Playing stealing user identification method and device, electronic equipment and storage medium

Abstract

The invention relates to a broadcast stealing user identification method and apparatus, an electronic device and a storage medium. The method comprises the steps of obtaining a historical playing behavior data set corresponding to each historical user in a historical user set; determining a historical user risk type corresponding to each historical user in the historical user set; training a preset machine learning model by using the historical playing behavior data set and the historical user risk type corresponding to each historical user in the historical user set to obtain a first recognition model; and when a target playing behavior data set corresponding to the target user is obtained, identifying the target user according to the target playing behavior data set and the first identification model to obtain a target user risk type corresponding to the target user. According to the invention, the situation that only a very few users can be identified in one day in the prior art is avoided, and the accuracy of identifying the broadcast stealing users is improved.

Description

Technical Field

[0001] The present application relates to the technical field of user identification, and in particular to a method, device, electronic device and storage medium for identifying pirated broadcast users. Background Art

[0002] Video piracy is a difficult problem that has long plagued major streaming media. After a video is pirated by a user, the pirate will post the pirated video to online storage, personal websites, etc. to make a profit, which seriously affects the interests of the video publisher.

[0003] At present, in order to identify pirated users, technologies such as video watermarks and interface honeypots are usually used to determine whether the user has engaged in pirated broadcasting. However, due to limitations in network bandwidth, storage, user experience and other factors, the above technologies can often only be used on a very small number of users in a day, thus affecting the accuracy of identifying pirated users. Summary of the invention

[0004] In view of this, in order to solve the above-mentioned technical problems or part of the technical problems, the embodiments of the present application provide a method, device, electronic device and storage medium for identifying pirated users.

[0005] In a first aspect, the present application provides a method for identifying pirated broadcast users, comprising:

[0006] Acquire a historical playback behavior data set corresponding to each historical user in the historical user set, where the historical playback behavior data set is generated by the historical user using the target application in one day;

[0007] Determine a historical user risk type corresponding to each of the historical users in the historical user set;

[0008] Using the historical playback behavior data set corresponding to each of the historical users in the historical user set and the historical user risk type, a preset machine learning model is trained to obtain a first recognition model;

[0009] When a target playback behavior data set corresponding to a target user is obtained, the target user is identified based on the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user, wherein the target playback behavior data set is generated by the target user using the target application within one day.

[0010] In an optional implementation, the use of the historical playback behavior data set corresponding to each of the historical users in the historical user set and the historical user risk type to train a preset machine learning model to obtain a first recognition model includes:

[0011] For each of the historical users in the historical user set, according to the historical playback behavior data set corresponding to the historical user, determine the historical aggregation feature data corresponding to each preset aggregation feature in the preset aggregation feature set, so as to obtain the historical aggregation feature data set corresponding to the historical user;

[0012] Using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set, the preset machine learning model is trained to obtain a first recognition model;

[0013] The identifying the target user according to the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user includes:

[0014] According to the target playback behavior data set, determine the target aggregate feature data corresponding to each of the preset aggregate features in the preset aggregate feature set to obtain the target aggregate feature data set corresponding to the target user;

[0015] The target user is identified according to the target aggregated feature data set and the first identification model to obtain a target user risk type corresponding to the target user.

[0016] In an optional embodiment, the method further includes:

[0017] After obtaining the first recognition model, a first user set is determined from the historical user set, and a second user set is determined from the historical user set according to the first recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, wherein the historical user risk type corresponding to the historical users in the first user set is a pirated broadcast user, and the historical users in the second user set are users incorrectly recognized by the first recognition model;

[0018] Using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the first user set and the second user set, the preset machine learning model is trained to obtain a second recognition model;

[0019] According to the second recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, a third user set is determined from the historical user set, wherein the historical users in the third user set are users incorrectly recognized by the second recognition model;

[0020] Using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the second user set and the third user set, the preset machine learning model is trained to obtain a third recognition model;

[0021] The identifying the target user according to the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user includes:

[0022] The target user is identified according to the target playback behavior data set, the first recognition model, the second recognition model, and the third recognition model to obtain a target user risk type corresponding to the target user.

[0023] In an optional implementation, the identifying the target user according to the target playback behavior data set, the first recognition model, the second recognition model, and the third recognition model to obtain a target user risk type corresponding to the target user includes:

[0024] Determine a first recognition result corresponding to the target user according to the target playback behavior data set and the first recognition model, determine a second recognition result corresponding to the target user according to the target playback behavior data set and the second recognition model, and determine a third recognition result corresponding to the target user according to the target playback behavior data set and the third recognition model;

[0025] When there is an identical recognition result among the first recognition result, the second recognition result, and the third recognition result, the user risk type included in the identical recognition result is determined as the target user risk type corresponding to the target user.

[0026] In an optional implementation, the using the historical aggregated feature data set corresponding to each of the historical users in the historical user set and the historical user risk type to train the preset machine learning model to obtain a first recognition model includes:

[0027] Determine a feature score corresponding to each of the preset aggregate features in the preset aggregate feature set, where the feature score is used to characterize the importance of the preset aggregate feature;

[0028] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set to complete the update of the preset aggregate feature set;

[0029] Using the updated preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to complete the update of each of the historical aggregation feature data sets;

[0030] The preset machine learning model is trained using the updated historical aggregate feature data set and the historical user risk type corresponding to each of the historical users in the historical user set to obtain a first recognition model.

