Abnormal account detection method and device, equipment and storage medium
By analyzing the dimension value and abnormal probability of the account to be tested in the virtual asset-related dimension set, and using the LOF algorithm to identify the abnormal account of virtual asset, the problem of inaccurate identification of abnormal account of virtual asset in the existing technology is solved, and the abnormality of virtual asset is achieved Accurate identification and distinction of accounts.
Patent Information
- Application Number
- CN202411542006.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-21
AI Technical Summary
The prior art is difficult to accurately identify virtual asset abnormalities, and it is impossible to effectively distinguish between accounts that obtain virtual assets through improper means and accounts that are only used to steal member videos.
By obtaining the dimension value of the account to be tested in the dimension set related to the virtual assets, the local anomaly factor LOF algorithm is used to calculate the abnormal probability of each dimension to form an abnormal probability set. Then, based on the set of abnormal probability, determine whether the virtual assets of the account are abnormal, and finally determine whether the account is a virtual asset abnormal account.
It realizes accurate identification of abnormal accounts of virtual assets, can effectively distinguish abnormal accounts from normal accounts, and improves the security of virtual asset management.
Smart Images
Figure CN119494658A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to an abnormal account detection method, device, equipment and storage medium. Background Art
[0002] With the development of technology, some apps will launch some activities to encourage users to continue using the current app. For example, the app will launch some virtual asset reward tasks, and users can obtain virtual assets by completing these tasks, and then exchange the obtained virtual assets for gifts to achieve the purpose of encouraging users to continue using. However, driven by interests, some users will steal virtual assets through non-compliant means, and then use the stolen virtual assets to exchange gifts. Therefore, the app needs to identify the accounts of users who steal virtual assets, that is, abnormal virtual asset accounts, and prohibit the continued issuance of virtual assets to these accounts.
[0003] In related technologies, apps often identify abnormal accounts by determining whether the device has multiple accounts, whether there are too many associated accounts, or whether the IP address is abnormal, and determine these abnormal accounts as abnormal virtual asset accounts.
[0004] However, since abnormal virtual asset accounts may also be normal accounts that obtain virtual assets through improper means, and some abnormal accounts exist only to steal member videos, the abnormal accounts determined by the above scheme are not necessarily abnormal virtual asset accounts, and cannot accurately determine abnormal virtual asset accounts. Summary of the invention
[0005] The present application provides an abnormal account detection method, apparatus, device and storage medium, which can accurately determine abnormal virtual asset accounts.
[0006] In a first aspect, the present application provides a method for detecting abnormal accounts, the method comprising:
[0007] Obtaining the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to virtual assets;
[0008] For the account to be tested, according to the dimension value of each dimension in the dimension set, determine the abnormal probability of each dimension in the dimension set to obtain an abnormal probability set;
[0009] Determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested;
[0010] According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an account with abnormal virtual assets.
[0011] Optionally, determining the abnormal probability of each dimension in the dimension set according to the dimension value of each dimension in the dimension set includes:
[0012] For each dimension in the dimension set, a local outlier factor (LOF) algorithm is used to analyze and calculate the dimension value of the dimension to obtain the LOF value of the dimension;
[0013] The LOF value of each dimension in the dimension set is determined as the abnormal probability of each dimension in the dimension set.
[0014] Optionally, determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested includes:
[0015] Detecting whether the abnormal probability set corresponding to the account to be tested meets the preset conditions;
[0016] When the abnormal probability set corresponding to the account to be tested does not meet the preset condition, it is determined that the virtual assets of the account to be tested are abnormal;
[0017] When the abnormal probability set corresponding to the account to be tested meets the preset condition, it is determined that there is no abnormality in the virtual assets of the account to be tested.
[0018] Optionally, determining whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal includes:
[0019] When the virtual assets of the account to be tested are abnormal, determine a preset time period with the current time point as the end time point, obtain the total consumed virtual assets of the account to be tested within the preset time period, and determine whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets;
[0020] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0021] Optionally, determining whether the account to be tested is an abnormal virtual asset account according to the consumed virtual assets includes:
[0022] Obtaining a preset average value, which is the average total consumption of virtual assets by all accounts within a preset time period;
[0023] determining a difference between the total consumed virtual assets and the average value;
[0024] According to the absolute value of the difference and the preset difference, it is determined whether the account to be tested is an abnormal virtual asset account.
