Cheating behavior detection method and device

Abstract

The invention provides a cheating behavior detection method and device, and relates to the technical field of computers, in particular to the technical field of data processing. According to the specific implementation scheme, the method comprises the steps of counting advertisement browsing behavior information of each to-be-detected device; according to the advertisement browsing behavior information of the to-be-detected devices, determining an association relationship between the to-be-detected devices; for each to-be-detected device, on the basis of the device features of the associated devices of the to-be-detected device, feature updating is carried out on the device features of the to-be-detected device, and according to the updated device features, whether the to-be-detected device is a cheating device is detected; and according to the detection result of each to-be-detected device, determining whether a cheating behavior exists in the third-party media platform on which the detected cheating device has clicked the advertisement. By applying the scheme provided by the embodiment of the invention, whether the third-party media platform has a cheating behavior or not can be detected.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, in particular to the field of data processing technology, and more particularly to a cheating behavior detection method and device. Background Art

[0002] To increase the exposure of their own products, advertisers can entrust advertising platforms to promote their products and pay advertising fees to the advertising platforms. When advertising platforms promote advertisers' products, they can place advertisements for advertisers' products on their own platforms and on the third-party media platforms they cooperate with.

[0003] For advertisements placed on third-party media platforms, when the third-party media platform displays the advertisement on the user's device, the third-party media platform needs to send an advertisement display request carrying the user's device information to the advertising platform, so as to obtain the advertisement information fed back by the advertising platform and display it. In addition, if the user subsequently clicks on the advertisement to browse it, the advertising platform can monitor and obtain the user's ad browsing behavior information. The advertising platform can count the user device information and ad browsing behavior information obtained in the request at regular intervals, and pay the third-party media platform the cost of placing advertisements during that period of time based on the information counted.

[0004] However, some third-party media platforms may use forged user device information to generate ad display requests and simulate normal users clicking on ads to browse them. Through this cheating behavior, they increase the number of ad displays and views, thereby gaining more profits.

[0005] In view of this, a cheating behavior detection solution is needed to detect whether the third-party media platform has the above-mentioned cheating behavior. Summary of the invention

[0006] The present invention provides a cheating behavior detection method and device.

[0007] In a first aspect, an embodiment of the present disclosure provides a cheating behavior detection method, comprising:

[0008] Collecting statistics on the advertisement browsing behavior information of each device to be detected, wherein the device to be detected is: a device determined according to the user device information carried in the advertisement display information sent by the third-party media platform;

[0009] Determine the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected;

[0010] For each device to be detected, based on the device features of each associated device of the device to be detected, the device features of the device to be detected are updated, and according to the updated device features, whether the device to be detected is a cheating device is detected, wherein the associated device of the device to be detected is: a device that has an associated relationship with the device to be detected;

[0011] According to the detection results of each device to be detected, it is determined whether the third-party media platform whose advertisements were clicked by the detected cheating device has cheated.

[0012] In a second aspect, an embodiment of the present disclosure provides a cheating behavior detection device, comprising:

[0013] An information statistics module, used to count the advertisement browsing behavior information of each device to be detected, wherein the device to be detected is: a device determined according to the user device information carried in the advertisement display information sent by the third-party media platform;

[0014] A relationship determination module, used to determine the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected;

[0015] The device detection module is used to update the device characteristics of each device to be detected based on the device characteristics of each associated device of the device to be detected, and detect whether the device to be detected is a cheating device according to the updated device characteristics, wherein the associated device of the device to be detected is: a device that has an associated relationship with the device to be detected;

[0016] The behavior detection module is used to determine whether the third-party media platform on which the detected cheating device has clicked on the advertisement has cheated based on the detection results of each device to be detected.

[0017] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect.

[0021] In a fourth aspect, an embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method described in the first aspect.

[0022] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0023] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is applied to detect cheating behavior, the association relationship between the devices to be detected is determined based on the advertising browsing behavior information of each device to be detected. Since the advertising browsing behaviors of different cheating devices can be considered to be similar, the devices to be detected that are determined to have an association relationship can be considered to be devices to be detected that are suspected cheating devices. In this way, for each device to be detected, the device characteristics of its associated associated devices are used to update the characteristics of the device to be detected, and the device characteristics of multiple devices suspected of being cheating devices can be concentrated to determine whether the detection device is a cheating device. In this way, the technical problem that the third-party media platform disperses the cheating devices by switching device models to avoid being detected can be solved, and then according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0026] Figure 1 A flowchart of a first cheating behavior detection method provided by an embodiment of the present disclosure;

[0027] Figure 2 A schematic diagram of a process for constructing a device association diagram provided in an embodiment of the present disclosure;

[0028] Figure 3 A schematic diagram of the structure of a device association diagram provided in an embodiment of the present disclosure;

[0029] Figure 4 A schematic diagram of a flow chart of a second cheating behavior detection method provided in an embodiment of the present disclosure;

[0030] Figure 5 A schematic diagram of the structure of a first cheating behavior detection device provided in an embodiment of the present disclosure;

[0031] Figure 6 A schematic diagram of the structure of a second cheating behavior detection device provided in an embodiment of the present disclosure;

[0032] Figure 7It is a block diagram of an electronic device used to implement the cheating behavior detection method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0034] In the existing scheme for detecting whether a user device is a cheating device, preset rules can be used to detect whether a third-party media platform has cheating behavior. For example, statistics are obtained to obtain the distribution of information such as the number of ad views and frequency of the user device, and it is determined whether the obtained information distribution is consistent with the information distribution of a normal device. If not, the user device is determined to be a cheating device. If the number of ad views exceeds the normal number threshold, the user device is determined to be a cheating device.

[0035] However, some cheating third-party media platforms use forged device information when generating ad display requests. The cheating third-party media platforms can avoid abnormal distribution of ad browsing information of cheating devices with the same forged device information by switching device information.

[0036] For example, if the above-mentioned normal number threshold is 15, if the cheating third-party media platform does not switch the device information and sends 20 requests, the advertising platform can detect that the device with the device information has browsed the advertisement 20 times, and can determine that the device is a cheating device; and if the cheating third-party media platform uses a forged device information, sends 10 requests, and then switches to another forged device information and sends 10 requests, the advertising platform actually detects that two different devices browsed the advertisement 10 times respectively. Since the number of advertisement browsing times of these two devices does not exceed 15 times, the advertising platform will not detect that these two devices are cheating devices.

[0037] In order to solve the above technical problems, the embodiments of the present disclosure provide a cheating behavior detection method and device.

[0038] First, the execution subject of the cheating behavior detection solution provided by the embodiment of the present disclosure is described.

[0039] The executor of this plan is the advertising platform.

[0040] The advertising platform can count the user device information and ad browsing behavior information in the request at regular intervals, detect cheating devices based on the counted information, and remove the information of cheating devices from the counted information, so as to pay fees to the third-party media platform based on the remaining information; or evaluate the cheating third-party media platform based on the detected cheating devices, etc.

[0041] The following describes it in detail through specific embodiments.

[0042] In one embodiment of the present disclosure, see Figure 1 , a flow chart of a first cheating behavior detection method is provided. In this embodiment, the method includes the following steps S101-S104.

[0043] Step S101: Collecting statistics on advertisement browsing behavior information of each device to be detected.

[0044] The device to be detected is: a device determined according to user device information carried in the advertisement display information sent by the third-party media platform.

[0045] The above-mentioned advertisement browsing behavior information may include the number, duration, and frequency of advertisement browsing of the device to be detected.

