Abnormal account recognition model construction method and device, abnormal account recognition method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computer and network data analysis, and provides a construction method and device of an abnormal account recognition model, an abnormal account recognition method and device, equipment and a storage medium. According to the construction method of the abnormal account recognition model, feature data contained in basic information data are analyzed, recognition features influencing abnormal account behaviors and normal behaviors are found out, a reasonable target proportion is determined for the recognition features, and finally the abnormal account recognition model is constructed by applying the target proportion through a random forest model. And the trained abnormal account identification model is obtained, so that the abnormal account identification model can efficiently distinguish the abnormal account and the non-abnormal account.

Description

Technical Field

[0001] The present application relates to the technical field of computer and network data analysis, and specifically to a method and device for constructing an abnormal account identification model, an abnormal account identification method and device, equipment and storage medium. Background Art

[0002] Currently, the main abnormal account identification models on the market are mainly targeted at a single platform and have a narrow application scenario. Therefore, there is a lack of an abnormal account identification mechanism that can be applied to various platforms. Summary of the invention

[0003] To solve the above problems, the present application provides a method and device for constructing an abnormal account identification model, an abnormal account identification method and device, a device and a storage medium to overcome or partially overcome the deficiencies in the prior art.

[0004] This application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a method for constructing an abnormal account identification model, the method comprising:

[0006] Obtain basic information data of multiple user accounts, manually determine whether the user account is an abnormal account, and output the determination result of whether the user account is an abnormal account as the target;

[0007] Extract account features and work features based on basic information data of multiple user accounts, conduct joint analysis on the account features and work features to determine derived features, and screen the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts;

[0008] The random forest model is trained using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained.

[0009] In a second aspect, the present application provides a method for identifying abnormal accounts, the method comprising:

[0010] Obtain the article data to be identified, and determine the user account based on the article data to be identified;

[0011] Obtain basic information data corresponding to the user account within the retrospective period, and extract features from the basic information data to obtain identification features;

[0012] The identification features are sent to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the above-mentioned abnormal account identification model construction method.

[0013] In a third aspect, the present application provides a device for constructing an abnormal account identification model, the device comprising:

[0014] A target output determination unit, used to obtain basic information data of multiple user accounts, manually determine whether the user account is an abnormal account, and output the determination result of whether the user account is an abnormal account as a target;

[0015] An identification feature screening unit, for extracting account features and work features based on basic information data of multiple user accounts, jointly analyzing the account features and work features to determine derived features, and screening the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts;

[0016] The model training unit is used to train the random forest model using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained.

[0017] In a fourth aspect, the present application provides an abnormal account identification device, the device comprising:

[0018] A user account determination unit, used to obtain the article data to be identified and determine the user account according to the article data to be identified;

[0019] An identification feature determination unit is used to obtain basic information data corresponding to the user account within the retrospective period, and extract features from the basic information data to obtain identification features;

[0020] The abnormal account identification unit is used to send the identification features to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the above-mentioned abnormal account identification model construction method.

[0021] In a fifth aspect, the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for constructing an abnormal account identification model or the steps of the abnormal account identification method described above are implemented.

[0022] In a sixth aspect, the present application provides a computer-readable storage medium storing a computer program, which, when instructed by a processor, implements the above-mentioned method for constructing an abnormal account identification model or the steps of the abnormal account identification method.

[0023] At least one of the above technical solutions adopted in this application can achieve the following beneficial effects:

[0024] The method for constructing an abnormal account identification model provided in the present application first obtains basic information data of multiple user accounts, manually determines whether the user account is an abnormal account, and uses the determination result of whether the user account is an abnormal account as the target output, thereby determining the baseline result of the random forest model; secondly, extracts account features and work features based on the basic information data of multiple user accounts, jointly analyzes the account features and work features to determine derived features, and screens the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user account, thereby determining the input features of sample data for training the random forest model; finally, the random forest model is trained using the identification features corresponding to the user account and the target output, and when the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained, thereby applying the abnormal account identification model to abnormal account identification. The abnormal account identification model constructed based on the construction method of the abnormal account identification model provided in this application is compatible with multiple different platform usage scenarios, is not limited to specific social media or network platforms, and has wide applicability and flexibility; it can quickly identify abnormal accounts, provide users with immediate feedback, and effectively respond to rapid changes in the network environment; because the model focuses on the common identification features of abnormal accounts, accurate identification is achieved through data modeling, thereby effectively reducing misjudgments and missed judgments, and ensuring the accuracy and reliability of abnormal account identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 A schematic diagram showing a flow chart of a method for constructing an abnormal account identification model according to an embodiment of the present application;

[0027] Figure 2 A schematic diagram showing a flow chart of an abnormal account identification method according to an embodiment of the present application;

[0028] Figure 3 A schematic diagram showing the structure of a device for constructing an abnormal account identification model according to an embodiment of the present application;

[0029] Figure 4 A schematic diagram showing the structure of an abnormal account identification device according to an embodiment of the present application is shown;

[0030] Figure 5 A schematic structural diagram of a computer device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0032] The idea of ​​this application is to extract valuable identification features for identifying whether a user account is an abnormal account by analyzing the basic information data of the user account on different platforms, and use the identification features to train the random forest model to obtain an abnormal account identification model with high identification accuracy. The abnormal account identification model is used to identify whether the posting account is an abnormal account, which can provide clues to abnormal accounts suspected of manipulating and misleading public opinion, hyping topics, etc., and help purify the network ecological space.

[0033] The present application is described in detail below through specific embodiments.

[0034] On the one hand, the present application provides a method for constructing an abnormal account identification model.

