Short message platform abnormal behavior detection method and system and computer equipment

Abstract

The invention relates to the technical field of communication, and provides a short message platform abnormal behavior detection method and system and computer equipment. The method comprises the following steps: acquiring short message sending data information of a detected account within a preset time period, and constructing a short message sending behavior chain of the detected account within the preset time period based on the short message sending data information; judging whether the detected account has an abnormal short message sending behavior within the preset time period or not based on the short message sending behavior chain; if yes, obtaining corresponding equipment information of the detected account in the preset time period, and generating a target short message abnormal behavior score of the detected account based on the short message sending behavior chain and the equipment information; and determining management measures of the detected account based on the target short message abnormal behavior score. According to the method, the accuracy of a short message sending abnormal behavior detection result is improved, and complex and hidden short message sending abnormal behaviors can be identified.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, system and computer equipment for detecting abnormal behavior of a text message platform. Background Art

[0002] With the rapid development of mobile communication technology, SMS has become one of the indispensable means of communication in people's daily life and work. SMS platforms are widely used in many fields such as personal communication, corporate publicity, account verification, information notification, etc. However, with the popularization of SMS services, the security issues of SMS platforms have become increasingly prominent. Some lawless elements use SMS platforms to carry out illegal activities, including sending spam SMS, fraud SMS, malicious SMS, etc. These abnormal behaviors not only infringe on the legitimate rights and interests of users, but also may disrupt the normal order of society.

[0003] In order to deal with these problems, existing technologies identify spam text messages by keyword filtering to monitor abnormal text message sending behaviors. However, these methods usually have limitations and cannot effectively deal with more complex and hidden abnormal text message sending behaviors. Summary of the invention

[0004] The present application provides a method, system and computer device for detecting abnormal behavior of a short message platform, so as to solve the problems raised by the above-mentioned background technology.

[0005] In a first aspect, the present application provides a method for detecting abnormal behavior of a short message platform, comprising: Acquire the SMS sending data information of the detected account within a preset time period, and construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information; Based on the SMS sending behavior chain, determining whether the detected account has abnormal SMS sending behavior within the preset time period; If yes, obtain the device information corresponding to the detected account within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information; The management measures for the detected account are determined based on the target SMS abnormal behavior score.

[0006] In a possible implementation, the SMS sending data information includes SMS recipient information and SMS bit value corresponding to each SMS sending moment of the detected account within the preset time period, and constructing the SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information includes: Constructing a text message sending timeline based on each text message sending moment within the preset time period; For each SMS sending moment on the SMS sending timeline, the SMS recipient information and the SMS bit value corresponding to the SMS sending moment are marked at the SMS sending moment to obtain the sending time node information corresponding to the SMS sending moment on the SMS sending timeline; each sending time node information on the SMS sending timeline constitutes the SMS sending behavior chain.

[0007] In a possible implementation, the SMS recipient information includes the recipient device location, the recipient account number and the recipient device model, and the SMS recipient information and the SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the SMS sending behavior chain, including: For each recipient of the SMS recipient information, determine the recipient device location on a preset globe, and mark the recipient's account number and recipient device model at the recipient device location in a preset marking manner to obtain the recipient distribution information corresponding to the SMS sending time; The recipient distribution information and the SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the sending time node information corresponding to the SMS sending time on the SMS sending time axis.

[0008] In a possible implementation, judging whether the detected account has abnormal SMS sending behavior within the preset time period based on the SMS sending behavior chain includes: Respectively obtain the similarities between the SMS sending behavior chain and each preset SMS abnormal sending behavior chain, and compare each similarity with the preset similarity; If any of the similarities is greater than the preset similarity, it is determined that the detected account has abnormal SMS sending behavior within the preset time period.

[0009] In a possible implementation, the device information includes a sender device model corresponding to each SMS sending moment within the preset time period, the detected account is logged in to the sender device, and generating a target SMS abnormal behavior score of the detected account based on the SMS sending behavior chain and the device information includes: For each recipient account on the SMS sending behavior chain, extract the SMS receiving behavior chain corresponding to the recipient account within the preset time period on the SMS sending behavior chain, and obtain the abnormal score of the recipient account based on the SMS receiving behavior chain; wherein the SMS receiving behavior chain includes at least one receiving time node information, and the receiving time node information includes the recipient device model and the recipient device location; Adding up the abnormal scores of each of the above to obtain an initial SMS abnormal behavior score; For each SMS bit value in the SMS sending behavior chain, count the number of times the SMS bit value appears in the SMS sending behavior chain, and determine the number corresponding to the maximum number of each of the numbers as the target number; Multiplying the initial SMS abnormal behavior score by the first target number to obtain an intermediate SMS abnormal behavior score; Counting a first number of different sender device models corresponding to the detected account within the preset time period; The intermediate SMS abnormal behavior score is multiplied by a number corresponding to the first quantity to obtain the target SMS abnormal behavior score.

