Risk object identification method and device, equipment, storage medium and program product

Abstract

The invention provides a risk object recognition method and device, equipment, a storage medium and a program product, and relates to the technical field of computer technologies, in particular to the technical field of entity object recognition. The method comprises the following steps: extracting number information in a target object; searching entity information corresponding to the number information in a preset entity library, wherein the preset entity library is obtained by extracting the entity information from the target object; aggregating the corresponding entity information based on the number information; and determining that the target object belongs to the risk object in response to determining that the aggregation result contains the same number information corresponding to a plurality of different entity information. According to the invention, the possible risk number is mined by using the corresponding relationship between the entity and the number, so that the accuracy of identifying the risk object can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, specifically to the field of entity object identification technology, and in particular to a risk object identification method, device, equipment, storage medium and program product. Background Art

[0002] Black and gray industries publish false information on various authoritative content publishing platforms. When users search for search terms such as "service phone" and "after-sales hotline" of corresponding companies, due to the authority of the content publishing platform, the corresponding false information will usually be ranked first or near the front of the search engine, which can easily lead to users being defrauded by contacting the corresponding institutions of false information. Such problems not only cause serious economic losses to search users, but also have a serious impact on the reputation of search engines. Summary of the invention

[0003] The embodiments of the present disclosure provide a risk object identification method, apparatus, device, storage medium, and program product.

[0004] In a first aspect, an embodiment of the present disclosure proposes a risk object identification method, including: extracting number information from a target object; searching for entity information corresponding to the number information in a preset entity library, the preset entity library being obtained by extracting entity information from the target object; aggregating the corresponding entity information based on the number information; in response to determining that the aggregation result contains the same number information corresponding to multiple different entity information, determining that the target object is a risk object.

[0005] In the second aspect, an embodiment of the present disclosure proposes a risk object identification device, including: a number extraction module, configured to extract number information from a target object; an entity search module, configured to search for entity information corresponding to the number information in a preset entity library, the preset entity library is obtained by extracting entity information from the target object; an aggregation module, configured to aggregate the corresponding entity information based on the number information; an object identification module, configured to determine that the target object belongs to a risk object in response to determining that the aggregation result contains the same number information corresponding to multiple different entity information.

[0006] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that when the at least one processor executes, it is able to implement the risk object identification method described in any implementation method in the first aspect.

[0007] In a fourth aspect, an embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, which are used to enable a computer to implement the risk object identification method described in any implementation method of the first aspect when executed.

[0008] In a fifth aspect, an embodiment of the present disclosure provides a computer program product comprising a computer program, which, when executed by a processor, can implement the risk object identification method as described in any implementation manner in the first aspect.

[0009] The risk object identification method provided by the embodiment of the present disclosure extracts the number information in the target object and queries the corresponding entity information, and uses the correspondence between the entity and the number to mine possible risk numbers, which can improve the accuracy of identifying risk objects. At the same time, it does not require additional computing resources and is very suitable for number analysis and mining scenarios in large-scale scenarios.

[0010] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Other features, objects and advantages of the present disclosure will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0012] Figure 1 is an exemplary system architecture in which the present disclosure may be applied;

[0013] Figure 2 A flowchart of a risk object identification method provided by an embodiment of the present disclosure;

[0014] Figure 3 A flowchart of another risk object identification method provided by an embodiment of the present disclosure;

[0015] Figure 4 A flowchart of another risk object identification method provided by an embodiment of the present disclosure;

[0016] Figure 5 A schematic diagram of a process for identifying a risk object in an application scenario provided by an embodiment of the present disclosure;

[0017] Figure 6 A schematic diagram of an application example of a risk object identification method provided by an embodiment of the present disclosure;

[0018] Figure 7 A structural block diagram of a risk object identification device provided by an embodiment of the present disclosure;

[0019] Figure 8 A schematic diagram of the structure of an electronic device suitable for executing a risk object identification method provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0020] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description. It should be noted that the embodiments in the present disclosure and the features in the embodiments may be combined with each other without conflict.

[0021] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0022] Figure 1 An exemplary system architecture 100 is shown to which embodiments of the risk object identification method, apparatus, electronic device, and computer-readable storage medium of the present disclosure can be applied.