[0046] Various requests sent by the third-party media platform to the advertising platform may carry device information such as device model, IP address, etc. The advertising platform can parse the device information from the request, so that each request received by the advertising platform can be considered as: the user device described by the parsed device information, the request sent by the third-party media platform when accessing the third-party media platform. Therefore, each request corresponds to a user device. If the device information carried in different requests is the same, the advertising platform can consider that the different requests correspond to the same user device.

[0047] Since the advertising platform can generate an advertising log for each response to a request sent by a third-party media platform and record the information carried in the request in the advertising log, when counting the advertising browsing behavior information of each device to be detected, various information in the advertising log can be counted to obtain the advertising browsing behavior information of each device to be detected and each device to be detected.

[0048] Step S102: determining the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected.

[0049] When a third-party media platform uses forged user device information to generate ad display requests and simulates normal users clicking on ads to browse, it can be considered that the third-party media platform has fabricated a cheating device to cheat, and the device information of the cheating device is the forged user device information. When a third-party media platform switches user device information, it can be considered that each third-party platform has switched to a different cheating device to cheat.

[0050] Since the ad browsing behaviors of different cheating devices can be considered similar, for example, the ad browsing times and frequencies of different cheating devices may be the same, therefore, based on the ad browsing behavior information of each device to be detected, different devices to be detected whose ad browsing behavior information distribution is relatively similar can be detected. There is a correlation between the different devices to be detected, that is, they may all be cheating devices.

[0051] The specific method of determining the association relationship between the devices to be detected can be found in the subsequent embodiments and will not be described in detail here.

[0052] Step S103: for each device to be detected, based on the device features of each associated device of the device to be detected, the device features of the device to be detected are updated, and according to the updated device features, whether the device to be detected is a cheating device is detected.

[0053] The associated device of the device to be detected is a device that has an associated relationship with the device to be detected.

[0054] The above device characteristics may include at least one of the following four characteristics:

[0055] The first feature: user information features of the user who uses the device to be detected;

[0056] The second feature: advertisement browsing behavior feature, wherein the advertisement browsing behavior feature is obtained based on advertisement browsing behavior information;

[0057] The third feature: device environment information of the device to be detected;

[0058] The fourth feature: information features of the device to be detected registered on a third-party media platform.

[0059] These four characteristics are introduced below.

[0060] For the first type of feature, the above user information feature may include user ID, unique identifier, address, etc.

[0061] When a third-party media platform sends a request to an advertising platform, the request may carry user information characteristics, so that the advertising platform can obtain the request and parse the user information characteristics carried in the request.

[0062] For the second feature, there may be multiple types of ad browsing behavior information, such as number of times, duration, frequency, etc., which correspond to multiple dimensions of the ad browsing behavior feature. The feature value under one dimension of the ad browsing behavior feature may be an information value of the ad browsing behavior information.

[0063] After the advertising platform obtains the advertising browsing behavior information of the device to be detected, various information of the device to be detected can be used as feature values ​​under various dimensions of advertising browsing behavior characteristics, thereby forming the advertising browsing behavior information.

[0064] For the third feature, the device environment information can be understood as information describing the operating environment of the device. For example, the device environment information can include the model of the device's CPU, the number of CPU cores, the model of the GPU, and so on.

[0065] For the fourth feature, during the cooperation between the advertising platform and the third-party media platform, the advertising platform can negotiate with the third-party media platform to obtain the user device registration information on the third-party media platform during the process of advertising. In this way, when the advertising platform places advertisements on the third-party media platform, it can obtain the information of the device to be detected that has been negotiated with the third-party media platform as the above-mentioned information feature.

[0066] Since the above four characteristics of cheating devices are difficult to be completely consistent with the above four characteristics of normal devices, any one of the four characteristics can accurately reflect whether the device to be detected is a normal device or a cheating device, so cheating behavior detection can be performed based on at least one of the four characteristics, which can improve detection accuracy.

[0067] Two implementation methods for updating the device features of the device to be detected are described below.

[0068] The first implementation method may be to obtain the attention coefficient between the device to be detected and the associated device as mentioned in the following embodiments, and update it according to the attention coefficient. For details, please refer to the subsequent embodiments, which will not be described in detail here.

[0069] In the second implementation method, a deep neural network can be used to extract deeper features from the device features of the device to be detected. For example, a convolutional neural network is used to perform deep convolution on the device features of the device to be detected to obtain the deep features of the device to be detected as the updated features of the device to be detected.

[0070] The following describes a method for detecting whether a device to be detected is a cheating device after obtaining updated device characteristics.

[0071] According to the updated device features of the device to be detected, a classification algorithm, a model, etc. may be used to detect whether the device to be detected is a cheating device.

[0072] For example, based on the updated device features of the device to be detected, a classification model is used to predict the confidence that the device to be detected is a cheating device. If the confidence is higher than a preset confidence, the device to be detected is determined to be a cheating device; or the confidence that the device to be detected is not a cheating device is predicted. If the confidence is lower than a preset confidence, the device to be detected is determined to be a cheating device.

[0073] On the basis of the above detection method, in one embodiment of the present disclosure, the device features of the device to be detected after the update and the device features before the update can be fused to obtain the device fusion features, and based on the device fusion features of the device to be detected, it is detected whether the device to be detected is a cheating device.

[0074] Specifically, the device features of the device to be detected before and after the update can be added, or weighted summation can be performed using a preset weight coefficient, etc., to obtain the calculated device features as device fusion features, and then a classification algorithm, model, etc. can be used to detect whether the device to be detected is a cheating device.

[0075] In this solution, the device features of the device to be detected before and after the update are integrated, which can avoid information loss during the update process and improve the accuracy of the device features. Therefore, detection based on the device fusion features can improve the accuracy of detecting whether the device to be detected is a cheating device, thereby improving the accuracy of cheating behavior detection.

[0076] Step S104: Determine, based on the detection results of each device to be detected, whether the third-party media platform whose advertisements were clicked by the detected cheating device has cheated.

[0077] After the advertising platform detects the cheating devices among the devices to be detected, it can determine the third-party media platforms on which these cheating devices have clicked on advertisements. For the determined platforms, it can further determine whether the platform has cheating behavior based on the advertising traffic behavior information of each device counted for the platform.

[0078] The following two detection methods are introduced respectively.

[0079] In the first detection method, the ratio of the number of false clicks on the target media platform to the total number of platform clicks on the target media platform can be obtained, and based on the obtained ratio, it is detected whether there is cheating on the target media platform.

[0080] Among them, the target media platform is: the third-party media platform where the detected cheating device has clicked on the advertisement.

[0081] The number of fake clicks is the sum of the number of clicks on ads by various cheating devices on the target media platform.

[0082] Specifically, after determining the target media platform on which the cheating device has clicked on the advertisement, we can determine the devices that have clicked on the advertisement on the target media platform, count the total number of clicks on the advertisements by these devices, determine the cheating devices among these devices, count the total number of clicks on the advertisements by the determined cheating devices, that is, the number of false clicks, and calculate the ratio between the number of false clicks and the total number of clicks. If the ratio exceeds a threshold, it can be accurately determined that cheating behavior exists on the target media platform.

[0083] In the second detection method, after determining the devices that have clicked on advertisements on the target media platform and the cheating devices among these devices, the ratio between the number of cheating devices and the number of these devices can be directly calculated. If the ratio exceeds a threshold, it can be determined that cheating behavior exists on the target media platform.