[0035] Figure 1 A flow chart of a method for constructing an abnormal account identification model proposed in one embodiment of the present application is shown. Figure 1 As shown, the method of this embodiment includes steps S110 to S130:

[0036] Step S110, obtaining basic information data of multiple user accounts, manually determining whether the user account is an abnormal account, and outputting the determination result of whether the user account is an abnormal account as a target.

[0037] Construct a target output for evaluating the training random forest model. The target output is the benchmark result of the random forest model. The sample data can come from multiple user accounts. The multiple user accounts can include different user accounts on multiple platforms (including but not limited to Weibo, Xiaohongshu, Kuaishou, Douyin, Yiche, etc.).

[0038] When obtaining multiple user accounts, you can use random sampling to extract different user accounts from multiple platforms. In order to restore the real user ratio as much as possible and to ensure that the ratio of a small number of abnormal users to the majority of normal users can be reasonably reflected, the user accounts obtained can be as many as possible within the data volume allowed. In some cases, you may have the same user account on different platforms. For example, if you obtain the user account "I am an account" on the Weibo platform and the user account "I am an account" on the Douyin platform, you can merge the same user accounts on different platforms into the same user account. For the merged user account, its basic information data on different platforms can be aggregated.

[0039] For the acquired user accounts, manual judgment is used to determine whether the user accounts are abnormal accounts. That is, manual judgment is used to determine whether the user accounts are abnormal accounts one by one, and the results of manual judgment are used as the target output for evaluating the training random forest model.

[0040] During the manual identification process, user accounts that are obviously normal, such as official accounts and teacher accounts, can be judged as non-abnormal accounts; user accounts that are obviously non-normal users and that only publish negative works, publish works with homogeneous texts on different platforms, frequently change the location of user accounts, and intensively publish works in a short period of time, can be judged as abnormal accounts.

[0041] When obtaining multiple user accounts, it is also possible to extract only the user accounts of obvious normal users on multiple platforms, and simulate the user accounts of abnormal users for multiple platforms. In this case, the amount of data of the extracted user accounts of normal users should be much larger than the amount of data of the simulated user accounts of abnormal users, so as to be as close to the real user ratio as possible.

[0042] For the obtained user accounts, manual judgment is used to determine whether the user accounts are abnormal accounts. That is, the user accounts of normal users extracted from multiple platforms are judged as non-abnormal accounts, and the user accounts of generated abnormal users are judged as abnormal accounts.

[0043] Step S120, extracting account features and work features based on basic information data of multiple user accounts, jointly analyzing the account features and work features to determine derived features, and screening the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts.

[0044] Construct the input features of the sample data used to train the random forest model.

[0045] The multiple user accounts obtained include basic information data. The basic information data includes multi-dimensional information data such as user interaction behavior characteristics, user content characteristics, user communication characteristics, etc. The basic information data is divided into account characteristics and work characteristics.

[0046] Account features are used to indicate the feature dimensions related to the intrinsic characteristics of the user account. Account features may include, but are not limited to: account ID, account name, media name, platform name, number of fans, number of followers, authentication status, etc.

[0047] Typically, account names are used to distinguish different user accounts. Therefore, in the above steps, in the case of having the same user account on different platforms, it can be determined based on having the same account name on different platforms, and other account features related to the same account name can be aggregated. When the account feature includes the number of fans or the number of followers, the number of fans or the number of followers for the same user account on different platforms can be accumulated.

[0048] Work features are used to indicate the feature dimensions related to the works published by the user account. Work features may include, but are not limited to: work identification, work publishing location, work title, work link, work text, work publishing time, number of posts, etc. For accounts with the same name on different platforms, the work features related to the same account name can be aggregated, but no logical calculation is performed.

[0049] The account features and work features corresponding to multiple user accounts are jointly analyzed to determine the derived features.

[0050] Derived features are used to indicate feature dimensions that cannot be directly extracted from the basic information data of the user account and need to be determined by combining account features and work features for joint analysis. Derived features may include, but are not limited to: media identity, homogeneity of copywriting, multiple different negative works, negative works published through a matrix, abnormal posting location, intensive posting in a short period of time, negative works on different topics of the same brand, and the number of negative works.

[0051] The following describes the methods for determining each derived feature.

[0052] Media identity: The media identity of a user account can be determined as self-media, amateur, etc. based on the number of followers and authentication status in the account characteristics.

[0053] For example, a division value is determined for the number of fans. When the number of fans reaches the division value and is authenticated, the media identity of the account characteristics is self-media; when the number of fans does not reach the division value (regardless of whether it is authenticated or not) or the number of fans reaches the division value but is not authenticated, the media identity of the account characteristics is an amateur.

[0054] There is homogeneity in copywriting: For multiple different user accounts on a platform, by identifying the work titles and work texts in the work features of different user accounts, it is possible to compare the same works published by multiple different user accounts. This means that there is homogeneity in copywriting among multiple different user accounts.

[0055] For example, the semantic fingerprints of the title and text of the work are determined through the work features. When the similarity of the semantic fingerprints of the title and text of different works reaches a certain value (for example, 98%), the different works are identified as homogeneous works. The derivative features of multiple user accounts corresponding to different works are determined to be homogeneous.

[0056] There are multiple different negative works: Natural language processing (NLP) technology can be used to classify the sentiment of works and classify the sentiment of works into positive, neutral and negative. If a user account on a platform publishes multiple works with negative sentiment classification and different semantic fingerprints of titles and texts, then the user account has multiple different negative works.

[0057] For example, when a user account on a platform posts a piece of work with a negative sentiment classification and different semantic fingerprints in the title and body, the derived feature of the user account is determined as the presence of multiple different negative works.

[0058] Publishing negative works through the matrix: If the same user account publishes works with the same title and text semantic fingerprints on different platforms, then the user account has published negative works through the matrix.

[0059] Abnormal publication location: If the publication location of a work in the work characteristics corresponding to a user account changes frequently, then the user account has an abnormal publication location.