[0025] Optionally, determining whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal includes:
[0026] When the virtual assets of the account to be tested are abnormal, obtaining the virtual asset change details of the account to be tested, and determining whether the account to be tested is an account with abnormal virtual assets according to the virtual asset change details;
[0027] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0028] Optionally, when the virtual asset change details include virtual assets obtained through a preset path, determining whether the account to be tested is an abnormal virtual asset account according to the virtual asset change details includes:
[0029] Get the users involved in the preset path;
[0030] Detecting whether the user meets the preset rules according to the user information of the user;
[0031] When the user information does not conform to a preset rule, determining that the account to be tested is an abnormal virtual asset account;
[0032] When the user information meets the preset rules, it is determined that the account to be tested is not an abnormal virtual asset account.
[0033] In a second aspect, the present application provides an abnormal account detection device, the device comprising:
[0034] An acquisition unit, used to acquire a dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to the virtual asset;
[0035] A first determining unit is used to determine, for the account to be tested, the abnormal probability of each dimension in the dimension set according to the dimension value of each dimension in the dimension set, to obtain an abnormal probability set;
[0036] A second determining unit, configured to determine whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested;
[0037] The third determining unit is used to determine whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal.
[0038] Optionally, the first determining unit is configured to:
[0039] For each dimension in the dimension set, a local outlier factor (LOF) algorithm is used to analyze and calculate the dimension value of the dimension to obtain the LOF value of the dimension;
[0040] The LOF value of each dimension in the dimension set is determined as the abnormal probability of each dimension in the dimension set.
[0041] Optionally, the second determining unit is configured to:
[0042] Detecting whether the abnormal probability set corresponding to the account to be tested meets the preset conditions;
[0043] When the abnormal probability set corresponding to the account to be tested does not meet the preset condition, it is determined that the virtual assets of the account to be tested are abnormal;
[0044] When the abnormal probability set corresponding to the account to be tested meets the preset condition, it is determined that there is no abnormality in the virtual assets of the account to be tested.
[0045] Optionally, the third determining unit is used to:
[0046] When the virtual assets of the account to be tested are abnormal, determine a preset time period with the current time point as the end time point, obtain the total consumed virtual assets of the account to be tested within the preset time period, and determine whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets;
[0047] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0048] Optionally, the third determining unit is used to:
[0049] Obtaining a preset average value, which is the average total consumption of virtual assets by all accounts within a preset time period;
[0050] determining a difference between the total consumed virtual assets and the average value;
[0051] According to the absolute value of the difference and the preset difference, it is determined whether the account to be tested is an abnormal virtual asset account.
[0052] Optionally, the third determining unit is used to:
[0053] When the virtual assets of the account to be tested are abnormal, obtaining the virtual asset change details of the account to be tested, and determining whether the account to be tested is an account with abnormal virtual assets according to the virtual asset change details;
[0054] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0055] Optionally, when the virtual asset change details include virtual assets obtained through a preset path, the third determining unit is used to:
[0056] Get the users involved in the preset path;
[0057] Detecting whether the user meets the preset rules according to the user information of the user;
[0058] When the user information does not conform to a preset rule, determining that the account to be tested is an abnormal virtual asset account;
[0059] When the user information meets the preset rules, it is determined that the account to be tested is not an abnormal virtual asset account.
[0060] In a third aspect, the present application provides an abnormal account detection device, comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; at least one memory connected to the at least one bus, wherein the processor is configured to:
[0061] Obtaining the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to virtual assets;
[0062] For the account to be tested, according to the dimension value of each dimension in the dimension set, determine the abnormal probability of each dimension in the dimension set to obtain an abnormal probability set;
[0063] Determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested;
[0064] According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an account with abnormal virtual assets.
[0065] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above-mentioned abnormal account detection method when executed by a processor.
