Abnormal account identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal account identification method and apparatus, an electronic device and a storage medium. The method comprises the steps of obtaining multimedia online downloading data from a multimedia content distribution node; the multimedia online downloading data comprises a user account requesting for online playing of the multimedia content from the multimedia content distribution node, a client identifier corresponding to the user account and an online downloading speed of the user account about the multimedia content; detecting the online downloading speed of the user account about the multimedia content; if it is detected that the online downloading speed exceeds the preset downloading speed, sending a speed limiting instruction to a client corresponding to the client identifier; the speed limiting instruction is used for indicating the client to adjust the online downloading speed; and if it is detected that the client does not adjust the online downloading speed, marking the user account as an abnormal account. According to the abnormal account identification method, the abnormal user can be accurately identified, and the problem that the abnormal user downloads videos or other multimedia in a large scale at present is effectively solved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to an abnormal account identification method, device, electronic device and storage medium. Background Art

[0002] In the field of multimedia content such as video, some people use unconventional means to download video resources on a large scale and spread them on the Internet without permission, which not only damages the network environment, but also seriously infringes on the rights and interests of creators and platforms. Internet platforms need to constantly identify these abnormal users to ensure the normal operation of Internet services. Summary of the invention

[0003] In order to accurately identify abnormal users and ensure the normal operation of Internet services, this application provides an abnormal account identification method, device, electronic device and storage medium:

[0004] According to a first aspect of the present application, a method for identifying abnormal accounts is provided, comprising:

[0005] Acquire multimedia online download data from the multimedia content distribution node; the multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account;

[0006] Detecting the online download speed of multimedia content in user accounts;

[0007] If it is detected that the online download speed exceeds the preset download speed, a speed limit instruction is sent to the client corresponding to the client identifier; the speed limit instruction is used to instruct the client to adjust the online download speed;

[0008] If it is detected that the client has not adjusted the online download speed, the user account will be marked as an abnormal account, and the abnormal account represents an account with illegal downloading behavior.

[0009] According to a second aspect of the present application, there is provided an abnormal account identification device, comprising:

[0010] An acquisition module is used to acquire multimedia online download data from a multimedia content distribution node; the multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account;

[0011] A detection module, used to detect the online download speed of multimedia content of a user account;

[0012] A sending module, for sending a speed limit instruction to a client corresponding to the client identifier if it is detected that the online download speed exceeds the preset download speed; the speed limit instruction is used to instruct the client to adjust the online download speed;

[0013] The marking module is used to mark the user account as an abnormal account if it is detected that the client does not adjust the online download speed. The abnormal account represents an account with illegal downloading behavior.

[0014] According to the third aspect of the present application, an electronic device is provided, including a processor and a memory, wherein at least one instruction or at least one program is stored in the memory, and the at least one instruction or at least one program is loaded and executed by the processor to implement the abnormal account identification method of the first aspect of the present application.

[0015] According to the fourth aspect of the present application, a computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the abnormal account identification method of the first aspect of the present application.

[0016] According to the fifth aspect of the present application, a computer program product is provided, which includes at least one instruction or at least one program. When the at least one instruction or at least one program is executed by a processor, the abnormal account identification method of the first aspect of the present application is implemented.

[0017] The present application provides an abnormal account identification method, device, electronic device and storage medium, which have the following technical effects:

[0018] By acquiring multimedia online download data from multimedia content distribution nodes, detecting the online download speed in the multimedia online download data, issuing a speed limit instruction when the speed exceeds the limit, and identifying abnormal accounts based on the comparison results of the online download speed before and after the speed limit instruction, the current situation of abnormal users downloading videos or other multimedia on a large scale can be effectively solved; at the same time, due to the reduction of abnormal users, the pressure on multimedia content distribution nodes can be reduced, thereby making the download speed of normal users faster, which helps to improve the user's playback experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1is a schematic diagram of an application environment provided by an embodiment of the present application;

[0021] Figure 2 It is a flowchart of an abnormal account identification method provided by an embodiment of the present application;

[0022] Figure 3 This is a flow chart of determining various indicator data of a user account according to historical playback data of the user account provided by an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of a video playback interface provided in an embodiment of the present application;

[0024] Figure 5 This is a schematic diagram of a process for verifying a serial number provided in an embodiment of the present application;

[0025] Figure 6 It is a schematic diagram of a flow chart of determining a preset download speed provided by an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of different responses of different clients to a speed limit instruction provided in an embodiment of the present application;

[0027] Figure 8 This is a schematic diagram of a data interaction process provided by an embodiment of the present application;

[0028] Fig. 9 It is a block diagram of a device for identifying abnormal accounts provided by an embodiment of the present application;

[0029] Fig.10 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0031] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] See also Figure 1 , Figure 1 It is a schematic diagram of an application environment provided in an embodiment of the present application. The application environment refers to the current content delivery network (CDN) architecture, and may specifically include a playback control terminal 01, at least one multimedia content distribution node 02, and at least one client 03; wherein the playback control terminal 01 and at least one multimedia content distribution node 02 jointly provide multimedia playback services for each client 03, such as video and audio playback services, the playback control terminal 01 is mainly responsible for responding to playback requests from the client 03 and controlling the playback process, and the multimedia content distribution node 02 is mainly used to store and send multimedia data such as audio and video data to the client 03.