[0060] For example, the work publishing locations in the work features corresponding to a user account are summarized to determine the number of different work publishing locations. Generally speaking, normal users usually post in fixed locations or in a few common locations. Therefore, a division value can be determined. When the number of different work publishing locations in the work features corresponding to a user account is greater than the division value, the derived features of the user account are determined to be abnormal in the posting location.

[0061] Frequent posting in a short period of time: If the time interval between the release of multiple works in the work characteristics corresponding to a user account is too short, then the user account has posted frequently in a short period of time.

[0062] For example, the work release time in the work feature corresponding to a user account is sorted. Generally speaking, normal users need to write before publishing works, so the release time of adjacent works will not be too short. Therefore, a time length can be determined. When the time interval between a user account publishing at least two works is less than the time length, the derived feature of the user account is determined to be intensive posting in a short period of time.

[0063] Negative works exist on different topics of the same brand: If a user account publishes a work with negative sentiment classification on one topic, and also publishes works with negative sentiment classification on other topics of the same brand, then the user account has negative works on different topics of the same brand.

[0064] For example, a brand is associated with multiple topics in different directions. If a user account has posted works with negative sentiment classification for at least two topics in the brand, the derived feature of the user account is determined to be negative works on different topics of the same brand.

[0065] Number of negative works: It can count the total number of negative works among all works published by a user account after using natural language processing (NLP) technology to classify the works' sentiments.

[0066] After determining the account features, work features, and derived features, each feature can be sorted based on relevance, and features with higher relevance rankings can be selected as identification features, while features with lower relevance rankings can be eliminated.

[0067] For example, the account identification, account name, media name, platform name, number of fans, number of followers, certification status, work identification, work publishing location, work title, work link, work text, work publishing time, number of works, media identity, existence of homogeneous copywriting, existence of multiple different negative works, negative works published through the matrix, abnormal posting location, intensive posting in a short period of time, negative works on different topics of the same brand, number of negative works and other features are based on whether they are strongly correlated with the judgment result of whether the user account is an abnormal account. The existence of homogeneous copywriting and the existence of multiple different negative works with strong correlation can be used as the main identification features. The publication of negative works through the matrix, abnormal posting location, intensive posting in a short period of time, and the existence of negative works on different topics of the same brand with moderate correlation are used as secondary identification features. The main identification features and secondary identification features constitute the identification features, and other features are eliminated.

[0068] Step S130, using the identification features corresponding to the user account and the target output to train the random forest model, when the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained.

[0069] The random forest model is an ensemble learning method that improves prediction accuracy and stability by building multiple decision trees and outputting the mode or average of their results.

[0070] An initial ratio can be assigned to the identification features corresponding to the determined user account, providing a default initial value for the subsequent training of the random forest model. The identification features with the initial ratio are then sent to the constructed random forest model to obtain the output result of the random forest model. The output result is often deviated from the target output. For example, for a user account, the target output based on manual judgment is an abnormal account, but the output result based on the random forest model is a non-abnormal account.

[0071] The process of training a random forest model is to make the output result as close to the target output as possible or the same as the target output. Therefore, the initial ratio can be adjusted according to the importance of the evaluated recognition features and the performance changes of the random forest model, and the optimal ratio that makes the output result as close to the target output as possible or the same as the target output can be gradually found.

[0072] After determining the optimal ratio, a trained abnormal account recognition model is obtained, which can be used to perform abnormal account recognition.

[0073] The recognition capability of the abnormal account recognition model can be continuously monitored, and performance evaluation and targeted optimization can be performed regularly to ensure the recognition accuracy and efficiency of the abnormal account recognition model when it is used for abnormal account recognition.

[0074] from Figure 1It can be seen from the method shown that the method for constructing the abnormal account identification model provided by the present application first obtains basic information data of multiple user accounts, manually determines whether the user account is an abnormal account, and uses the determination result of whether the user account is an abnormal account as the target output, thereby determining the baseline result of the random forest model; secondly, based on the basic information data of multiple user accounts, account features and work features are extracted, the account features and work features are jointly analyzed to determine the derived features, and the derived features, account features and work features are screened based on the correlation to obtain the identification features corresponding to the user account, thereby determining the input features of the sample data for training the random forest model; finally, the random forest model is trained using the identification features corresponding to the user account and the target output, and when the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained, thereby applying the abnormal account identification model to abnormal account identification. The abnormal account identification model constructed based on the construction method of the abnormal account identification model provided in this application is compatible with multiple platform usage scenarios, is not limited to specific social media or network platforms, and has wide applicability and flexibility; it can quickly identify abnormal accounts, provide users with instant feedback, and effectively respond to rapid changes in the network environment; because the model focuses on the common identification features of abnormal accounts, accurate identification is achieved through data modeling, thereby effectively reducing misjudgments and missed judgments, and ensuring the accuracy and reliability of abnormal account identification.

[0075] In some embodiments of the present application, in the above method, step S110, obtaining basic information data of multiple user accounts, manually determining whether the user account is an abnormal account, and outputting the determination result of whether the user account is an abnormal account as the target, includes: obtaining basic information data of multiple platforms and multiple user accounts within a preset time range; manually determining whether the user account is an abnormal account; if any user account is an abnormal account, marking the user account as an abnormal account mark; if any user account is determined not to be an abnormal account, marking the user account as a non-abnormal account mark.

[0076] In this embodiment, basic information data of multiple platforms and multiple user accounts within a preset time range can be collected.