[0023] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0024] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Terminal devices 101, 102, 103 and server 105 can be installed with various applications for realizing information communication between the two, such as browser applications, search engine applications, instant messaging applications, etc.

[0025] Terminal devices 101, 102, 103 and server 105 can be hardware or software. When terminal devices 101, 102, 103 are hardware, they can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc.; when terminal devices 101, 102, 103 are software, they can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules, or as a single software or software module, and no specific limitation is made here. When server 105 is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or as a single server; when the server is software, it can be implemented as multiple software or software modules, or as a single software or software module, and no specific limitation is made here.

[0026] The risk object identification method provided in the subsequent embodiments of the present disclosure is generally executed by the server 105, and accordingly, the risk object identification device can generally be set in the server 105. However, it should also be pointed out that when the terminal devices 101, 102, and 103 also have computing capabilities and computing resources that meet the requirements, the terminal devices 101, 102, and 103 can also complete the above-mentioned various operations that are handed over to the server 105 through the browser-type applications installed thereon, and then output the same results as the server 105. Especially in the case where there are multiple terminal devices with different computing capabilities at the same time, but when the browser-type application determines that the terminal device where it is located has a stronger computing capability and more remaining computing resources, it can allow the terminal device to perform the above-mentioned operations, thereby appropriately reducing the computing pressure of the server 105. Accordingly, the risk object identification device can also be set in the terminal devices 101, 102, and 103. In this case, the exemplary system architecture 100 may also not include the server 105 and the network 104.

[0027] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0028] Please refer to Figure 2 , Figure 2 This is a flow chart of a risk object identification method provided by an embodiment of the present disclosure, wherein process 200 includes the following steps:

[0029] Step 201: extracting number information from a target object;

[0030] In this embodiment, the execution subject of the risk object identification method (for example Figure 1The server 105 or terminal devices 101, 102, 103 shown in the figure obtains the number information in the target object, wherein the target object may refer to the web page clicked by the user when surfing the Internet in the browser, or the search result page obtained by searching through a search engine application or a web version search engine. Accordingly, the execution subject may extract the number information from the browser page or the search result page in the search engine application or the web version search engine.

[0031] In some optional implementations of this embodiment, the process of extracting the number information may be to identify the text of preset keywords (such as "customer service, number, hotline, contact number", etc.) in the target object. Then, the text information around the keyword is extracted, because a certain amount of text before and after the above keyword usually records specific number information. In an optional implementation, the number information may be further extracted from the text information through a number regular expression.

[0032] Step 202: searching for entity information corresponding to the number information in a preset entity library;

[0033] In this embodiment, after the execution subject extracts the number information from the target object, it can compare the number information with the entity information in a preset entity library to find the entity information corresponding to the number information. Among them, the entity can refer to a corporate entity, an institutional entity, a unit entity, an organizational entity, etc. The preset entity library is obtained by extracting entity information from the target object, and the entity extraction capability is used to extract entities that appear in the web page no less than a certain number of times (for example, no less than 5 times, etc.). In some optional implementations of this embodiment, entity extraction can be performed through a common named entity recognition (Named-entity recognition, NER) model to extract corporate entities; it can also be performed by instructions to allow the large model to extract entities, and by designing a specific prompt (prompt word paradigm, which is a text paragraph provided when the user interacts with the AI ​​model, used to describe the information, answers, text, etc. that the user wants to obtain from the model) using the large model to extract corporate entities, and a small number of examples are given to improve the accuracy of entity extraction. For example, the prompt can be referenced as follows:

[0034] “I hope you can act as a data annotation expert. You need to extract and output the company entities in the text. If there is an entity for drainage, directly output the entity type and its text; if not, directly output that it does not exist.

[0035] Some examples are given below. Please study them carefully and then label the input data.

[0036] Input: If you need to contact the customer service staff of operator X, you can dial xxxxx directly. Output: Operator X

[0037] Input: Y company smart door lock 24-hour service hotline number yyyy. Output: Y company

[0038] Input: Beijing Z Company’s fingerprint lock nationwide after-sales service numbers. Output: Beijing Z Company Input: M Company’s travel service center phone number. Output: M Company’s travel service center”.