[0031] In an optional embodiment, the preset machine learning model is an XGBoost model;

[0032] The determining a feature score corresponding to each of the preset aggregate features in the preset aggregate feature set includes:

[0033] Using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set, the preset machine learning model is trained to obtain an initial recognition model;

[0034] Determine, according to the initial recognition model, a feature score corresponding to each of the preset aggregated features in the preset aggregated feature set;

[0035] The filtering out all the preset aggregate features that meet a preset filtering condition from the preset aggregate feature set according to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set to complete the updating of the preset aggregate feature set includes:

[0036] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet a preset screening condition are screened out from the preset aggregate feature set;

[0037] Using each of the preset aggregation features screened out from the preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to obtain each processed historical aggregation feature data set;

[0038] Based on each of the processed historical aggregate feature data sets, return to execute the step of training the preset machine learning model using the historical aggregate feature data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain an initial recognition model, until all of the preset aggregate features in the preset aggregate feature set meet the preset screening conditions to complete the update of the preset aggregate feature set.

[0039] In an optional embodiment, the method further includes:

[0040] When the update cycle is reached, determining the historical play behavior data set corresponding to all the historical users that meet a first preset condition, wherein the first preset condition includes that the acquisition time of the historical play behavior data set is less than or equal to a preset time from the current time;

[0041] Using the historical play behavior data sets corresponding to all the historical users that meet the first preset condition, the historical play behavior data sets corresponding to each of the historical users in the historical user set are updated;

[0042] Using the updated historical playback behavior data set corresponding to each of the historical users in the historical user set, the step of determining the historical user risk type corresponding to each of the historical users in the historical user set is performed to obtain the first recognition model again;

[0043] Determine a first recognition effect corresponding to the first recognition model obtained again and a second recognition effect corresponding to the first recognition model obtained initially;

[0044] When the first recognition effect is better than the second recognition result, the newly obtained first recognition model is used to complete the update of the initially obtained first recognition model, so as to use the updated first recognition model to perform the step of identifying the target user according to the target playback behavior data set and the first recognition model when the target playback behavior data set corresponding to the target user is obtained, so as to obtain the target user risk type corresponding to the target user.

[0045] In a second aspect, the present application provides a device for identifying pirated users, including:

[0046] An acquisition module, used to acquire a historical playback behavior data set corresponding to each historical user in a historical user set, wherein the historical playback behavior data set is generated by the historical user using the target application in one day;

[0047] A determination module, used to determine a historical user risk type corresponding to each of the historical users in the historical user set;

[0048] A training module, configured to train a preset machine learning model using the historical playback behavior data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain a first recognition model;

[0049] The identification module is used to identify the target user according to the target playback behavior data set and the first identification model when a target playback behavior data set corresponding to the target user is obtained, so as to obtain the target user risk type corresponding to the target user, wherein the target playback behavior data set is generated by the target user using the target application within one day.

[0050] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory, wherein the processor is used to execute a pirate broadcast user identification program stored in the memory to implement the pirate broadcast user identification method as described above.

[0051] In a fourth aspect, the present application further provides a storage medium storing one or more programs, wherein the one or more programs can be executed by one or more processors to implement the method for identifying pirated users as described above.

[0052] The above-mentioned technical scheme provided by the embodiment of the present application has the following advantages compared with the prior art. The method provided by the embodiment of the present application includes: obtaining a historical playback behavior data set corresponding to each historical user in the historical user set, the historical playback behavior data set being generated by the historical user using the target application in one day; determining the historical user risk type corresponding to each historical user in the historical user set; using the historical playback behavior data set and the historical user risk type corresponding to each historical user in the historical user set to train a preset machine learning model to obtain a first recognition model; when obtaining the target playback behavior data set corresponding to the target user, identifying the target user according to the target playback behavior data set and the first recognition model to obtain the target user risk type corresponding to the target user, the target playback behavior data set being generated by the target user using the target application in one day. Through the above method, the embodiment of the present application obtains the historical playback behavior data set generated by each historical user in the historical user set using the target application in one day, and determines the historical user risk type corresponding to each historical user in the historical user set, thereby establishing a first recognition model for identifying pirated users according to the historical playback behavior data and historical user risk type corresponding to each user in the historical user set. When the target playback behavior data set corresponding to the target user is obtained, the first recognition model can be used to identify whether the target user is a pirated user, thereby avoiding the use of existing technology to identify only a very small number of users in one day, and improving the accuracy of identifying pirated users. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0055] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0056] Figure 1 A schematic diagram of a flow chart of a method for identifying a pirate broadcasting user provided in an embodiment of the present application;

[0057] Figure 2 A flowchart of another method for identifying pirated broadcast users provided in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of the structure of a device for identifying pirated broadcast users provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0060] In the above attached figure:

[0061] 10. Acquisition module; 20. Determination module; 30. Training module; 40. Recognition module;

[0062] 400, electronic device; 401, processor; 402, memory; 4021, operating system; 4022, application; 403, user interface; 404, network interface; 405, bus system. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0064] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0065] refer to Figure 1 , Figure 1 A flowchart of a method for identifying a pirate broadcasting user provided in an embodiment of the present application. A method for identifying a pirate broadcasting user provided in the present application comprises the following steps:

[0066] S101: Obtain a historical playback behavior data set corresponding to each historical user in a historical user set.

[0067] In this embodiment, the historical play behavior data set is generated by the historical users using the target application in one day. The target application can be understood as video playback software. The historical users in the historical user set are users before the identification model for identifying pirated users is established, and the historical play behavior data set generated by each historical user using the target application in one day is obtained.

[0068] Among them, the historical playback behavior data set may include multiple historical playback behavior data. The historical playback behavior data can be obtained from the logs of the boss authentication service interface (used to determine whether the current user is eligible to play member videos, paid videos, etc.), the CDN resource scheduling interface (content distribution network, allocating resources to the nearest computer room based on the IP address of the playing user), and the VRS interface (streaming media virtual resource supply, pulling the TS segment of the video through the m3u8 file corresponding to each video), to obtain the time, device ID, device IP address, UA information and request header when the user requests these interfaces.

