioral characteristic data corresponding to the sample network users into the risk pool; based on the characteristic sub-data included in the risk pool, the risk audit model is updated to optimize the risk audit model.
[0123] In this embodiment, optionally, the second determining module 240 is specifically configured to:
[0124] If the social risk level of the target network user meets the preset level condition, the social risk type of the target network user is determined to be the first type; if the social risk level of the target network user does not meet the preset level condition, the social risk type of the target network user is determined to be the second type.
[0125] The device for identifying risky users in a social process provided by the present disclosure can execute the above method embodiments. Its specific implementation principles and technical effects can be found in the above method embodiments, and the present disclosure will not repeat them here.
[0126] The present application also provides a computer device. Figure 3 , Figure 3 This is a basic structural block diagram of the computer device in this embodiment.
[0127] The computer device includes a memory 310 and a processor 320 that are connected to each other through a system bus. It should be noted that the figure only shows a computer device with a memory 310 and a processor 320, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.
[0128] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.
[0129] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes a non-volatile memory or a volatile memory, for example, a flash memory, a hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc., and the RAM may include a static RAM or a dynamic RAM. In some embodiments, the memory 310 may be an internal storage unit of a computer device, for example, a hard disk or a memory of the computer device. In other embodiments, the memory 310 may also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, or a flash card (FlashCard) equipped on the computer device. Of course, the memory 310 may also include both the internal storage unit of the computer device and its external storage device. In this embodiment, the memory 310 is generally used to store the operating system and various application software installed on the computer device, such as the program code of the above method. In addition, the memory 310 may also be used to temporarily store various data that have been output or are to be output.
[0130] The processor 320 is generally used to perform the overall operation of the computer device. In this embodiment, the memory 310 is used to store program codes or instructions, the program code includes computer operation instructions, and the processor 320 is used to execute the program codes or instructions stored in the memory 310 or process data, such as running the program code of the above method.
[0131] In this article, the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus system can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
[0132] Another embodiment of the present application also provides a computer-readable medium, which may be a computer-readable signal medium or a computer-readable medium. A processor in a computer reads a computer-readable program code stored in the computer-readable medium, so that the processor can execute the functional actions specified in each step or a combination of steps in the above method; and generate a device for implementing the functional actions specified in each block or a combination of blocks in the block diagram.
[0133] Computer-readable media include but are not limited to electronic, magnetic, optical, electromagnetic, infrared memory or semiconductor systems, devices or apparatuses, or any appropriate combination of the foregoing, the memory is used to store program codes or instructions, the program codes include computer operating instructions, and the processor is used to execute the program codes or instructions of the above methods stored in the memory.
[0134] For the definitions of memory and processor, please refer to the description of the aforementioned computer device embodiment and will not be repeated here.
[0135] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0136] Each functional unit or module in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0137] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.
[0138] In the claims, any reference symbols placed between brackets shall not be construed as limiting the claims. The word "comprising" described in the present application does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application can be implemented with the aid of hardware comprising several different elements and with the aid of a suitably programmed computer. In a unit claim that lists a number of devices, several units of these devices may be embodied by the same hardware item. The use of first, second, and third, etc. does not indicate any order, and these words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.
[0139] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for identifying risky users in a social process, characterized in that: include: Acquire social behavior data of a target network user during a social process, wherein the social behavior data of the target network user is used to describe social violation data obtained by performing abnormal identification on historical social behaviors of the target network user; Extracting features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user; Inputting the behavior characteristic data corresponding to the target network user into a risk audit model, and determining the social risk level of the target network user based on the output result of the risk audit model; Determining the social risk type of the target network user based on the social risk level of the target network user; The social risk types of the target network user include: a first type and a second type, wherein the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user.
2. The method according to claim 1, characterized in that The step of extracting features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user includes: Performing common feature analysis on the social behavior data of the target network user to obtain social commonality data under different social dimensions; Behavioral features are extracted from social commonality data under different social dimensions to obtain behavioral feature data corresponding to the target network user.
3. The method according to claim 1, characterized in that The step of obtaining the social behavior data of the target network user during the social process includes: Obtain audit violation data of the target network user; Performing data cleaning on the audit violation data of the target network user to obtain the social behavior data of the target network user during the social process; The data cleaning process is used to make a violation determination on the audit violation data of the target network user, so as to remove the social compliance data in the audit violation data of the target network user.
4. The method according to claim 1, characterized in that: Before inputting the behavior characteristic data corresponding to the target network user into the risk audit model and determining the social risk level of the target network user based on the output result of the risk audit model, the method further includes: Acquire social behavior data of sample network users, where the social behavior data of the sample network users is used to describe social violation data obtained by performing abnormal identification on historical social behaviors of the sample network users; Extracting features from the social behavior data of the sample network users to obtain behavior feature data corresponding to the sample network users; Training a preset network model based on the behavioral feature data corresponding to the sample network users to obtain the risk audit model; Among them, the risk audit model includes: a first network branch, a second network branch and a third network branch. The first network branch is used to divide the behavioral feature data corresponding to the sample network users into label rules, the second network branch is used to set risk values for different label rules obtained by division, and the third network branch is used to predict social risk levels according to different risk values.
5. The method according to claim 4, characterized in that The step of inputting the behavior characteristic data corresponding to the target network user into a risk audit model, and determining the social risk level of the target network user based on an output result of the risk audit model, includes: Inputting the behavior feature data corresponding to the target network user into the first network branch in the risk audit model to obtain corresponding multiple risk label rules; Inputting the plurality of risk label rules into the second network branch in the risk audit model to obtain a plurality of corresponding risk label values; The plurality of risk tag values are input into the third network branch in the risk audit model to obtain the social risk level of the target network user.
6. The method according to claim 4, characterized in that The behavior characteristic data corresponding to the sample network user includes: a plurality of characteristic sub-data; The method further comprises: The characteristic sub-data triggering the preset risk rules in the behavior characteristic data corresponding to the sample network users are stored in the risk pool; Based on the characteristic sub-data included in the risk pool, the risk audit model is updated to optimize the risk audit model.
7. The method according to claim 1, characterized in that The determining the social risk type of the target network user based on the social risk level of the target network user includes: If the social risk level of the target network user meets the preset level condition, determining that the social risk type of the target network user is the first type; If the social risk level of the target network user does not meet the preset level condition, it is determined that the social risk type of the target network user is the second type.
8. A device for identifying risky users in a social process, characterized in that: include: An acquisition module is used to acquire social behavior data of a target network user during a social process, wherein the social behavior data of the target network user is used to describe social violation data obtained by performing abnormal identification on the historical social behavior of the target network user; An extraction module, used to extract features from the social behavior data of the target network user to obtain behavior feature data corresponding to the target network user; A first determination module, configured to input the behavior characteristic data corresponding to the target network user into a risk audit model, and determine the social risk level of the target network user based on an output result of the risk audit model; A second determination module, configured to determine a social risk type of the target network user based on the social risk level of the target network user; The social risk types of the target network user include: a first type and a second type, wherein the first type is used to describe the social type corresponding to the social risk user, and the second type is used to describe the social type corresponding to the non-social risk user.
9. A computer device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a method for identifying risky users in a social process as claimed in any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying risky users in a social process as described in any one of claims 1 to 7 is implemented.