[0039] Step 203: Aggregate the corresponding entity information based on the number information;

[0040] In this embodiment, after determining the number information and its corresponding entity information, the execution subject can make a specific analysis of the number information and entity information. For example, for the same number information, the entity information corresponding to it is aggregated to determine how many entity information the same number information corresponds to. For example, a user searches for "home appliance industry related companies", and in the content displayed on the search results page, there are: home appliance company 1, customer service phone number: 11111, website link: ...; home appliance company 2, service hotline: 11111, website link: ...; home appliance group 3, contact number: 11111, website link: ... and so on. Accordingly, the execution subject can extract from the page that the number information 11111 corresponds to home appliance company 1, home appliance company 2, and home appliance group 3 respectively. At this time, by aggregating the entity information corresponding to the number information 11111, the aggregation result obtained can show that the enterprise entity corresponding to the number information 11111 is not a single one, but three different enterprise entities.

[0041] Step 204: In response to determining that the aggregation result includes the same number information corresponding to multiple different entity information, determining that the target object is a risk object.

[0042] The main logic for judging whether an object is a risk is that, through analysis of a large amount of data, it was found that when black and gray industries (usually referring to telecommunications fraud, phishing websites, Trojan viruses, hacker extortion and other activities that use the Internet to carry out illegal and criminal activities) publish false information on various authoritative content publishing platforms, since virtual number resources are relatively precious resources, the same virtual number will be reused to impersonate multiple entities.

[0043] Based on this, in this embodiment, after determining the aggregation of the entity information corresponding to the number information, the execution subject analyzes the aggregation results to determine whether the same number information corresponds to multiple entity information in the aggregation results. If there is a situation where the same number information corresponds to multiple entity information, based on the judgment logic described above, the number information is determined as a risky number, and the target object is determined as a risky object. In other words, the number information is likely to belong to a virtual number published by a phishing website, a gambling website, or other black and gray industries, and the webpage that publishes the number is likely to belong to a phishing website, a gambling website, or other black and gray industries.

[0044] Correspondingly, if it is determined that in the aggregation result, the same number information only corresponds to the same entity information, it means that the number information is basically a safe number, and the target object can be determined to be a safe object.

[0045] The risk object identification method provided by the embodiment of the present disclosure extracts the number information in the target object and queries the corresponding entity information, and uses the correspondence between the entity and the number to mine possible risk numbers, which can improve the accuracy of identifying risk objects. At the same time, it does not require additional computing resources and is very suitable for number analysis and mining scenarios in large-scale scenarios.

[0046] In this embodiment, the risk object identification process implemented by the execution subject is mainly based on the number information identified and the number of corresponding entity information to determine whether the number information is a risk number. In actual applications, there may be some special circumstances in the entity information obtained from the target object (such as a web page), which may cause the execution subject to make a misjudgment, thereby affecting the recognition accuracy of the execution subject.

[0047] For the above situation, please refer to Figure 3 , Figure 3 This is a flow chart of another risk object identification method provided by an embodiment of the present disclosure, wherein process 300 includes the following steps:

[0048] Step 301: extracting number information from a target object;

[0049] Step 302: Searching for entity information corresponding to the number information in a preset entity library;

[0050] Step 303: Aggregate the corresponding entity information based on the number information;

[0051] Step 304: In response to determining that the aggregation result includes the same number information corresponding to multiple different entity information, determining that the target object is a risk object;

[0052] The above steps 301-304 are similar to Figure 2Steps 201-204 shown are consistent, and for the same contents, please refer to the corresponding parts of the previous embodiment, which will not be repeated here.

[0053] Step 305: obtaining feedback information in response to the target object being determined to be a risk object;

[0054] In this embodiment, in the entity information obtained from the target object (such as a webpage), there may be special cases, such as Company A belonging to a group company, which has branches and subsidiaries in multiple regions, including Company A Beijing Branch, Company A Hebei Branch, Company A Chongqing Branch, etc. At this time, even if the actual customer service phone number 400-800-XXXX of Company A is a real phone number, as a switchboard, it may also correspond to three different companies, namely Company A Beijing Branch, Company A Hebei Branch, and Company A Chongqing Branch, so it is possible that the customer service phone number 400-800-XXXX will also be identified as a risky phone number.