[0033] At present, for some multimedia contents, such as videos in the preview stage or due to the requirements of the copyright holder, the playback control terminal 01 only provides online playback function for these multimedia contents, that is, the client 03 can only watch them online but cannot cache them locally or play them offline; for these multimedia contents, the client 03 can send an online playback request to the playback control terminal 01, and the playback control terminal 01 responds to the online playback request and returns the corresponding multimedia playback address file to the client 03. The multimedia playback address file is a text-based playlist file used to specify the network links and playback order of each segment of the multimedia content. The client 03 can download the network links of each segment in the multimedia playback address file one by one and then play them online.

[0034] However, for these multimedia contents that can only be played online, abnormal users will take a series of measures to crack them, illegally download them to the local computer, and then spread them on the network without permission. Generally, abnormal users will use programs to simulate the online playback requests of normal user accounts, obtain the multimedia playback address file from the playback control terminal 01, and then illegally download them to the corresponding multimedia content distribution node 02.

[0035] In order to accurately identify abnormal users and prevent illegal downloading, an embodiment of the present application provides an abnormal account identification method, which can be used for the playback control terminal 01. By detecting the online download speed of the client 03 requesting online playback, the abnormal account is identified based on the different reactions of the normal account and the abnormal account in the case of overspeed download.

[0036] The playback control terminal 01 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can include a network communication unit, a processor, a memory, and the like.

[0037] The playback control terminal 01 and the multimedia content distribution node 02 can be set separately or integrated together. When the playback control terminal 01 and the multimedia content distribution node 02 are set separately, the multimedia content distribution node 02 can be an edge node in the CDN, and each multimedia content distribution node 02 can include an independent physical server.

[0038] The client 03 may be a physical device such as a smart phone, a computer (such as a desktop computer, a tablet computer, a laptop computer), an augmented reality (AR) / virtual reality (VR) device, a digital assistant, an intelligent voice interaction device (such as an intelligent speaker), an intelligent wearable device, an intelligent home appliance, a vehicle-mounted terminal, etc., or may be software running in a physical device, such as a computer program. The operating system corresponding to the client may be an Android system (Android system), an iOS system (a mobile operating system developed by Apple), a Linux system (an operating system), a Microsoft Windows system (Microsoft Windows operating system), etc.

[0039] It should be noted that for operational data involving user information, etc. in the embodiments of this application, when the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0040] The following is based on Figure 1 The application environment introduces a specific embodiment of an abnormal account identification method of the present application, and the abnormal account identification method can be applied to a playback control terminal. Figure 2 It is a flowchart of an abnormal account identification method provided in an embodiment of the present application. The present application provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. Specifically, Figure 2 As shown, the method may include:

[0041] S201: Acquire multimedia online download data from a multimedia content distribution node; the multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account.

[0042] In the embodiment of the present application, multimedia content may refer to data in audio, video or other multimedia forms. The multimedia content distribution node stores multimedia data, which includes but is not limited to video data and audio data. An application with multimedia playback function is running on the client, and the client can request the multimedia content distribution node to play the multimedia content online through the application. When the client downloads multimedia data from the multimedia content distribution node, the multimedia content distribution node can record the user account currently logged in by the application and the client identification, and can also record the online download speed of the client, thereby forming multimedia online download data for storage. It should be noted that the client needs to download and play while playing online. Here, downloading refers to online downloading, and the multimedia content downloaded online will not be saved locally on the client. The playback control terminal can obtain the multimedia online download data from the multimedia content distribution node for subsequent detection. The above-mentioned client may refer to a physical device, and accordingly, the client identification may include a device identification.

[0043] Before the client sends a multimedia request to the multimedia content distribution node to play multimedia content online, it needs to know the address information of the multimedia content distribution node before downloading and playing the multimedia content from the multimedia content distribution node. Therefore, in some possible embodiments, before obtaining multimedia online download data from the multimedia content distribution node, the abnormal account identification method of the embodiment of the present application may also include: in response to the online play request sent by the client, sending a multimedia play address file to the client; the multimedia play address file includes address information pointing to the multimedia content distribution node.

[0044] Specifically, in practical applications, multimedia content can be sliced ​​into multiple content segments, and different content segments are stored by different multimedia content distribution nodes. Therefore, in the embodiment of the present application, multimedia content can refer to a whole segment of complete multimedia content, or it can refer to individual content segments. Correspondingly, when the multimedia content requested to be played by the client is sliced ​​into multiple content segments and stored on different multimedia content distribution nodes, the above-mentioned multimedia playback address file includes address information pointing to each multimedia content distribution node corresponding to each content segment. When the multimedia content is a video, the multimedia playback address file can be an M3U8 file commonly used for streaming media transmission; the M3U8 file contains the link addresses of multiple TS (TransportStream) files, and the client can download TS files one by one according to the link address in the M3U8 file, and play each video segment in a specified order.

[0045] Taking multimedia content as an example, in general, when the client plays a video, it will pre-download part of the video within a few minutes according to the current network conditions to ensure that the user's viewing speed and download speed are maintained within a certain balance, that is, the duration of the downloaded video is greater than the current playback time plus a small buffering time, so that the normal download time of a video is generally close to the viewing time of the video. However, for abnormal users who download rather than watch, the online download time is too long, so abnormal users usually download at high speed and cache the video locally.