[0069] Specifically, as long as the user uses the target application, the various playback behavior data generated by the user using the target application will be stored in the server's memory. When it is necessary to establish an identification model for identifying pirated users, the historical playback behavior data set generated by each historical user using the target application in one day is obtained from the server's storage, and then the identification model for identifying pirated users is established using the historical playback behavior data sets corresponding to all historical users.

[0070] S102: Determine the historical user risk type corresponding to each historical user in the historical user set.

[0071] In this embodiment, historical user risk types include white users and pirated broadcast users. Since the honeypot is placed for the user ID and drama ID dimensions, that is, when a user plays a certain episode of a specific drama, the big playback kernel will perform the honeypot placement operation. Then, when the user plays other dramas on the same day, the honeypot is not actually placed, so it is impossible to know whether the user is pirated at this time. Therefore, in order to ensure that the recognition model for identifying pirated broadcast users established later can accurately identify pirated broadcast users, as long as a user has a honeypot anomaly on the same day, the user can be considered as a pirated broadcast user, and all the playback behaviors of this user on that day are considered as part of the pirated broadcast behavior. Therefore, in the process of users using the target application, when a user has a honeypot anomaly on the same day, the user can be marked as a pirated broadcast user, and the corresponding playback behavior data set of the user is regarded as the one generated by the pirated broadcast user using the target application. Finally, the user risk type and playback behavior data set corresponding to the user are stored in the memory of the server, so that when the recognition model for identifying pirated broadcast users is established, the user risk type corresponding to the user is determined. Based on the logic that the honeypot was deployed on the same day and the user passed all honeypot detections, the user can be marked as a white user, and the corresponding playback behavior data set of the user can be regarded as the one generated by the white user using the target application. Finally, the user risk type and playback behavior data set corresponding to the user are stored in the memory of the server, so that when establishing the recognition model for identifying pirated users, the user risk type corresponding to the user can be determined. In this way, the historical playback behavior data set corresponding to the white user and the historical playback behavior data set corresponding to the pirated user can be obtained, and all the historical playback behavior data sets obtained above are used as training samples and applied to the preset machine learning model to train the recognition model for identifying pirated users.

[0072] S103: Using the historical playback behavior data set and historical user risk type corresponding to each historical user in the historical user set, a preset machine learning model is trained to obtain a first recognition model.

[0073] In this embodiment, the preset machine learning model is an XGBoost model. After obtaining the historical playback behavior data set and historical user risk type corresponding to each historical user in the historical user set, the historical playback behavior data set and historical user risk type corresponding to all users in the historical user set can be used as training samples to train the preset machine learning model, thereby obtaining a first recognition model for identifying pirated users, and then the first recognition model can be used to identify target users who subsequently use the target application to identify whether the target user risk type corresponding to the target user is a pirated user.

[0074] S104: When the target playback behavior data set corresponding to the target user is obtained, the target user is identified according to the target playback behavior data set and the first identification model to obtain a target user risk type corresponding to the target user.

[0075] In this embodiment, the target playback behavior data set is generated by the target user using the target application within one day. The target user risk types include white users and pirated users. After the first recognition model is trained, if the target playback behavior data set corresponding to the target user is obtained within one day, the target playback behavior data set can be input into the first recognition model so that the first recognition model outputs the target user risk type corresponding to the target user, thereby determining whether the target user is a pirated user based on the target user risk type.

[0076] Among them, since the users detected as abnormal by the honeypot only account for 1% of the total number of users passing through the honeypot, and most machine learning algorithms assume that the data is balanced, when the data is seriously unbalanced, the model is more likely to tend to the majority class, because this can appear to be relatively high in terms of overall accuracy. For example, if 90% of the samples are normal transactions and 10% are fraudulent transactions, a simple model may tend to classify all transactions as normal transactions, thereby obtaining an apparent accuracy of 90%, but in fact it is very poor in the fraud detection task. Therefore, in order to avoid the above situation, in order to further improve the accuracy of pirated user identification.

[0077] Specifically, the present embodiment provides a method for identifying pirated broadcast users, further comprising the following steps:

[0078] After obtaining the first recognition model, determining a first user set from the historical user set, and determining a second user set from the historical user set according to the first recognition model and a historical playback behavior data set corresponding to each historical user in the historical user set;

[0079] Using the historical playback behavior data set and the historical user risk type corresponding to each historical user in the first user set and the second user set, the preset machine learning model is trained to obtain a second recognition model;

[0080] Determine a third user set from the historical user set according to the second recognition model and a historical playback behavior data set corresponding to each historical user in the historical user set;

[0081] The preset machine learning model is trained using the historical playback behavior data set and historical user risk type corresponding to each historical user in the second user set and the third user set to obtain a third recognition model.

[0082] In the above step S104, the target user is identified according to the target playback behavior data set and the first identification model to obtain the target user risk type corresponding to the target user, including:

[0083] The target user is identified according to the target playback behavior data set, the first identification model, the second identification model, and the third identification model to obtain a target user risk type corresponding to the target user.

[0084] In this embodiment, the historical user risk type corresponding to the historical users in the first user set is a pirated user, the historical users in the second user set are users incorrectly identified by the first recognition model, and the historical users in the third user set are users incorrectly identified by the second recognition model. The XGBoost model itself is an integrated model, which has good performance for unbalanced sample data. On this basis, a further model integration method is adopted to improve the accuracy of identifying pirated users by training three different recognition models. Among them, the user incorrectly identified by the first recognition model can be understood as, when the historical user risk type corresponding to the historical user is a white user, the user risk type corresponding to the historical user identified by the first recognition model is a pirated user; similarly, when the historical user risk type corresponding to the historical user is a white user, the user risk type corresponding to the historical user identified by the second recognition model is a pirated user.