[0010] In a possible implementation, the obtaining the abnormality score of the recipient's account based on the SMS receiving behavior chain includes: Counting a second number of receiving time node information on the SMS receiving behavior chain, and counting a third number of different receiving device models corresponding to the receiving party account within the preset time period; For each receiving device location in the SMS receiving behavior chain, obtaining a risk value corresponding to the receiving device location in a preset geographic security information database; Determine the maximum risk value among the risk values ​​as the target risk value; The number corresponding to the second quantity, the number corresponding to the third quantity, and the target risk value are multiplied to obtain the abnormality score.

[0011] In a possible implementation, the determining of the management measures of the detected account based on the target SMS abnormal behavior score includes: Determine whether the target SMS abnormal behavior score is greater than a preset score; If yes, freeze the detected account; If not, continue to monitor the SMS sending behavior of the detected account.

[0012] In a second aspect, the present application provides a system for detecting abnormal behavior of a short message platform, comprising: A first acquisition module is used to acquire SMS sending data information of the detected account within a preset time period, and to construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information; A judgment module, used to judge whether the detected account has abnormal SMS sending behavior within the preset time period based on the SMS sending behavior chain; A second acquisition module is used to obtain the device information corresponding to the detected account in the preset time period if the detected account has abnormal SMS sending behavior within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information; A determination module is used to determine the management measures of the detected account based on the target SMS abnormal behavior score.

[0013] In a third aspect, the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method for detecting abnormal behavior of an SMS platform as described in any of the above items is implemented.

[0014] The present application provides a method, system and computer device for detecting abnormal behavior of a text message platform. The method includes: obtaining the text message sending data information of the detected account within a preset time period, and constructing the text message sending behavior chain of the detected account within the preset time period based on the text message sending data information; judging whether the detected account has abnormal text message sending behavior within the preset time period based on the text message sending behavior chain; if so, obtaining the device information corresponding to the detected account within the preset time period, and generating the target text message abnormal behavior score of the detected account based on the text message sending behavior chain and the device information; determining the management measures of the detected account based on the target text message abnormal behavior score. This method realizes the visual detection of abnormal text message sending behavior by constructing a visual text message sending behavior chain, and generates the target text message abnormal behavior score of the detected account based on the text message sending behavior chain and the device information, thereby improving the accuracy of the detection results of abnormal text message sending behavior, and can identify complex and hidden abnormal text message sending behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0016] Figure 1 A flow chart of a method for detecting abnormal behavior on a short message platform provided in an embodiment of the present application; Figure 2 A schematic block diagram of the structure of the SMS platform abnormal behavior detection system provided in an embodiment of the present application; Figure 3 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0019] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0020] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0021] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0022] See also Figure 1 , Figure 1 A flow chart of a method for detecting abnormal behavior of a text message platform provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the SMS platform abnormal behavior detection method provided in the embodiment of the present application includes steps S1 to S4.

[0023] Step S1: obtaining SMS sending data information of a detected account within a preset time period, and constructing a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information.

[0024] Step S2: based on the SMS sending behavior chain, determine whether the detected account has any abnormal SMS sending behavior within the preset time period.

[0025] Step S3: If yes, obtain the device information corresponding to the detected account within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information.

[0026] Step S4: Determine management measures for the detected account based on the target SMS abnormal behavior score.

[0027] As described in the above step S1, the SMS sending data information of the detected account within the preset time period is obtained, and the SMS sending behavior chain of the detected account within the preset time period is constructed based on the SMS sending data information. In order to improve the accuracy of the detection result, the preset time period is not more than 10 minutes. Specifically, the SMS sending data information includes the SMS recipient information and SMS bit value corresponding to each SMS sending moment of the detected account within the preset time period. The SMS sending behavior chain of the detected account within the preset time period is constructed based on the SMS sending data information, including the following steps: Constructing a text message sending timeline based on each text message sending moment within the preset time period; For each SMS sending moment on the SMS sending timeline, the SMS recipient information and the SMS bit value corresponding to the SMS sending moment are marked at the SMS sending moment to obtain the sending time node information corresponding to the SMS sending moment on the SMS sending timeline; each sending time node information on the SMS sending timeline constitutes the SMS sending behavior chain.