[0055] In order to further improve the recognition accuracy, in this embodiment, the execution subject may further obtain feedback information on the recognition result, and the feedback information may be, for example, feedback from users, feedback from related entities, feedback from subjects identified as risk objects, etc.

[0056] Step 306: Based on the feedback information, adjust the number of multiple different entity information corresponding to the same number information.

[0057] In this embodiment, if the feedback information received is that a number is mistakenly identified as a risk number too many times, it may mean that for the number, although it corresponds to multiple different entities, these entities may be branches or companies belonging to the same overall entity (such as the situation of Group A described in the above embodiment). Then, after verification, the number of different entities corresponding to the number can be adjusted, and the threshold of this number can be increased, so as to filter out as much as possible the actually normal situations.

[0058] In actual applications, when the feedback received is from a subject identified as a risk object, another method can be used to filter it. After verification, if the subject is actually a safe subject, the subject can be stored in a preset whitelist library to prevent the subject from being mistakenly identified as a risk number again.

[0059] The risk object identification method provided by the embodiment of the present disclosure extracts the number information in the target object and queries the corresponding entity information, and uses the correspondence between the entity and the number to mine possible risk numbers. It also adds a feedback verification mechanism to verify the feedback and adjust the judgment criteria accordingly, thereby avoiding some misjudgments and further improving the accuracy of risk object identification.

[0060] In actual applications, some specific numbers may be authenticated as safe numbers or risky numbers. For such numbers, the execution subject of this embodiment can also filter them according to the specific situation of the number information after extracting the number information. Figure 4 , Figure 4 This is a flow chart of another risk object identification method provided by an embodiment of the present disclosure, wherein process 400 includes the following steps:

[0061] Step 401: extracting number information from the target object;

[0062] The above step 401 is similar to Figure 2 The step 201 shown is consistent, and the same content can be found in the corresponding part of the previous embodiment, which will not be repeated here.

[0063] Step 405: In response to determining that the number information belongs to a preset number blacklist, determining that the target object is a risk object;

[0064] In this embodiment, the screening process set up can be to compare the number information with a preset number blacklist. If the number information is in the preset number blacklist, it means that the number information has been registered as a risk number by the relevant regulatory department, or it has been verified that the number is indeed a risk number. At this time, the number information can be directly determined as a risk number, and the corresponding target object can be determined as a risk object.

[0065] In some optional implementations of this embodiment, a part of the samples in the preset blacklist may be risk data (e.g., fraud-related data) issued by relevant regulatory authorities (e.g., the Ministry of Industry and Information Technology, the National Anti-Fraud Center, and other regulatory units), and the numbers recorded in the fraud-related data are the number information that has been determined to be risk numbers; another part may also be marking data from users, and a marking blacklist threshold may be set for the user marking data, that is, for the number information suspected of being a risk number marked by the user, if the same number is marked no less than a certain threshold (e.g., 20 times), the number is also determined to be a risk number, which can improve the accuracy of the marking. Then, the number information determined by these two parts is combined to construct the preset number blacklist.

[0066] In this way, it is possible to accurately identify whether the target object's number is a risky number, and it can also save processes to a large extent and improve the efficiency of identifying risky objects.

[0067] It is understandable that, in actual implementation, the preset number blacklist may not be static. For number information that was not originally on the number blacklist, if it is still judged as a risk number in the subsequent process, or is further verified to be a risk number, the number can be stored in the number blacklist and the number blacklist can be updated to avoid slipping through the net and further improve the recognition accuracy of blacklist numbers.

[0068] Step 406: In response to determining that the number information belongs to a preset number whitelist, determining that the target object is a safe object;

[0069] In some optional implementations of this embodiment, in addition to the preset number blacklist, a preset number whitelist can also be set. The number whitelist can be official telephone information obtained through the yellow pages, and telephone information that is verified by the regulatory authorities to be a real number. After the number information is extracted, if it is determined that the number information belongs to the preset number whitelist, it means that the number is a trustworthy and safe number, and the corresponding target object is determined as a safe object.