[0085] Specifically, the sample data used by the first recognition model is the historical playback behavior data set and historical user risk type corresponding to all users in the acquired historical user set. The sample data used by the second recognition model includes the sample data that the first recognition model mistakenly identifies for the historical user set, that is, the sample data that mistakenly judges the honeypot user as an abnormal honeypot user, and the sample data used by the second recognition model also includes the sample data of the historical user risk type corresponding to the historical user in the historical user set as a pirated broadcast user. The sample data used by the third recognition model includes the sample data that the first recognition model mistakenly identifies for the historical user set and the sample data that the second recognition model mistakenly identifies for the historical user set. The preset machine learning model is trained through each sample data, so that the first recognition model, the second recognition model and the third recognition model can be obtained, and then the first recognition model, the second recognition model and the third recognition model can be used to identify the target user respectively, so as to jointly determine the target user risk type corresponding to the target user according to the recognition result of the first recognition model, the recognition result of the second recognition model and the recognition result of the third recognition model.

[0086] More specifically, the target user is identified according to the target playback behavior data set, the first recognition model, the second recognition model and the third recognition model to obtain the target user risk type corresponding to the target user, which specifically includes:

[0087] Determine a first recognition result corresponding to the target user according to the target playback behavior data set and the first recognition model, determine a second recognition result corresponding to the target user according to the target playback behavior data set and the second recognition model, and determine a third recognition result corresponding to the target user according to the target playback behavior data set and the third recognition result;

[0088] When there is an identical recognition result among the first recognition result, the second recognition result, and the third recognition result, the user risk type included in the identical recognition result is determined as the target user risk type corresponding to the target user.

[0089] Among them, the first identification result includes the user risk type corresponding to the target user, the second identification result includes the user risk type corresponding to the target user, and the third identification result includes the user risk type corresponding to the target user. User risk types include white users and pirated users. When the same identification results exist in the first identification result, the second identification result, and the third identification result, the user risk type included in the same identification result is determined as the target user risk type corresponding to the target user in accordance with the principle of minority obeys majority. For example, the first identification result includes that the target user is a white user, the second identification result includes that the target user is a pirated user, and the third identification result includes that the target user is a pirated user, so the target user risk type corresponding to the target user is a pirated user.

[0090] The present embodiment provides a method for identifying pirated broadcast users, further comprising the following steps:

[0091] When the update cycle is reached, determining the historical play behavior data set corresponding to all the historical users that meet a first preset condition, the first preset condition including that the acquisition time of the historical play behavior data set is less than or equal to a preset time from the current time;

[0092] Using the historical play behavior data sets corresponding to all historical users that meet the first preset condition, the historical play behavior data sets corresponding to each historical user in the historical user set are updated;

[0093] Using the historical playback behavior data set corresponding to each historical user in the updated historical user set, a step of determining the historical user risk type corresponding to each historical user in the historical user set is performed to obtain the first recognition model again;

[0094] Determine a first recognition effect corresponding to the retrieved first recognition model and a second recognition effect corresponding to the initially obtained first recognition model;

[0095] When the first recognition effect is better than the second recognition result, the newly obtained first recognition model is used to complete the update of the initially obtained first recognition model, so that when the target playback behavior data set corresponding to the target user is obtained, the target user is identified according to the target playback behavior data set and the first recognition model using the updated first recognition model to obtain the target user risk type step corresponding to the target user.

[0096] Among them, the historical playback behavior data sets corresponding to all historical users are stored in the server's memory. Since the pirated broadcast users predicted by the model are not completely accurate, and the honeypot also has a portion of random placement, it is necessary to regularly fine-tune the model based on the actual online placement results, delete some older data, introduce the latest placement data, retrain the model, and compare the recognition effects of the old model and the new model. If the effect is not improved, keep the old model. If the effect is improved, update the old model with the new model, so as to improve the recognition accuracy of the recognition model used to identify pirated broadcast users.

[0097] Specifically, the update cycle and the preset duration can be set according to actual needs, and the specific values ​​of the update cycle and the preset duration are not limited in this embodiment. The first recognition effect can be determined by applying the re-obtained first recognition model to the prediction set, and the second recognition effect can be determined by applying the initially obtained first recognition model to the prediction set. The specific determination method can be selected according to actual needs, and the determination method of the first recognition result and the second recognition result is not specifically limited in this embodiment.

[0098] The present embodiment provides a method for identifying pirated users, which obtains a historical playback behavior data set generated by each historical user in a historical user set using a target application in one day, and determines the historical user risk type corresponding to each historical user in the historical user set, thereby establishing a first recognition model for identifying pirated users according to the historical playback behavior data and the historical user risk type corresponding to each user in the historical user set. When the target playback behavior data set corresponding to the target user is obtained, the first recognition model can be used to identify whether the target user is a pirated user, thereby avoiding the problem of only being able to identify a very small number of users in one day using the existing technology, and improving the accuracy of identifying pirated users.

[0099] refer to Figure 2 , Figure 2 A flowchart of another method for identifying a pirate broadcasting user provided in an embodiment of the present application. The present application provides a method for identifying a pirate broadcasting user, comprising the following steps:

[0100] S201: Obtain a historical playback behavior data set corresponding to each historical user in a historical user set.

[0101] S202: Determine the historical user risk type corresponding to each historical user in the historical user set.

