Abnormal multimedia account group identification method and device, medium and electronic equipment

Abstract

The invention discloses an abnormal multimedia account group identification method and device, a computer readable medium and electronic equipment, and the method comprises the steps: obtaining the account feature data of each multimedia account contained in a multimedia account group, the account feature data comprises attribute features of the multimedia account and relation features between the multimedia account and the multimedia account group; identifying abnormal multimedia accounts in the multimedia account group according to the account feature data of each multimedia account; generating a group feature of a multimedia account group according to the account feature data of the abnormal multimedia account; and determining whether the multimedia account group is abnormal or not according to the group characteristics of the multimedia account group. According to the embodiment of the invention, the group characteristics can focus on abnormal data in the multimedia account group and can reflect abnormal characteristics of the multimedia account group, so that the accuracy of identifying the abnormal multimedia account group is improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a method, device, computer-readable medium and electronic device for identifying an abnormal multimedia account group. Background Art

[0002] With the development of Internet technology, online social networking based on the Internet has become more and more popular in people's lives. Multimedia account groups on social platforms are a way for people to conduct online social networking. However, since the communication in multimedia account groups is not face-to-face communication, there are certain security risks in conducting social activities through multimedia account groups. For example, criminals may use multimedia account groups to carry out fraudulent activities. Therefore, accurately identifying such abnormal multimedia account groups is conducive to conducting safe online social networking.

[0003] At present, the multimedia account is usually identified based on the abnormal characteristics of the multimedia account group itself. For example, the probability of judging that a newly created multimedia account group is abnormal is usually higher than the probability of judging that a multimedia account group that has been created for a certain period of time is abnormal. However, the accuracy of this identification method is low and needs to be optimized. Summary of the invention

[0004] The purpose of the present application is to provide a method, device, computer-readable medium and electronic device for identifying abnormal multimedia account groups, so as to improve the accuracy of abnormal multimedia account group identification.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to one aspect of an embodiment of the present application, a method for identifying an abnormal multimedia account group is provided, comprising:

[0007] Acquiring account characteristic data of each multimedia account included in the multimedia account group, wherein the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group;

[0008] Identifying abnormal multimedia accounts in the multimedia account group according to the account characteristic data of each multimedia account;

[0009] generating a group feature of the multimedia account group according to the account feature data of the abnormal multimedia account;

[0010] Determine whether the multimedia account group is abnormal according to the group characteristics of the multimedia account group.

[0011] According to one aspect of an embodiment of the present application, a device for identifying an abnormal multimedia account group is provided, comprising:

[0012] A data acquisition module, used to acquire account characteristic data of each multimedia account included in the multimedia account group, wherein the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group;

[0013] An abnormal account identification module, used to identify abnormal multimedia accounts in the multimedia account group according to the account feature data of each multimedia account;

[0014] A group feature generation module, used to generate a group feature of the multimedia account group according to the account feature data of the abnormal multimedia account;

[0015] The abnormality judgment module is used to determine whether the multimedia account group has an abnormality according to the group characteristics of the multimedia account group.

[0016] In one embodiment of the present application, the group feature generation module includes:

[0017] A hash calculation unit, configured to perform a hash calculation based on the account feature data of the abnormal multimedia account to obtain a hash calculation result corresponding to the abnormal multimedia account;

[0018] The group feature generating unit is used to use the hash calculation result corresponding to the abnormal multimedia account as the group feature of the multimedia account group.

[0019] In one embodiment of the present application, the account feature data of the abnormal multimedia account includes multiple feature data; the hash calculation unit includes:

[0020] A hash calculation subunit, configured to perform hash calculation on each feature data according to the category of each feature data included in the account feature data of the abnormal multimedia account, to obtain a hash value corresponding to each feature data;

[0021] The result generating subunit is used to generate the hash calculation result corresponding to the abnormal multimedia account according to the hash value corresponding to each characteristic data.

[0022] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0023] For first characteristic data of time type, calculating a difference between the first characteristic data and the time characteristic of the multimedia account group;

[0024] The difference is bucketed, and a hash value corresponding to the first feature data is generated according to the bucketing result.

[0025] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0026] For the second characteristic data of the category type, the second characteristic data is encoded, and a hash value corresponding to the second characteristic data is generated according to the encoding result.

[0027] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0028] For the third characteristic data of the content type, information digest calculation is performed on the third characteristic data, and a hash value corresponding to the third characteristic data is generated according to the calculation result.

[0029] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0030] For fourth characteristic data of numerical type, encoding data of a specified length is generated according to the fourth characteristic data, and a hash value corresponding to the fourth characteristic data is generated according to the encoding data.

[0031] In one embodiment of the present application, the result generating subunit is specifically used for:

[0032] The hash values ​​corresponding to the various feature data are concatenated in a set order to generate a hash calculation result corresponding to the multimedia account.

[0033] In one embodiment of the present application, there are multiple abnormal multimedia accounts; and the group feature generation unit is specifically used to:

[0034] The hash calculation results corresponding to the multiple abnormal multimedia accounts are concatenated to generate a group feature of the multimedia account group.

[0035] In one embodiment of the present application, the abnormal account identification module is specifically used to:

[0036] Identifying, according to the account characteristic data of each multimedia account, a plurality of abnormal multimedia accounts in the multimedia account group and an abnormal type corresponding to each abnormal multimedia account;

[0037] The group feature generation module is specifically used for:

[0038] Extracting a plurality of abnormal multimedia accounts with different abnormal types from the plurality of abnormal multimedia accounts to generate an abnormal account group;

[0039] A plurality of group characteristics of the multimedia account group are generated according to the account characteristic data corresponding to the plurality of abnormal account groups.

[0040] In one embodiment of the present application, the abnormality judgment module is specifically used to:

[0041] When at least one group feature among the plurality of group features of the multimedia account group is the same as a pre-marked group feature, determining that the multimedia account group is abnormal;

[0042] When there is no group feature identical to the pre-marked group feature among the plurality of group features of the multimedia account group, it is determined that the multimedia account group is normal.

[0043] In one embodiment of the present application, the data acquisition module is specifically used to:

[0044] The account feature data of each multimedia account included in the multimedia account group is obtained from a graph database, wherein the graph database is a database constructed with multimedia accounts as account nodes, multimedia groups as group nodes, and relationships between multimedia accounts and multimedia account groups as edges.

[0045] In one embodiment of the present application, the abnormal account identification module is specifically used to:

[0046] The account feature data of each multimedia account group is input into the classification model to identify abnormal multimedia accounts in the multimedia account group according to the output data of the classification model.

[0047] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for identifying an abnormal multimedia account group in the above technical solution is implemented.

[0048] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor executes the executable instructions so that the electronic device executes a method for identifying abnormal multimedia account groups as in the above technical solution.

[0049] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for identifying abnormal multimedia account groups in the above technical solution.