[0070] Similarly, the preset number whitelist is not static. For number information that was not originally on the number whitelist, if it is judged as a safe number in the subsequent process, or is further verified to be a safe number, the number can be stored in the number whitelist and the number whitelist can be updated to avoid being misjudged as a risky number, thereby further improving the recognition accuracy of whitelist numbers.

[0071] It should be noted that there is no causal or dependency relationship between the process of querying numbers in the blacklist library implemented by step 405 and the process of querying numbers in the whitelist library implemented by step 406. They do not need to be applied in one embodiment at the same time. They can be applied in different embodiments to query numbers in the blacklist library or to query numbers in the whitelist library as needed. This embodiment exists only as a preferred embodiment that simultaneously includes two specific implementations.

[0072] Furthermore, the process steps in this embodiment are not limited in the order of execution of the steps by the order of the size of the serial numbers. Without departing from the teachings of the present disclosure, the execution order of the steps in this embodiment can be adjusted. For example, the above-mentioned steps 405 and 406 can be performed by executing step 405 first and then step 406, or by executing step 406 first and then step 405. This embodiment is not limited to this.

[0073] If it is determined through the above process that the extracted number information does not belong to the number blacklist or the number whitelist, continue to execute the following process.

[0074] Step 402: searching for entity information corresponding to the number information in a preset entity library;

[0075] Step 403: Aggregate the corresponding entity information based on the number information;

[0076] Step 404: In response to determining that the aggregation result includes the same number information corresponding to multiple different entity information, determining that the target object is a risk object;

[0077] The above steps 402-404 are similar to Figure 2 Steps 202-204 shown are consistent, and for the same contents, please refer to the corresponding parts of the previous embodiment, which will not be repeated here.

[0078] The risk object identification method provided by the embodiment of the present disclosure extracts the number information in the target object and queries the corresponding entity information. It uses the correspondence between the entity and the number to mine possible risk numbers. In combination with the blacklist and whitelist mechanisms, on the one hand, it can realize accurate identification of number information. On the other hand, it can save the overall identification process to a certain extent and improve processing efficiency.

[0079] To deepen understanding, the present disclosure also provides a specific implementation solution in combination with a specific application scenario, see Figure 5 Flow 500 is shown.

[0080] Step 501: When a user searches for "home appliance repair" on a web page, the corresponding search result page is preliminarily screened to retain only text containing keywords such as customer service, number, hotline, etc.;

[0081] Step 502: extract the text around the above keywords, and extract the number using the number regular expression;

[0082] Step 503: Determine whether the number is in the blacklist database. If yes, directly determine that the number is a risky number and the webpage has a problem and is a risky page.

[0083] Step 504: If the number does not belong to the blacklist library, determine whether the number hits the whitelist library, and if so, directly determine that the number is a safe number and the webpage is a safe webpage;

[0084] Step 505: If the number does not belong to the white list library or the black list library, the extracted number is searched for a corresponding enterprise entity in the preset enterprise entity library to find the enterprise entity corresponding to the number;

[0085] Step 506: For the same number, aggregate data of the corresponding enterprise entity;

[0086] Step 507: After data aggregation, the corresponding relationship between the unknown number and the entity is determined. If the number corresponds to multiple different corporate entities at the same time, the number is determined to be a risky number and the webpage is determined to be a risky webpage. Figure 6 As shown, based on the user's search results for "home appliance repair", it is identified that the number "111-2222-333" corresponds to three different corporate entities (Company A, Company B, and Group C) at the same time. The number can be determined as a risky number, and the web page where the number appears can be determined as a risky web page.

[0087] Further references Figure 7 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a risk object identification device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0088] like Figure 7 As shown, the risk object identification device 700 of this embodiment may include: a number extraction module 701, an entity search module 702, an aggregation module 703 and an object identification module 704. Among them, the number extraction module 701 is configured to extract the number information in the target object; the entity search module 702 is configured to search for the entity information corresponding to the number information in the preset entity library, and the preset entity library is obtained by extracting the entity information from the target object; the aggregation module 703 is configured to aggregate the corresponding entity information based on the number information; the object identification module 704 is configured to determine that the target object belongs to the risk object in response to determining that the same number information corresponds to multiple different entity information in the aggregation result.