[0102] Regarding the above-mentioned step S201 and step S202, step S201 is consistent with the above-mentioned step S101, and step S202 is consistent with the above-mentioned step S102. For details, please refer to the above-mentioned step S101 and step S102, which will not be described in detail in this embodiment.

[0103] S203: For each historical user in the historical user set, determine the historical aggregate feature data corresponding to each preset aggregate feature in the preset aggregate feature set according to the historical playback behavior data set corresponding to the historical user, so as to obtain the historical aggregate feature data set corresponding to the historical user.

[0104] S204: Train a preset machine learning model using the historical aggregated feature data set and historical user risk type corresponding to each historical user in the historical user set to obtain a first recognition model.

[0105] Regarding the above-mentioned steps S203 and S204, since when training the recognition model, a pirated broadcast user is a user who fails to pass the honeypot detection within one day and is considered to be a pirated broadcast user, when obtaining the historical playback behavior data set corresponding to the pirated broadcast user and the white user, all the historical playback behavior data in the historical playback behavior data set are aggregated according to each preset aggregation feature in the preset aggregation feature set to transform it into a feature at the day level, so as to train the preset machine learning model according to each preset aggregation feature in the preset aggregation feature set to improve the accuracy of subsequent identification of pirated broadcast users. Among them, each preset aggregation feature in the preset aggregation feature set can be set according to actual needs, and the preset aggregation features are not specifically limited in this embodiment. For example, the average number of seconds per episode played by user A on that day, the cumulative number of seconds played, the standard deviation of each episode played, the average value of the playback time difference between the two levels, etc.

[0106] In the above step S204, the preset machine learning model is trained using the historical aggregate feature data set and the historical user risk type corresponding to each historical user in the historical user set to obtain a first recognition model, including:

[0107] Determine a feature score corresponding to each preset aggregate feature in the preset aggregate feature set, where the feature score is used to characterize the importance of the preset aggregate feature;

[0108] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set to complete the update of the preset aggregate feature set;

[0109] Using the updated preset aggregation feature set, the historical aggregation feature data set corresponding to each historical user in the historical user set is processed to complete the update of each historical aggregation feature data set;

[0110] The preset machine learning model is trained using the updated historical aggregate feature data set and historical user risk type corresponding to each historical user in the historical user set to obtain a first recognition model.

[0111] Specifically, in order to make the final first recognition model more accurate in identifying the target user, each preset aggregate feature in the preset aggregate feature set is screened to screen out all preset aggregate features with higher importance from the preset aggregate feature set, and then each historical aggregate feature data set is screened according to all the screened preset aggregate features, so that each historical aggregate feature data set only includes historical aggregate feature data corresponding to all the screened preset aggregate features, thereby completing the update of each historical aggregate feature data set. After completing the update of each historical aggregate feature data set, the preset machine learning model can be trained using the updated historical aggregate feature data set and historical user risk type corresponding to each historical user in the historical user set to obtain a more accurate first recognition model.

[0112] More specifically, for the establishment of the above-mentioned second recognition model and the third recognition model, the updated preset aggregate feature set can be used to process the historical aggregate feature data set corresponding to each historical user in the first user set, the second user set and the third user set to complete the update of the historical aggregate feature data set in the first user set, the second user set and the third user set, thereby using the updated historical aggregate feature data set and historical user risk type corresponding to each historical user in the first user set and the second user set to train the preset machine learning model to obtain the second recognition model, and using the updated historical aggregate feature data set and historical user risk type corresponding to each historical user in the second user set and the third user set to train the preset machine learning model to obtain the third recognition model.

[0113] In the above, determining the feature score corresponding to each preset aggregate feature in the preset aggregate feature set includes:

[0114] The preset machine learning model is trained using the historical aggregate feature data set and historical user risk type corresponding to each historical user in the historical user set to obtain an initial recognition model;

[0115] According to the initial recognition model, a feature score corresponding to each preset aggregate feature in the preset aggregate feature set is determined.

[0116] According to the feature scores corresponding to all preset aggregate features in the preset aggregate feature set, all preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set to complete the update of the preset aggregate feature set, including:

[0117] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set;

[0118] Using each of the preset aggregation features screened out from the preset aggregation feature set, processing the historical aggregation feature data set corresponding to each historical user in the historical user set to obtain each processed historical aggregation feature data set;

[0119] Based on each processed historical aggregate feature data set, return to execute the historical aggregate feature data set and historical user risk type corresponding to each historical user in the historical user set, train the preset machine learning model to obtain the initial recognition model step, until all preset aggregate features in the preset aggregate feature set meet the preset filtering conditions to complete the update of the preset aggregate feature set.

[0120] Specifically, XGBoost (Extreme Gradient Boosting) is a distributed machine learning model based on gradient boosting, which is widely used in classification and regression tasks. Feature Importance refers to the importance of each feature in the model to the prediction result. By evaluating the feature importance, we can identify which features have a greater impact on the prediction results of the model, thereby helping to further optimize the model or perform feature screening. The model calculates the average information gain contributed by each feature on the splitting nodes in all trees (decision trees) to indicate the degree of improvement of the model after using the feature to split the node. That is to say, the less the information gain of the feature, the lower the importance, and the less information gain the decision tree brings when splitting on this feature.

[0121] Using the feature importance index, training can be performed multiple times, each time deleting the feature with the lowest feature importance in the current round, and then retraining an XGBoost model until the importance of all remaining features meets the preset screening conditions. The preset screening conditions can be that the feature score corresponding to the preset aggregated feature is greater than the preset threshold. The preset threshold can be set according to actual needs. In this embodiment, the specific value of the preset threshold is not specifically limited. After that, it can be compared which round of models has the highest accuracy on the prediction set, and this version of the recognition model is retained, and the corresponding low-importance features are deleted.

