Method and device for constructing abnormal account identification model, method and device for identifying abnormal account, equipment and storage medium

Abstract

The application relates to the technical field of computer and network data analysis, and proposes a construction method and device of an abnormal account identification model, an abnormal account identification method and device, equipment and a storage medium. The construction method of the abnormal account identification model analyzes feature data contained in basic information data, finds out identification features influencing abnormal account behaviors and normal behaviors, determines reasonable target proportions for the identification features, and finally obtains a trained abnormal account identification model by applying the target proportions through a random forest model, so that the abnormal account identification model can efficiently distinguish abnormal accounts and non-abnormal accounts.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer and network data analysis, in particular to a construction method and device of an abnormal account identification model, an abnormal account identification method and device, equipment and a storage medium. BACKGROUND

[0002] At present, the main abnormal account identification model on the market is mainly aimed at a single platform, and the application scene is narrow. Therefore, there is a lack of an abnormal account identification mechanism applicable to various platforms. SUMMARY

[0003] To solve the above problems, the present application provides a construction method and device of an abnormal account identification model, an abnormal account identification method and device, equipment and a storage medium, to overcome or partially overcome the deficiencies in the prior art.

[0004] The present application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a construction method of an abnormal account identification model, the method comprising:

[0006] Obtaining basic information data of a plurality of user accounts, manually distinguishing whether the user accounts are abnormal accounts, and taking the distinguishing result of whether the user accounts are abnormal accounts as a target output;

[0007] Extracting account features and work features based on the basic information data of the plurality of user accounts, jointly analyzing the account features and the work features to determine derived features, and screening the derived features, the account features and the work features based on correlation to obtain identification features corresponding to the user accounts;

[0008] Training a random forest model using the identification features corresponding to the user accounts and the target output, and obtaining a trained abnormal account identification model when an evaluation index of the random forest model reaches a preset standard.

[0009] In a second aspect, the present application provides an abnormal account identification method, the method comprising:

[0010] Obtaining to-be-identified article data, and determining a user account according to the to-be-identified article data;

[0011] Obtaining basic information data corresponding to the user account in a backtracking time period, and extracting identification features from the basic information data;

[0012] Sending the identification features into an abnormal account identification model for identification, and obtaining an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the construction method of the abnormal account identification model.

[0013] In a third aspect, the application provides a device for constructing an abnormal account identification model, the device comprising:

[0014] a target output determination unit configured to obtain basic information data of a plurality of user accounts, manually determine whether the user accounts are abnormal accounts, and take the determination result of whether the user accounts are abnormal accounts as a target output;

[0015] a recognition feature screening unit configured to extract account features and work features based on the basic information data of the plurality of user accounts, jointly analyze the account features and the work features to determine derived features, and screen the derived features, the account features and the work features based on correlations to obtain recognition features corresponding to the user accounts;

[0016] a model training unit configured to train a random forest model by using the recognition features corresponding to the user accounts and the target output, and obtain a trained abnormal account identification model when an evaluation index of the random forest model reaches a preset standard.

[0017] In a fourth aspect, the application provides an abnormal account identification device, the device comprising:

[0018] a user account determination unit configured to obtain to-be-identified article data and determine a user account according to the to-be-identified article data;

[0019] a recognition feature determination unit configured to obtain basic information data corresponding to the user account in a backtracking time period, and extract features from the basic information data to obtain recognition features;

[0020] an abnormal account identification unit configured to input the recognition features into an abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the above-mentioned method for constructing an abnormal account identification model.

[0021] In a fifth aspect, the application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned method for constructing an abnormal account identification model or the above-mentioned method for identifying an abnormal account when executing the computer program.

[0022] In a sixth aspect, the application provides a computer-readable storage medium storing a computer program, wherein the computer program implements the steps of the above-mentioned method for constructing an abnormal account identification model or the above-mentioned method for identifying an abnormal account when being instructed by a processor.

[0023] The above-mentioned at least one technical solution adopted by the application can achieve the following beneficial effects:

[0024] The method for constructing an abnormal account identification model provided in this application first obtains basic information data of multiple user accounts, manually judges whether a user account is an abnormal account, and uses the judgment result as the target output to determine the baseline result of the random forest model. Second, based on the basic information data of multiple user accounts, account features and work features are extracted, and the account features and work features are jointly analyzed to determine derived features. The derived features, account features, and work features are filtered based on correlation to obtain the identification features corresponding to the user accounts, thereby determining the input features of the sample data for training the random forest model. Finally, the random forest model is trained using the identification features corresponding to the user accounts and the target output. When the evaluation index of the random forest model reaches the preset standard, the trained abnormal account identification model is obtained, and the abnormal account identification model is then applied to identify abnormal accounts. The abnormal account identification model constructed based on the construction method of the abnormal account identification model provided in this application is compatible with multiple different platform usage scenarios, is not limited to specific social media or network platforms, and has wide applicability and flexibility; it can quickly identify abnormal accounts, provide users with timely feedback, and effectively cope with the rapid changes in the network environment; since the model focuses on the common identification features of abnormal accounts and achieves accurate identification through data modeling, it effectively reduces false positives and false negatives, and ensures the accuracy and reliability of abnormal account identification. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 A flowchart illustrating a method for constructing an abnormal account identification model according to an embodiment of this application is shown.