[0084] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is applied to detect cheating behavior, the association relationship between the devices to be detected is determined based on the advertising browsing behavior information of each device to be detected. Since the advertising browsing behaviors of different cheating devices can be considered to be similar, the devices to be detected that are determined to have an association relationship can be considered to be devices to be detected that are suspected cheating devices. In this way, for each device to be detected, the device characteristics of its associated associated devices are used to update the characteristics of the device to be detected, and the device characteristics of multiple devices suspected of being cheating devices can be concentrated to determine whether the detection device is a cheating device. In this way, the technical problem that the third-party media platform disperses the cheating devices by switching device models to avoid being detected can be solved, and then according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0085] The following is an explanation of the method of determining the association relationship between the devices to be detected mentioned in the above step S102.

[0086] In one embodiment of the present disclosure, for each device pair, the device similarity between the two devices to be detected included in the device pair is obtained based on the advertising browsing behavior information of the two devices to be detected included in the device pair. If the obtained device similarity is greater than a preset similarity threshold, it is determined that the two devices to be detected included in the device pair have an associated relationship.

[0087] The above-mentioned preset similarity threshold is a pre-set threshold.

[0088] When building a device pair, you can use either of the following two methods to build it.

[0089] In the first method, for a device pair, any two devices can be selected from the devices to be detected to form a device pair.

[0090] In the second method, the advertising platform can cooperate with multiple third-party media platforms. For each third-party media platform, the advertising platform can count the devices to be detected that have browsed advertisements on the third-party media platform to form a potential set of devices that may be related, and then select any two devices from the set to form a device pair.

[0091] This method first finds the device set, and then selects two devices from the device set to build a device pair. Compared with directly selecting two devices from each device to be detected to build a device pair, this method can improve processing efficiency and thus improve the efficiency of cheating behavior detection.

[0092] Two implementation methods for obtaining the device similarity between two devices to be detected included in a device pair are described below.

[0093] In the first implementation, the first number of clicks and the second number of clicks are determined based on the advertisement browsing behavior information of the two devices to be detected included in the device pair, and the ratio of the determined first number of clicks to the second number of clicks is obtained as the device similarity between the two devices to be detected included in the device pair.

[0094] The first number of clicks is: the sum of the number of clicks of the two devices to be detected included in the device pair on the advertisements clicked on the same third-party media platform.

[0095] The second number of clicks is: the sum of the total number of advertisement clicks by the device on the two devices to be detected.

[0096] For example, if the device pair includes two devices, device 1 and device 2, and device 1 has clicked on ads 3 times on platform a and 4 times on platform b, then device 1 has clicked on ads a total of 7 times; if device 2 has clicked on ads 5 times on platform b and 2 times on platform c, then device 2 has clicked on ads a total of 7 times.

[0097] The above devices 1 and 2 have both clicked on advertisements on platform b, therefore, the above first number of clicks is 4+5=9, and the above second number of clicks is 7+7=14, and the ratio of the first number of clicks to the second number of clicks is 9 / 14.

[0098] Specifically, the larger the total number of clicks on advertisements by the two devices to be detected included in the device pair on the same third-party media platform, the more similar the advertisement browsing situations of the two devices are, and the more similar the two devices to be detected are. Therefore, using the ratio of the first number of clicks to the second number of clicks as the device similarity can improve the accuracy of the device similarity, and thus improve the accuracy of cheating behavior detection.

[0099] In the second implementation method, the first browsing time and the second browsing time are determined based on the advertising browsing behavior information of the two devices to be detected included in the device pair, and the ratio of the determined first browsing time to the second browsing time is obtained as the device similarity between the two devices to be detected included in the device pair.

[0100] The first browsing duration is: the sum of the browsing durations of the two devices to be detected included in the device pair browsing advertisements on the same third-party media platform.

[0101] The second browsing duration is: the sum of the total advertisement browsing durations of the two devices to be detected by the device.

[0102] This implementation is similar to the first implementation. The larger the total browsing time of the two devices to be detected included in the device pair for browsing advertisements on the same third-party media platform, the more similar the advertisement browsing situations of the two devices are, and the more similar the two devices to be detected are. Therefore, using the ratio of the first browsing time to the second browsing time as the device similarity can improve the accuracy of the device similarity, and thus improve the accuracy of cheating behavior detection.

[0103] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, the device similarity between the two devices to be detected is obtained based on the advertisement browsing behavior information of the two devices. If the obtained device similarity is greater than the preset similarity threshold, it means that the two devices may be two cheating devices that switch device models, so that the two devices to be detected whose device similarity is greater than the preset similarity threshold are determined as devices with an associated relationship. Subsequently, the device characteristics of the devices with an associated relationship can be comprehensively considered. This can solve the technical problem that the third-party media platform disperses the cheating devices by switching device models, thereby avoiding detection. Further, according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0104] In another embodiment of the present disclosure, when determining the association relationship between the devices to be detected, for each device pair, the distribution of each advertising browsing behavior information of the two devices included in the device pair can be compared. If the two information distributions are similar, it is determined that there is an association relationship between the two devices included in the device pair.

[0105] For example, if the ad browsing behavior information includes two types of information: the number of ad clicks and the duration, if the difference between the number of ad clicks of the two devices is small (for example, the difference is less than a preset first threshold), and the difference between the ad browsing durations is small (for example, the difference is less than a preset second threshold), then it can be determined that the distribution of the various ad browsing behavior information of the two devices is similar, and there is a correlation between the two devices.

[0106] Third-party media platforms may also cheat for a short period of time and not cheat for the rest of the time to avoid being detected by advertising platforms.

[0107] To solve the above technical problems, in one embodiment of the present disclosure, when device characteristics include advertising browsing behavior characteristics, the device characteristics include multiple sub-device characteristics, and each sub-device characteristic includes: advertising browsing behavior characteristics obtained by statistics in a time window within the statistical time period of the advertising browsing behavior information.

[0108] The above-mentioned time window can be understood as a time period. When the advertising platform counts the advertising browsing behavior information within a period of time, it can count the advertising browsing behavior information in batches according to the preset time length. For example, statistics are performed every five minutes, ten minutes or fifteen minutes. Each statistics obtains the advertising browsing behavior information of the device to be detected browsing advertisements within a preset time period. The advertising platform then obtains the advertising browsing behavior characteristics based on each piece of advertising browsing behavior information.

[0109] In this case, when detecting whether the device to be detected is a cheating device, for each time window, based on the sub-device features of each associated device of the device to be detected and corresponding to the time window, the device features of the device to be detected and corresponding to the time window are updated, and according to the updated sub-device features, whether the device to be detected is a cheating device is detected to obtain a sub-detection result;

[0110] According to each sub-detection result of the device to be detected, detect whether the device to be detected is a cheating device.

[0111] Specifically, for each time window, the feature is updated based on the sub-device feature corresponding to the time window, and whether the device to be detected is a cheating device is detected according to the updated sub-device feature. Please refer to the aforementioned step S103, which will not be repeated here.

[0112] After obtaining the sub-detection results corresponding to each time window, the proportion of the sub-detection results that the device to be detected is a cheating device can be counted. If the proportion is greater than a preset proportion, it means that the device to be detected is a cheating device.