[0122] S205: When the target playback behavior data set corresponding to the target user is obtained, target aggregate feature data corresponding to each preset aggregate feature in the preset aggregate feature set is determined according to the target playback behavior data set to obtain the target aggregate feature data set corresponding to the target user.

[0123] S206: Identify the target user according to the target aggregated feature data set and the first identification model to obtain a target user risk type corresponding to the target user.

[0124] With respect to the above-mentioned steps S205 and S206, when the target playback behavior data set corresponding to the target user is obtained, the target playback behavior data set can be processed according to each preset aggregation feature in the preset aggregation feature set, so as to obtain the target aggregation feature data corresponding to each preset aggregation feature in the preset aggregation feature set, and then obtain the target aggregation feature data set corresponding to the target user. The target aggregation feature data set is input into the first recognition model, so that the first recognition model can output the target user risk type corresponding to the target user.

[0125] Specifically, after obtaining the second recognition model and the third recognition model, the first recognition model, the second recognition model and the third recognition model can be used to identify the target user to obtain the target user risk type corresponding to the target user, thereby making the determined target user risk type more accurate.

[0126] The present embodiment provides a method for identifying pirated users, which obtains a historical playback behavior data set generated by each historical user in a historical user set using a target application in one day, and determines the historical user risk type corresponding to each historical user in the historical user set, thereby establishing a first recognition model for identifying pirated users according to the historical playback behavior data and the historical user risk type corresponding to each user in the historical user set. When the target playback behavior data set corresponding to the target user is obtained, the first recognition model can be used to identify whether the target user is a pirated user, thereby avoiding the problem of only being able to identify a very small number of users in one day using the existing technology, and improving the accuracy of identifying pirated users.

[0127] refer to Figure 3 , Figure 3A schematic diagram of the structure of a device for identifying pirated users provided in an embodiment of the present application. A device for identifying pirated users provided in an embodiment of the present application includes: an acquisition module 10, a determination module 20, a training module 30 and an identification module 40. The acquisition module 10 is used to acquire a historical playback behavior data set corresponding to each historical user in a historical user set, wherein the historical playback behavior data set is generated by the historical user using a target application in one day; the determination module 20 is used to determine a historical user risk type corresponding to each historical user in the historical user set; the training module 30 is used to train a preset machine learning model using the historical playback behavior data set and the historical user risk type corresponding to each historical user in the historical user set to obtain a first identification model; the identification module 40 is used to identify the target user according to the target playback behavior data set and the first identification model when a target playback behavior data set corresponding to the target user is acquired, so as to obtain a target user risk type corresponding to the target user, wherein the target playback behavior data set is generated by the target user using the target application in one day.

[0128] In this embodiment, the training module 30 is further used for:

[0129] For each of the historical users in the historical user set, according to the historical playback behavior data set corresponding to the historical user, determine the historical aggregation feature data corresponding to each preset aggregation feature in the preset aggregation feature set, so as to obtain the historical aggregation feature data set corresponding to the historical user;

[0130] The preset machine learning model is trained using the historical aggregate feature data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain a first recognition model.

[0131] In this embodiment, the identification module 40 is further used for:

[0132] According to the target playback behavior data set, determine the target aggregate feature data corresponding to each of the preset aggregate features in the preset aggregate feature set to obtain the target aggregate feature data set corresponding to the target user;

[0133] The target user is identified according to the target aggregated feature data set and the first identification model to obtain a target user risk type corresponding to the target user.

[0134] In this embodiment, the training module 30 is further used for:

[0135] After obtaining the first recognition model, a first user set is determined from the historical user set, and a second user set is determined from the historical user set according to the first recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, wherein the historical user risk type corresponding to the historical users in the first user set is a pirated broadcast user, and the historical users in the second user set are users incorrectly recognized by the first recognition model;

[0136] Using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the first user set and the second user set, the preset machine learning model is trained to obtain a second recognition model;

[0137] According to the second recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, a third user set is determined from the historical user set, wherein the historical users in the third user set are users incorrectly recognized by the second recognition model;

[0138] The preset machine learning model is trained using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the second user set and the third user set to obtain a third recognition model.

[0139] In this embodiment, the identification module 40 is further used for:

[0140] The target user is identified according to the target playback behavior data set, the first recognition model, the second recognition model, and the third recognition model to obtain a target user risk type corresponding to the target user.

[0141] In this embodiment, the identification module 40 is further used for:

[0142] Determine a first recognition result corresponding to the target user according to the target playback behavior data set and the first recognition model, determine a second recognition result corresponding to the target user according to the target playback behavior data set and the second recognition model, and determine a third recognition result corresponding to the target user according to the target playback behavior data set and the third recognition model;

[0143] When there is an identical recognition result among the first recognition result, the second recognition result, and the third recognition result, the user risk type included in the identical recognition result is determined as the target user risk type corresponding to the target user.

[0144] In this embodiment, the training module 30 is further used for:

[0145] Determine a feature score corresponding to each of the preset aggregate features in the preset aggregate feature set, where the feature score is used to characterize the importance of the preset aggregate feature;

[0146] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set to complete the update of the preset aggregate feature set;

[0147] Using the updated preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to complete the update of each of the historical aggregation feature data sets;

[0148] The preset machine learning model is trained using the updated historical aggregate feature data set and the historical user risk type corresponding to each of the historical users in the historical user set to obtain a first recognition model.

[0149] In this embodiment, the preset machine learning model is an XGBoost model.