[0027] Figure 2 A flowchart illustrating an abnormal account identification method according to an embodiment of this application is shown.

[0028] Figure 3 A schematic diagram of the structure of an apparatus for constructing an abnormal account identification model according to an embodiment of this application is shown;

[0029] Figure 4 This diagram illustrates the structure of an abnormal account identification device according to an embodiment of the present application.

[0030] Figure 5 A schematic diagram of the structure of a computer device according to an embodiment of this application is shown. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] The concept of this application is as follows: For user accounts on different platforms, valuable identifying features for determining whether an account is abnormal are extracted by analyzing the basic information data of the user accounts. These features are then used to train a random forest model, resulting in an abnormal account identification model with high accuracy. Using this abnormal account identification model to determine whether a posting account is abnormal can provide clues about accounts suspected of manipulating or misleading public opinion, or hyping up topics, thus contributing to the purification of the online ecosystem.

[0033] The present application will now be described in detail through specific embodiments.

[0034] On the one hand, this application provides a method for constructing an abnormal account identification model.

[0035] Figure 1 A flowchart illustrating a method for constructing an abnormal account identification model according to an embodiment of this application is shown. Figure 1 As shown, the method in this embodiment includes steps S110 to S130:

[0036] Step S110: Obtain basic information data of multiple user accounts, manually determine whether the user accounts are abnormal accounts, and use the determination result of whether the user accounts are abnormal accounts as the target output.

[0037] Construct a target output for evaluating the trained random forest model. The target output is the benchmark result of the random forest model. Sample data can come from multiple user accounts. Multiple user accounts can include different user accounts on multiple platforms (including but not limited to Weibo, Xiaohongshu, Kuaishou, Douyin, Yiche, etc.).

[0038] When obtaining multiple user accounts, a random sampling method can be used to extract different user accounts of multiple platforms. In order to restore the real user ratio as much as possible and ensure that the ratio of a small number of abnormal users to a large number of normal users can be reasonably reflected, the number of user accounts obtained can be as large as possible within the allowable range of data volume. In some cases, different platforms can have the same user account, such as obtaining the user account "I am an account" on the microblog platform and obtaining the user account "I am an account" on the TikTok platform. Therefore, the same user accounts of different platforms can be merged into the same user account. For the merged user account, the basic information data of the user account on different platforms can be aggregated.

[0039] For the obtained user accounts, a manual discrimination method is used to determine whether the user account is an abnormal account. That is, the manual method is used to judge whether each user account is an abnormal account, and the result of the manual judgment is used as the target output for evaluating the training of the random forest model.

[0040] In the manual discrimination process, official accounts, teacher accounts, and other obviously normal user accounts can be judged as non-abnormal accounts. User accounts that simultaneously exhibit phenomena such as only publishing negative works, publishing homogenized works on different platforms, frequently changing the location of the user account, and densely publishing works in a short period of time can be judged as abnormal accounts.

[0041] When obtaining multiple user accounts, only user accounts of multiple platforms that are obviously normal users can be extracted, and user accounts of non-normal users can be generated for multiple platforms. At this time, the data volume of the extracted normal user accounts should be much larger than the data volume of the generated non-normal user accounts, in order to approach the real user ratio as much as possible.

[0042] For the obtained user accounts, a manual discrimination method is used to determine whether the user account is an abnormal account. That is, the normal user accounts extracted from multiple platforms are judged as non-abnormal accounts, and the generated non-normal user accounts are judged as abnormal accounts.

[0043] In step S120, the basic information data of the multiple user accounts are used to extract account features and work features, and the account features and work features are jointly analyzed to determine derived features. The derived features, account features, and work features are filtered based on correlation to obtain identification features corresponding to the user accounts.

[0044] The input features of the sample data used to train the random forest model are constructed.

[0045] The obtained plurality of user accounts comprises basic information data. The basic information data contains multi-dimensional information data such as user interaction behavior characteristics, user content characteristics, and user dissemination characteristics. The basic information data is divided into account characteristics and work characteristics.