[0077] For example, in order to collect basic information data as comprehensively as possible, 12,361 user accounts on multiple platforms (such as Weibo, Xiaohongshu, Kuaishou, Douyin, Yiche, etc.) can be selected within a time range of 3 months from the current time point. These user accounts include normal user accounts (that is, user accounts that can be identified as non-abnormal accounts) and abnormal user accounts (that is, user accounts that can be identified as abnormal accounts). The basic information data corresponding to these user accounts involves 6,260,183 items, including account identification, account name, media name, platform name, number of fans, number of followers, certification status, work identification, work publication location, work title, work link, work text, work publication time, etc. In the basic information data, the above-mentioned multiple user accounts involve a total of 46,972 works.

[0078] For the above multiple user accounts, we use manual identification to mark whether they are abnormal accounts one by one. If any user account is manually identified as an abnormal user account, the user account is marked as an abnormal account; if any user account is manually identified as a normal user account, the user account is marked as a non-abnormal account. The above 12,361 user accounts are all marked as abnormal accounts, which are used as the identification results and the target output for evaluating the training random forest model, i.e., the benchmark results.

[0079] In some embodiments of the present application, in the above method, step S120, the derived features, account features and work features are screened based on correlation to obtain identification features corresponding to the user account, including: normalizing and discretizing the derived features, account features and work features to obtain candidate features; using descriptive statistical methods to determine the difference ranking of the candidate features in the judgment result of whether the user account is an abnormal account, and screening out a first sub-candidate feature from the candidate features according to the difference ranking; performing a hypothesis test on the first sub-candidate feature to determine the second sub-candidate feature; using the Spearman correlation coefficient method to determine the correlation ranking of the second sub-candidate feature in the judgment result of whether the user account is an abnormal account, and screening out the identification feature from the second sub-candidate feature according to the correlation ranking.

[0080] In this embodiment, identification features are gradually analyzed based on basic information data.

[0081] First, extract the basic information data of multiple user accounts. The basic information data of user accounts is shown in Table 1 below. The basic information data of user accounts shown is a case where one user account corresponds to one work, which is intended to intuitively display the content of the basic information data. In actual situations, one user account often corresponds to multiple works, so the basic information data in actual situations is not limited to this.

[0082] Table 1:

[0083]

[0084] Based on the basic information data, account features and work features are extracted. Account features may include: account ID, account name, media name, platform name, number of fans, number of followers, certification status, etc. Work features may include: work ID, work publishing location, work title, work link, work text, work publishing time, etc.

[0085] For the extracted account features and work features, some preprocessing operations may be required to ensure the quality and effectiveness of the account features and work features, such as cleaning the account features and work features. The cleaning methods include but are not limited to discarding null values, incomplete data, and removing abnormal values.

[0086] Based on the basic information data in the above Table 1, the work identification items of the three user accounts are all empty values, so the work identification item is discarded.

[0087] Secondly, a joint analysis is performed based on the account characteristics and work characteristics to determine the derived features.

[0088] When determining the derived features, we can first calculate the semantic fingerprint of the title and text of each work, the sentiment classification of the work, etc., and determine the derived features based on this.

[0089] Continuing with the example of Table 1 above, Table 2 exemplarily shows the derived features of the user account. The derived features in actual situations are not limited to this.

[0090] Table 2:

[0091]

[0092] Next, after determining the account features, work features, and derived features, each feature is normalized and discretized. The normalization and discretization methods can adopt existing technologies and are not specifically limited here. The purpose of normalization and discretization is to facilitate subsequent screening and identification of features. The account features, work features, and derived features after normalization and discretization are used as candidate features.

[0093] For example, for the media identity feature in the derived features, if the media identity is self-media, the corresponding field is recorded as 1; if the media identity is an amateur, the corresponding field is recorded as 2. In addition, based on the result of manual judgment of whether the user account is an abnormal account, the user account can also be normalized and discretized. The user account is marked as an abnormal account as 1, and the user account is marked as a non-abnormal account as 0.

[0094] Then, descriptive statistical methods were used to preliminarily screen the candidate features.

[0095] Use the mean and median to compare the central tendency of normal and abnormal user accounts on each candidate feature. Use the standard deviation and interquartile range to compare the degree of dispersion of normal and abnormal user accounts on each candidate feature. Use the box plot to compare the distribution differences of normal and abnormal user accounts on each candidate feature. Normal user accounts are user accounts that are manually identified as non-abnormal accounts, and abnormal user accounts are user accounts that are manually identified as abnormal accounts.

[0096] Through the above descriptive statistical method, the difference ranking of each candidate feature is determined, and the candidate feature with greater difference is selected as the first candidate sub-feature.

[0097] For example, the first candidate sub-features screened out may include: the number of fans, the number of followers, certification status, the number of posts, media identity, the existence of homogeneous copywriting, the existence of multiple different negative works, the release of negative works through a matrix, abnormal posting locations, intensive postings in a short period of time, the existence of negative works on different topics of the same brand, the number of negative works, etc.

[0098] A hypothesis test is performed on the first sub-candidate feature to determine the second sub-candidate feature.

[0099] For the continuous features in the first sub-candidate features, an independent sample t-test can be used. For example, an independent sample t-test can be performed on the number of fans, the number of followers, the number of posts, the number of negative works, etc. For the categorical features in the first sub-candidate features, a chi-square test can be used. For example, a chi-square test can be performed on the certification status, media identity, the existence of homogeneous copywriting, the existence of multiple different negative works, the release of negative works through a matrix, the abnormal location of postings, intensive postings in a short period of time, and the existence of negative works on different topics of the same brand.

[0100] Based on the results of the hypothesis test, the second sub-candidate features are screened out again from the first sub-candidate features. The screened second sub-candidate features may include: the number of fans, the number of followers, the number of posts, the media identity, the existence of homogeneous copywriting, the existence of multiple different negative works, the release of negative works through a matrix, abnormal posting locations, intensive postings in a short period of time, and the existence of negative works on different topics of the same brand.