[0150] In this embodiment, the training module 30 is further used for:

[0151] Using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set, the preset machine learning model is trained to obtain an initial recognition model;

[0152] Determine, according to the initial recognition model, a feature score corresponding to each of the preset aggregated features in the preset aggregated feature set;

[0153] According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening condition are screened out from the preset aggregate feature set;

[0154] Using each of the preset aggregation features screened out from the preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to obtain each processed historical aggregation feature data set;

[0155] Based on each of the processed historical aggregate feature data sets, return to execute the step of training the preset machine learning model using the historical aggregate feature data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain an initial recognition model, until all of the preset aggregate features in the preset aggregate feature set meet the preset screening conditions to complete the update of the preset aggregate feature set.

[0156] In this embodiment, the determination module 20 is further configured to:

[0157] When the update cycle is reached, determining the historical play behavior data set corresponding to all the historical users that meet a first preset condition, wherein the first preset condition includes that the acquisition time of the historical play behavior data set is less than or equal to a preset time from the current time;

[0158] Using the historical play behavior data sets corresponding to all the historical users that meet the first preset condition, the historical play behavior data sets corresponding to each of the historical users in the historical user set are updated;

[0159] The step of determining the historical user risk type corresponding to each historical user in the historical user set is performed by using the updated historical playback behavior data set corresponding to each historical user in the historical user set to re-obtain the first recognition model.

[0160] The identification module 40 is also used for:

[0161] Determine a first recognition effect corresponding to the first recognition model obtained again and a second recognition effect corresponding to the first recognition model obtained initially;

[0162] When the first recognition effect is better than the second recognition result, the newly obtained first recognition model is used to complete the update of the initially obtained first recognition model, so as to use the updated first recognition model to perform the step of identifying the target user according to the target playback behavior data set and the first recognition model when the target playback behavior data set corresponding to the target user is obtained, so as to obtain the target user risk type corresponding to the target user.

[0163] The present embodiment provides a device for identifying pirated users. The device obtains a historical playback behavior data set generated by each historical user in a historical user set when using a target application in one day, and determines a historical user risk type corresponding to each historical user in the historical user set. Thus, a first recognition model for identifying pirated users is established according to the historical playback behavior data and the historical user risk type corresponding to each user in the historical user set. When a target playback behavior data set corresponding to the target user is obtained, the first recognition model can be used to identify whether the target user is a pirated user, thereby avoiding the problem of only being able to identify a very small number of users in one day using the existing technology, and improving the accuracy of identifying pirated users.

[0164] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 The electronic device 400 shown includes: at least one processor 401, a memory 402, at least one network interface 404 and other user interfaces 403. The various components in the electronic device 400 are coupled together via a bus system 405. It is understood that the bus system 405 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 405 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 405 is not shown in FIG. Figure 4 Various buses are labeled as bus system 405 .

[0165] The user interface 403 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0166] It can be understood that the memory 402 in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 402 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0167] In some implementations, the memory 402 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 4021 and application programs 4022 .

[0168] Among them, the operating system 4021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 4022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present application can be included in the application 4022.

[0169] In the embodiment of the present application, by calling the program or instructions stored in the memory 402, specifically, the program or instructions stored in the application 4022, the processor 401 is used to execute the method steps provided by each method embodiment.

[0170] The method disclosed in the above embodiment of the present application can be applied to the processor 401, or implemented by the processor 401. The processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 401 or the instruction in the form of software. The above processor 401 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 402, and the processor 401 reads the information in the memory 402 and completes the steps of the above method in combination with its hardware.

[0171] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0172] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0173] The electronic device provided in this embodiment may be Figure 4 The electronic device shown in FIG. 1 may perform the following steps: Figure 1 and Figure 2 All steps of the method for identifying pirated broadcast users in the Figure 1 and Figure 2 For details, please refer to Figure 1 and Figure 2 For the sake of brevity, the relevant description is not repeated here.

[0174] The embodiment of the present application also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0175] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned method for identifying pirated broadcast users executed on the side of the pirated broadcast user identification device can be implemented.

[0176] The processor is used to execute the pirate broadcast user identification program stored in the memory to implement the following steps of the pirate broadcast user identification method executed on the pirate broadcast user identification device side.

[0177] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0178] It should be noted that the phrases "one implementation", "an embodiment", "an exemplary embodiment", "some embodiments", etc. mentioned in the specification indicate that the described embodiments may include certain features, structures or characteristics, but not every embodiment may include the certain features, structures or characteristics. In addition, such phrases do not necessarily refer to the same embodiment. In addition, when describing certain features, structures or characteristics in conjunction with an embodiment, it is within the knowledge of those skilled in the art to implement such features, structures or characteristics in conjunction with other embodiments, whether explicitly or not explicitly described.

[0179] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying pirated broadcast users, characterized in that: include: Acquire a historical playback behavior data set corresponding to each historical user in the historical user set, where the historical playback behavior data set is generated by the historical user using the target application in one day; Determine a historical user risk type corresponding to each of the historical users in the historical user set; Using the historical playback behavior data set corresponding to each of the historical users in the historical user set and the historical user risk type, a preset machine learning model is trained to obtain a first recognition model; When a target playback behavior data set corresponding to a target user is obtained, the target user is identified based on the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user, wherein the target playback behavior data set is generated by the target user using the target application within one day.

2. The method according to claim 1, characterized in that The method of training a preset machine learning model by using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the historical user set to obtain a first recognition model includes: For each of the historical users in the historical user set, according to the historical playback behavior data set corresponding to the historical user, determine the historical aggregation feature data corresponding to each preset aggregation feature in the preset aggregation feature set, so as to obtain the historical aggregation feature data set corresponding to the historical user; Using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set, the preset machine learning model is trained to obtain a first recognition model; The identifying the target user according to the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user includes: According to the target playback behavior data set, determine the target aggregate feature data corresponding to each of the preset aggregate features in the preset aggregate feature set to obtain the target aggregate feature data set corresponding to the target user; The target user is identified according to the target aggregated feature data set and the first identification model to obtain a target user risk type corresponding to the target user.