[0046] In an embodiment of the present application, in order to accurately identify abnormal users, that is, to identify abnormal accounts that have engaged in illegal downloading behaviors such as caching multimedia content that is only for online playback locally, the playback control terminal can obtain multimedia online download data from the multimedia content distribution node and identify abnormal accounts based on the multimedia online download data.

[0047] S203: Detecting the online download speed of multimedia content in the user account.

[0048] In the embodiment of the present application, the playback control terminal mainly detects the online download speed of the multimedia content of the user account in the multimedia online download data to identify the user account with abnormal download speed.

[0049] Due to the large number of clients that multimedia content distribution nodes face in actual applications, it is very difficult to accurately identify abnormal accounts from a large number of user accounts, so it is necessary to narrow the scope of abnormal accounts. This application takes into account that during the playback process, abnormal accounts involving abnormal users always have some behaviors or characteristics that are inconsistent with normal user accounts. For example, in order to download as many videos as possible, abnormal accounts will have a low video completion rate but a high download completion rate. Another example is that abnormal accounts frequently switch videos in a short period of time.

[0050] Based on this, in some possible embodiments, the playback control terminal may identify some suspicious user accounts, and then focus on detecting the online download speed of multimedia content of these user accounts; specifically, the above-mentioned detection of the online download speed of multimedia content of the user account may include: detecting the online download speed corresponding to the user account that meets at least one of the following screening conditions;

[0051] The above screening criteria include:

[0052] (1) The number of online playback requests for different multimedia contents made by the user account within a first preset time period is greater than or equal to a first preset number;

[0053] (2) the number of online playback requests for the same multimedia content made by the user account within a second preset time period is greater than or equal to a second preset number;

[0054] (3) The completion rate of the user account is less than or equal to a preset completion rate and the download completion rate of the user account is greater than or equal to a preset completion rate; the completion rate represents the probability of completely playing the multimedia content, and the download completion rate represents the probability of completely downloading the multimedia content;

[0055] (4) the number of client identifiers associated with the user account is greater than or equal to a third preset number;

[0056] (5) The quality information of the multimedia content currently requested to be played online by the user account is greater than or equal to the preset quality information;

[0057] (6) There is an abnormality in the serial number of the multimedia content currently being played online by the user account.

[0058] The above-mentioned screening conditions are used by the playback control terminal to screen user accounts in order to narrow the identification scope of abnormal accounts; specifically, the playback control terminal can determine whether the relevant indicators of each user account meet the corresponding screening conditions for each user account, and detect the online download speed of multimedia content for user accounts that meet at least one screening condition.

[0059] In the above embodiment, combined with the abnormal behavior or characteristics of abnormal accounts during actual playback, a large number of user accounts are automatically screened by setting corresponding screening conditions to narrow the scope of existence of abnormal accounts. Compared with the method of directly identifying abnormal accounts from a large number of user accounts, the difficulty of identification can be greatly reduced and the accuracy of identification can be improved.

[0060] The above-mentioned screening conditions are described in detail below. First, for the above-mentioned screening conditions (1) to (4), various indicator data related to the playback behavior of the user account are involved, namely, the number of online playback requests for different multimedia contents by the user account within the first preset time, the number of online playback requests for the same multimedia content by the user account within the second preset time, the completion rate of the user account, the download completion rate of the user account and the client identifier associated with the user account; the above-mentioned indicator data can be determined based on the historical playback data of the user account;

[0061] Therefore, in some possible embodiments, after S201 obtains multimedia online download data from the multimedia content distribution node, before S203 detects the online download speed of the user account regarding the multimedia content, the abnormal account identification method of the embodiment of the present application may also include the following steps: Figure 3 The following steps are shown:

[0062] S301: Obtain historical playback data of a user account.

[0063] Specifically, the historical playback data may include the multimedia content identifiers requested for online playback by the user account within the historical time period, the playback client identifiers corresponding to the multimedia content identifiers, the historical playback start time, the historical playback end time, and the download information. Here, the download information may specifically include the download time, the download speed, the download completion identifier, etc. The historical time period may be within the past N days, N weeks, or N months, etc. The playback client identifier is the device identifier for playing each multimedia content identifier.

[0064] S303: Determine the number of online play requests for different multimedia contents by the user account within a first preset duration and the number of online play requests for the same multimedia content by the user account within a second preset duration according to the identifiers of the multimedia contents requested for online play within the historical time period.

[0065] Specifically, the first preset duration and the second preset duration can both be within a few minutes or a few hours; for example, the playback control terminal can determine the total number of online playback requests in the past week based on the multimedia content identifiers requested for online playback in the past week, and then average it out to obtain the number of online playback requests for different multimedia contents per hour by the user account; or, for each multimedia content identifier, the playback control terminal can average the number of online playback requests for the multimedia content identifier per hour based on the number of times online playback was requested in the past week.

[0066] S305: Determine the completion rate of the user account and the download completion rate of the user account according to the historical play start time, the historical play end time and the download information of each multimedia content identifier.