[0101] Finally, the Spearman correlation coefficient method is used to sort the relevance of the second sub-candidate features, and the identification features with a high relevance to the result of determining whether the user account is an abnormal account are screened from the second sub-candidate sub-features.

[0102] The Spearman correlation coefficient method is an existing technology in the art for evaluating the correlation between two statistical variables. It will not be described in detail here, and only Table 3 is used to exemplarily show the correlation ranking results calculated based on the Spearman correlation coefficient method.

[0103] Table 3:

[0104]

[0105] Here, |ρ| represents the absolute value of the Spearman correlation coefficient.

[0106] Based on Table 3 above, the features with strong and medium correlation in the second sub-candidate features can be retained, and the features with weak correlation can be discarded, so as to screen out identification features from the second sub-candidate features. Identification features may include: the existence of multiple different negative works, the existence of homogeneous copywriting, intensive posting in a short period of time, the release of negative works through a matrix, abnormal posting location, and the existence of negative works on different topics of the same brand.

[0107] In some embodiments of the present application, in the above method, step S130, using the identification features corresponding to the user account and the target output to train the random forest model, when the evaluation index of the random forest model reaches the preset standard, a trained abnormal account recognition model is obtained, including: dividing the identification features corresponding to the user account into a training set, a validation set and a test set; assigning an initial ratio to each identification feature in the training set, using the training set carrying the initial ratio as the training input, sending the training input to the constructed random forest model, and determining the training output corresponding to the training input; determining the evaluation index according to the training output and the target output, adjusting the initial ratio to obtain the target ratio with the evaluation index reaching the preset standard as the goal; assigning a target ratio to each identification feature in the validation set, using the validation set carrying the target ratio as the validation input, assigning a target ratio to each identification feature in the test set, and using the test set carrying the target ratio as the test input; sending the verification input to the random forest model for verification, and sending the test input to the random forest model for testing, to obtain a trained abnormal account recognition model.

[0108] The identification features corresponding to the user account are divided into training set, validation set and test set, and a random forest model is constructed. When dividing the training set, validation set and test set, they can be divided according to the ratio of 70%:15%:15%. This division method is to ensure that the training set has enough data to train the random forest model, and to ensure that the validation set and the test set are independent enough to evaluate the generalization ability of the random forest model and avoid overfitting or underfitting.

[0109] An initial initial ratio is set for each recognition feature to provide a default value for the training of the random forest model. The training set with the initial ratio is sent to the random forest model as the training input to obtain the training output corresponding to the training input.

[0110] For example, under the initial ratio, for the identification feature corresponding to a user account, the random forest model outputs "1" (abnormal account); and for this user account, the result of manual determination of whether the user account is an abnormal account is "0" (non-abnormal account). For the identification feature corresponding to another user account, the random forest model outputs "0" (non-abnormal account); and for this user account, the result of manual determination of whether the user account is an abnormal account is "0" (non-abnormal account).

[0111] That is to say, there may be a deviation between the training output and the target output obtained by feeding the training set of the random forest model with the initial ratio, and this deviation leads to inaccurate recognition results of the random forest model. Therefore, the evaluation index can be determined according to the training output and the target output, and the initial ratio can be adjusted to obtain the target ratio with the goal of the evaluation index reaching the preset standard.

[0112] Specifically, the evaluation index is determined according to the training output and the target output, and the initial ratio is adjusted to obtain the target ratio with the goal of the evaluation index reaching the preset standard, including: determining the precision, recall rate and F1 score according to the training output and the target output; and determining the target ratio by grid search, random search, or Bayesian optimization with the goal of the precision, recall rate and F1 score reaching the preset standard.

[0113] During the training process of the random forest model, the initial proportion of each recognition feature can be dynamically adjusted according to the changes in the evaluation indicators. The evaluation indicators may include precision, recall rate, and F1 score.

[0114] Precision can be expressed as Precision. For normal user accounts (i.e. user accounts that are manually identified as non-abnormal accounts), For abnormal user accounts (i.e. user accounts that are manually identified as abnormal accounts), Among them, TP means that the true category is a non-abnormal account and the result of model recognition is also a non-abnormal account; TN means that the true category is an abnormal account and the result of model recognition is also an abnormal account; FP means that the true category is an abnormal account but the result of model recognition is a non-abnormal account; FN means that the true category is a non-abnormal account but the result of model recognition is an abnormal account.

[0115] The recall rate can be expressed as Recall. For normal user accounts (i.e. user accounts that are manually identified as non-abnormal accounts), For abnormal user accounts (i.e. user accounts that are manually identified as abnormal accounts),

[0116] The F1 score can be expressed as F1 Score .

[0117] After determining the above evaluation indicators according to the training output and the target output, each evaluation indicator can be compared with the preset standard to determine whether each evaluation indicator reaches the preset standard. For example, the preset standard of each evaluation indicator can be determined as 0.8, and when some of the evaluation indicators do not reach 0.8, the initial ratio is dynamically adjusted.

[0118] When adjusting the initial ratio, the correlation of each identification feature can also be considered. For example, the identification feature with a higher correlation (the absolute value of the Spearman correlation coefficient) can have its initial ratio increased, while the identification feature with a lower correlation (the absolute value of the Spearman correlation coefficient) can have its initial ratio reduced.

[0119] Adjusting the initial ratio only once often does not make all evaluation indicators reach the preset standard. Therefore, multiple iterations can be made to adjust and finally find the optimal ratio group that makes all evaluation indicators reach the preset standard, and the optimal ratio combination is used as the target ratio. During multiple iterations, grid search, random search, Bayesian optimization and other methods can be used. The above-mentioned iterative methods are all common iterative methods in the prior art of the present invention, and are not explained in detail here.