[0066] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: In the embodiment of the present application, the dimension value of each dimension of the account to be tested in the dimension set is obtained, wherein the dimension is a dimension related to virtual assets. For the account to be tested, the abnormal probability of each dimension in the dimension set is determined according to the dimension value of each dimension in the dimension set, and an abnormal probability set is obtained. According to the abnormal probability set corresponding to the account to be tested, it is determined whether the virtual assets of the account to be tested are abnormal. According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an abnormal virtual asset account. It can be seen that the present application determines whether the virtual assets of the account are abnormal by analyzing the dimension values of each dimension related to virtual assets, and then determines whether the account is an abnormal virtual asset account. Since the present application determines the abnormal virtual asset account through data related to virtual assets, and the data related to virtual assets can accurately reflect the abnormal situation of virtual assets, the present application can accurately determine the abnormal virtual asset account. BRIEF DESCRIPTION OF THE DRAWINGS
[0067] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0069] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.
[0070] Figure 1 A flowchart of an abnormal account detection method provided in an embodiment of the present application;
[0071] Figure 2 A flowchart of a method for determining an abnormality probability provided in an embodiment of the present application;
[0072] Figure 3 A flowchart of a method for detecting anomalies of virtual assets provided in an embodiment of the present application;
[0073] Figure 4 A flowchart of a method for determining abnormal virtual asset accounts provided in an embodiment of the present application;
[0074] Figure 5A flowchart of another method for determining abnormal virtual asset accounts provided in an embodiment of the present application;
[0075] Figure 6 A flowchart of another method for determining abnormal virtual asset accounts provided in an embodiment of the present application;
[0076] Figure 7 A flowchart of another method for determining abnormal virtual asset accounts provided in an embodiment of the present application;
[0077] Figure 8 A schematic diagram of a flow chart of an abnormal account detection device provided in an embodiment of the present application;
[0078] Fig. 9 A schematic diagram of an abnormal account detection device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0079] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0080] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.
[0081] With the development of technology, some apps will launch some activities to encourage users to continue using the current app. For example, the app will launch some virtual asset reward tasks, and users can obtain virtual assets by completing these tasks, and then exchange the obtained virtual assets for gifts to achieve the purpose of encouraging users to continue using. However, driven by interests, some users will steal virtual assets through non-compliant means, and then use the stolen virtual assets to exchange gifts. Therefore, the app needs to identify the accounts of users who steal virtual assets, that is, abnormal virtual asset accounts, and prohibit the continued issuance of virtual assets to these accounts.
[0082] In order to determine abnormal virtual asset accounts, the present application can determine whether the virtual assets of the account are abnormal by analyzing the dimension values of each dimension related to virtual assets, and then determine whether the account is an abnormal virtual asset account. Since the present application determines abnormal virtual asset accounts through data related to virtual assets, and data related to virtual assets can accurately reflect the abnormal situation of virtual assets, the present application can accurately determine abnormal virtual asset accounts.
[0083] In summary, the present application embodiment provides a method for detecting abnormal accounts, which can accurately determine abnormal virtual asset accounts, such as Figure 1 As shown, the specific steps include:
[0084] Step 101, obtaining the dimension value of each dimension in the dimension set of the account to be tested.
[0085] Among them, the accounts to be tested are multiple accounts that need to be detected for anomalies. The dimensions are dimensions related to virtual assets, such as the total amount of virtual resources, the number of times participating in tasks to obtain virtual assets, etc. The dimension set includes at least one dimension. Virtual assets are used to exchange gifts. In a usage scenario, when it is necessary to determine whether the points of the account to be tested are abnormal, the virtual assets involved in this step are points. Of course, the virtual assets involved in this step can also be gold coins, exchange coupons, etc.
[0086] In this step, the account to be tested can be all accounts or other accounts except obviously abnormal accounts. When the account to be tested is all accounts, the server can directly obtain the dimension value of each dimension of the account to be tested in the dimension set. When the account to be tested is other accounts except obviously abnormal accounts, the server first determines the accounts with obviously abnormal virtual assets, determines other accounts except these accounts, and then obtains the dimension value of each dimension of other accounts in the dimension set.