[0050] In the technical solution provided in the embodiment of the present application, abnormal multimedia accounts are identified based on the account feature data of the multimedia accounts, and then the group features of the multimedia account group are generated based on the account feature data of the abnormal multimedia accounts. Finally, it is determined whether the multimedia account group has abnormalities based on the group features of the multimedia account group. Since the group features are generated based on the account feature data of the abnormal multimedia accounts, the group features avoid interference from normal multimedia accounts in the multimedia account group, and can better focus on the abnormal data in the multimedia account group, and can better reflect the abnormal characteristics of the multimedia account group, thereby improving the accuracy of identifying abnormal multimedia account groups.

[0051] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0054] Figure 2 The flowchart of a method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown.

[0055] Figure 3 The flowchart of a method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown.

[0056] Figure 4 The flowchart of a method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown.

[0057] Figure 5 The flowchart of a method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown.

[0058] Figure 6 The schematic diagram schematically shows a group feature provided by an embodiment of the present application.

[0059] Figure 7 The flowchart of a method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown.

[0060] Figure 8 The structural block diagram of the device for identifying abnormal multimedia account groups provided in an embodiment of the present application is schematically shown.

[0061] Fig. 9 The structure block diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0062] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0063] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0064] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0065] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0066] It is understandable that in the specific implementation of this application, when it comes to account data and other related data, when the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the account owner, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0067] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0068] like Figure 1As shown, the system architecture 100 may include a terminal device 110, a network 120 and a server 130. The terminal device 110 may include a smart phone, a tablet computer, a laptop computer, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, etc. The server 130 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The network 120 may be a communication medium of various connection types that can provide a communication link between the terminal device 110 and the server 130, for example, a wired communication link or a wireless communication link.

[0069] According to the implementation requirements, the system architecture in the embodiment of the present application can have any number of terminal devices, networks and servers. For example, the server 130 can be a server group composed of multiple server devices. In addition, the technical solution provided in the embodiment of the present application can be applied to the terminal device 110, can also be applied to the server 130, or can be implemented by the terminal device 110 and the server 130 together, and the present application does not make any special restrictions on this.

[0070] For example, user A uses terminal device A to create multimedia account A on the multimedia platform, user B uses terminal device B to create multimedia account B on the multimedia platform, user C uses terminal device C to create multimedia account C on the multimedia platform, and user D uses terminal device D to create multimedia account D on the multimedia platform. User A uses multimedia account A to create a multimedia account group, and adds multimedia account B, multimedia account C, and multimedia account D to the multimedia account group, so multimedia account A, multimedia account B, multimedia account C, and multimedia account D can communicate in the multimedia account group based on the network 120 and the server 130.

[0071] In one embodiment of the present application, the technical solution of the present application is implemented by the server 130. The server 130 obtains the account feature data of each multimedia account included in the multimedia account group, and the account feature data includes the attribute features of the multimedia account and the relationship features between the multimedia account and the multimedia account group. That is, the server 130 obtains the account feature data of multimedia account A, multimedia account B, multimedia account C and multimedia account D. Before obtaining the account feature data of each multimedia account, an account feature data acquisition request can be sent to each multimedia account. When the consent information of each multimedia account is received, the account feature data of each multimedia account can be obtained. Then, the server 130 identifies the abnormal multimedia account in the multimedia account group according to the account feature data of each multimedia account. For example, it identifies whether the multimedia account A is an abnormal multimedia account according to the account feature data of the multimedia account A, and identifies whether the multimedia account B is an abnormal multimedia account according to the account feature data of the multimedia account B. It is assumed that the abnormal multimedia accounts are identified as multimedia account C and multimedia account D. Next, the server 130 generates the group features of the multimedia account group according to the account feature data of the abnormal multimedia account. That is, the server 130 generates a group feature of the multimedia account group according to the account feature data of the multimedia account C and the multimedia account D. Finally, the server 130 determines whether there is an abnormality in the multimedia account group according to the group feature of the multimedia account group.

[0072] The following is a detailed description of the method for identifying abnormal multimedia account groups provided by the present application in conjunction with specific implementation methods.

[0073] Figure 2 The flowchart of the method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown. The method can be implemented by the device for identifying an abnormal multimedia account group provided by any embodiment of the present application, and the device can be configured in a terminal device or a server, for example Figure 1 The terminal device 110 or the server 130 shown in the figure, the specific implementation process of the method will be described below with the device as the execution subject. Figure 2 As shown, the method for identifying an abnormal multimedia account group provided in the embodiment of the present application includes steps 210 to 240, which are specifically as follows:

[0074] Step 210: Acquire account characteristic data of each multimedia account included in the multimedia account group, where the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group.

[0075] Specifically, a multimedia account group is a group constructed by multiple multimedia accounts. When creating a multimedia account group, the creator selects multiple multimedia accounts to be added to the multimedia account group. After the multimedia account group is created, the multimedia accounts in the multimedia account group can invite other multimedia accounts to join the multimedia account group. When detecting whether the multimedia account group is abnormal, the identification device of the abnormal multimedia account group first obtains the account feature data of each multimedia account included in the multimedia account group. The account feature data of the multimedia account includes the attribute features of the multimedia account and the relationship features between the multimedia account and the multimedia account group. The attribute features of the multimedia account refer to the features of the multimedia account itself, such as the registration time of the multimedia account, the registration area of ​​the multimedia account, whether the multimedia account has performed a certain behavior, etc. The relationship features between the multimedia account and the multimedia account group refer to the features that can reflect the certain correlation between the multimedia account and the multimedia account group, such as the time when the multimedia account joins the multimedia account group, the way in which the multimedia account joins the multimedia account group, whether the multimedia account has performed a certain operation in the multimedia account group, whether the multimedia account has an association with other multimedia accounts in the multimedia account group, etc.

[0076] Step 220: Identify abnormal multimedia accounts in the multimedia account group based on the account characteristic data of each multimedia account.

[0077] Specifically, the account characteristic data of a multimedia account reflects the characteristics of the multimedia account itself and the behavioral characteristics of the multimedia account in the multimedia account group. Therefore, based on the account characteristic data of the multimedia account, it is possible to analyze and identify whether the multimedia account is an abnormal multimedia account in the multimedia account group.

[0078] In one embodiment of the present application, abnormal multimedia accounts in a multimedia account group can be identified by a machine learning model. A machine learning model is pre-built, and the machine learning model is trained using account feature data of multimedia accounts that have been marked as normal or abnormal to obtain a trained machine learning model. When detecting whether a multimedia account group is abnormal, the account feature data of the multimedia account is input into the trained machine learning model, and the output data of the machine learning model indicates whether the multimedia account is an abnormal multimedia account.

[0079] Step 230: Generate group characteristics of the multimedia account group based on the account characteristic data of the abnormal multimedia account.