[0089] In some optional implementations of this embodiment, the number extraction module 701 includes: a keyword recognition submodule, configured to recognize keyword information in the target object; and a number extraction submodule, configured to extract the number information based on the keyword information.

[0090] In some optional implementations of this embodiment, the number extraction submodule includes: a text extraction unit, configured to extract a preset number of text information before and after the keyword information appears; a number extraction unit, configured to extract the number in the text information using a number regular expression to obtain the number information.

[0091] In this embodiment, in the risk object identification device 700, the specific processing of the number extraction module 701, the entity search module 702, the aggregation module 703 and the object identification module 704 and the technical effects thereof can be referred to respectively. Figure 2 The relevant descriptions of steps 201 - 204 in the corresponding embodiment are not repeated here.

[0092] This embodiment exists as an apparatus embodiment corresponding to the above-mentioned method embodiment. The risk object identification device provided by this embodiment extracts the number information in the target object and queries the corresponding entity information, and uses the correspondence between the entity and the number to mine possible risk numbers, which can improve the accuracy of identifying risk objects. At the same time, it does not require additional computing resources and is very suitable for number analysis and mining scenarios in large-scale scenarios.

[0093] In some optional implementations of this embodiment, the risk object identification device further includes: an adjustment module, configured to obtain feedback information in response to the target object being determined to be a risk object; based on the feedback information, adjust the number of multiple different entity information corresponding to the same number information. The specific processing of the adjustment module and the technical effects brought about by it can be referred to respectively Figure 3 The relevant descriptions of step 305 and step 306 in the corresponding embodiment will not be repeated here.

[0094] In some optional implementations of this embodiment, the object identification module 704 is further configured to: in response to determining that the same number information contained in the aggregation result only corresponds to the same entity information, determine that the target object belongs to a secure object.

[0095] In some optional implementations of this embodiment, the object identification module 704 is further configured to: in response to determining that the number information belongs to a preset number blacklist, determine that the target object is a risk object.

[0096] In some optional implementations of this embodiment, the object identification module 704 is further configured to: in response to determining that the number information belongs to a preset number whitelist, determine that the target object belongs to a safe object.

[0097] The specific processing of the object recognition module 704 and the technical effects thereof can be referred to respectively. Figure 4 The relevant descriptions of step 405 and step 406 in the corresponding embodiment will not be repeated here.

[0098] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the risk object identification method described in any of the above embodiments can be implemented when the at least one processor executes.

[0099] According to an embodiment of the present disclosure, the present disclosure further provides a readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to implement the risk object identification method described in any of the above embodiments when executed.

[0100] According to an embodiment of the present disclosure, the present disclosure further provides a computer program product, which, when executed by a processor, can implement the risk object identification method described in any of the above embodiments.

[0101] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0102] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0103] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0104] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as the risk object identification method. For example, in some embodiments, the risk object identification method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the risk object identification method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the risk object identification method in any other appropriate manner (e.g., by means of firmware).

[0105] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0107] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0108] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0109] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0110] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0111] According to the technical solution of the embodiment of the present disclosure, the number information in the target object is extracted, and the corresponding entity information is queried. The corresponding relationship between the entity and the number is used to mine possible risk numbers, which can improve the accuracy of identifying risk objects. At the same time, no additional computing resources are required, which is very suitable for number analysis and mining scenarios in large-scale scenarios.

[0112] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0113] The above specific implementation does not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for identifying a risk object, comprising: Extract the number information from the target object; Searching for entity information corresponding to the number information in a preset entity library, wherein the preset entity library is obtained by extracting entity information from the target object; Aggregating corresponding entity information based on the number information; In response to determining that the aggregation result includes the same number information corresponding to a plurality of different entity information, it is determined that the target object is a risk object.

2. The risk object identification method according to claim 1, wherein: The step of extracting the number information from the target object includes: Identifying keyword information in the target object; The number information is extracted based on the keyword information.