[0028] The SMS recipient information includes the recipient device location, recipient account number and recipient device model, and the SMS recipient information and SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the SMS sending behavior chain, including the following steps: For each recipient of the SMS recipient information, determine the recipient device location on a preset globe, and mark the recipient's account number and recipient device model at the recipient device location in a preset marking manner to obtain the recipient distribution information corresponding to the SMS sending time; The recipient distribution information and the SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the sending time node information corresponding to the SMS sending time on the SMS sending time axis.

[0029] It can be understood that step S1 constructs a visualized SMS sending behavior chain through multi-dimensional SMS sending behavior information such as SMS sending time, SMS recipient information and SMS bit value, realizes a visualized management method for SMS abnormal behavior, helps to comprehensively detect SMS abnormal behavior, and improves the accuracy of SMS abnormal behavior detection.

[0030] As described in step S2 above, based on the SMS sending behavior chain, it is determined whether the detected account has abnormal SMS sending behavior within the preset time period. Specifically, the following steps are included: Respectively obtain the similarity between the SMS sending behavior chain and each preset SMS abnormal sending behavior chain, and compare each similarity with the preset similarity; specifically, input the SMS sending behavior chain into a preset SMS sending behavior chain feature extraction model to obtain a first feature vector, input each of the SMS abnormal sending behavior chains into the SMS sending behavior chain feature extraction model to obtain a second feature vector corresponding to each of the SMS abnormal sending behavior chains, and calculate the similarity between the first feature vector and each of the second feature vectors.

[0031] If any of the similarities is greater than the preset similarity, it is determined that the detected account has abnormal SMS sending behavior within the preset time period.

[0032] As described in the above step S3, if the detected account has abnormal SMS sending behavior within the preset time period, the device information corresponding to the detected account within the preset time period is obtained, and the target SMS abnormal behavior score of the detected account is generated based on the SMS sending behavior chain and the device information. Specifically, the device information includes the sender device model corresponding to each SMS sending moment within the preset time period, and the detected account is logged in to the sender device. The target SMS abnormal behavior score of the detected account is generated based on the SMS sending behavior chain and the device information, including the following steps: For each recipient account on the SMS sending behavior chain, extract the SMS receiving behavior chain corresponding to the recipient account within the preset time period on the SMS sending behavior chain, and obtain the abnormal score of the recipient account based on the SMS receiving behavior chain; wherein the SMS receiving behavior chain includes at least one receiving time node information, and the receiving time node information includes the recipient device model and the recipient device location; specifically, extract the relevant information of the recipient account on the SMS sending behavior chain, including the recipient device location, recipient device model and SMS receiving time corresponding to the recipient account. It can be understood that the SMS sending time corresponding to the recipient device on the SMS sending behavior chain is regarded as the SMS receiving time of the recipient account; Adding up the abnormal scores of each of the above to obtain an initial SMS abnormal behavior score; For each SMS bit value in the SMS sending behavior chain, count the number of times the SMS bit value appears in the SMS sending behavior chain, and determine the number corresponding to the maximum number of each of the numbers as the target number; Multiplying the initial SMS abnormal behavior score by the first target number to obtain an intermediate SMS abnormal behavior score; Counting a first number of different sender device models corresponding to the detected account within the preset time period; The intermediate SMS abnormal behavior score is multiplied by a number corresponding to the first quantity to obtain the target SMS abnormal behavior score.

[0033] Wherein, obtaining the abnormal score of the recipient's account based on the SMS receiving behavior chain includes the following steps: Counting a second number of receiving time node information on the SMS receiving behavior chain, and counting a third number of different receiving device models corresponding to the receiving party account within the preset time period; For each receiving device location in the SMS receiving behavior chain, obtaining a risk value corresponding to the receiving device location in a preset geographic security information database; Determine the maximum risk value among the risk values ​​as the target risk value; The number corresponding to the second quantity, the number corresponding to the third quantity, and the target risk value are multiplied to obtain the abnormality score.