[0080] Specifically, when a multimedia account group has an abnormality, it is often because there are abnormal problems in the multimedia accounts within the group. Therefore, the abnormal multimedia accounts reflect the abnormality of the multimedia account group to a certain extent. Then, by generating the group features of the multimedia account group based on the account feature data of the abnormal multimedia accounts, the group features can be generated by focusing on the abnormal data within the multimedia account group, avoiding the interference of normal multimedia accounts within the group, and making the group features more able to reflect the abnormal characteristics of the multimedia account group, which is conducive to subsequent abnormality identification. Exemplarily, assuming that there are 10 multimedia accounts in the multimedia account group and 2 abnormal multimedia accounts, if the group features are generated based on the account feature data of all multimedia accounts in the multimedia account group, due to the large number of normal multimedia accounts, the account feature data of 8 normal multimedia accounts will dilute the account feature data of 2 abnormal multimedia accounts, so that the final group features may more reflect the normal multimedia accounts in the multimedia account group, but it is difficult to reflect whether there is an abnormality in the multimedia account group. The technical solution of this application focuses on abnormal multimedia accounts, and uses the account feature data of two abnormal multimedia accounts to generate group features, avoiding interference from normal multimedia accounts in the group, which is conducive to improving the accuracy of abnormal multimedia account identification.

[0081] In one embodiment of the present application, when generating the group feature of the multimedia account group, specified feature data can be extracted from the account feature data of the abnormal multimedia account as the group feature of the multimedia account group. For example, whether the abnormal multimedia account has performed a certain specified behavior can be used as the group feature of the multimedia account group. It is also possible to extract multiple feature data from the account feature data of the abnormal multimedia account and fuse them to generate the group feature of the multimedia account group.

[0082] In one embodiment of the present application, a machine learning model may be used to process the account feature data of abnormal multimedia accounts to generate group features of multimedia account groups. For example, a graph embedding model may be used to embed the account feature data of abnormal multimedia accounts. The embedding process is equivalent to a coding process, and the account feature data of abnormal multimedia accounts may be encoded into a vector, which may be used as the group feature of the multimedia account group.

[0083] In one embodiment of the present application, when there are multiple abnormal multimedia accounts, a group feature of the multimedia account group can be generated for the account feature data of each abnormal multimedia account, and then the group features corresponding to the multiple abnormal multimedia accounts are fused to generate the final group feature of the multimedia account group.

[0084] Step 240: Determine whether there is any abnormality in the multimedia account group according to the group characteristics of the multimedia account group.

[0085] Specifically, to determine whether a multimedia account group is normal based on the group feature, the group feature can be compared with the group feature of an abnormal multimedia account group (abnormal group feature for short). If the two are consistent, the multimedia account group can be considered abnormal; if the two are inconsistent, the multimedia account group is considered normal. To determine whether the group feature is consistent with the abnormal group feature, the similarity between the group feature and the abnormal group feature can be calculated. When the similarity between the two is greater than a threshold, the two are considered consistent; otherwise, the two are considered inconsistent.

[0086] In the technical solution provided in the embodiment of the present application, abnormal multimedia accounts are identified based on the account feature data of the multimedia accounts, and then the group features of the multimedia account group are generated based on the account feature data of the abnormal multimedia accounts. Finally, it is determined whether the multimedia account group has abnormalities based on the group features of the multimedia account group. Since the group features are generated based on the account feature data of the abnormal multimedia accounts, the group features avoid interference from normal multimedia accounts in the multimedia account group, and can better focus on the abnormal data in the multimedia account group, and can better reflect the abnormal characteristics of the multimedia account group, thereby improving the accuracy of identifying abnormal multimedia account groups.

[0087] Figure 3 The flowchart of the method for identifying abnormal multimedia account groups provided by one embodiment of the present application is schematically shown. This embodiment is a further refinement of the above embodiment. Figure 3 As shown, the method for identifying an abnormal multimedia account group provided in the embodiment of the present application includes steps 310 to 350, which are specifically as follows:

[0088] Step 310: Obtain account feature data of each multimedia account included in the multimedia account group from a graph database. The graph database is a database constructed with multimedia accounts as account nodes, multimedia groups as group nodes, and the relationship between multimedia accounts and multimedia account groups as edges; the account feature data includes attribute features of multimedia accounts and relationship features between multimedia accounts and multimedia account groups.

[0089] Specifically, the technical solution of the present application adopts a graph database to store account feature data. A graph database is a database based on a graph structure, which uses nodes, edges and attributes to represent and store data. In the present application, the nodes in the graph database include account nodes and group nodes. Account nodes represent multimedia accounts, and group nodes represent multimedia account groups. If a multimedia account is in a multimedia account group, an edge is constructed between the corresponding account node and the group node. If an edge is constructed between two nodes, the two nodes are said to be interconnected. Based on this, the account node in the graph database records the attribute characteristics of the multimedia account itself corresponding to the account node, for example, the creation time of the multimedia account. The group node in the graph database records the attribute characteristics of the multimedia account group itself corresponding to the group node, for example, the creation time of the multimedia account group. The edge in the graph database records the association relationship between the account node and the group node, that is, the relationship characteristics between the multimedia account and the multimedia account group, such as the time when the multimedia account joins the multimedia account group.

[0090] When obtaining account characteristic data, the identification device of the abnormal multimedia account group can find the corresponding group node in the graph database according to the identifier of the multimedia account group, and then take the multimedia account corresponding to the account node connected to the group node as the multimedia account in the multimedia account group, and then obtain the data recorded by each account node and the data recorded by each edge as the account characteristic data of each multimedia account.

[0091] Step 320: Identify abnormal multimedia accounts in the multimedia account group based on the account characteristic data of each multimedia account.

[0092] Step 320 is the same as step 220 in the aforementioned embodiment and will not be described again herein.

[0093] Step 330: Perform a hash calculation based on the account feature data of the abnormal multimedia account to obtain a hash calculation result corresponding to the abnormal multimedia account.

[0094] Specifically, this embodiment uses hash calculation to generate the group characteristics of the multimedia account group. The identification device of the abnormal multimedia account group first performs hash calculation on the account characteristic data of the abnormal multimedia account, and then generates the group characteristics of the multimedia account group based on the hash calculation results corresponding to the abnormal multimedia account.

[0095] In one embodiment of the present application, the account feature data includes multiple feature data. When performing hash calculation on the account feature data, the identification device of the abnormal multimedia account group first performs hash calculation on each feature data according to the category of each feature data included in the account feature data of the abnormal multimedia account, and obtains the hash value corresponding to each feature data. Then, the identification device of the abnormal multimedia account group generates the hash calculation result corresponding to the multimedia account according to the hash value corresponding to each feature data.