[0113] In the above step S103, it is mentioned that when detecting whether the device to be detected is a cheating device, the confidence that the device to be detected is a cheating device can be predicted. When the detection is performed in this way, each time window corresponds to a sub-detection result and a confidence level, and multiple time windows correspond to multiple sub-detection results and multiple confidence levels. In this way, when detecting whether the device to be detected is a cheating device, the weight coefficient of each confidence level can be determined according to the distribution of the confidence levels corresponding to each sub-detection result, wherein the greater the confidence level, the greater the weight coefficient. In this way, the confidence levels corresponding to each sub-detection result are weighted and summed, which can highlight cheating within the cheating time period, so that according to each sub-detection result of the device to be detected, it is possible to accurately detect whether the device to be detected is a cheating device, thereby improving the accuracy of cheating behavior detection.

[0114] The following is an explanation of the method for updating the device features of the device to be detected mentioned in the above step S103.

[0115] In one embodiment of the present disclosure, an attention coefficient characterizing the degree of association between the device to be detected and each associated device is obtained based on the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected; and the device characteristics of the device to be detected are updated based on the attention coefficient corresponding to each associated device to obtain the updated device characteristics of the device to be detected.

[0116] The device characteristics of a device may include at least one of the aforementioned user information characteristics, ad browsing behavior characteristics, information characteristics, and other characteristics. Different cheating devices have different device models, but other characteristics may be the same, such as user address, device address, etc. Therefore, the more similar the device characteristics of different devices to be detected are, the greater the possibility that the different devices to be detected are cheating devices, and the higher the degree of association.

[0117] The method of obtaining the attention coefficient is described below.

[0118] In the first implementation, based on the device characteristics of the device to be detected and the device characteristics of the associated devices, a function or algorithm for calculating the attention coefficient can be used to characterize the attention coefficient of the degree of association between the device to be detected and the associated devices.

[0119] In the second implementation, the device features of the device can be represented in the form of a feature vector, so that the similarity between the feature vector of the device to be detected and the feature vector of the associated device can be calculated, and then the attention coefficient characterizing the degree of association between the device to be detected and the associated device can be determined based on the calculated similarity.

[0120] For example, the calculated similarity is multiplied by a preset weight coefficient to obtain an attention coefficient.

[0121] The following describes two implementation methods for updating the device characteristics of the device to be detected based on the attention coefficient after the attention coefficient is obtained.

[0122] In the first implementation method, for each associated device, the device characteristics of the device to be detected, the attention coefficient corresponding to the associated device, and the preset weight coefficient are multiplied to obtain a first intermediate feature; the first intermediate features corresponding to each associated device are feature fused to obtain a second intermediate feature; the second intermediate feature is nonlinearly transformed to obtain a third intermediate feature; based on the third intermediate feature, the updated device characteristics of the device to be detected are obtained.

[0123] Specifically, for each associated device, after obtaining the attention coefficient characterizing the degree of association between the device to be detected and the associated device, the device feature of the device to be detected, the attention coefficient and a preset weight coefficient can be multiplied to obtain a first intermediate feature.

[0124] Each associated device corresponds to a first intermediate feature, and multiple associated devices correspond to multiple first intermediate features. After obtaining the first intermediate features corresponding to each associated device of the device to be detected, the first intermediate features corresponding to each associated device can be added together to obtain the second intermediate features. The second intermediate features can be nonlinearly transformed using nonlinear transformation formulas, such as ReLU activation function, Sigmoid activation function, etc., to obtain the transformation result, which is the updated device features of the device to be detected.

[0125] In this scheme, the device characteristics of the device to be detected, the attention coefficient corresponding to the associated device and the preset weight coefficient are used to accurately calculate the updated device characteristics of the device to be detected through a series of operations such as multiplication, fusion and nonlinear transformation. The updated device characteristics of the device to be detected can then be used to detect cheating behavior, thereby improving detection accuracy.

[0126] In one embodiment of the present disclosure, the following expression may be used to update the device characteristics of the device to be detected:

[0127] h2=σ(∑ j∈N(i) α j ×W×h1)

[0128] Wherein, h2 represents the characteristics of the device to be detected after the update, h1 represents the characteristics of the device to be detected before the update, W represents the preset weight coefficient, α j represents the attention coefficient corresponding to the j-th associated device, N(i) represents the set of associated devices associated with the device to be detected, and σ() represents the ReLU activation function.

[0129] In the second implementation method, after obtaining the attention coefficient corresponding to each associated device, the device characteristics of the device to be detected, the device characteristics of the associated device, and the attention coefficient corresponding to the associated device can be multiplied for each associated device, and then the multiplication results corresponding to each associated device are accumulated to obtain the accumulated characteristics as the updated characteristics of the device to be detected.

[0130] It can be seen from the above that when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, the attention coefficient represents the degree of association between the device to be detected and the associated device. In this way, based on the attention coefficient, the device characteristics can be updated by considering the degree of association of the associated device with the device to be detected, thereby obtaining more accurate device characteristics, and further improving the accuracy of cheating behavior detection.

[0131] In order to improve the accuracy of the updated device characteristics, the device characteristics of the device to be detected may also be updated in the manner mentioned in the following embodiments.

[0132] In one embodiment of the present disclosure, a multi-layer attention coefficient characterizing the degree of association between the device to be detected and each associated device can be obtained based on the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected. The device characteristics of the device to be detected are iteratively updated according to each layer of coefficients in the multi-layer attention coefficients to obtain the updated device characteristics of the device to be detected.

[0133] There can be multiple layers of attention coefficients, and each layer of attention coefficients is used to iteratively update the device features of the device to be detected.

[0134] Specifically, when obtaining multi-layer attention coefficients, different functions, algorithms, etc. for calculating attention coefficients can be used according to the device characteristics of the device to be detected and the device characteristics of the associated devices to obtain multiple attention coefficients, thereby obtaining multi-layer attention coefficients containing the multiple attention coefficients.

[0135] After obtaining the multi-layer attention coefficients, when the device characteristics of the device to be detected are iteratively updated, the method of each update process can be referred to the aforementioned embodiment and will not be repeated here.

[0136] When one iterative update process is completed, the processing result can be used as the device feature of the device to be detected for the next iterative update process, until the number of iterations reaches the number of layers of the multi-layer attention coefficient, the iterative update is completed, and the final updated device feature is obtained.

[0137] As can be seen from the above, when the embodiment of the present disclosure is applied to detect cheating behavior, the device features of the device to be detected are updated multiple times through iterative updating, which can improve the accuracy of the updated features, thereby detecting cheating behavior based on the updated features, which can improve the detection accuracy.

[0138] In one embodiment of the present application, the association relationship between the devices to be detected can be displayed in the form of an association diagram.

[0139] In this case, when determining the association relationship between the devices to be detected, it is possible to determine whether any two devices to be detected are associated with each other based on the advertisement browsing behavior information of the devices to be detected, and construct a device association graph.

[0140] Furthermore, when detecting whether the device to be detected is a cheating device, for each node in each device association graph, the device features contained in the node are updated based on the device features contained in the neighboring nodes of the node, and based on the updated device features, it is detected whether the device to be detected corresponding to the node is a cheating device.

[0141] Among them, each node in the device association graph corresponds to a device to be detected, including the device characteristics of the corresponding device, and each edge indicates that the devices to be detected corresponding to the two connected nodes are associated.

[0142] Specifically, the method of determining whether two devices to be detected are associated with each other can be referred to the aforementioned embodiment, which will not be described in detail here.

[0143] After determining whether the devices to be detected are associated with each other, an initial association graph with the devices to be detected as nodes can be generated, and the nodes in the graph also include device features of the devices to be detected. And for the nodes corresponding to the associated devices to be detected in the graph, an edge between the two nodes can be generated, indicating that the devices to be detected corresponding to the two nodes connected by the edge are associated.