[0087] It should be noted that the execution entity of the present application can be a server or other detection equipment, which is not limited here.
[0088] Step 102: for the account to be tested, determine the abnormal probability of each dimension in the dimension set according to the dimension value of each dimension in the dimension set to obtain an abnormal probability set.
[0089] Among them, the abnormal probability is the probability that the account to be tested has an abnormality in the corresponding dimension.
[0090] In this step, for the account to be tested, the server can calculate the dimension value of each dimension in the dimension set according to the LOF algorithm to obtain the LOF value of each dimension, determine the LOF value of each dimension as the abnormal probability of each dimension, and combine these abnormal probabilities to obtain an abnormal probability set.
[0091] Among them, the LOF algorithm (Local Outlier Factor algorithm) is an algorithm for anomaly detection. It is a density-based outlier detection method that can be used to identify abnormal data points in a data set. In this step, the LOF algorithm can be used to calculate the LOF value of the account to be tested in each dimension.
[0092] Alternatively, for each dimension, the server may add up the dimension values of all accounts to be tested in the dimension to obtain a sum, and calculate the average value in the dimension based on the sum and the number of accounts to be tested. For each dimension of the account to be tested, the server calculates the difference between the dimension value of the dimension and the average value, and normalizes the absolute value of the difference to obtain a normalized value, determines the value as the abnormal probability, and combines these abnormal probabilities to obtain an abnormal probability set.
[0093] Step 103: Determine whether the virtual assets of the account to be tested are abnormal based on the abnormal probability set corresponding to the account to be tested.
[0094] In this step, the server stores the preset abnormal probability corresponding to each dimension. When the abnormal probability of the account to be tested in each dimension is greater than the corresponding preset abnormal probability, the server determines that the virtual assets of the account to be tested are abnormal. Or when the abnormal probability of the account to be tested in a certain dimension is greater than the preset abnormal probability corresponding to the dimension, the server determines that the virtual assets of the account to be tested are abnormal. Of course, this step can also use other methods, and this step is not limited.
[0095] Step 104 , determining whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal.
[0096] In this step, when the server determines that the virtual assets of the account to be tested are abnormal, the server can determine that the account to be tested is an account with abnormal virtual assets. When the server determines that the virtual assets of the account to be tested are normal, the server can determine that the account to be tested is not an account with abnormal virtual assets.
[0097] Alternatively, the server may further check the accounts with abnormal virtual assets to determine whether the virtual assets of these accounts are truly abnormal. For example, by checking the virtual asset transaction details of these accounts, it is further determined whether the virtual assets of these accounts are truly abnormal. By comparing the virtual asset consumption of these accounts with the average virtual asset consumption, it is further determined whether the virtual assets of these accounts are truly abnormal.
[0098] In an embodiment of the present application, the dimension value of each dimension of the account to be tested in the dimension set is obtained, wherein the dimension is a dimension related to virtual assets. For the account to be tested, the abnormal probability of each dimension in the dimension set is determined according to the dimension value of each dimension in the dimension set, and an abnormal probability set is obtained. According to the abnormal probability set corresponding to the account to be tested, it is determined whether the virtual assets of the account to be tested are abnormal. According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an abnormal virtual asset account. It can be seen that the present application determines whether the virtual assets of the account are abnormal by analyzing the dimension values of the account in each dimension related to virtual assets, and then determines whether the account is an abnormal virtual asset account. Since the present application determines the abnormal virtual asset account through data related to virtual assets, and the data related to virtual assets can accurately reflect the abnormal situation of virtual assets, therefore, the present application can accurately determine the abnormal virtual asset account.
[0099] In the implementation of this application, the server can calculate the abnormal probability of the account to be tested in the dimension based on the LOF algorithm. Therefore, this embodiment of the application provides a method for determining abnormal probability. Figure 2 As shown, the specific steps include:
[0100] Step 201: For each dimension in the dimension set, use the LOF algorithm to analyze and calculate the dimension value of the dimension to obtain the LOF value of the dimension.