[0046] The account characteristics are used to indicate characteristics dimensions related to the intrinsic characteristics of the user account. The account characteristics can include but are not limited to account identification, account name, media name, platform name, number of fans, number of followings, authentication status, etc.

[0047] Generally, the account name is used to distinguish different user accounts. Therefore, in the above steps, in the case of the same user account on different platforms, the same account name can be used to determine the aggregation of other account characteristics related to the same account name. When the account characteristics include the number of fans or the number of followings, the number of fans or the number of followings of the same user account on different platforms can be accumulated.

[0048] The work characteristics are used to indicate characteristics dimensions related to the works published by the user account. The work characteristics can include but are not limited to work identification, work publishing territory, work title, work link, work text, work publishing time, number of posts, etc. For the case of the same account name on different platforms, the work characteristics related to the same account name can be aggregated, but not logically calculated.

[0049] The account characteristics and work characteristics corresponding to the plurality of user accounts are jointly analyzed to determine derived characteristics.

[0050] The derived characteristics are used to indicate characteristics dimensions that cannot be directly extracted based on the basic information data of the user account and need to be jointly analyzed based on the account characteristics and work characteristics. The derived characteristics can include but are not limited to media identity, existence of homogeneous scripts, existence of multiple different negative works, publication of negative works through matrix, abnormal work publishing territory, intensive posting in a short period of time, existence of negative works on different topics of the same brand, number of negative works, etc.

[0051] The determination methods of each derived characteristic are introduced below.

[0052] Media identity: The media identity of the user account can be determined as self-media and amateur based on the number of fans and authentication status in the account characteristics.

[0053] For example, a division value is determined for the number of fans. When the number of fans reaches the division value and has authentication, the media identity of the account characteristics is self-media. When the number of fans does not reach the division value (whether or not it has authentication) or the number of fans reaches the division value but does not have authentication, the media identity of the account characteristics is amateur.

[0054] There is script homogenization: for multiple different user accounts of a platform, by identifying the work title and work body in the work features of different user accounts, it is found that multiple different user accounts publish the same works. That is, it is determined that multiple different user accounts exist script homogenization.

[0055] For example, by the work title and work body in the work features, the title body semantic fingerprint of the work is determined. When the similarity of the title body semantic fingerprints of different works reaches a certain value (such as 98%), the different works are determined to be script homogenization works. The derivative features of the multiple user accounts corresponding to the different works are determined to exist script homogenization.

[0056] There are multiple different negative works: natural language processing (NLP) technology can be used to classify the sentiment of the works, and the sentiment of the works is classified as positive, neutral and negative. If a user account of a platform publishes multiple works with different title body semantic fingerprints and negative sentiment classification, the user account has multiple different negative works.

[0057] For example, a division value is determined. When the number of works with different title body semantic fingerprints and negative sentiment classification published by a user account of a platform reaches the division value, the derivative features of the user account are determined to have multiple different negative works.

[0058] Publish negative works through matrix: if the same user account publishes works with the same title body semantic fingerprint on different platforms, the user account has published negative works through matrix.

[0059] Abnormality of work origin: if the work origin of the work features corresponding to a user account frequently changes, the user account has abnormality of work origin.

[0060] For example, the number of different work origins in the work features corresponding to a user account is determined. Generally, normal users usually publish works in fixed locations or in a small number of commonly used locations. Therefore, a division value can be determined. When the number of different work origins in the work features corresponding to a user account is greater than the division value, the derivative features of the user account are determined to have abnormality of work origin.

[0061] Intensive publishing in a short period of time: if the work features corresponding to a user account have multiple works with too short work publishing time intervals, the user account has intensive publishing in a short period of time.

[0062] For example, the works publishing time in the works features corresponding to a user account is sorted. Generally, a normal user needs to write before publishing works, so the works publishing time of adjacent works will not be too short. Therefore, a time length can be determined, and when the time interval of at least two works published by a user account is less than the time length, the derived feature of the user account is determined as intensive publishing in a short time.

[0063] There are negative works for different topics of the same brand: if a user account publishes works with negative sentiment classification for a topic, and also publishes works with negative sentiment classification for other topics of the same brand, then the user account has negative works for different topics of the same brand.

[0064] For example, a brand is associated with multiple topics in different directions. If a user account publishes works with negative sentiment classification for at least two direction topics of the brand, then the derived feature of the user account is determined as negative works for different topics of the same brand.

[0065] Negative work quantity: the total number of negative works can be counted among all works published by a user account after the works are sentiment classified using natural language processing (NLP) technology.

[0066] After determining the account features, work features, and derived features, the features can be sorted based on relevance, and the features with higher relevance sorting are selected as identification features, and the features with lower relevance sorting are removed.