[0144] See also Figure 2 , provides a schematic diagram of the process of building a device association graph. Figure 2 In the process, firstly, a device pair is constructed (step S201), and the similarity between the two devices to be detected contained in each device pair is calculated (step S202), and it is determined whether the similarity exceeds a set threshold (step S203). If so, an edge relationship between the nodes corresponding to the two devices to be detected contained in the device pair is constructed (step S204), and if not, no edge relationship is constructed.

[0145] After constructing the device association graph, for each node in the graph, the neighboring nodes connected to it can be determined, and based on the device characteristics of the node and the device characteristics of the neighboring nodes, the device characteristics contained in the node are updated. Based on the updated device characteristics, it is detected whether the device to be detected corresponding to the node is a cheating device.

[0146] The specific feature updating method can be found in the above-mentioned embodiment and will not be described in detail here.

[0147] See also Figure 3 , provides a schematic diagram of the structure of a device association diagram, from Figure 3 It can be seen that the nodes h1-h6 in the device association diagram are associated, a12 represents the association relationship between node h1 and node h2, a15 represents the association relationship between node h1 and node h5, a14 represents the association relationship between node h1 and node h4, a13 represents the association relationship between node h1 and node h3, and a16 represents the association relationship between node h1 and node h6.

[0148] From the above, it can be seen that when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, by constructing a device association graph, the device association graph can clearly reflect the relationship between the devices to be detected, so that based on the device association graph, the device characteristics of the device to be detected are updated, and the associated devices of the device to be detected can be accurately and quickly located, and subsequent processing can be performed. It can be seen that the application of the scheme provided by the embodiment of the present disclosure to cheating behavior detection can improve the accuracy and efficiency of cheating behavior detection.

[0149] After constructing the above device association diagram, the following methods mentioned in the embodiments may be used to detect whether each device to be detected is a cheating device.

[0150] In one embodiment of the present disclosure, when detecting whether a device to be detected is a cheating device, the device association graph can be input into a pre-trained graph attention network, so that the graph attention network detects whether the device to be detected corresponding to each node is a cheating device based on the device features contained in each node in the device association graph, and obtains the detection result corresponding to each node in the device association graph.

[0151] In the training process of the above-mentioned graph attention network, the sample device association graph can be used as input, and the label value representing whether the device corresponding to each sample node in the sample device association graph is a normal device or a cheating device can be used as the true value of the model output to train the initial graph attention network.

[0152] Specifically, after the graph attention network is trained, the graph attention network learns the process of detecting whether the device corresponding to the node is a cheating device. In this way, the device association graph is input into the attention network. For each node, the network can determine other nodes that are leveled with the node as the neighbor nodes of the node, thereby detecting whether the device to be detected corresponding to the node is a cheating device based on the device features contained in the node and the device features of the determined neighbor nodes.

[0153] See also Figure 4 , provides a flow chart of the second cheating behavior detection method. Figure 4 In the process, the advertising platform can first count the advertising browsing behavior information of each device to be detected from the advertising log (step S401), and build a device association graph based on the advertising click count information in the advertising browsing behavior information of each detected device (step S402). The advertising platform can count the device features of each device to be detected (step S403), add the device features of each device to be detected to the node corresponding to the same device to be detected in the device association graph, and use the graph attention network layer to update the device features contained in each node in the device association graph to obtain the updated features of each device to be detected (step S404). In addition, the features of each device to be detected before updating can be transformed through a residual network to obtain transformed features (step S405), and then the updated features and transformed features of the same device to be detected are added (step S406), and the summed results of each device to be detected are input into a feedforward neural network for classification to obtain a classification result of whether each device to be detected is a cheating device (step S407), and then based on the classification result of each device to be detected, it is determined whether each device to be detected is a cheating device (step S408), and then it can be determined whether the third-party media platform is a cheating platform (step S409).

[0154] It can be seen from the above that when applying the solution provided by the embodiment of the present disclosure to detect cheating devices, using the trained graph attention network to detect whether the device corresponding to each node in the device association graph is a cheating device can improve the accuracy of detecting cheating devices, thereby improving the accuracy of cheating behavior detection.

[0155] In addition, since the graph attention network has the function of aggregating the features of adjacent nodes, using the graph attention network to detect cheating devices can accurately detect cheating behaviors that use multiple cheating devices to cheat in groups.

[0156] In one embodiment of the present disclosure, see Figure 5 , a structural schematic diagram of a first cheating behavior detection device is provided, which includes an advertising log input module 501, a feature processing module 502, a graph attention network reasoning module 503 and a cheating anomaly judgment module 504.

[0157] Wherein, the advertisement log input module 501 is used to generate and store advertisement logs;

[0158] The feature processing module 502 is used to obtain the information recorded in the log from the advertisement log input module 501, and obtain the advertisement browsing behavior information and device features of each device to be detected according to the obtained information;

[0159] The graph attention network inference module 503 is used to construct a device association graph based on the advertisement browsing behavior information and device characteristics of each device to be detected, and detect whether each device to be detected is a cheating device based on the trained graph attention network;

[0160] The cheating anomaly determination module 504 is used to determine whether the third-party media platform whose advertisements were clicked by the detected cheating device has cheated according to the detection results of each device to be detected.

[0161] Corresponding to the above-mentioned cheating behavior detection method, the embodiment of the present disclosure also provides a cheating behavior detection device.

[0162] In one embodiment of the present disclosure, see Figure 6 , a schematic diagram of the structure of a second cheating behavior detection device is provided. In this embodiment, the device includes:

[0163] The information statistics module 601 is used to count the advertisement browsing behavior information of each device to be detected, wherein the device to be detected is: a device determined according to the user device information carried in the advertisement display information sent by the third-party media platform;

[0164] A relationship determination module 602, used to determine the association relationship between the devices to be detected according to the advertisement browsing behavior information of the devices to be detected;

[0165] The device detection module 603 is used to update the device characteristics of each device to be detected based on the device characteristics of each associated device of the device to be detected, and detect whether the device to be detected is a cheating device according to the updated device characteristics, wherein the associated device of the device to be detected is: a device that has an associated relationship with the device to be detected;

[0166] The behavior detection module 604 is used to determine whether the third-party media platform whose advertisements were clicked by the detected cheating device has cheated according to the detection results of each device to be detected.

[0167] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is applied to detect cheating behavior, the association relationship between the devices to be detected is determined based on the advertising browsing behavior information of each device to be detected. Since the advertising browsing behaviors of different cheating devices can be considered to be similar, the devices to be detected that are determined to have an association relationship can be considered to be devices to be detected that are suspected cheating devices. In this way, for each device to be detected, the device characteristics of its associated associated devices are used to update the characteristics of the device to be detected, and the device characteristics of multiple devices suspected of being cheating devices can be concentrated to determine whether the detection device is a cheating device. In this way, the technical problem that the third-party media platform disperses the cheating devices by switching device models to avoid being detected can be solved, and then according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0168] In one embodiment of the present disclosure, the device detection module 603 includes:

[0169] The feature update submodule is used to obtain an attention coefficient representing the degree of association between the device to be detected and each associated device according to the device feature of the device to be detected and the device features of each associated device of the device to be detected; and update the device feature of the device to be detected according to the attention coefficient corresponding to each associated device to obtain the updated device feature of the device to be detected;

[0170] The device detection submodule is used to detect whether the device to be detected is a cheating device according to the updated device characteristics.