[0067] Specifically, the playback control terminal can calculate the completion rate of the user account based on the historical playback start time and the historical playback end time of each multimedia content identifier; for example, the playback control terminal determines the completion rate of each multimedia content based on the matching degree between the time difference between the historical playback start time and the historical playback end time and the duration of the multimedia content, and then determines the average completion rate in the historical time period; or, according to the historical playback start time and the historical playback end time of each multimedia content identifier, the number of complete playbacks is determined, and the number of complete playbacks is divided by the total number of multimedia contents to obtain the completion rate. In addition, the playback control terminal can determine whether each multimedia content has been downloaded according to the download completion identifier in the download information of each multimedia content identifier, and divide the number of multimedia contents that have been downloaded by the total number of multimedia contents to obtain the download completion rate.

[0068] S307: Determine the client identifier associated with the user account based on the playback client identifier corresponding to each multimedia content identifier.

[0069] Specifically, the playback control terminal can count the number of clients used by the same user account in a historical period, that is, determine the playback client identifier corresponding to each multimedia content as the client identifier associated with the user account, and obtain the number of client identifiers associated with the user account.

[0070] In the above embodiment, the playback control terminal determines the playback behavior characteristics of the user account based on the historical playback data of the user account, so that some suspicious accounts can be preliminarily screened out based on the playback behavior characteristics of abnormal accounts, which helps to improve the accuracy of abnormal account identification.

[0071] Secondly, for the above-mentioned screening conditions (5) to (6), it involves the multimedia content currently requested for online playback by the user account; firstly, considering that in actual applications, abnormal users only download high-quality multimedia content when downloading multimedia content, such as Figure 4 In the video playback interface shown, abnormal users only download high-definition videos such as Blu-ray and 4K, so that the playback control terminal can exclude some user accounts with lower quality requirements based on the quality information of the multimedia content currently requested for online playback by the user account. Secondly, in actual applications, the client will send the playback information of the multimedia content currently being played online to the playback control terminal. The playback information includes but is not limited to the serial number, multimedia content identifier, hardware information of the playback client, network data, quality information of the multimedia content, etc.; and abnormal accounts generally do not actually watch online and therefore cannot generate playback information, so the client of the abnormal account needs to construct some false playback information and report it to the playback control terminal. Based on this, the playback control terminal can screen out suspicious accounts by detecting the authenticity of the playback information.

[0072] In some possible embodiments, after obtaining the multimedia online download data from the multimedia content distribution node and before detecting the online download speed of the multimedia content of the user account, the abnormal account identification method of the embodiment of the present application may also include the following steps: Figure 5 The following steps are shown:

[0073] S501: Obtaining the serial number of the multimedia content currently being played online by the user account reported by the client.

[0074] As described above, in actual applications, the client sends the playback information of the multimedia content currently being played online to the playback control end, and the playback information includes the serial number of the multimedia content currently being played online by the user account.

[0075] S503: Verify the serial number based on the standard serial number encoding rule to obtain a verification result indicating that the serial number is abnormal or that the serial number is not abnormal.

[0076] Under normal circumstances, the serial number is automatically generated according to the standard serial number encoding rules, such as randomly generating a serial number with a fixed number of alphanumeric digits; since the abnormal account does not know the serial number generation rules, the playback control end can verify the serial number based on the standard serial number encoding rules when detecting the serial number. When the number of digits in the serial number does not match the fixed number of digits, and / or the alphanumeric combination does not conform to the standard form, a verification result indicating that there is an abnormality in the serial number can be obtained; otherwise, a verification result indicating that there is no abnormality in the serial number is obtained.

[0077] In the above embodiment, the playback control terminal can also preliminarily screen out some suspicious accounts based on the quality information of the multimedia content currently requested to be played online by the user account and the playback information such as the serial number. By combining various screening conditions, the scope of abnormal accounts can be minimized, which is helpful for identifying abnormal accounts.

[0078] S205: If it is detected that the online download speed exceeds the preset download speed, a speed limit instruction is sent to the client corresponding to the client identifier; the speed limit instruction is used to instruct the client to adjust the online download speed.

[0079] In an embodiment of the present application, the playback control end detects the online download speed of the multimedia content of the user account. If it is detected that the online download speed exceeds the preset download speed, a speed limit instruction is sent to the client corresponding to the client identifier. After the client receives the speed limit instruction, it needs to adjust the online download speed.

[0080] The preset download speed is determined by the playback control terminal. In some possible embodiments, after obtaining the multimedia online download data from the multimedia content distribution node, and before detecting the online download speed of the multimedia content of the user account, the abnormal account identification method of the embodiment of the present application may also include the following steps: Figure 6 The following steps are shown:

[0081] S601: Acquire quality information of multimedia content currently requested to be played online by a user account reported by a client.

[0082] As described above, in actual applications, the client sends the playback information of the multimedia content currently being played online to the playback control end, and the playback information includes the quality information of the multimedia content currently requested to be played online by the user account.

[0083] S603: Determine a preset download speed according to the amount of downloaded data corresponding to the quality information and the playback duration of the multimedia content.