[0101] In this step, when the number of accounts to be tested does not exceed the preset number, for each dimension in the dimension set, the server inputs the dimension value of these accounts to be tested in the dimension into the LOF algorithm to obtain the LOF value of these accounts to be tested in the dimension. When the number of accounts to be tested exceeds the preset number, the server can group these accounts to be tested and then perform calculations based on the grouped accounts to be tested.
[0102] Step 202 : Determine the LOF value of each dimension in the dimension set as the abnormal probability of each dimension in the dimension set.
[0103] In this step, the server may determine the LOF value of each dimension in the dimension set as the abnormal probability of each dimension in the dimension set.
[0104] In the embodiment of the present application, the server stores preset conditions, and then the server can detect whether the abnormal probability of the account to be tested in each dimension meets the preset conditions to determine whether the virtual assets of the account to be tested are abnormal. Therefore, the embodiment of the present application provides a virtual asset abnormality detection method, which is as follows: Figure 3 As shown, the specific steps include:
[0105] Step 301: Check whether the abnormal probability set corresponding to the account to be tested meets the preset conditions.
[0106] In this step, the preset condition is that for each dimension in the dimension set, the abnormal probability of the account to be tested in a certain dimension is greater than the preset value of the dimension. In other words, the technician sets a preset value for each dimension, and then the server can detect whether the abnormal probability of the account to be tested in each dimension is greater than the preset value of each dimension.
[0107] The preset value is set by the technician based on experience, and may also be set based on other methods, for example, by calculating the average value of the abnormal probability of all tested accounts in each dimension and determining the average value as the preset value.
[0108] Step 302: When the abnormal probability set corresponding to the account to be tested meets a preset condition, it is determined that there is an abnormality in the virtual assets of the account to be tested.
[0109] In this step, when the abnormal probability set corresponding to the account to be tested meets the preset conditions, the server determines that there is an abnormality in the virtual assets of the account to be tested.
[0110] Step 303: When the abnormal probability set corresponding to the account to be tested does not meet the preset condition, it is determined that there is no abnormality in the virtual assets of the account to be tested.
[0111] In this step, when the abnormal probability set corresponding to the account to be tested does not meet the preset conditions, it is determined that there is no abnormality in the virtual assets of the account to be tested.
[0112] In the embodiment of the present application, the server can further detect the account to be tested based on the virtual assets consumed by the account to be tested, so as to accurately identify the virtual asset abnormal account. Therefore, the embodiment of the present application provides a method for determining the virtual asset abnormal account. Figure 4 As shown, the specific steps include:
[0113] Step 401, when the virtual assets of the account to be tested are abnormal, determine a preset time period with the current time point as the end time point, and obtain the total consumed virtual assets of the account to be tested within the preset time period, and determine whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets.
[0114] In this step, when the virtual assets of the account to be tested are abnormal, the server obtains the current time point and the preset duration, and determines a preset time period with the current time point as the end time point and the preset duration, obtains all consumed virtual assets of the account to be tested within the preset time period, and adds up these consumed virtual assets to obtain the total consumed virtual assets, and determines whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets and the preset average consumed virtual assets.
[0115] In the above process, the average consumption of virtual assets is the average value of the total consumption of virtual assets by all accounts within a preset time period. The specific acquisition steps are: after obtaining the preset time period, the server can obtain the total consumption of virtual assets of each account within the preset time period, and determine the average value based on these total consumption of virtual assets, and determine the average value as the average consumption of virtual assets. Alternatively, the average consumption of virtual assets is the average value of virtual assets consumed by normal accounts within a preset time period. The preset time period is set by the technician based on experience, and can also be set to one month or three months.
[0116] Step 402: When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0117] In this step, when the virtual assets of the account to be tested are normal, it means that the account to be tested is a normal account. Therefore, the server can determine that the account to be tested is not an account with abnormal virtual assets.
[0118] In the embodiment of the present application, the server can also determine whether the account to be tested is an abnormal virtual asset account according to the consumed virtual assets. The embodiment of the present application provides a method for determining an abnormal virtual asset account. Figure 5 As shown, the specific steps include:
[0119] Step 501, obtaining a preset average value.
[0120] The average value is the average total consumption of virtual assets by all accounts in a preset time period. The account involved in this step may be the account to be tested involved in step 101, or may be an account that has been determined and is obviously normal.