[0096] Specifically, the feature data included in the account feature data has certain category attributes, and different hash calculation methods are used based on feature data of different category attributes to obtain the hash value corresponding to the feature data. For example, when a feature data belongs to the attribute characteristics of the multimedia account itself, the first hash calculation method is used for calculation, so that the obtained hash value is the first specified length. When a feature data belongs to the relationship characteristics between the multimedia account and the multimedia account group, the second hash calculation method is used for calculation, so that the obtained hash value is the second specified length.

[0097] In one embodiment of the present application, the categories of feature data include four types: time type, category type, content type and value type. The feature data of the time type is recorded as the first feature data, and the first feature data represents a time data, such as the creation time of the multimedia account, the time when the multimedia account joins the multimedia account group, etc. The feature data of the category type is recorded as the second feature data, and the second feature data often represents feature data with multiple classification options. For example, the way a multimedia account joins a multimedia account group includes scanning a code to join the group, inviting to join the group, and face-to-face joining the group. If a feature data is scanning a code to join the group, then the feature data belongs to the second feature data of the category type. The feature data of the content type is recorded as the third feature data, and the third feature data refers to feature information with certain content meanings, usually text information, such as the signature information of a multimedia account. The feature data of the value type is recorded as the fourth feature data, and the fourth feature data refers to a numerical feature composed of pure numbers.

[0098] In one embodiment of the present application, when calculating the hash value of feature data, for the first feature data of the time type, the difference between the time feature of the first feature data and the multimedia account group is calculated; the difference is bucketed, and a hash value corresponding to the first feature data is generated based on the bucketing result. The time feature of the multimedia account group is generally the creation time of the multimedia account group. The difference between the first feature data and the time feature of the multimedia account group is calculated, that is, the difference between the first feature data and the creation time of the multimedia account group is calculated, and the difference can reflect the temporal correlation between the multimedia account and the multimedia account group. Bucketing can be regarded as a feature mapping method, which maps continuous features into discrete features and then converts them into hash values. Bucketing the difference is to discretize the continuous difference. The unit of bucketing can be set according to actual needs. For example, bucketing can be performed by hour or by day. Taking hourly bucketing as an example, assuming that the first feature data is the time when the multimedia account joins the multimedia account group, "2023-08-16, 10:00:00", it means that the multimedia account joins the multimedia account group at 10 o'clock on August 16, 2023. The creation time of the multimedia account group is "2023-08-16, 08:30:35". The difference between the first feature data and the creation time of the multimedia account group is 1 hour, 29 minutes and 25 seconds. When bucketing by hour, round down, the bucketing result of the difference is 1, that is, the hash value is 1, or it is set to 001. Assuming that the first feature data is "2023-08-16, 13:30:45", the difference is 5 hours, 0 minutes and 10 seconds, then the bucketing result of the difference is 5, that is, the hash value is 5, or it is set to 005.

[0099] In one embodiment of the present application, when calculating the hash value of the feature data, for the second feature data of the category type, the second feature data is encoded, and the hash value corresponding to the second feature data is generated according to the encoding result. Specifically, the second feature data can be encoded by an encoding method that converts discrete data into vector data, for example, a one-hot encoding method is used for encoding. Each classification option in the category type feature data corresponds to a code. When encoding the second feature data, the code of the classification option represented by the second feature data is set to a first value, and the code of other classification options is set to a second value, thereby generating the encoding result of the second feature data. Exemplarily, taking the way in which a multimedia account joins a multimedia account group as an example, the code of the classification option represented by the second feature data is set to 1, and the code of other classification options is set to 0. Assuming that the way in which a multimedia account joins a multimedia account group includes three types: scanning a code to join a group, inviting to join a group, and face-to-face joining a group, if a certain feature data is scanning a code to join a group, the corresponding encoding result is 100. If a certain feature data is invited to join a group, the corresponding encoding result is 010. If a certain characteristic data is face-to-face joining of a group, the corresponding coding result is 001.

[0100] In one embodiment of the present application, when calculating the hash value of the characteristic data, for the third characteristic data of the content type, the third characteristic data is subjected to information digest calculation, and a hash value corresponding to the third characteristic data is generated according to the calculation result. Calculating the information digest of the third characteristic data refers to calculating the third characteristic data using an information digest algorithm. For example, MD5 (Message Digest Algorithm 5, version 5 information digest algorithm) can be used to calculate the third characteristic data. After executing the MD5 algorithm, a data string of fixed length can be obtained, which can be used as the hash value corresponding to the third characteristic data.

[0101] In one embodiment of the present application, when calculating the hash value of the feature data, for the fourth feature data of the numerical type, the coded data of the specified length is generated according to the fourth feature data, and the hash value corresponding to the fourth feature data is generated according to the coded data. For the feature data of the numerical type, it is already a number, so there is no need to do too much conversion, and the fourth feature data can be directly used as the corresponding hash value. It should be noted that in order to avoid confusion caused by different data lengths, when encoding the fourth feature data of the numerical type, the encoded data must be of the specified length. If the length of the fourth feature data is less than the specified length, a predetermined value can be supplemented on the left side of the fourth feature data so that the encoded data reaches the specified length, for example, 0 is supplemented on the left side. If the length of the fourth feature data is greater than the specified length, the data of the specified length can be intercepted as the encoded data. Exemplarily, assuming that the specified length is 5 digits, if the fourth feature data is 123, the hash value 00123 corresponding to the fourth feature data is generated after 0 is supplemented on the left side of the fourth feature data. If the fourth feature data is 123456, 12345 is intercepted as the hash value corresponding to the fourth feature data.

[0102] In one embodiment of the present application, after performing hash calculation on each feature data in the account feature data of the abnormal multimedia account, the identification device of the abnormal multimedia account group can splice the hash values ​​corresponding to each feature data to generate a hash calculation result corresponding to the abnormal multimedia account. Specifically, the identification device of the abnormal multimedia account group can splice the hash values ​​of each feature data according to a set order, and the set order can be generated according to the category of the feature data. For example, the set order can be: feature data of time type, feature data of category type, feature data of content type and feature data of numerical type, then the splicing rule of the hash value is: the hash value of the first feature data, the hash value of the second feature data, the hash value of the third feature data and the hash value of the fourth feature data. Exemplarily, the hash value of the first feature data is 001, the hash value of the second feature data is 100, the hash value of the third feature data is 123456efg, and the hash value of the fourth feature data is 00123, then the hash calculation result corresponding to the abnormal multimedia account obtained by splicing is 001100123456efg00123.

[0103] In one embodiment of the present application, the lengths of hash values ​​corresponding to feature data belonging to the same category are equal, and the number and category of feature data contained in different abnormal multimedia accounts should be the same, so that when subsequently spliced, the hash calculation results of different multimedia accounts have the same length.

[0104] Step 340: Use the hash calculation result corresponding to the abnormal multimedia account as the group feature of the multimedia account group.