[0171] It can be seen from the above that when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, the attention coefficient ensures the degree of association between the device to be detected and the associated device. In this way, based on the attention coefficient, the device characteristics can be updated by considering the degree of association of the associated device with the device to be detected, thereby obtaining more accurate device characteristics, and further improving the accuracy of cheating behavior detection.

[0172] In one embodiment of the present disclosure, the feature updating submodule is specifically used to:

[0173] For each associated device, multiply the device feature of the device to be detected, the attention coefficient corresponding to the associated device, and a preset weight coefficient to obtain a first intermediate feature;

[0174] Perform feature fusion on the first intermediate features corresponding to each associated device to obtain a second intermediate feature;

[0175] A nonlinear transformation is performed on the second intermediate feature to obtain an updated device feature of the device to be detected.

[0176] In this scheme, the device characteristics of the device to be detected, the attention coefficient corresponding to the associated device and the preset weight coefficient are used to accurately calculate the updated device characteristics of the device to be detected through a series of operations such as multiplication, fusion and nonlinear transformation. The updated device characteristics of the device to be detected can then be used to detect cheating behavior, thereby improving detection accuracy.

[0177] In one embodiment of the present disclosure, the feature updating submodule is specifically used to:

[0178] According to the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected, a multi-layer attention coefficient representing the degree of association between the device to be detected and each associated device is obtained;

[0179] According to each layer of coefficients in the multi-layer attention coefficients, the device characteristics of the device to be detected are iteratively updated to obtain updated device characteristics of the device to be detected.

[0180] As can be seen from the above, when the embodiment of the present disclosure is applied to detect cheating behavior, the device features of the device to be detected are updated multiple times through iterative updating, which can improve the accuracy of the updated features, thereby detecting cheating behavior based on the updated features, which can improve the detection accuracy.

[0181] In one embodiment of the present disclosure, the device detection module is specifically used to:

[0182] The device characteristics after the device to be detected is merged with the device characteristics before the update to obtain the device fusion characteristics;

[0183] According to the device fusion feature of the device to be detected, it is detected whether the device to be detected is a cheating device.

[0184] In this solution, the device features of the device to be detected before and after the update are integrated, which can avoid information loss during the update process and improve the accuracy of the device features. Therefore, detection based on the device fusion features can improve the accuracy of detecting whether the device to be detected is a cheating device, thereby improving the accuracy of cheating behavior detection.

[0185] In one embodiment of the present disclosure, the relationship determination module includes:

[0186] A relationship determination submodule, used to determine whether two devices to be detected are associated with each other based on the advertisement browsing behavior information of each device to be detected;

[0187] A graph construction submodule is used to construct a device association graph, wherein each node in the device association graph corresponds to a device to be detected, including device features of the corresponding device, and each edge indicates that the devices to be detected corresponding to the two connected nodes are associated;

[0188] The device detection module is specifically used for:

[0189] For each node in the device association graph, based on the device features included in the neighboring nodes of the node, the device features included in the node are updated, and according to the updated device features, it is detected whether the device to be detected corresponding to the node is a cheating device.

[0190] From the above, it can be seen that when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, by constructing a device association graph, the device association graph can clearly reflect the relationship between the devices to be detected, so that based on the device association graph, the device characteristics of the device to be detected are updated, and the associated devices of the device to be detected can be accurately and quickly located, and subsequent processing can be performed. It can be seen that the application of the scheme provided by the embodiment of the present disclosure to cheating behavior detection can improve the accuracy and efficiency of cheating behavior detection.

[0191] In one embodiment of the present disclosure, the device detection module is specifically used to:

[0192] The device association graph is input into a pre-trained graph attention network, so that the graph attention network detects whether the device to be detected corresponding to each node is a cheating device according to the device features contained in each node in the device association graph, and obtains the detection result corresponding to each node in the device association graph.

[0193] It can be seen from the above that when applying the solution provided by the embodiment of the present disclosure to detect cheating devices, using the trained graph attention network to detect whether the device corresponding to each node in the device association graph is a cheating device can improve the accuracy of detecting cheating devices, thereby improving the accuracy of cheating behavior detection.

[0194] In one embodiment of the present disclosure, the device features include at least one of the following features:

[0195] The user information characteristics of the user using the device to be detected, the advertising browsing behavior characteristics, the device environment information of the device to be detected, and the information characteristics of the device to be detected registered on the third-party media platform, wherein the advertising browsing behavior characteristics are obtained based on the advertising browsing behavior information.

[0196] Since the above four characteristics of cheating devices are difficult to be completely consistent with the above four characteristics of normal devices, any one of the four characteristics can accurately reflect whether the device to be detected is a normal device or a cheating device, so cheating behavior detection can be performed based on at least one of the four characteristics, which can improve detection accuracy.

[0197] In one embodiment of the present disclosure, when the device feature includes an advertisement browsing behavior feature, the device feature includes a plurality of sub-device features, each of which includes: an advertisement browsing behavior feature obtained by statistics in a time window within a statistical time period of the advertisement browsing behavior information;

[0198] The device detection module is specifically used for:

[0199] For each time window, based on the sub-device features corresponding to the time window of each associated device of the device to be detected, the device features corresponding to the time window of the device to be detected are updated, and according to the updated sub-device features, whether the device to be detected is a cheating device is detected to obtain a sub-detection result;

[0200] According to each sub-detection result of the device to be detected, detect whether the device to be detected is a cheating device.

[0201] When detecting whether the device to be detected is a cheating device, the confidence that the device to be detected is a cheating device can be predicted. When this method is used for detection, each time window corresponds to a sub-detection result and a confidence level, and multiple time windows correspond to multiple sub-detection results and multiple confidence levels. In this way, when detecting whether the device to be detected is a cheating device, the weight coefficient of each confidence level can be determined according to the distribution of the confidence levels corresponding to each sub-detection result, wherein the greater the confidence level, the greater its weight coefficient. In this way, the confidence levels corresponding to each sub-detection result are weighted and summed, which can highlight cheating within the cheating time period, and thus accurately detect whether the device to be detected is a cheating device according to each sub-detection result of the device to be detected, thereby improving the accuracy of cheating behavior detection.

[0202] In one embodiment of the present disclosure, the behavior detection module is specifically used to:

[0203] Obtaining a ratio of the number of false clicks on a target media platform to the total number of platform clicks on the target media platform, wherein the target media platform is a third-party media platform on which the detected cheating device has clicked on advertisements, and the number of false clicks is the sum of the number of clicks on advertisements by each cheating device on the target media platform;

[0204] According to the obtained ratio, it is detected whether there is cheating behavior on the target media platform.

[0205] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is applied to detect cheating behavior, the association relationship between the devices to be detected is determined based on the advertising browsing behavior information of each device to be detected. Since the advertising browsing behaviors of different cheating devices can be considered to be similar, the devices to be detected that are determined to have an association relationship can be considered to be devices to be detected that are suspected cheating devices. In this way, for each device to be detected, the device characteristics of its associated associated devices are used to update the characteristics of the device to be detected, and the device characteristics of multiple devices suspected of being cheating devices can be concentrated to determine whether the detection device is a cheating device. In this way, the technical problem that the third-party media platform disperses the cheating devices by switching device models to avoid being detected can be solved, and then according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0206] In one embodiment of the present disclosure, the relationship determination module is specifically used to:

[0207] For each device pair, the device similarity between the two devices to be detected included in the device pair is obtained based on the advertising browsing behavior information of the two devices to be detected included in the device pair. If the obtained device similarity is greater than the preset similarity threshold, it is determined that the two devices to be detected included in the device pair have an associated relationship.