[0121] In this step, the server needs to first obtain the total virtual assets consumed by each account within a preset time period, and then determine the average virtual assets consumed based on the total virtual assets consumed by each account. The specific steps are as follows: for each account, the server can obtain the virtual assets consumed by the account within a preset time period, and add up these consumed virtual assets to obtain the total virtual assets consumed by the account. After that, the server can calculate the average virtual assets consumed by the total virtual assets consumed by each account.
[0122] Step 502, determine the difference between the total consumed virtual assets and the average value.
[0123] In this step, since the total virtual assets consumed by a normal account will fluctuate around the average total virtual assets consumed, and will not deviate too far from the average total virtual assets consumed, if the total virtual assets consumed by a certain account differ too far from the average total virtual assets consumed, the virtual assets of the account are really abnormal, and the account is determined as an abnormal virtual asset account. In summary, in order to determine the degree of deviation between the total virtual assets consumed and the average total virtual assets consumed, the server can calculate the difference between the total virtual assets consumed and the average value.
[0124] Step 503: Determine whether the account to be tested is an abnormal virtual asset account based on the absolute value of the difference and the preset difference.
[0125] In this step, since the difference determined in step 502 may be positive or negative, the server may determine the absolute value of the difference for the sake of comparison, and then compare the absolute value with the preset difference. When the absolute value is greater than the preset difference, it indicates that the total virtual assets consumed deviate too far from the average total virtual assets consumed, and the server determines that the account to be tested is an abnormal virtual asset account; when the absolute value is less than or equal to the preset difference, it indicates that the total virtual assets consumed do not deviate too far from the average total virtual assets consumed, and the server determines that the account to be tested is not an abnormal virtual asset account.
[0126] In the embodiment of the present application, the server can also obtain the virtual asset change details, and then determine whether the account to be tested is an abnormal virtual asset account according to the virtual asset change details, so as to accurately identify the abnormal virtual asset account. Therefore, the embodiment of the present application provides a method for determining an abnormal virtual asset account. Figure 6 As shown, the specific steps include:
[0127] Step 601, when the virtual assets of the account to be tested are abnormal, obtain the virtual asset change details of the account to be tested, and determine whether the account to be tested is an account with abnormal virtual assets according to the virtual asset change details.
[0128] Among them, the virtual asset change details include at least one virtual asset change item, and each virtual asset change item includes the virtual asset change situation and the reason for the virtual asset change. For example, the virtual asset is points, the virtual asset change situation is an increase of 10 points, and the reason is inviting a new user.
[0129] In this step, the virtual asset change details include the virtual asset change situation and the reasons for the virtual asset change. The server can further verify the virtual asset change situation and the reasons to verify whether the virtual assets of the account to be tested are normal. The specific execution steps are: when the virtual assets of the account to be tested are abnormal, the server can obtain the virtual asset change details of the account to be tested, and verify each virtual asset change item in the details to determine whether the account to be tested is an abnormal virtual asset account.
[0130] Step 602: When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0131] In this step, when the virtual assets of the account to be tested are normal, it means that the account to be tested is a normal account. Therefore, the server can determine that the account to be tested is not an account with abnormal virtual assets.
[0132] In the embodiment of the present application, when the virtual asset change details include virtual assets obtained through a preset path, and the preset path involves some users, the server can detect these users to determine whether the virtual assets obtained through the preset path are compliant. Therefore, the embodiment of the present application provides a method for determining abnormal virtual asset accounts. Figure 7 As shown, the specific steps include:
[0133] Step 701, obtaining users involved in a preset path.
[0134] Among them, the preset path is set by the technical staff according to the actual needs, which will involve other users. For example, the preset path can be a path for inviting new users, or a path for inviting users who have registered for one year, etc.
[0135] In this step, the server may detect each virtual asset change item in the virtual asset change details, and when it is detected that the cause of a virtual asset change item is a preset path, the server obtains the users involved in the preset path.
[0136] Step 702: Detect whether the user meets the preset rules based on the user information.
[0137] The preset rules are set by the technical staff according to actual needs. For example, the preset rules require the user to be a newly registered user, or require the user to be a user who has been registered for one year.