[0120] After determining the target ratio, assign the target ratio to each recognition feature in the validation set, and use the validation set with the target ratio as the validation input; assign the target ratio to each recognition feature in the test set, and use the test set with the target ratio as the test input.

[0121] The validation input is fed into the random forest model for validation, and the performance of the random forest model on unseen validation input is evaluated to identify potential overfitting issues. The test input is fed into the random forest model for testing, to evaluate the final performance and generalization ability of the random forest model.

[0122] After the above steps, a trained abnormal account recognition model is obtained. The following Table 4 exemplifies the final performance of the trained abnormal account recognition model on normal user accounts and abnormal user accounts.

[0123] Table 4:

[0124]

[0125]

[0126] As can be seen from Table 4, the trained abnormal account recognition model performs better in classifying normal users than abnormal users. When detecting abnormal users, the abnormal account recognition model has achieved a high level of accuracy and recall, and the recognition effect is good. When detecting normal users, the abnormal account recognition model has better final performance.

[0127] The method for constructing an abnormal account recognition model proposed in this application analyzes the feature data contained in the basic information data to find out the recognition features that affect abnormal account behavior and normal behavior, determines a reasonable target ratio for these recognition features, and finally applies the target ratio through a random forest model to obtain a trained abnormal account recognition model, so that the abnormal account recognition model can efficiently distinguish between abnormal accounts and non-abnormal accounts.

[0128] On the other hand, the present application provides a method for identifying abnormal accounts.

[0129] Figure 2 A flow chart of an abnormal account identification method proposed in an embodiment of the present application is shown.

[0130] according to Figure 2 As shown, the method of this embodiment includes steps S210 to S230:

[0131] Step S210, obtaining the article data to be identified, and determining the user account according to the article data to be identified.

[0132] When identifying abnormal accounts, you can obtain the article data to be identified and trace back the user account that published the article data to be identified, so as to identify whether the user account is an abnormal account.

[0133] For example, for an article under any topic on the Weibo platform, the article is obtained as the article data to be identified. Based on the article, the account that published the article is traced back as the user account.

[0134] Step S220, obtaining basic information data corresponding to the user account within the retrospective time period, and performing feature extraction on the basic information data to obtain identification features.

[0135] After the user account is determined, basic information data corresponding to the user account is obtained from multiple platforms according to the retrospective period. The retrospective period can be 6 months, 3 months, or 1 month, etc.

[0136] Continuing with the above example, after determining the publishing account from the Weibo platform, search for the same user account as the publishing account on multiple other platforms such as Xiaohongshu, Douyin, Kuaishou, and Yiche, and then collect basic information data within the retrospective time period from multiple platforms.

[0137] The basic information data includes multi-dimensional information data such as user interaction behavior characteristics, user content characteristics, and user communication characteristics. Based on the basic information data, account characteristics and work characteristics are extracted, and the account characteristics and work characteristics are jointly analyzed to determine the derived characteristics. The derived characteristics, account characteristics, and work characteristics are screened based on the correlation to obtain the identification characteristics corresponding to the user account. The specific method for determining the identification characteristics can refer to the content involved in step S120 in the method for constructing the abnormal account identification model proposed in this application. It will not be repeated here.

[0138] In step S230, the identification features are sent to an abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method proposed in the above-mentioned application.

[0139] Through the abnormal account identification model, it is possible to directly identify whether the user account is an abnormal account, thereby directly classifying the user account as an abnormal account or a non-abnormal account.

[0140] For example, for the three user accounts in Table 2, after using the abnormal account identification model for identification, the identification results obtained are all abnormal accounts.

[0141] In some cases, considering that the abnormal account identification model performs better in classifying normal users than abnormal users. The following method can also be used for identification. In some embodiments of the present application, the identification features include primary identification features and secondary identification features; obtaining an identification result of whether a user account is an abnormal account includes: determining other user accounts other than those identified as non-abnormal accounts as suspected abnormal accounts; if the primary identification features of the suspected abnormal account include a hit result, determining the suspected abnormal account as an abnormal account; if the primary identification features of the suspected abnormal account do not include a hit result, determining the suspected abnormal account as an abnormal account tendency account.

[0142] In this embodiment, the abnormal account identification model is used to identify the user account. If the identification result is a normal user, the user account is directly determined to be a non-abnormal account. For other user accounts other than those identified as non-abnormal accounts, further detailed judgment is performed based on the main identification features corresponding to the other user accounts.

[0143] Referring to the correlation ranking given in Table 3, the existence of copy homogeneity and the existence of multiple different negative works, which are strongly correlated to the judgment result of whether the user account is an abnormal account, can be used as the main identification features, and the publication of negative works through the matrix, abnormal posting location, intensive posting in a short period of time, and the existence of negative works on different topics of the same brand, which are moderately correlated to the judgment result of whether the user account is an abnormal account, can be used as secondary identification features.

[0144] If the main identification feature of any other user account includes a hit result, then determine that user account as an abnormal account.

[0145] For a user whose account is not identified as a non-abnormal account by the abnormal account recognition model and whose main identification feature includes a hit result, it is determined that the user account must be an abnormal account.

[0146] For example, for the user account "IT* Family" in Table 2, after being identified by the abnormal account recognition model, it is not determined as a non-abnormal account. Therefore, analyze its identification features again. Since its main identification feature "There are multiple different negative works" is "Yes", the user account is determined as an abnormal account.

[0147] For the user account "Ni* Car" in Table 2, after being identified by the abnormal account recognition model, it is not determined as a non-abnormal account. Therefore, analyze its identification features again. Since all its main identification features are "Yes", the user account is determined as an abnormal account.

[0148] If the main identification feature of any other user account does not include a hit result, then determine that user account as an abnormal account tendency account.