[0084] Specifically, the playback control terminal can limit the online speed; usually, the playback control terminal can limit the online download speed according to the quality information of the multimedia content currently requested for online playback by the user account and the playback time of the multimedia content; for example, the playback control terminal divides the amount of downloaded data corresponding to the quality information by the duration of the multimedia content to obtain a preset download speed, and then the playback control terminal controls the online download speed of the client according to the preset download speed, and ensures that the online download duration is only a few seconds longer than the online playback duration. Further, the playback control terminal can consider the situation where the client watches at different speeds, such as in the case of one-time viewing, the preset download speed = the amount of downloaded data corresponding to the quality information / the duration of the multimedia content, and in the case of three-time viewing, the preset download speed = (the amount of downloaded data corresponding to the quality information / the duration of the multimedia content) * 3. Further, the playback control terminal can also consider that the client user releases the limit on the online download speed in the case of dragging, urgently downloads part of the content, and then controls it according to the preset download speed when the playback is stable.

[0085] In a further possible embodiment, the device type of the client can also be considered. For example, when the device type of the client is a TV, due to the agreement between TV manufacturers, the download speed detection and restriction of the user account on the TV may not be performed. This can also help the playback control end exclude some non-suspicious accounts.

[0086] In the above embodiment, the playback control terminal determines the preset download speed based on the quality information of the multimedia content currently requested to be played online by the user account, and can reasonably limit the online download speed of the client while ensuring that the client playback is not stalled.

[0087] In the embodiment of the present application, if the online download speed exceeds the preset download speed, the playback control terminal will send a speed limit instruction to the client, and the client needs to adjust the online download speed; generally, the client corresponding to the normal account and the client corresponding to the abnormal account have different reactions to the speed limit instruction. Figure 7 As shown in the figure, after the client exceeds the preset download speed, it receives the speed limit instruction, and then adjusts the online download speed without lag, making the online download speed slower; and the client corresponding to the abnormal account is as follows Figure 7 As shown, after the client exceeds the preset download speed, it will not perceive the speed limit instruction, and the online download speed will not slow down and will still download at a high speed. For example, if it is detected that the online download speeds of the normal account client and the abnormal account client are both 2MB / s, the playback control end will send speed limit instructions to the two clients respectively, instructing the two clients to reduce the online download speed to 1MB / s. By continuing to detect the online download speed, it will be found that the online download speed of the normal account client has dropped to 1MB / s, while the online download speed of the abnormal account client is still 2MB / s.

[0088] Therefore, in an embodiment of the present application, the playback control end issues a speed limit instruction, and then detects the online download speed after issuing the speed limit instruction. By comparing the online download speed detected before issuing the speed limit instruction with the online download speed detected after issuing the speed limit instruction, it is checked whether the user is an abnormal user.

[0089] S207: If it is detected that the client does not adjust the online download speed, the user account is marked as an abnormal account, where the abnormal account represents an account with illegal downloading behavior.

[0090] In an embodiment of the present application, after the playback control end sends a speed limit instruction to the client corresponding to the client identifier, the online download speed of the client is detected. If it is detected that the client has not adjusted the online download speed, the user account is marked as an abnormal account.

[0091] The following are two methods for detecting whether the client adjusts the online download speed.

[0092] First, in some possible embodiments, the application on the client can maintain a long connection with the playback control terminal, and specifically a heartbeat mechanism can be used; in this way, the playback control terminal can use a heartbeat packet to send a speed limit instruction to the client, and then, the above-mentioned sending of the speed limit instruction to the client corresponding to the client identifier can include: sending the speed limit instruction to the client through an encrypted heartbeat packet. Here, in order to further increase the difficulty of cracking by abnormal users, the playback control terminal can encrypt the heartbeat packet containing the speed limit instruction.

[0093] Correspondingly, if it is detected that the client has not adjusted the online download speed, marking the user account as an abnormal account may include: if no heartbeat packet response data from the client is received within a preset time, it is determined that the client has not adjusted the online download speed, and marking the user account as an abnormal account.

[0094] Under normal circumstances, after receiving the encrypted heartbeat packet, the client decrypts the encrypted heartbeat packet according to the agreed decryption algorithm to obtain the speed limit instruction, and then adjusts the online download speed. After the adjustment, it adds response data indicating that the speed has been reduced to the heartbeat packet regularly returned to the playback control end; for abnormal accounts, since the online playback request is not normally triggered in the application, there is no long connection maintained by the heartbeat mechanism between its client and the playback control end, so it cannot perceive and cannot make any response to the encrypted heartbeat packet sent by the playback control end; based on this, the playback control end can determine whether the client has adjusted the online download speed by detecting whether there is response data indicating that the speed has been reduced in the heartbeat packet returned by the client. If the heartbeat packet returned by the client is not received or the response data indicating that the speed has been reduced is not detected in the returned heartbeat packet, it is considered that the client has not adjusted the online download speed, and the user account is marked as an abnormal account.

[0095] In actual applications, the developer of multimedia playing applications can use programming languages ​​such as C++ to develop related functional components to form a code package in the form of a WebAssembly file or a so package. In this way, the above-mentioned detection method based on the heartbeat mechanism can be implemented on different platforms such as browsers, Android, and Apple.