[0105] Specifically, the identification device of the abnormal multimedia account group can directly use the hash calculation result corresponding to the abnormal multimedia account as the group feature of the multimedia account group, and the group feature can also be recorded as a group hash identifier (hash ID). For example, if the hash calculation result corresponding to the abnormal multimedia account is 001100123456efg00123, then the group feature of the multimedia account group is 001100123456efg00123.

[0106] In one embodiment of the present application, when there are multiple abnormal multimedia accounts, a hash calculation result corresponding to an abnormal multimedia account can be extracted from the hash calculation results corresponding to the multiple abnormal multimedia accounts as the group feature of the multimedia account group, or the hash calculation results corresponding to the multiple abnormal multimedia accounts can be spliced ​​to form the group feature of the multimedia account group, or the hash calculation results corresponding to the multiple abnormal multimedia accounts can all be used as the group feature of the multimedia account group. In this case, the multimedia account group has multiple group features.

[0107] Step 350: Determine whether there is any abnormality in the multimedia account group according to the group characteristics of the multimedia account group.

[0108] Specifically, to determine whether a multimedia account group is abnormal based on the group characteristics, the group characteristics of the multimedia account group may be compared with the group characteristics of a multimedia account group known to be abnormal in advance (recorded as abnormal group characteristics). In some cases, there may be multiple multimedia account groups known to be abnormal in advance, that is, there are multiple abnormal group characteristics. When making the comparison, if the group characteristics of the multimedia account group are consistent with any abnormal group characteristics, then the multimedia account group is considered to be abnormal; if the group characteristics of the multimedia account group are inconsistent with any abnormal group characteristics, then the multimedia account group is considered to be normal.

[0109] The technical solution of this application uses the hash calculation results corresponding to abnormal multimedia accounts as the group features of multimedia account groups, and when performing hash calculations on the account feature data of abnormal multimedia accounts, different hash calculation methods are used based on different categories of feature data in the account feature data, so that the group features can reflect the categories of feature data, thereby enhancing the interpretability of group features, and further enhancing the interpretability of abnormal multimedia account group identification. At the same time, it is also convenient to add or delete the categories of feature data, so that the group features have high optimizability or scalability.

[0110] Figure 4 The flowchart of the method for identifying abnormal multimedia account groups provided by one embodiment of the present application is schematically shown. This embodiment is a further optimization of the above embodiment. Figure 4As shown, the method for identifying an abnormal multimedia account group provided in the embodiment of the present application includes steps 410 to 460, which are specifically as follows:

[0111] Step 410: Acquire account characteristic data of each multimedia account included in the multimedia account group, where the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group.

[0112] For step 410, reference may be made to the relevant descriptions of step 210 or step 310 in the aforementioned embodiment, which will not be repeated here.

[0113] Step 420: Identify multiple abnormal multimedia accounts in the multimedia account group and the abnormal type corresponding to each abnormal multimedia account according to the account characteristic data of each multimedia account.

[0114] Specifically, when identifying an abnormal multimedia account, the abnormal type of the abnormal multimedia account can be simultaneously identified. The abnormal type of the abnormal multimedia account reflects the role type represented by the abnormal multimedia account in the abnormal multimedia account group, for example, group creator, manager, first-level organizer, second-level organizer, etc.

[0115] In one embodiment of the present application, the device for identifying abnormal multimedia account groups may input the account feature data of each multimedia account group into a classification model to identify abnormal multimedia accounts in the multimedia account group and the abnormal types corresponding to the abnormal multimedia accounts according to the output data of the classification model. The classification model may be trained in advance using training data, and the account feature data of the multimedia accounts included in the training data should have a mark of whether it is an abnormal multimedia account, and a mark of the corresponding abnormal type. The classification model may be any model that can realize the classification function, for example, the classification model may be an XGBoost model.

[0116] Step 430: extract multiple abnormal multimedia accounts with different abnormal types from the multiple abnormal multimedia accounts to generate an abnormal account group.

[0117] Specifically, among the identified abnormal multimedia accounts, each abnormal type may correspond to multiple abnormal multimedia accounts. When generating an abnormal account group, the abnormal multimedia account group identification device extracts multiple abnormal multimedia accounts with different abnormal types to form an abnormal account group, which can avoid repeated use of account feature data of the same abnormal multimedia account in subsequent calculation of group features, thereby improving the accuracy of group feature calculation.

[0118] In one embodiment of the present application, the identification device of the abnormal multimedia account group can extract an abnormal multimedia account from each abnormal type of abnormal multimedia account and add it to the abnormal account group. In this way, multiple abnormal account groups can be generated, and the abnormal account group includes multiple abnormal multimedia accounts with different abnormal types. There should be no identical abnormal multimedia accounts between the abnormal account groups, that is, an abnormal multimedia account can only be added to one abnormal account group. And the number of accounts included in each abnormal account group is the same, so that the group features generated based on different abnormal account groups can have the same length.

[0119] In one embodiment of the present application, the number of abnormal multimedia accounts corresponding to each abnormal type may not be exactly the same. Therefore, when generating an abnormal account group, there may be one or more abnormal types that have no corresponding abnormal multimedia account. At this time, the specified multimedia account can be added to the abnormal account group as an abnormal multimedia account, or the abnormal multimedia account corresponding to the abnormal type in the abnormal account group can be assigned a null value.

[0120] Step 440: Generate multiple group features of the multimedia account group based on the account feature data corresponding to the multiple abnormal account groups.

[0121] Specifically, for an abnormal account group, the account feature data of each abnormal multimedia account in the abnormal account group is hashed to obtain the hash calculation results corresponding to each abnormal multimedia account, and then the hash calculation results corresponding to each abnormal multimedia account are spliced ​​into the group features of the multimedia account group. In this way, an abnormal account group corresponds to a group feature of a multimedia account group, and multiple abnormal account groups can obtain multiple group features of a multimedia account group. Among them, the process of performing hash calculation on the account feature data of the abnormal multimedia account to obtain the hash calculation result can refer to the relevant description of step 330 in the aforementioned embodiment, which will not be repeated here.

[0122] In one embodiment of the present application, when splicing the hash calculation results corresponding to each abnormal multimedia account, the identification device of the abnormal multimedia account group can determine the splicing order of the corresponding hash calculation results based on the abnormal type of each abnormal multimedia account. Exemplarily, assuming that the abnormal types include managers, first-level organizers, and second-level organizers, and splicing in this order, the group characteristics of the multimedia account group should include the hash calculation results of the manager account, the hash calculation results of the first-level organizer, and the hash calculation results of the second-level organizer in sequence.

[0123] In one embodiment of the present application, when there is a designated multimedia account as an abnormal multimedia account in the abnormal account group, or there is a null value, when performing a hash calculation, the hash calculation result corresponding to the designated multimedia account or the null value can be set to a designated value, for example, to 0.