[0034] It can be understood that, on the one hand, step S3 integrates the SMS sending behavior chain, the recipient behavior chain and the device information to form a multi-dimensional and refined scoring system, which effectively improves the detection accuracy of abnormal SMS behavior. On the other hand, by counting the digital bit values ​​of the SMS content, it is possible to identify the content repetitiveness in abnormal sending behavior even when the SMS is encrypted.

[0035] As described in step S4 above, the management measures for the detected account are determined based on the target SMS abnormal behavior score. Specifically, the following steps are included: Determine whether the target SMS abnormal behavior score is greater than a preset score; If yes, freeze the detected account; If not, continue to monitor the SMS sending behavior of the detected account.

[0036] The method provided in this embodiment realizes the visual detection of abnormal SMS sending behavior by constructing a visualized SMS sending behavior chain, and generates a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information, thereby improving the accuracy of the SMS sending abnormal behavior detection results and being able to identify complex and hidden abnormal SMS sending behaviors.

[0037] See also Figure 2 , Figure 2The structure schematic block diagram of the SMS platform abnormal behavior detection system 100 provided in the embodiment of the present application is as follows: Figure 2 As shown, the SMS platform abnormal behavior detection system 100 provided in the embodiment of the present application includes: The first acquisition module 110 is used to acquire the SMS sending data information of the detected account within a preset time period, and construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information.

[0038] The judgment module 120 is used to judge whether the detected account has abnormal SMS sending behavior within the preset time period based on the SMS sending behavior chain.

[0039] The second acquisition module 130 is used to obtain the device information corresponding to the detected account within the preset time period if the detected account has abnormal SMS sending behavior within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information.

[0040] The determination module 140 is used to determine the management measures of the detected account based on the target SMS abnormal behavior score.

[0041] It should be noted that technicians in the relevant technical field can clearly understand that for the convenience and simplicity of description, the specific working processes of the platform and each module described above can refer to the corresponding processes in the aforementioned SMS platform abnormal behavior detection method embodiment, and will not be repeated here.

[0042] The SMS platform abnormal behavior detection system 100 provided in the above embodiment can be implemented in the form of a computer program. The computer program can be used in Figure 3 The system is run on the terminal device 200 shown.

[0043] See also Figure 3 , Figure 3 The terminal device 200 provided in the embodiment of the present application is a schematic block diagram of the structure, wherein the terminal device 200 includes a processor 201 and a memory 202, wherein the processor 201 and the memory 202 are connected via a system bus 203, wherein the memory 202 may include a non-volatile storage medium and an internal memory.

[0044] The non-volatile storage medium can store a computer program. The computer program includes program instructions, and when the program instructions are executed by the processor 201, the processor 201 can execute any of the above-mentioned SMS platform abnormal behavior detection methods.

[0045] The processor 201 is used to provide computing and control capabilities to support the operation of the entire terminal device 200.

[0046] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor 201, the processor 201 can execute any of the above-mentioned methods for detecting abnormal behavior of the SMS platform.

[0047] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the terminal device 200 involved in the scheme of the present application. The specific terminal device 200 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0048] It should be understood that the processor 201 may be a central processing unit (CPU), and the processor 201 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0049] In some embodiments, the processor 201 is used to run a computer program stored in the memory to implement the following steps: Acquire the SMS sending data information of the detected account within a preset time period, and construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information; Based on the SMS sending behavior chain, determining whether the detected account has abnormal SMS sending behavior within the preset time period; If yes, obtain the device information corresponding to the detected account within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information; The management measures for the detected account are determined based on the target SMS abnormal behavior score.

[0050] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the terminal device 200 described above can refer to the corresponding process of the aforementioned SMS platform abnormal behavior detection method, which will not be repeated here.

[0051] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting abnormal behavior of a short message platform, characterized in that: include Acquire the SMS sending data information of the detected account within a preset time period, and construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information; Based on the SMS sending behavior chain, determining whether the detected account has abnormal SMS sending behavior within the preset time period; If yes, obtain the device information corresponding to the detected account within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information; The management measures for the detected account are determined based on the target SMS abnormal behavior score.

2. The method for detecting abnormal behavior of a short message platform according to claim 1, characterized in that: The SMS sending data information includes SMS recipient information and SMS bit value corresponding to each SMS sending moment of the detected account within the preset time period, and constructing the SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information includes: Constructing a text message sending timeline based on each text message sending moment within the preset time period; For each SMS sending moment on the SMS sending timeline, the SMS recipient information and the SMS bit value corresponding to the SMS sending moment are marked at the SMS sending moment to obtain the sending time node information corresponding to the SMS sending moment on the SMS sending timeline; each sending time node information on the SMS sending timeline constitutes the SMS sending behavior chain.