[0208] As can be seen from the above, when the scheme provided by the embodiment of the present disclosure is used to detect cheating behavior, the device similarity between the two devices to be detected is obtained based on the advertisement browsing behavior information of the two devices. If the obtained device similarity is greater than the preset similarity threshold, it means that the two devices may be two cheating devices that switch device models, so that the two devices to be detected whose device similarity is greater than the preset similarity threshold are determined as devices with an associated relationship. Subsequently, the device characteristics of the devices with an associated relationship can be comprehensively considered. This can solve the technical problem that the third-party media platform disperses the cheating devices by switching device models, thereby avoiding detection. Further, according to the detection results of each device to be detected, it is determined whether the third-party media platform has cheating behavior, which can improve the accuracy of cheating behavior detection.

[0209] In one embodiment of the present disclosure, obtaining the device similarity between the two devices to be detected included in the device pair according to the advertisement browsing behavior information of the two devices to be detected included in the device pair includes:

[0210] Determine a first number of clicks and a second number of clicks according to the advertisement browsing behavior information of the two devices to be detected included in the device, wherein the first number of clicks is: the sum of the number of clicks of the two devices to be detected included in the device on the advertisements on the same third-party media platform, and the second number of clicks is: the sum of the total number of advertisement clicks of the two devices to be detected included in the device;

[0211] A ratio of the determined first number of clicks to the second number of clicks is obtained as the device similarity between the two devices to be detected included in the device pair.

[0212] In this scheme, the larger the total number of clicks on advertisements by the two devices to be detected included in the device pair on the same third-party media platform, the more similar the advertisement browsing situations of the two devices are, and the more similar the two devices to be detected are. Therefore, using the ratio of the first number of clicks to the second number of clicks as the device similarity can improve the accuracy of the device similarity, and thus improve the accuracy of cheating behavior detection.

[0213] In one embodiment of the present disclosure, two devices to be detected included in a device pair belong to the same device set, and each device set includes devices that have browsed advertisements on the same third-party media platform.

[0214] This method first finds the device set, and then selects two devices from the device set to build a device pair. Compared with directly selecting two devices from each device to be detected to build a device pair, this method can improve processing efficiency and thus improve the efficiency of cheating behavior detection.

[0215] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0216] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0217] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0218] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0219] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0220] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the cheating behavior detection method. For example, in some embodiments, the cheating behavior detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the cheating behavior detection method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the cheating behavior detection method in any other appropriate manner (e.g., by means of firmware).

[0221] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0222] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0223] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0224] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0225] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0226] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0227] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0228] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A cheating behavior detection method, comprising: Collecting statistics on the advertisement browsing behavior information of each device to be detected, wherein the device to be detected is: a device determined according to the user device information carried in the advertisement display information sent by the third-party media platform; Determine the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected; For each device to be detected, based on the device features of each associated device of the device to be detected, the device features of the device to be detected are updated, and according to the updated device features, whether the device to be detected is a cheating device is detected, wherein the associated device of the device to be detected is: a device that has an associated relationship with the device to be detected; According to the detection results of each device to be detected, it is determined whether the third-party media platform whose advertisements were clicked by the detected cheating device has cheated.

2. The method according to claim 1, wherein: The updating of the device characteristics of the device to be detected based on the device characteristics of each associated device of the device to be detected includes: According to the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected, an attention coefficient representing the degree of association between the device to be detected and each associated device is obtained; According to the attention coefficient corresponding to each associated device, the device characteristics of the device to be detected are updated to obtain the updated device characteristics of the device to be detected.

3. The method according to claim 2, wherein: The updating process of the device characteristics of the device to be detected according to the attention coefficient corresponding to each associated device to obtain the updated device characteristics of the device to be detected includes: For each associated device, multiply the device feature of the device to be detected, the attention coefficient corresponding to the associated device, and a preset weight coefficient to obtain a first intermediate feature; Perform feature fusion on the first intermediate features corresponding to each associated device to obtain a second intermediate feature; A nonlinear transformation is performed on the second intermediate feature to obtain an updated device feature of the device to be detected.

4. The method according to claim 2, wherein: The step of obtaining, according to the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected, an attention coefficient representing the degree of association between the device to be detected and each associated device, comprises: According to the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected, a multi-layer attention coefficient representing the degree of association between the device to be detected and each associated device is obtained; The updating process of the device characteristics of the device to be detected according to the attention coefficient corresponding to each associated device to obtain the updated device characteristics of the device to be detected includes: According to each layer of coefficients in the multi-layer attention coefficients, the device characteristics of the device to be detected are iteratively updated to obtain updated device characteristics of the device to be detected.

5. The method according to any one of claims 1 to 4, wherein: The detecting, according to the updated device characteristics, whether the device to be detected is a cheating device includes: The device characteristics after the device to be detected is merged with the device characteristics before the update to obtain the device fusion characteristics; According to the device fusion feature of the device to be detected, it is detected whether the device to be detected is a cheating device.

6. The method according to claim 1, wherein: The determining the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected includes: Determine whether any two devices to be detected are associated with each other based on the advertisement browsing behavior information of each device to be detected; Constructing a device association graph, wherein each node in the device association graph corresponds to a device to be detected, including device features of the corresponding device, and each edge indicates that the devices to be detected corresponding to the two connected nodes are associated; The method of updating the device characteristics of each device to be detected based on the device characteristics of each associated device of the device to be detected, and detecting whether the device to be detected is a cheating device according to the updated device characteristics, includes: For each node in the device association graph, based on the device features included in the neighboring nodes of the node, the device features included in the node are updated, and according to the updated device features, it is detected whether the device to be detected corresponding to the node is a cheating device.

7. The method according to claim 6, wherein: The method of updating the device features of each node in the device association graph based on the device features of the neighboring nodes of the node, and detecting whether the device to be detected corresponding to the node is a cheating device according to the updated device features, includes: The device association graph is input into a pre-trained graph attention network, so that the graph attention network detects whether the device to be detected corresponding to each node is a cheating device according to the device features contained in each node in the device association graph, and obtains the detection result corresponding to each node in the device association graph.

8. The method according to claim 1, wherein: The device features include at least one of the following features: The user information characteristics of the user using the device to be detected, the advertising browsing behavior characteristics, the device environment information of the device to be detected, and the information characteristics of the device to be detected registered on the third-party media platform, wherein the advertising browsing behavior characteristics are obtained based on the advertising browsing behavior information.

9. The method according to claim 8, wherein: In the case where the device feature includes an advertisement browsing behavior feature, the device feature includes a plurality of sub-device features, each of which includes: an advertisement browsing behavior feature obtained by statistics in a time window within a statistical time period of the advertisement browsing behavior information; The updating of the device characteristics of the device to be detected based on the device characteristics of each associated device of the device to be detected, and detecting whether the device to be detected is a cheating device according to the updated device characteristics, includes: For each time window, based on the sub-device features corresponding to the time window of each associated device of the device to be detected, the device features corresponding to the time window of the device to be detected are updated, and according to the updated sub-device features, whether the device to be detected is a cheating device is detected to obtain a sub-detection result; According to each sub-detection result of the device to be detected, detect whether the device to be detected is a cheating device.