[0149] For a user whose account is not identified as a non-abnormal account by the abnormal account recognition model but whose main identification feature does not include a hit result, it is determined that the user account has a tendency to be an abnormal account. For such a user account, determine it as an abnormal account tendency account, pay key attention and continuously observe according to the actual situation, and make a clear determination manually when necessary.

[0150] For example, for the user account "EE* Gas??" in Table 2, after being identified by the abnormal account recognition model, it is not determined as a non-abnormal account. Therefore, analyze its identification features again. Since all its main identification features are "No", the user account is determined as an abnormal account tendency account. It is necessary to pay key attention and continuously observe this user account.

[0151] Figure 3 The structure diagram of the construction device of the abnormal account recognition model proposed in an embodiment of the present application is shown. According to Figure 3 As shown, the device 300 includes:

[0152] A target output determination unit 310, configured to obtain basic information data of multiple user accounts, manually determine whether a user account is an abnormal account, and use the determination result of whether the user account is an abnormal account as the target output;

[0153] The identification feature screening unit 320 is used to extract account features and work features based on the basic information data of multiple user accounts, jointly analyze the account features and work features to determine derived features, and screen the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts;

[0154] The model training unit 330 is used to train the random forest model using the identification features corresponding to the user account and the target output, and obtain a trained abnormal account identification model when the evaluation index of the random forest model reaches a preset standard.

[0155] In some embodiments of the present application, in the above-mentioned device 300, the target output determination unit 310 is specifically used to: obtain basic information data of multiple platforms and multiple user accounts within a preset time range; manually determine whether the user account is an abnormal account; if any user account is an abnormal account, mark the user account as an abnormal account mark; if any user account is not an abnormal account, mark the user account as a non-abnormal account mark; and use the determination result of whether the user account is an abnormal account as the target output.

[0156] In some embodiments of the present application, in the above-mentioned device 300, the identification feature screening unit 320 is specifically used to: normalize and discretize the derived features, account features and work features to obtain candidate features; use descriptive statistical methods to determine the difference ranking of the candidate features in the judgment result of whether the user account is an abnormal account, and screen out the first sub-candidate feature from the candidate features according to the difference ranking; perform hypothesis testing on the first sub-candidate feature to determine the second sub-candidate feature; use the Spearman correlation coefficient method to determine the correlation ranking of the second sub-candidate feature in the judgment result of whether the user account is an abnormal account, and screen out the identification feature from the second sub-candidate feature according to the correlation ranking.

[0157] In some embodiments of the present application, in the above-mentioned device 300, the model training unit 330 is specifically used to: divide the identification features corresponding to the user account into a training set, a verification set and a test set; assign an initial ratio to each identification feature in the training set, use the training set carrying the initial ratio as the training input, send the training input to the constructed random forest model, and determine the training output corresponding to the training input; determine the evaluation index according to the training output and the target output, and adjust the initial ratio to obtain the target ratio with the evaluation index reaching a preset standard as the goal; assign a target ratio to each identification feature in the verification set, use the verification set carrying the target ratio as the verification input, assign a target ratio to each identification feature in the test set, and use the test set carrying the target ratio as the test input; send the verification input to the random forest model for verification, and send the test input to the random forest model for testing to obtain a trained abnormal account recognition model.

[0158] It should be noted that the above-mentioned abnormal account identification model construction device 300 can implement the above-mentioned abnormal account identification model construction method one by one, which will not be repeated here.

[0159] Figure 4 A schematic diagram of the structure of an abnormal account identification device proposed in one embodiment of the present application is shown.

[0160] according to Figure 4 As shown, the device 400 includes:

[0161] A user account determination unit 410 is used to obtain the article data to be identified and determine the user account according to the article data to be identified;

[0162] The identification feature determination unit 420 is used to obtain basic information data corresponding to the user account within the retrospective period, and extract features from the basic information data to obtain identification features;

[0163] The abnormal account identification unit 430 is used to send the identification features to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method proposed in this application.

[0164] In some embodiments of the present application, in the above-mentioned device 400, the identification features include primary identification features and secondary identification features; the abnormal account identification unit 430 is specifically used to: determine other user accounts other than those identified as non-abnormal accounts as suspected abnormal accounts; if the main identification features of the suspected abnormal account include hit results, the suspected abnormal account is determined as an abnormal account; if the main identification features of the suspected abnormal account do not include hit results, the suspected abnormal account is determined as an abnormal account tendency account.

[0165] Figure 5 A schematic diagram showing the structure of a computer device according to an embodiment of the present application is shown. Figure 5 As shown, the internal structure of the computer device may include a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, the method for constructing an abnormal account identification model or the functions or steps of the abnormal account identification method are implemented.

[0166] In one embodiment, the computer device provided by the present application includes a memory and a processor, the memory stores a database and a computer program that can be run on the processor, and the processor implements the following steps when executing the computer program:

[0167] Obtain basic information data of multiple user accounts, manually determine whether the user account is an abnormal account, and output the determination result of whether the user account is an abnormal account as the target;

[0168] Extract account features and work features based on basic information data of multiple user accounts, conduct joint analysis on the account features and work features to determine derived features, and screen the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts;

[0169] The random forest model is trained using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained.

[0170] Alternatively, the computer device provided in the present application includes a memory and a processor, the memory stores a database and a computer program that can be run on the processor, and the processor implements the following steps when executing the computer program:

[0171] Obtain the article data to be identified, and determine the user account based on the article data to be identified;

[0172] Obtain basic information data corresponding to the user account within the retrospective period, and extract features from the basic information data to obtain identification features;

[0173] The identification features are sent to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method proposed in this application.

[0174] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0175] Obtain basic information data of multiple user accounts, manually determine whether the user account is an abnormal account, and output the determination result of whether the user account is an abnormal account as the target;

[0176] Extract account features and work features based on basic information data of multiple user accounts, conduct joint analysis on the account features and work features to determine derived features, and screen the derived features, account features, and work features based on correlation to obtain identification features corresponding to the user accounts;

[0177] The random forest model is trained using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, a trained abnormal account identification model is obtained.