[0124] In one embodiment of the present application, when the number of abnormal account groups is large, the abnormal account groups can be filtered according to the number of abnormal multimedia accounts contained in the abnormal account groups to avoid generating too many group features. Specifically, the abnormal account groups whose number of abnormal multimedia accounts is less than (or less than or equal to) the threshold value can be filtered out, and the abnormal account groups whose number of abnormal multimedia accounts is greater than (or greater than or equal to) the threshold value are retained, and group features are subsequently generated based on the retained abnormal account groups. When the number of abnormal multimedia accounts in the abnormal account group is less than the threshold value, it indicates that most of the abnormal types do not have corresponding abnormal accounts, that is, the abnormal account group includes fewer abnormal types, then the group features generated at this time are not representative enough for the group abnormality, so they can be filtered out in advance to reduce the amount of calculation.

[0125] Step 450: When at least one of the plurality of group characteristics of the multimedia account group is the same as a pre-marked group characteristic, it is determined that the multimedia account group is abnormal.

[0126] Step 460: When there is no group feature identical to the pre-marked group feature among the multiple group features of the multimedia account group, it is determined that the multimedia account group is normal.

[0127] Specifically, after obtaining multiple group features of a multimedia account group, the multiple group features are compared with pre-marked group features. The pre-marked group features refer to group features of a multimedia account group that has been judged to be abnormal, that is, the abnormal group features mentioned above. There may be multiple pre-marked group features. When there is at least one group feature that is the same as the pre-marked group feature, that is, there is a group feature that is the same as one of the abnormal group features, the identification device of the abnormal multimedia account group can determine that the multimedia account group is abnormal. When there is no group feature that is the same as the pre-marked group feature, that is, any group feature is different from any pre-marked group feature, the identification device of the abnormal multimedia account group can determine that the multimedia account group is normal.

[0128] The technical solution of the present application generates an abnormal account group by extracting abnormal multimedia accounts of different abnormal types, and then generates multiple group features of the multimedia account group based on the multiple abnormal account groups. Finally, the multiple group features are used to determine whether the multimedia account group is abnormal, thereby further improving the accuracy of the multimedia account group judgment.

[0129] Figure 5The flowchart of the method for identifying an abnormal multimedia account group provided by an embodiment of the present application is schematically shown. In this embodiment, the multimedia account is referred to as an account, and the multimedia account group is referred to as a group. Figure 5 As shown, the method comprises the following steps:

[0130] Step 510: Build an account-group graph database.

[0131] Specifically, each account and group is stored in the graph database in advance, where the account and group are nodes in the graph. If the account is in the group, an edge is constructed between the account node and the group node. The account node also stores the characteristic information of each account (such as the account registration time, etc.), the edge records the association information between the account and the group (such as the time of joining the group, etc.), and the group node stores the characteristic information of the group (such as the time of creating the group, etc.). Through the graph database, the account list in the group, account information, account and group association information, group information and other data can be queried in real time.

[0132] Step 520: Build a role model.

[0133] Specifically, "role" refers to the role played by an account in a group. For example, the role of the account that creates a group is the group creator, the role of the account responsible for inviting other accounts to join the group is the inviter, and the role of the account responsible for issuing virtual resources in the group is the virtual resource issuer, etc. When an account is an abnormal account, the role corresponding to the abnormal account is the abnormal type corresponding to the abnormal account. In this embodiment, the role refers to the abnormal type. For a normal account, no specific role is set for it, that is, the role of all normal accounts can be empty, or a general role can be set to represent a normal account.

[0134] The role model is a classification model that distinguishes the roles to which an account belongs, also known as a role classification model. Classification algorithms such as XGBoost can be used to build a classification model. The classification model can be trained based on historical data. Specifically, from historical abnormal groups, the roles in the group are marked to accumulate training samples, and the classification model is built and trained based on the account's own characteristics and the account's behavior in the group. The account's own characteristics and the account's behavior in the group are obtained through the graph database.

[0135] Step 530: Identify roles within the group.

[0136] Specifically, the account feature data obtained from the graph database is input into the classification model to identify abnormal accounts and roles of abnormal accounts based on the output results of the classification model.

[0137] Step 540: Generate group hash ID.

[0138] Specifically, the account feature data of abnormal accounts can be obtained through the graph database. The account feature data includes multiple feature data, such as the time of joining the group, the method of joining the group, which account is used to join the group, the abnormal characteristics of the role itself, etc., and then the account feature data is encoded into a digital string. Different encoding methods (i.e. hash calculations) are used for different features. For time-based features (such as the time of joining the group), the difference between it and the time of group creation is calculated, and then the difference is bucketed, such as bucketing by hours or bucketing by days. For category-type features (such as the method of joining the group), we one-hot encode the features. For content-based features (such as account description information), we directly calculate the content md5. For other numerical features, we store them in a fixed length (fill with 0 on the left if the length is insufficient).

[0139] Finally, these coding strings are concatenated to get a complete group hash ID (i.e., group features). Since each group may have multiple roles, and each role may have multiple accounts, in this way, we can calculate multiple group hash IDs for each group. Each group hash ID includes a coding string generated based on the abnormal accounts of each role (i.e., the hash calculation result). The coding string corresponding to each role is generated based on the account feature data of one of the abnormal accounts belonging to the role. In some cases, group hash IDs with fewer roles can be filtered out. For example, Figure 6 The following schematically shows a schematic diagram of a group feature provided by an embodiment of the present application. Figure 6 As shown, the group hash ID represents the group feature, and the role 1 feature represents the hash calculation result obtained based on the abnormal account of role 1. A group hash ID is composed of multiple role features.

[0140] Step 550: Identify the malicious group hash ID.

[0141] When a group is identified as an abnormal group (i.e., a malicious group), the group hash ID of the group is marked as malicious. This step is to obtain the "pre-marked group features" in the aforementioned embodiment. At this time, the risk control system of the multimedia platform can be used to identify whether a group is a malicious group, and the group hash ID of the malicious group is marked as malicious, thereby obtaining the pre-marked group features, so as to facilitate the subsequent identification of malicious groups based on the pre-marked group features.

[0142] Step 560: Malicious group processing.

[0143] After marking the malicious group hash ID, when subsequently detecting whether a group is a malicious group, the group hash ID can be calculated through the above steps, and the group hash ID can be compared with the group hash ID previously marked as malicious, which is equivalent to detecting whether the group hash ID is marked as malicious. If the group hash ID belongs to the malicious group hash ID, then the group is a malicious group and can be processed, such as banning, restricting speech, issuing prompt information, etc.

[0144] The technical solution of the present application can be applied in the anti-fraud business of fake orders. The fake order fraud group is the main scenario of fake order fraud in multimedia platforms. This scenario is highly confrontational, the pattern changes quickly, and the fraud cycle is short, which brings great challenges to the processing. Based on the original risk control system of the multimedia platform, the technical solution of the present application proposes a marking method for the fake order fraud group, which converts the fake order fraud group into a group hash ID. The group hash ID can be easily integrated with the existing risk control system. When a new group is discovered, it can be quickly marked and subsequently processed in real time, which has a significant effect on reducing the pressure on the fraud group. At the same time, the group hash ID has very good interpretability and optimizability, and is very suitable for anti-fraud scenarios.