[0138] In this step, when the preset rule requires that the user is a newly registered user, the server can determine whether the user is a newly registered user based on the user information of the user. If yes, it is determined that the user meets the preset rule. If not, it is determined that the user does not meet the preset rule. Similarly, when the content of the preset rule is other content, the detection method of the server is similar.
[0139] Step 703: When the user does not meet the preset rules, the account to be tested is determined to be an abnormal virtual asset account.
[0140] In this step, when the user does not meet the preset rules, it means that the user to be tested should not have obtained the virtual assets obtained through the preset channel. Therefore, the server regards the account to be tested as an abnormal virtual asset account.
[0141] Step 704: When the user meets the preset rules, it is determined that the account to be tested is not an abnormal virtual asset account.
[0142] In this step, when the user meets the preset rules, the server may identify the account to be tested as an abnormal virtual asset account.
[0143] In the embodiment of the present application, an abnormal account detection device is also provided, which corresponds to the method embodiment, specifically as follows: Figure 8 As shown, including:
[0144] The acquisition unit 801 is used to acquire the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to the virtual asset;
[0145] A first determining unit 802 is configured to determine, for the account to be tested, the abnormal probability of each dimension in the dimension set according to the dimension value of each dimension in the dimension set, to obtain an abnormal probability set;
[0146] The second determining unit 803 is used to determine whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested;
[0147] The third determining unit 804 is configured to determine whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal.
[0148] Optionally, the first determining unit 802 is configured to:
[0149] For each dimension in the dimension set, a local outlier factor (LOF) algorithm is used to analyze and calculate the dimension value of the dimension to obtain the LOF value of the dimension;
[0150] The LOF value of each dimension in the dimension set is determined as the abnormal probability of each dimension in the dimension set.
[0151] Optionally, the second determining unit 803 is configured to:
[0152] Detecting whether the abnormal probability set corresponding to the account to be tested meets the preset conditions;
[0153] When the abnormal probability set corresponding to the account to be tested does not meet the preset condition, it is determined that the virtual assets of the account to be tested are abnormal;
[0154] When the abnormal probability set corresponding to the account to be tested meets the preset condition, it is determined that there is no abnormality in the virtual assets of the account to be tested.
[0155] Optionally, the third determining unit 803 is configured to:
[0156] When the virtual assets of the account to be tested are abnormal, determine a preset time period with the current time point as the end time point, obtain the total consumed virtual assets of the account to be tested within the preset time period, and determine whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets;
[0157] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0158] Optionally, the third determining unit 803 is configured to:
[0159] Obtaining a preset average value, which is the average total consumption of virtual assets by all accounts within a preset time period;
[0160] determining a difference between the total consumed virtual assets and the average value;
[0161] According to the absolute value of the difference and the preset difference, it is determined whether the account to be tested is an abnormal virtual asset account.
[0162] Optionally, the third determining unit 803 is configured to:
[0163] When the virtual assets of the account to be tested are abnormal, obtaining the virtual asset change details of the account to be tested, and determining whether the account to be tested is an account with abnormal virtual assets according to the virtual asset change details;
[0164] When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
[0165] Optionally, when the virtual asset change details include virtual assets obtained through a preset path, the third determining unit 803 is used to:
[0166] Get the users involved in the preset path;
[0167] Detecting whether the user meets the preset rules according to the user information of the user;
[0168] When the user information does not conform to a preset rule, determining that the account to be tested is an abnormal virtual asset account;
[0169] When the user information meets the preset rules, it is determined that the account to be tested is not an abnormal virtual asset account.
[0170] like Fig. 9 As shown, the embodiment of the present application provides an abnormal account detection device, including a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.
[0171] Memory 903, used for storing computer programs;
[0172] In one embodiment of the present application, the processor 901 is used to implement the abnormal account detection method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 903, including:
[0173] Obtaining the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to virtual assets;
[0174] For the account to be tested, according to the dimension value of each dimension in the dimension set, determine the abnormal probability of each dimension in the dimension set to obtain an abnormal probability set;
[0175] Determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested;
[0176] According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an account with abnormal virtual assets.