3. The risk object identification method according to claim 2, wherein: The extracting the number information based on the keyword information includes: Extracting a preset number of text information before and after the keyword information; The number in the text information is extracted using a number regular expression to obtain the number information.

4. The risk object identification method according to claim 1, wherein: The preset entity library is constructed by extracting entity names whose occurrence times exceed a preset number in the target object through named entity recognition.

5. The risk object identification method according to claim 1, wherein: The preset entity library is obtained by extracting entities from the target object based on preset examples using a large language model.

6. The risk object identification method according to any one of claims 1 to 5, wherein: The risk object identification method further includes: Acquiring feedback information in response to determining that the target object is a risk object; Based on the feedback information, the quantity of the multiple different entity information corresponding to the same number information is adjusted.

7. The risk object identification method according to any one of claims 1 to 5, wherein: The risk object identification method further includes: In response to determining that the same number information contained in the aggregation result only corresponds to the same entity information, it is determined that the target object belongs to a secure object.

8. The risk object identification method according to any one of claims 1 to 5, wherein: After extracting the number information from the target object, the risk object identification method further includes: In response to determining that the number information belongs to a preset number blacklist, it is determined that the target object is a risk object.

9. The risk object identification method according to claim 8, wherein: The process of constructing the preset number blacklist includes: Obtain risk data determined by the supervisory unit and marking data of the user, wherein the risk data includes first number information determined as a risk number, and the marking data includes second number information marked by the user as a suspected risk number; Determine the second number information, which is marked as a suspected risk number a number of times not less than a preset threshold, as a risk number; The preset number blacklist is constructed based on the first number information and the second number information determined to be a risky number.

10. The risk object identification method according to any one of claims 1 to 5, wherein: After extracting the number information from the target object, the risk object identification method further includes: In response to determining that the number information belongs to a preset number whitelist, it is determined that the target object belongs to a safe object.

11. A risk object identification device, comprising: A number extraction module is configured to extract number information from a target object; An entity search module is configured to search for entity information corresponding to the number information in a preset entity library, wherein the preset entity library is obtained by extracting entity information from the target object; an aggregation module, configured to aggregate corresponding entity information based on the number information; The object identification module is configured to determine that the target object is a risk object in response to determining that the aggregation result contains the same number information corresponding to multiple different entity information.

12. The risk object identification device according to claim 11, wherein: The number extraction module comprises: A keyword identification submodule, configured to identify keyword information in the target object; The number extraction submodule is configured to extract the number information based on the keyword information.

13. The risk object identification device according to claim 12, wherein: The number extraction submodule includes: A text extraction unit, configured to extract a preset number of text information before and after the keyword information appears; The number extraction unit is configured to extract the number in the text information by using a number regular expression to obtain the number information.

14. The risk object identification device according to claim 11, wherein: The preset entity library is constructed by extracting entity names whose occurrence times exceed a preset number in the target object through named entity recognition.

15. The risk object identification device according to claim 11, wherein: The preset entity library is obtained by extracting entities from the target object based on preset examples using a large language model.

16. The risk object identification device according to any one of claims 11 to 15, wherein: The risk object identification device also includes: The adjustment module is configured to obtain feedback information in response to the determination that the target object is a risk object; based on the feedback information, adjust the number of multiple different entity information corresponding to the same number information.

17. The risk object identification device according to any one of claims 11 to 15, wherein: The object recognition module is further configured to: In response to determining that the same number information contained in the aggregation result only corresponds to the same entity information, it is determined that the target object belongs to a secure object.

18. The risk object identification device according to any one of claims 11 to 15, wherein: The object recognition module is further configured to: In response to determining that the number information belongs to a preset number blacklist, it is determined that the target object is a risk object.

19. The risk object identification device according to any one of claims 11 to 15, wherein: The object recognition module is further configured to: In response to determining that the number information belongs to a preset number whitelist, it is determined that the target object belongs to a safe object.

20. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the risk object identification method according to any one of claims 1 to 10.

21. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the risk object identification method according to any one of claims 1 to 10.

22. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the risk object identification method according to any one of claims 1 to 10 are implemented.

Images