[0096] Secondly, in some other possible embodiments, the playback control terminal may obtain multimedia online download data corresponding to each period from the multimedia content distribution node according to a preset period, that is, the multimedia online download data includes a user account that requests online playback of multimedia content from the multimedia content distribution node in each period obtained from the multimedia content distribution node according to the preset period, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account; then, the above-mentioned detection of the online download speed of the multimedia content in the user account may include: detecting the online download speed corresponding to the user account in each period;

[0097] For example, the playback control end can obtain from the multimedia content distribution node every N hours the user account that requested online playback of multimedia content from the multimedia content distribution node in the past N hours, the client identifier corresponding to the user account, and the online download speed of the multimedia content in the user account; then, the playback control end can detect the online download speed corresponding to each user account in the past N hours.

[0098] Accordingly, if it is detected that the online download speed exceeds the preset download speed, sending a speed limit instruction to the client corresponding to the client identifier may include: if it is detected that the online download speed exceeds the preset download speed in the current cycle, sending a speed limit instruction to the client corresponding to the client identifier; here, the specific process can refer to step S205 and related embodiments, which will not be repeated here;

[0099] Correspondingly, if it is detected that the client has not adjusted the online download speed, marking the user account as an abnormal account may include: if no adjustment of the online download speed is detected in a subsequent cycle of the current cycle, marking the user account as an abnormal account.

[0100] Specifically, since the playback control end will perform speed detection periodically, the playback control end can mark the client that is detected to be downloading at an excessive speed in the current cycle, and subsequently focus on the client that has been marked as having excessive speed; if the client is not detected to have adjusted the online download speed in the next cycle or the next cycle or other subsequent cycles, the user account will be marked as an abnormal account; conversely, if the client is detected to have adjusted the online download speed, it indicates that the client is a trusted device and the user account is a normal account.

[0101] In the above two embodiments of detecting whether the client adjusts the online download speed, the playback control end is based on the feature that abnormal accounts cannot perceive the speed limit instruction. By comparing the online download speed before the speed limit instruction is issued with the online download speed after the speed limit instruction is issued, the client that has not adjusted the online download speed can be quickly identified, and the corresponding user account can be marked as an abnormal account. The download behavior of the abnormal account can be stopped in time later to avoid the leakage of multimedia content.

[0102] In a further possible embodiment, if it is detected that the client does not adjust the online download speed, the user account is marked as an abnormal account, which may also include: if it is detected that the client does not adjust the online download speed for multiple times, the user account is marked as an abnormal account. Specifically, the playback control terminal can repeatedly verify, that is, repeatedly send the speed limit instruction - detect whether the online download speed is adjusted. If the client does not adjust the online download speed each time during the multiple verifications, the corresponding user account can be identified as an abnormal account, thereby avoiding the situation where some normal accounts are misidentified.

[0103] In a further possible embodiment, in order to prevent abnormal accounts from noticing that the playback control terminal is performing abnormal detection, the playback control terminal may not issue a speed limit instruction immediately, and may cancel the speed limit after a period of time after issuing the speed limit instruction. In this way, the possibility of abnormal users noticing can be reduced.

[0104] In addition, it should be noted that the steps implemented by the above-mentioned playback control terminal can be implemented in the same background, or can be implemented by different backgrounds according to the division of steps, and can be specifically set according to the actual situation of the business end.

[0105] Combine the following Figure 8 The data interaction process between the playback control terminal, the client and the multimedia content distribution node in the abnormal account identification method of the embodiment of the present application is further described. Figure 8 As shown, in step S801, the client sends an online play request to the playback control terminal, and the online play request may carry a multimedia content identifier requested to be played; in step S803, the playback control terminal responds to the online play request and sends a multimedia playback address file corresponding to the multimedia content identifier to the client; in step S805, the client requests the corresponding multimedia content distribution node to play the multimedia content online according to the address information in the multimedia playback address file; then the multimedia content distribution node responds to the request and sends multimedia data to the client; in step S807, the multimedia content distribution node records and saves the multimedia online download data, that is, records the online download speed, user account, and client identifier of the client; in step S809, the playback control terminal obtains the multimedia online download data from the multimedia content distribution node; in step S811, the playback control terminal detects the online download speed; in step S813, the playback control terminal determines that the client is overspeeding and sends a speed limit instruction to the client; in step S815, the playback control terminal detects whether the client adjusts the online download speed, and determines whether the client is an abnormal user, that is, whether the user account is an abnormal account according to the detection result.

[0106] In summary, the abnormal account identification method provided in the embodiment of the present application detects the online download speed of the user account, issues a speed limit instruction when the speed exceeds the limit, and identifies the abnormal account based on the comparison result of the online download speed before and after the speed limit instruction. In this way, the current situation of abnormal users downloading videos or other multimedia on a large scale can be effectively solved; at the same time, due to the reduction of abnormal users, the pressure on multimedia content distribution nodes can be reduced, so that the download speed of normal users can be faster, which helps to improve the user's playback experience.

[0107] The present application also provides an abnormal account identification device, such as Fig. 9 As shown, the abnormal account identification device 90 includes:

[0108] The acquisition module 901 is used to acquire multimedia online download data from the multimedia content distribution node; the multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account;

[0109] A detection module 902, configured to detect the online download speed of multimedia content of a user account;

[0110] The sending module 903 is used to send a speed limit instruction to the client corresponding to the client identifier if it is detected that the online download speed exceeds the preset download speed; the speed limit instruction is used to instruct the client to adjust the online download speed;

[0111] The marking module 904 is used to mark the user account as an abnormal account if it is detected that the client does not adjust the online download speed. The abnormal account represents an account with illegal downloading behavior.