3. The method for detecting abnormal behavior of a short message platform according to claim 2, characterized in that: The SMS recipient information includes the recipient device location, recipient account number and recipient device model, and the SMS recipient information and SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the SMS sending behavior chain, including: For each recipient of the SMS recipient information, determine the recipient device location on a preset globe, and mark the recipient's account number and recipient device model at the recipient device location in a preset marking manner to obtain the recipient distribution information corresponding to the SMS sending time; The recipient distribution information and the SMS bit value corresponding to the SMS sending time are marked at the SMS sending time to obtain the sending time node information corresponding to the SMS sending time on the SMS sending time axis.

4. The method for detecting abnormal behavior of a short message platform according to claim 1, characterized in that: The determining, based on the SMS sending behavior chain, whether the detected account has abnormal SMS sending behavior within the preset time period includes: Respectively obtain the similarities between the SMS sending behavior chain and each preset SMS abnormal sending behavior chain, and compare each similarity with the preset similarity; If any of the similarities is greater than the preset similarity, it is determined that the detected account has abnormal SMS sending behavior within the preset time period.

5. The method for detecting abnormal behavior of a short message platform according to claim 3, characterized in that: The device information includes the sender device model corresponding to each SMS sending moment within the preset time period, the detected account is logged in to the sender device, and the target SMS abnormal behavior score of the detected account is generated based on the SMS sending behavior chain and the device information, including: For each recipient account on the SMS sending behavior chain, extract the SMS receiving behavior chain corresponding to the recipient account within the preset time period on the SMS sending behavior chain, and obtain the abnormal score of the recipient account based on the SMS receiving behavior chain; wherein the SMS receiving behavior chain includes at least one receiving time node information, and the receiving time node information includes the recipient device model and the recipient device location; Adding up the abnormal scores of each of the above to obtain an initial SMS abnormal behavior score; For each SMS bit value in the SMS sending behavior chain, count the number of times the SMS bit value appears in the SMS sending behavior chain, and determine the number corresponding to the maximum number of each of the numbers as the target number; Multiplying the initial SMS abnormal behavior score by the target number to obtain an intermediate SMS abnormal behavior score; Counting a first number of different sender device models corresponding to the detected account within the preset time period; The intermediate SMS abnormal behavior score is multiplied by a number corresponding to the first quantity to obtain the target SMS abnormal behavior score.

6. The method for detecting abnormal behavior of a short message platform according to claim 5, characterized in that: The obtaining of the abnormal score of the recipient's account based on the SMS receiving behavior chain includes: Counting a second number of receiving time node information on the SMS receiving behavior chain, and counting a third number of different receiving device models corresponding to the receiving party account within the preset time period; For each receiving device location in the SMS receiving behavior chain, obtaining a risk value corresponding to the receiving device location in a preset geographic security information database; Determine the maximum risk value among the risk values ​​as the target risk value; The number corresponding to the second quantity, the number corresponding to the third quantity, and the target risk value are multiplied to obtain the abnormality score.

7. The method for detecting abnormal behavior of a short message platform according to claim 1, characterized in that: The determining of the management measures of the detected account based on the target SMS abnormal behavior score includes: Determine whether the target SMS abnormal behavior score is greater than a preset score; If yes, freeze the detected account; If not, continue to monitor the SMS sending behavior of the detected account.

8. A SMS platform abnormal behavior detection system, characterized in that: include A first acquisition module is used to acquire SMS sending data information of the detected account within a preset time period, and to construct a SMS sending behavior chain of the detected account within the preset time period based on the SMS sending data information; A judgment module, used to judge whether the detected account has abnormal SMS sending behavior within the preset time period based on the SMS sending behavior chain; A second acquisition module is used to obtain the device information corresponding to the detected account in the preset time period if the detected account has abnormal SMS sending behavior within the preset time period, and generate a target SMS abnormal behavior score for the detected account based on the SMS sending behavior chain and the device information; A determination module is used to determine the management measures of the detected account based on the target SMS abnormal behavior score.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method for detecting abnormal behavior of a short message platform as described in any one of claims 1 to 7 is implemented.

Images