[0178] Alternatively, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0179] Obtain the article data to be identified, and determine the user account based on the article data to be identified;

[0180] Obtain basic information data corresponding to the user account within the retrospective period, and extract features from the basic information data to obtain identification features;

[0181] The identification features are sent to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method proposed in this application.

[0182] It should be noted that the above functions or steps that can be implemented by the computer device or computer-readable storage medium can refer to the relevant description in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0183] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0184] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0185] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for constructing an abnormal account identification model, characterized in that: The method comprises: Obtaining basic information data of multiple user accounts, manually determining whether the user accounts are abnormal accounts, and outputting the determination result of whether the user accounts are abnormal accounts as a target; Extracting account features and work features based on the basic information data of the multiple user accounts, jointly analyzing the account features and the work features to determine derived features, and screening the derived features, the account features, and the work features based on correlation to obtain identification features corresponding to the user accounts; The random forest model is trained using the identification features corresponding to the user account and the target output, and when the evaluation index of the random forest model reaches a preset standard, the trained abnormal account identification model is obtained.

2. The method for constructing an abnormal account identification model according to claim 1, characterized in that: The obtaining of basic information data of multiple user accounts, manually determining whether the user accounts are abnormal accounts, and outputting the determination result of whether the user accounts are abnormal accounts as a target includes: Obtain the basic information data of multiple platforms and multiple user accounts within a preset time range; Manually determine whether the user account is an abnormal account; If any of the user accounts is an abnormal account, the user account is marked as an abnormal account; If any of the user accounts is not an abnormal account, the user account is marked as a non-abnormal account; The determination result of whether the user account corresponds to an abnormal account is used as the target output.

3. The method for constructing an abnormal account identification model according to claim 1, characterized in that: The screening of the derived features, the account features, and the work features based on correlation to obtain the identification features corresponding to the user account includes: Normalizing and discretizing the derived features, the account features, and the work features to obtain candidate features; Describing the difference ranking of the candidate features on the discrimination result of whether the user account is an abnormal account by using a descriptive statistical method, and selecting a first sub-candidate feature from the candidate features according to the difference ranking; Performing a hypothesis test on the first sub-candidate feature to determine a second sub-candidate feature; The Spearman correlation coefficient method is used to determine the correlation ranking of the second sub-candidate features on the judgment result of whether the user account is an abnormal account, and the identification feature is screened out from the second sub-candidate features according to the correlation ranking.

4. The method for constructing an abnormal account identification model according to claim 1, characterized in that: The step of training the random forest model by using the identification feature corresponding to the user account and the target output, and obtaining the trained abnormal account identification model when the evaluation index of the random forest model reaches a preset standard, includes: Dividing the identification features corresponding to the user account into a training set, a validation set, and a test set; Assigning an initial ratio to each of the identification features in the training set, using the training set with the initial ratio as a training input, feeding the training input into the constructed random forest model, and determining a training output corresponding to the training input; Determine the evaluation index according to the training output and the target output, and adjust the initial ratio to obtain the target ratio with the evaluation index reaching the preset standard as the goal; Allocating the target ratio to each of the identification features in the validation set, using the validation set with the target ratio as validation input, allocating the target ratio to each of the identification features in the test set, and using the test set with the target ratio as test input; The verification input is sent to the random forest model for verification, and the test input is sent to the random forest model for testing to obtain the trained abnormal account recognition model.

5. A method for identifying abnormal accounts, characterized in that: The method comprises: Acquire the article data to be identified, and determine the user account according to the article data to be identified; Obtaining basic information data corresponding to the user account within the retrospective period, and performing feature extraction on the basic information data to obtain identification features; The identification feature is sent to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method described in any one of claims 1-4.

6. The abnormal account identification method according to claim 5, characterized in that: The identification features include primary identification features and secondary identification features; The obtaining of the identification result of whether the user account is an abnormal account includes: Determine the user accounts other than the identified non-abnormal accounts as suspected abnormal accounts; If the main identification feature of the suspected abnormal account includes a hit result, the suspected abnormal account is determined as an abnormal account; If the main identification features of the suspected abnormal account do not include a hit result, the suspected abnormal account is determined to be an abnormal account tendency account.

7. A device for constructing an abnormal account identification model, characterized in that: The device comprises: a target output determination unit, configured to obtain basic information data of a plurality of user accounts, manually determine whether the user accounts are abnormal accounts, and output the determination result of whether the user accounts are abnormal accounts as a target; an identification feature screening unit, configured to extract account features and work features based on the basic information data of the plurality of user accounts, jointly analyze the account features and the work features to determine derived features, and screen the derived features, the account features, and the work features based on correlation to obtain identification features corresponding to the user accounts; A model training unit is used to train a random forest model using the identification features corresponding to the user account and the target output, and obtain the trained abnormal account identification model when the evaluation index of the random forest model reaches a preset standard.

8. An abnormal account identification device, characterized in that: The device comprises: A user account determination unit, used to obtain the article data to be identified and determine the user account according to the article data to be identified; An identification feature determination unit, used to obtain basic information data corresponding to the user account within a retrospective period, and extract features from the basic information data to obtain identification features; An abnormal account identification unit is used to send the identification features into the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method described in any one of claims 1-4.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the method for constructing an abnormal account identification model as described in any one of claims 1 to 4, or the steps of the abnormal account identification method as described in claim 5 or 6.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is instructed by a processor, it implements the method for constructing an abnormal account identification model as described in any one of claims 1 to 4, or the steps of the abnormal account identification method as described in claim 5 or 6.

Images