[0112] In some possible embodiments, the detection module 902 is also used to detect the online download speed corresponding to the user account that meets at least one of the following screening conditions; the screening conditions include: the number of online playback requests for different multimedia contents by the user account within a first preset time period is greater than or equal to a first preset number; the number of online playback requests for the same multimedia content by the user account within a second preset time period is greater than or equal to a second preset number; the completion rate of the user account is less than or equal to the preset completion rate and the download completion rate of the user account is greater than or equal to the preset completion rate; the completion rate represents the probability of completely playing the multimedia content, and the download completion rate represents the probability of completely downloading the multimedia content; the number of client identifiers associated with the user account is greater than or equal to a third preset number; the quality information of the multimedia content currently requested to be played online by the user account is greater than or equal to the preset quality information; there is an abnormality in the serial number of the multimedia content currently played online by the user account.

[0113] In some possible embodiments, the device also includes a first determination module, which is used to obtain historical playback data of the user account; the historical playback data includes each multimedia content identifier requested for online playback by the user account within a historical time period and the playback client identifier corresponding to each multimedia content identifier, the historical playback start time, the historical playback end time, and download information; based on each multimedia content identifier requested for online playback within the historical time period, determine the number of online playback requests for different multimedia contents by the user account within a first preset time period and the number of online playback requests for the same multimedia content by the user account within a second preset time period; based on the historical playback start time, the historical playback end time and the download information of each multimedia content identifier, determine the completion rate of the user account and the download completion rate of the user account; based on the playback client identifier corresponding to each multimedia content identifier, determine the client identifier associated with the user account.

[0114] In some possible embodiments, the device also includes a verification module for obtaining the serial number of the multimedia content currently played online by the user account reported by the client; verifying the serial number based on standard serial number encoding rules to obtain a verification result indicating that there is an abnormality in the serial number or there is no abnormality in the serial number.

[0115] In some possible embodiments, the device also includes a second determination module for obtaining quality information of multimedia content currently requested to be played online by a user account reported by the client; and determining a preset download speed based on the amount of downloaded data corresponding to the quality information and the playback time of the multimedia content.

[0116] In some possible embodiments, the sending module 903 is further used to send a multimedia playback address file to the client in response to an online playback request sent by the client; the multimedia playback address file includes address information pointing to a multimedia content distribution node.

[0117] In some possible embodiments, the sending module 903 is also used to send a speed limit instruction to the client via an encrypted heartbeat packet; the marking module 904 is also used to determine that the client has not adjusted the online download speed if no heartbeat packet response data from the client is received within a preset time, and mark the user account as an abnormal account.

[0118] In some possible embodiments, the multimedia online download data includes a user account that requests online playback of multimedia content from the multimedia content distribution node in each cycle, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account, which are obtained from the multimedia content distribution node according to a preset cycle; the detection module 902 is also used to detect the online download speed corresponding to the user account in each cycle; the sending module 903 is also used to send a speed limit instruction to the client corresponding to the client identifier if it is detected that the online download speed exceeds the preset download speed in the current cycle; the marking module 904 is also used to mark the user account as an abnormal account if no adjustment of the online download speed is detected in the subsequent cycle of the current cycle.

[0119] It should be noted that the device in the device embodiment and the method embodiment are based on the same inventive concept.

[0120] An embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal account identification method provided in the above method embodiment.

[0121] In the embodiment of the present application, the electronic device may be the playback control terminal in the method embodiment, or may be the client in the method embodiment.

[0122] Further, Fig.10 FIG. 1 is a schematic diagram showing the hardware structure of an electronic device for implementing the abnormal account identification method provided in an embodiment of the present application. Fig.10 As shown, the electronic device 100 may include one or more (shown as 1002a, 1002b, ..., 1002n in the figure) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 1004 for storing data, and a transmission device 1006 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Fig.10 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig.10 More or fewer components as shown, or with Fig.10 Different configurations shown.

[0123] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 100 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0124] The memory 1004 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal account identification method described in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 1004, that is, realizing the above-mentioned abnormal account identification method. The memory 1004 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 1004 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the electronic device 100 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0125] The transmission device 1006 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 100. In one example, the transmission device 1006 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one embodiment, the transmission device 1006 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0126] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 100 (or mobile device).

[0127] An embodiment of the present application also provides a computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to an abnormal account identification method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal account identification method provided by the above method embodiment.

[0128] Optionally, in this embodiment, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0129] An embodiment of the present application also provides a computer program product, which includes at least one instruction or at least one program. When the at least one instruction or at least one program is executed by a processor, the abnormal account identification method provided by the above method embodiment is implemented.

[0130] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0131] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and electronic device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0132] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0133] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for identifying abnormal accounts, characterized in that: include: Obtain multimedia online download data from a multimedia content distribution node; The multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account; detecting an online download speed of the multimedia content in the user account; If it is detected that the online download speed exceeds the preset download speed, a speed limit instruction is sent to the client corresponding to the client identifier; The speed limit instruction is used to instruct the client to adjust the online download speed; If it is detected that the client does not adjust the online download speed, the user account is marked as an abnormal account, and the abnormal account represents an account with illegal downloading behavior.