[0145] For example, Figure 7 The flowchart of the method for identifying abnormal multimedia account groups provided by one embodiment of the present application is schematically shown. This embodiment is applied to the identification scenario of fraudulent order-brushing groups. Figure 7 As shown, the method comprises the following steps:

[0146] S701, graph construction: A graph database is constructed according to group behavior, where the group behavior includes a list of accounts in the group, account information, association information between the account and the group, group information, and other data.

[0147] S702. The group role model obtains features from the graph database, that is, obtains account feature data from the graph database.

[0148] S703: Generate a role model, that is, use the account feature data to build a role classification model.

[0149] S704, obtaining roles and role types, that is, identifying the roles to which the accounts in the group belong through the role classification model.

[0150] S705: Generate a group hash ID. That is, the group hash service generates a group hash ID according to the account feature data of each role.

[0151] S706: Processing the order-brushing fraud group and marking the group hash ID as malicious. The order-brushing fraud risk control system identifies the order-brushing fraud group, marks the corresponding group hash ID as malicious, and processes the order-brushing fraud group.

[0152] S707, query whether the group hash ID is a fraudulent order. That is, determine whether the group hash ID of the current group is a group hash ID marked as malicious. If yes, the current group is a fraudulent order group; if no, the current group is not a fraudulent order group.

[0153] S708: Group ban: If the group hash ID is a fraudulent order, the group is processed, that is, the group is banned.

[0154] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0155] The following introduces an apparatus embodiment of the present application, which can be used to execute the method for identifying an abnormal multimedia account group in the above-mentioned embodiment of the present application. Figure 8 The structure block diagram of the device for identifying abnormal multimedia account groups provided by the embodiment of the present application is schematically shown. Figure 8 As shown, the apparatus for identifying abnormal multimedia account groups provided in the embodiment of the present application includes:

[0156] A data acquisition module 810 is used to acquire account characteristic data of each multimedia account included in the multimedia account group, wherein the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group;

[0157] An abnormal account identification module 820, for identifying abnormal multimedia accounts in the multimedia account group according to account characteristic data of each multimedia account;

[0158] A group feature generation module 830, configured to generate a group feature of the multimedia account group according to the account feature data of the abnormal multimedia account;

[0159] The abnormality determination module 840 is used to determine whether the multimedia account group has an abnormality according to the group characteristics of the multimedia account group.

[0160] In one embodiment of the present application, the group feature generation module 830 includes:

[0161] A hash calculation unit, configured to perform a hash calculation based on the account feature data of the abnormal multimedia account to obtain a hash calculation result corresponding to the abnormal multimedia account;

[0162] The group feature generating unit is used to use the hash calculation result corresponding to the abnormal multimedia account as the group feature of the multimedia account group.

[0163] In one embodiment of the present application, the account feature data of the abnormal multimedia account includes multiple feature data; the hash calculation unit includes:

[0164] A hash calculation subunit, configured to perform hash calculation on each feature data according to the category of each feature data included in the account feature data of the abnormal multimedia account, to obtain a hash value corresponding to each feature data;

[0165] The result generating subunit is used to generate the hash calculation result corresponding to the abnormal multimedia account according to the hash value corresponding to each characteristic data.

[0166] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0167] For first characteristic data of time type, calculating a difference between the first characteristic data and the time characteristic of the multimedia account group;

[0168] The difference is bucketed, and a hash value corresponding to the first feature data is generated according to the bucketing result.

[0169] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0170] For the second characteristic data of the category type, the second characteristic data is encoded, and a hash value corresponding to the second characteristic data is generated according to the encoding result.

[0171] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0172] For the third characteristic data of the content type, information digest calculation is performed on the third characteristic data, and a hash value corresponding to the third characteristic data is generated according to the calculation result.

[0173] In one embodiment of the present application, the hash calculation subunit is specifically used for:

[0174] For fourth characteristic data of numerical type, encoding data of a specified length is generated according to the fourth characteristic data, and a hash value corresponding to the fourth characteristic data is generated according to the encoding data.

[0175] In one embodiment of the present application, the result generating subunit is specifically used for:

[0176] The hash values ​​corresponding to the various feature data are concatenated in a set order to generate a hash calculation result corresponding to the multimedia account.

[0177] In one embodiment of the present application, there are multiple abnormal multimedia accounts; and the group feature generation unit is specifically used to:

[0178] The hash calculation results corresponding to the multiple abnormal multimedia accounts are concatenated to generate a group feature of the multimedia account group.

[0179] In one embodiment of the present application, the abnormal account identification module 820 is specifically used to:

[0180] Identifying, according to the account characteristic data of each multimedia account, a plurality of abnormal multimedia accounts in the multimedia account group and an abnormal type corresponding to each abnormal multimedia account;

[0181] The group feature generation module 830 is specifically used for:

[0182] Extracting a plurality of abnormal multimedia accounts with different abnormal types from the plurality of abnormal multimedia accounts to generate an abnormal account group;

[0183] A plurality of group characteristics of the multimedia account group are generated according to the account characteristic data corresponding to the plurality of abnormal account groups.

[0184] In one embodiment of the present application, the abnormality determination module 840 is specifically used to:

[0185] When at least one group feature among the plurality of group features of the multimedia account group is the same as a pre-marked group feature, determining that the multimedia account group is abnormal;

[0186] When there is no group feature identical to the pre-marked group feature among the plurality of group features of the multimedia account group, it is determined that the multimedia account group is normal.

[0187] In one embodiment of the present application, the data acquisition module 810 is specifically used for:

[0188] The account feature data of each multimedia account included in the multimedia account group is obtained from a graph database, wherein the graph database is a database constructed with multimedia accounts as account nodes, multimedia groups as group nodes, and relationships between multimedia accounts and multimedia account groups as edges.

[0189] In one embodiment of the present application, the abnormal account identification module 820 is specifically used to:

[0190] The account feature data of each multimedia account group is input into the classification model to identify abnormal multimedia accounts in the multimedia account group according to the output data of the classification model.

[0191] The specific details of the device for identifying abnormal multimedia account groups provided in each embodiment of the present application have been described in detail in the corresponding method embodiments and will not be repeated here.

[0192] Fig. 9 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0193] It should be noted that Fig. 9 The computer system 900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0194] like Fig. 9 As shown, the computer system 900 includes a central processing unit 901 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 902 (ROM) or the program loaded from the storage part 908 to the random access memory 903 (RAM). Various programs and data required for system operation are also stored in the random access memory 903. The central processing unit 901, the read-only memory 902 and the random access memory 903 are connected to each other through a bus 904. An input / output interface 905 (Input / Output interface, i.e., I / O interface) is also connected to the bus 904.