10. The method according to any one of claims 1 to 4, wherein: The step of determining, based on the detection results of each device to be detected, whether a third-party media platform on which the detected cheating device has clicked on an advertisement has cheated includes: Obtaining a ratio of the number of false clicks on a target media platform to the total number of platform clicks on the target media platform, wherein the target media platform is a third-party media platform on which the detected cheating device has clicked on advertisements, and the number of false clicks is the sum of the number of clicks on advertisements by each cheating device on the target media platform; According to the obtained ratio, it is detected whether there is cheating behavior on the target media platform.

11. The method according to any one of claims 1 to 4, wherein: The determining the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected includes: For each device pair, the device similarity between the two devices to be detected included in the device pair is obtained based on the advertising browsing behavior information of the two devices to be detected included in the device pair. If the obtained device similarity is greater than the preset similarity threshold, it is determined that the two devices to be detected included in the device pair have an associated relationship.

12. The method according to claim 11, wherein: The obtaining, based on the advertisement browsing behavior information of the two devices to be detected included in the device pair, the device similarity between the two devices to be detected included in the device pair includes: Determine a first number of clicks and a second number of clicks according to the advertisement browsing behavior information of the two devices to be detected included in the device, wherein the first number of clicks is: the sum of the number of clicks of the two devices to be detected included in the device on the advertisements on the same third-party media platform, and the second number of clicks is: the sum of the total number of advertisement clicks of the two devices to be detected included in the device; A ratio of the determined first number of clicks to the second number of clicks is obtained as the device similarity between the two devices to be detected included in the device pair.

13. The method according to claim 11, wherein: Two devices to be detected included in a device pair belong to the same device set, and each device set includes devices that have browsed advertisements on the same third-party media platform.

14. A cheating behavior detection device, comprising: An information statistics module, used to count the advertisement browsing behavior information of each device to be detected, wherein the device to be detected is: a device determined according to the user device information carried in the advertisement display information sent by the third-party media platform; A relationship determination module, used to determine the association relationship between the devices to be detected based on the advertisement browsing behavior information of the devices to be detected; The device detection module is used to update the device characteristics of each device to be detected based on the device characteristics of each associated device of the device to be detected, and detect whether the device to be detected is a cheating device according to the updated device characteristics, wherein the associated device of the device to be detected is: a device that has an associated relationship with the device to be detected; The behavior detection module is used to determine whether the third-party media platform on which the detected cheating device has clicked on the advertisement has cheated based on the detection results of each device to be detected.

15. The device according to claim 14, wherein: The device detection module comprises: The feature update submodule is used to obtain an attention coefficient representing the degree of association between the device to be detected and each associated device according to the device feature of the device to be detected and the device features of each associated device of the device to be detected; and update the device feature of the device to be detected according to the attention coefficient corresponding to each associated device to obtain the updated device feature of the device to be detected; The device detection submodule is used to detect whether the device to be detected is a cheating device according to the updated device characteristics.

16. The device according to claim 15, wherein: The feature updating submodule is specifically used for: For each associated device, multiply the device feature of the device to be detected, the attention coefficient corresponding to the associated device, and a preset weight coefficient to obtain a first intermediate feature; Perform feature fusion on the first intermediate features corresponding to each associated device to obtain a second intermediate feature; A nonlinear transformation is performed on the second intermediate feature to obtain an updated device feature of the device to be detected.

17. The device according to claim 15, wherein: The feature updating submodule is specifically used for: According to the device characteristics of the device to be detected and the device characteristics of each associated device of the device to be detected, a multi-layer attention coefficient representing the degree of association between the device to be detected and each associated device is obtained; According to each layer of coefficients in the multi-layer attention coefficients, the device characteristics of the device to be detected are iteratively updated to obtain updated device characteristics of the device to be detected.

18. The device according to any one of claims 14 to 17, wherein: The device detection module is specifically used for: The device characteristics after the device to be detected is merged with the device characteristics before the update to obtain the device fusion characteristics; According to the device fusion feature of the device to be detected, it is detected whether the device to be detected is a cheating device.

19. The device according to claim 14, wherein: The relationship determination module includes: A relationship determination submodule, used to determine whether two devices to be detected are associated with each other based on the advertisement browsing behavior information of each device to be detected; A graph construction submodule is used to construct a device association graph, wherein each node in the device association graph corresponds to a device to be detected, including device features of the corresponding device, and each edge indicates that the devices to be detected corresponding to the two connected nodes are associated; The device detection module is specifically used for: For each node in the device association graph, based on the device features included in the neighboring nodes of the node, the device features included in the node are updated, and according to the updated device features, it is detected whether the device to be detected corresponding to the node is a cheating device.

20. The device according to claim 19, wherein The device detection module is specifically used for: The device association graph is input into a pre-trained graph attention network, so that the graph attention network detects whether the device to be detected corresponding to each node is a cheating device according to the device features contained in each node in the device association graph, and obtains the detection result corresponding to each node in the device association graph.

21. The device according to claim 14, wherein: The device features include at least one of the following features: The user information characteristics of the user using the device to be detected, the advertising browsing behavior characteristics, the device environment information of the device to be detected, and the information characteristics of the device to be detected registered on the third-party media platform, wherein the advertising browsing behavior characteristics are obtained based on the advertising browsing behavior information.

22. The device according to claim 21, wherein In the case where the device feature includes an advertisement browsing behavior feature, the device feature includes a plurality of sub-device features, each of which includes: an advertisement browsing behavior feature obtained by statistics in a time window within a statistical time period of the advertisement browsing behavior information; The device detection module is specifically used for: For each time window, based on the sub-device features corresponding to the time window of each associated device of the device to be detected, the device features corresponding to the time window of the device to be detected are updated, and according to the updated sub-device features, whether the device to be detected is a cheating device is detected to obtain a sub-detection result; According to each sub-detection result of the device to be detected, detect whether the device to be detected is a cheating device.

23. The device according to any one of claims 14 to 17, wherein: The behavior detection module is specifically used for: Obtaining a ratio of the number of false clicks on a target media platform to the total number of platform clicks on the target media platform, wherein the target media platform is a third-party media platform on which the detected cheating device has clicked on advertisements, and the number of false clicks is the sum of the number of clicks on advertisements by each cheating device on the target media platform; According to the obtained ratio, it is detected whether there is cheating behavior on the target media platform.

24. The device according to any one of claims 14 to 17, wherein: The relationship determination module is specifically used for: For each device pair, the device similarity between the two devices to be detected included in the device pair is obtained based on the advertising browsing behavior information of the two devices to be detected included in the device pair. If the obtained device similarity is greater than the preset similarity threshold, it is determined that the two devices to be detected included in the device pair have an associated relationship.

25. The device according to claim 24, wherein: The obtaining, based on the advertisement browsing behavior information of the two devices to be detected included in the device pair, the device similarity between the two devices to be detected included in the device pair includes: Determine a first number of clicks and a second number of clicks according to the advertisement browsing behavior information of the two devices to be detected included in the device, wherein the first number of clicks is: the sum of the number of clicks of the two devices to be detected included in the device on the advertisements on the same third-party media platform, and the second number of clicks is: the sum of the total number of advertisement clicks of the two devices to be detected included in the device; A ratio of the determined first number of clicks to the second number of clicks is obtained as the device similarity between the two devices to be detected included in the device pair.

26. The device according to claim 24, wherein: Two devices to be detected included in a device pair belong to the same device set, and each device set includes devices that have browsed advertisements on the same third-party media platform.

27. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 13.

28. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-13.

29. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 13.

Images