2. The abnormal account identification method according to claim 1, characterized in that: The detecting the online download speed of the multimedia content of the user account includes: Testing the online download speed corresponding to the user account that meets at least one of the following screening conditions; The screening conditions include: The number of online playback requests for different multimedia contents made by the user account within a first preset time period is greater than or equal to a first preset number; The number of online playback requests for the same multimedia content by the user account within a second preset time period is greater than or equal to a second preset number; The completion rate of the user account is less than or equal to a preset completion rate and the download completion rate of the user account is greater than or equal to a preset completion rate; the completion rate represents the probability of completely playing the multimedia content, and the download completion rate represents the probability of completely downloading the multimedia content; The number of client identifiers associated with the user account is greater than or equal to a third preset number; The quality information of the multimedia content currently requested to be played online by the user account is greater than or equal to the preset quality information; There is an abnormality in the serial number of the multimedia content currently being played online by the user account.

3. The abnormal account identification method according to claim 2, characterized in that: After acquiring multimedia online download data from the multimedia content distribution node and before detecting the online download speed of the multimedia content for the user account, the method further includes: Acquire historical playback data of the user account; the historical playback data includes each multimedia content identifier requested by the user account for online playback within a historical time period and the playback client identifier corresponding to each multimedia content identifier, historical playback start time, historical playback end time, and download information; Determining, according to the identifiers of the multimedia contents requested for online playback within the historical time period, the number of online playback requests for different multimedia contents made by the user account within a first preset time period and the number of online playback requests for the same multimedia content made by the user account within a second preset time period; Determining the completion rate of the user account and the download completion rate of the user account according to the historical playback start time, the historical playback end time and the download information of each multimedia content identifier; Based on the playback client identifiers corresponding to the multimedia content identifiers, the client identifier associated with the user account is determined.

4. The abnormal account identification method according to claim 2 or 3, characterized in that: After acquiring multimedia online download data from the multimedia content distribution node and before detecting the online download speed of the multimedia content for the user account, the method further includes: Obtaining the serial number of the multimedia content currently being played online by the user account reported by the client; The serial number is verified based on standard serial number encoding rules to obtain a verification result indicating that there is an abnormality in the serial number or that there is no abnormality in the serial number.

5. The abnormal account identification method according to claim 1, characterized in that: After acquiring multimedia online download data from the multimedia content distribution node and before detecting the online download speed of the multimedia content for the user account, the method further includes: Acquire quality information of multimedia content currently requested to be played online by the user account reported by the client; The preset download speed is determined according to the amount of downloaded data corresponding to the quality information and the playback duration of the multimedia content.

6. The abnormal account identification method according to claim 1, characterized in that: Before acquiring the multimedia online download data from the multimedia content distribution node, the method further includes: In response to the online play request sent by the client, a multimedia play address file is sent to the client; the multimedia play address file includes address information pointing to the multimedia content distribution node.

7. The abnormal account identification method according to any one of claims 1 to 6, characterized in that: The sending a speed limit instruction to the client corresponding to the client identifier includes: Sending the speed limit instruction to the client via an encrypted heartbeat packet; If it is detected that the client does not adjust the online download speed, marking the user account as an abnormal account includes: If the heartbeat packet response data of the client is not received within the preset time, it is determined that the client has not adjusted the online download speed, and the user account is marked as an abnormal account.

8. The abnormal account identification method according to any one of claims 1 to 6, characterized in that: The multimedia online download data includes a user account that requests the multimedia content distribution node to play multimedia content online in each cycle, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account obtained from the multimedia content distribution node according to a preset cycle; The detecting the online download speed of the multimedia content of the user account includes: Detecting the online download speed corresponding to the user account in each period; If it is detected that the online download speed exceeds the preset download speed, sending a speed limit instruction to the client corresponding to the client identifier includes: If it is detected that the online download speed exceeds the preset download speed in the current cycle, a speed limit instruction is sent to the client corresponding to the client identifier; If it is detected that the client does not adjust the online download speed, marking the user account as an abnormal account includes: If no adjustment of the online download speed is detected in a subsequent period of the current period, the user account is marked as an abnormal account.

9. An abnormal account identification device, characterized in that: include: An acquisition module, used for acquiring multimedia online download data from a multimedia content distribution node; The multimedia online download data includes a user account that requests the multimedia content distribution node to play the multimedia content online, a client identifier corresponding to the user account, and an online download speed of the multimedia content in the user account; A detection module, configured to detect an online download speed of the multimedia content of the user account; A sending module, configured to send a speed limit instruction to a client corresponding to the client identifier if it is detected that the online download speed exceeds a preset download speed; The speed limit instruction is used to instruct the client to adjust the online download speed; The marking module is used to mark the user account as an abnormal account if it is detected that the client does not adjust the online download speed, and the abnormal account represents an account with illegal downloading behavior.

10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal account identification method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal account identification method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product includes at least one instruction or at least one program, and when the at least one instruction or the at least one program is executed by a processor, the abnormal account identification method according to any one of claims 1 to 8 is implemented.

Images