[0177] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the abnormal account detection method provided in any of the aforementioned method embodiments are implemented.
[0178] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0179] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0180] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.
[0181] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A method for detecting abnormal accounts, characterized in that: The method comprises: Obtaining the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to virtual assets; For the account to be tested, according to the dimension value of each dimension in the dimension set, determine the abnormal probability of each dimension in the dimension set to obtain an abnormal probability set; Determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested; According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an account with abnormal virtual assets.
2. The method according to claim 1, characterized in that: The determining, according to the dimension value of each dimension in the dimension set, the abnormal probability of each dimension in the dimension set includes: For each dimension in the dimension set, a local outlier factor (LOF) algorithm is used to analyze and calculate the dimension value of the dimension to obtain the LOF value of the dimension; The LOF value of each dimension in the dimension set is determined as the abnormal probability of each dimension in the dimension set.
3. The method according to claim 1, characterized in that: The determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested includes: Detecting whether the abnormal probability set corresponding to the account to be tested meets the preset conditions; When the abnormal probability set corresponding to the account to be tested does not meet the preset condition, it is determined that the virtual assets of the account to be tested are abnormal; When the abnormal probability set corresponding to the account to be tested meets the preset condition, it is determined that there is no abnormality in the virtual assets of the account to be tested.
4. The method according to claim 1, characterized in that: The step of determining whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal includes: When the virtual assets of the account to be tested are abnormal, determine a preset time period with the current time point as the end time point, obtain the total consumed virtual assets of the account to be tested within the preset time period, and determine whether the account to be tested is an account with abnormal virtual assets based on the total consumed virtual assets; When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
5. The method according to claim 4, characterized in that: The step of determining whether the account to be tested is an account with abnormal virtual assets according to the total consumed virtual assets includes: Obtaining a preset average value, which is the average total consumption of virtual assets by all accounts within a preset time period; determining a difference between the total consumed virtual assets and the average value; According to the absolute value of the difference and the preset difference, it is determined whether the account to be tested is an abnormal virtual asset account.
6. The method according to claim 1, characterized in that: The step of determining whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal includes: When the virtual assets of the account to be tested are abnormal, obtaining the virtual asset change details of the account to be tested, and determining whether the account to be tested is an account with abnormal virtual assets according to the virtual asset change details; When the virtual assets of the account to be tested are normal, it is determined that the account to be tested is not an account with abnormal virtual assets.
7. The method according to claim 6, characterized in that: When the virtual asset change details include virtual assets obtained through a preset path, determining whether the account to be tested is an abnormal virtual asset account according to the virtual asset change details includes: Get the users involved in the preset path; Detecting whether the user meets the preset rules according to the user information of the user; When the user information does not conform to a preset rule, determining that the account to be tested is an abnormal virtual asset account; When the user information meets the preset rules, it is determined that the account to be tested is not an abnormal virtual asset account.
8. An abnormal account detection device, characterized in that: The device comprises: An acquisition unit, used to acquire a dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to the virtual asset; A first determining unit is used to determine, for the account to be tested, the abnormal probability of each dimension in the dimension set according to the dimension value of each dimension in the dimension set, to obtain an abnormal probability set; A second determining unit, configured to determine whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested; The third determining unit is used to determine whether the account to be tested is an account with abnormal virtual assets according to whether the virtual assets of the account to be tested are abnormal.
9. An abnormal account detection device, characterized in that: include: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; at least one memory connected to the at least one bus, wherein the processor is configured to: Obtaining the dimension value of each dimension of the account to be tested in the dimension set, wherein the dimension is a dimension related to virtual assets; For the account to be tested, according to the dimension value of each dimension in the dimension set, determine the abnormal probability of each dimension in the dimension set to obtain an abnormal probability set; Determining whether the virtual assets of the account to be tested are abnormal according to the abnormal probability set corresponding to the account to be tested; According to whether the virtual assets of the account to be tested are abnormal, it is determined whether the account to be tested is an account with abnormal virtual assets.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal account detection method according to any one of claims 1 to 7 is implemented.