[0195] The following components are connected to the input / output interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

[0196] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the central processor 901, various functions defined in the system of the present application are executed.

[0197] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0198] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0199] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0200] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0201] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0202] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for identifying abnormal multimedia account groups, characterized in that: include: Acquiring account characteristic data of each multimedia account included in the multimedia account group, wherein the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group; Identifying abnormal multimedia accounts in the multimedia account group according to the account characteristic data of each multimedia account; generating a group feature of the multimedia account group according to the account feature data of the abnormal multimedia account; Determine whether the multimedia account group is abnormal according to the group characteristics of the multimedia account group.

2. The method for identifying abnormal multimedia account groups according to claim 1, characterized in that: Generating the group characteristics of the multimedia account group according to the account characteristic data of the abnormal multimedia account includes: Performing a hash calculation based on the account feature data of the abnormal multimedia account to obtain a hash calculation result corresponding to the abnormal multimedia account; The hash calculation result corresponding to the abnormal multimedia account is used as the group feature of the multimedia account group.

3. The method for identifying abnormal multimedia account groups according to claim 2, characterized in that: The account characteristic data of the abnormal multimedia account includes a plurality of characteristic data; Performing a hash calculation according to the account feature data of the abnormal multimedia account to obtain a hash calculation result corresponding to the abnormal multimedia account includes: According to the category of each feature data included in the account feature data of the abnormal multimedia account, performing hash calculation on each feature data to obtain a hash value corresponding to each feature data; A hash calculation result corresponding to the abnormal multimedia account is generated according to the hash value corresponding to each feature data.

4. The method for identifying abnormal multimedia account groups according to claim 3, characterized in that: According to the category of each feature data included in the account feature data of the abnormal multimedia account, a hash calculation is performed on each feature data to obtain a hash value corresponding to each feature data, including: For first characteristic data of time type, calculating a difference between the first characteristic data and the time characteristic of the multimedia account group; The difference is bucketed, and a hash value corresponding to the first feature data is generated according to the bucketing result.

5. The method for identifying abnormal multimedia account groups according to claim 3, characterized in that: According to the category of each feature data included in the account feature data of the abnormal multimedia account, a hash calculation is performed on each feature data to obtain a hash value corresponding to each feature data, including: For the second characteristic data of the category type, the second characteristic data is encoded, and a hash value corresponding to the second characteristic data is generated according to the encoding result.

6. The method for identifying abnormal multimedia account groups according to claim 3, characterized in that: According to the category of each feature data included in the account feature data of the abnormal multimedia account, a hash calculation is performed on each feature data to obtain a hash value corresponding to each feature data, including: For the third characteristic data of the content type, information digest calculation is performed on the third characteristic data, and a hash value corresponding to the third characteristic data is generated according to the calculation result.

7. The method for identifying abnormal multimedia account groups according to claim 3, characterized in that: According to the category of each feature data included in the account feature data of the abnormal multimedia account, a hash calculation is performed on each feature data to obtain a hash value corresponding to each feature data, including: For fourth characteristic data of numerical type, encoding data of a specified length is generated according to the fourth characteristic data, and a hash value corresponding to the fourth characteristic data is generated according to the encoding data.

8. The method for identifying abnormal multimedia account groups according to claim 3, characterized in that: Generate a hash calculation result corresponding to the abnormal multimedia account according to the hash value corresponding to each feature data, including: The hash values ​​corresponding to the various feature data are concatenated in a set order to generate a hash calculation result corresponding to the multimedia account.

9. The method for identifying abnormal multimedia account groups according to claim 2, characterized in that: There are multiple abnormal multimedia accounts; The hash calculation result corresponding to the abnormal multimedia account is used as the group feature of the multimedia account group, including: The hash calculation results corresponding to the multiple abnormal multimedia accounts are concatenated to generate a group feature of the multimedia account group.

10. The method for identifying abnormal multimedia account groups according to claim 1, characterized in that: Identifying abnormal multimedia accounts in the multimedia account group according to the account feature data of each multimedia account includes: Identifying, according to the account characteristic data of each multimedia account, a plurality of abnormal multimedia accounts in the multimedia account group and an abnormal type corresponding to each abnormal multimedia account; Generating the group characteristics of the multimedia account group according to the account characteristic data of the abnormal multimedia account includes: Extracting a plurality of abnormal multimedia accounts with different abnormal types from the plurality of abnormal multimedia accounts to generate an abnormal account group; A plurality of group characteristics of the multimedia account group are generated according to the account characteristic data corresponding to the plurality of abnormal account groups.

11. The method for identifying abnormal multimedia account groups according to claim 10, characterized in that: Determining whether the multimedia account group is abnormal according to the group characteristics of the multimedia account group includes: When at least one group feature among the plurality of group features of the multimedia account group is the same as a pre-marked group feature, determining that the multimedia account group is abnormal; When there is no group feature identical to the pre-marked group feature among the plurality of group features of the multimedia account group, it is determined that the multimedia account group is normal.

12. The method for identifying an abnormal multimedia account group according to any one of claims 1 to 11, characterized in that: Obtaining account characteristic data of each multimedia account included in the multimedia account group, including: The account feature data of each multimedia account included in the multimedia account group is obtained from a graph database, wherein the graph database is a database constructed with multimedia accounts as account nodes, multimedia groups as group nodes, and relationships between multimedia accounts and multimedia account groups as edges.

13. The method for identifying an abnormal multimedia account group according to any one of claims 1 to 11, characterized in that: Identifying abnormal multimedia accounts in the multimedia account group according to the account feature data of each multimedia account includes: The account feature data of each multimedia account is input into the classification model to identify abnormal multimedia accounts in the multimedia account group according to the output data of the classification model.

14. A device for identifying abnormal multimedia account groups, characterized in that: include: A data acquisition module, used to acquire account characteristic data of each multimedia account included in the multimedia account group, wherein the account characteristic data includes attribute characteristics of the multimedia account and relationship characteristics between the multimedia account and the multimedia account group; An abnormal account identification module, used to identify abnormal multimedia accounts in the multimedia account group according to the account feature data of each multimedia account; A group feature generation module, used to generate a group feature of the multimedia account group according to the account feature data of the abnormal multimedia account; The abnormality judgment module is used to determine whether the multimedia account group has an abnormality according to the group characteristics of the multimedia account group.

15. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying an abnormal multimedia account group described in any one of claims 1 to 13 is implemented.

16. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor executes the executable instructions so that the electronic device executes the method for identifying an abnormal multimedia account group as described in any one of claims 1 to 13.

17. A computer program product, characterized in that The computer program product includes computer instructions stored in a computer-readable storage medium; The processor of the computer device reads and executes the computer instructions from the computer-readable storage medium, so that the computer device executes the method for identifying abnormal multimedia account groups as described in any one of claims 1 to 13.

Images