3. The method according to claim 1, characterized in that The method further comprises: After obtaining the first recognition model, a first user set is determined from the historical user set, and a second user set is determined from the historical user set according to the first recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, wherein the historical user risk type corresponding to the historical users in the first user set is a pirated broadcast user, and the historical users in the second user set are users incorrectly recognized by the first recognition model; Using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the first user set and the second user set, the preset machine learning model is trained to obtain a second recognition model; According to the second recognition model and the historical playback behavior data set corresponding to each of the historical users in the historical user set, a third user set is determined from the historical user set, wherein the historical users in the third user set are users incorrectly recognized by the second recognition model; Using the historical playback behavior data set and the historical user risk type corresponding to each of the historical users in the second user set and the third user set, the preset machine learning model is trained to obtain a third recognition model; The identifying the target user according to the target playback behavior data set and the first recognition model to obtain a target user risk type corresponding to the target user includes: The target user is identified according to the target playback behavior data set, the first recognition model, the second recognition model, and the third recognition model to obtain a target user risk type corresponding to the target user.

4. The method according to claim 3, characterized in that The identifying the target user according to the target playback behavior data set, the first recognition model, the second recognition model, and the third recognition model to obtain a target user risk type corresponding to the target user includes: Determine a first recognition result corresponding to the target user according to the target playback behavior data set and the first recognition model, determine a second recognition result corresponding to the target user according to the target playback behavior data set and the second recognition model, and determine a third recognition result corresponding to the target user according to the target playback behavior data set and the third recognition model; When there is an identical recognition result among the first recognition result, the second recognition result, and the third recognition result, the user risk type included in the identical recognition result is determined as the target user risk type corresponding to the target user.

5. The method according to claim 2, characterized in that: The step of training the preset machine learning model by using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set to obtain a first recognition model includes: Determine a feature score corresponding to each of the preset aggregate features in the preset aggregate feature set, where the feature score is used to characterize the importance of the preset aggregate feature; According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening conditions are screened out from the preset aggregate feature set to complete the update of the preset aggregate feature set; Using the updated preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to complete the update of each of the historical aggregation feature data sets; The preset machine learning model is trained using the updated historical aggregate feature data set and the historical user risk type corresponding to each of the historical users in the historical user set to obtain a first recognition model.

6. The method according to claim 5, characterized in that The preset machine learning model is an XGBoost model; The determining a feature score corresponding to each of the preset aggregate features in the preset aggregate feature set includes: Using the historical aggregated feature data set and the historical user risk type corresponding to each of the historical users in the historical user set, the preset machine learning model is trained to obtain an initial recognition model; Determine, according to the initial recognition model, a feature score corresponding to each of the preset aggregated features in the preset aggregated feature set; The filtering out all the preset aggregate features that meet a preset filtering condition from the preset aggregate feature set according to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set to complete the updating of the preset aggregate feature set includes: According to the feature scores corresponding to all the preset aggregate features in the preset aggregate feature set, all the preset aggregate features that meet the preset screening condition are screened out from the preset aggregate feature set; Using each of the preset aggregation features screened out from the preset aggregation feature set, processing the historical aggregation feature data set corresponding to each of the historical users in the historical user set to obtain each processed historical aggregation feature data set; Based on each of the processed historical aggregate feature data sets, return to execute the step of training the preset machine learning model using the historical aggregate feature data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain an initial recognition model, until all of the preset aggregate features in the preset aggregate feature set meet the preset screening conditions to complete the update of the preset aggregate feature set.

7. The method according to claim 1, characterized in that The method further comprises: When the update cycle is reached, determining the historical play behavior data set corresponding to all the historical users that meet a first preset condition, wherein the first preset condition includes that the acquisition time of the historical play behavior data set is less than or equal to a preset time from the current time; Using the historical play behavior data sets corresponding to all the historical users that meet the first preset condition, the historical play behavior data sets corresponding to each of the historical users in the historical user set are updated; Using the updated historical playback behavior data set corresponding to each of the historical users in the historical user set, the step of determining the historical user risk type corresponding to each of the historical users in the historical user set is performed to obtain the first recognition model again; Determine a first recognition effect corresponding to the first recognition model obtained again and a second recognition effect corresponding to the first recognition model obtained initially; When the first recognition effect is better than the second recognition result, the newly obtained first recognition model is used to complete the update of the initially obtained first recognition model, so as to use the updated first recognition model to perform the step of identifying the target user according to the target playback behavior data set and the first recognition model when the target playback behavior data set corresponding to the target user is obtained, so as to obtain the target user risk type corresponding to the target user.

8. A device for identifying pirated broadcast users, characterized in that: include: An acquisition module, used to acquire a historical playback behavior data set corresponding to each historical user in a historical user set, wherein the historical playback behavior data set is generated by the historical user using the target application in one day; A determination module, used to determine a historical user risk type corresponding to each of the historical users in the historical user set; A training module, configured to train a preset machine learning model using the historical playback behavior data set corresponding to each of the historical users in the historical user set and the historical user risk type to obtain a first recognition model; The identification module is used to identify the target user according to the target playback behavior data set and the first identification model when a target playback behavior data set corresponding to the target user is obtained, so as to obtain the target user risk type corresponding to the target user, wherein the target playback behavior data set is generated by the target user using the target application within one day.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a pirate broadcast user identification program stored in the memory to implement the pirate broadcast user identification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for identifying pirated users according to any one of claims 1 to 7.

Images