[0067] For example, the account identifier, account name, media name, platform name, fan number, attention number, authentication status, work identifier, work publishing location, work title, work link, work text, work publishing time, work quantity, media identity, existence of copywriting homogeneity, existence of multiple different negative works, negative works published through matrix, abnormal work publishing location, intensive publishing in a short time, negative works for different topics of the same brand, and negative work quantity are sorted based on whether they are strongly related to the determination result of whether the user account is an abnormal account. The existence of copywriting homogeneity and the existence of multiple different negative works with strong correlation can be used as main identification features. The negative works published through matrix, the abnormal work publishing location, the intensive publishing in a short time, and the negative works for different topics of the same brand with medium correlation can be used as secondary identification features. The main identification features and the secondary identification features constitute the identification features, and other features are removed.

[0068] Step S130, training a random forest model using the identification features corresponding to the user account and the target output, and obtaining a trained abnormal account identification model when the evaluation index of the random forest model reaches the preset standard.

[0069] The random forest model is an ensemble learning method that improves the prediction accuracy and stability by constructing multiple decision trees and outputting the mode or average value of the results.

[0070] An initial proportion can be assigned to the identification features corresponding to the determined user account, providing a default initial value for the subsequent training of the random forest model. Then the identification features carrying the initial proportion are sent into the constructed random forest model to obtain the output result of the random forest model. The output result and the target output are often biased. For example, for a user account, the target output based on manual discrimination is an abnormal account, but the output result based on the random forest model is a non-abnormal account.

[0071] The process of training the random forest model is to make the output result as close as possible to the target output or the same as the target output. Therefore, the initial proportion can be adjusted according to the importance of the evaluated identification features and the performance changes of the random forest model, to gradually find the optimal proportion that makes the output result as close as possible to the target output or the same as the target output.

[0072] After determining the optimal proportion, a trained abnormal account identification model is obtained. The abnormal account identification model can be applied to perform abnormal account identification.

[0073] The identification ability of the abnormal account identification model can be continuously monitored, and the performance evaluation and targeted optimization can be regularly performed to ensure the identification accuracy and efficiency of the abnormal account identification model when applied to perform abnormal account identification.

[0074] From Figure 1The method can be seen that the application provides a construction method of an abnormal account identification model. First, basic information data of a plurality of user accounts is acquired, whether the user accounts are abnormal accounts is manually distinguished, a result of distinguishing whether the user accounts are abnormal accounts is taken as a target output, so as to determine a benchmark result of a random forest model. Second, account features and work features are extracted based on the basic information data of the plurality of user accounts, the account features and the work features are jointly analyzed to determine derived features, the derived features, the account features and the work features are filtered based on correlation to obtain identification features corresponding to the user accounts, so as to determine input features of sample data for training the random forest model. Finally, the identification features corresponding to the user accounts and the target output are used to train the random forest model, and when an evaluation index of the random forest model reaches a preset standard, a trained abnormal account identification model is obtained, so that the abnormal account identification model is applied to abnormal account identification. The abnormal account identification model constructed based on the construction method of the abnormal account identification model provided by the application can be compatible with a plurality of different platform use scenarios, is not limited to a specific social media or network platform, has wide applicability and flexibility, can quickly identify abnormal accounts, provides instant feedback for users, effectively responds to rapid changes in the network environment, focuses on common identification features of abnormal accounts, realizes accurate identification through data modeling, effectively reduces misjudgment and omission, and ensures the accuracy and reliability of abnormal account identification.

[0075] In some embodiments of the application, in the above method, in step S110, the basic information data of the plurality of user accounts is acquired, whether the user accounts are abnormal accounts is manually distinguished, and the result of distinguishing whether the user accounts are abnormal accounts is taken as the target output, including: acquiring the basic information data of a plurality of user accounts of a plurality of platforms within a preset time range; manually distinguishing whether the user accounts are abnormal accounts; if any user account is an abnormal account, marking the user account as an abnormal account mark; if any user account is not an abnormal account, marking the user account as a non-abnormal account mark.

[0076] In this embodiment, the basic information data of a plurality of user accounts of a plurality of platforms within a preset time range can be collected.

[0077] For example, in order to collect as much basic information data as possible, 12361 user accounts of multiple platforms (such as Weibo, Xiaohongshu, Kuaishou, TikTok, and Yiche) within a time range of 3 months back from the current time point can be selected. These user accounts include normal user accounts (i.e., user accounts that can be identified as non-abnormal accounts) and non-normal user accounts (i.e., user accounts that can be identified as abnormal accounts). The basic information data corresponding to these user accounts involves 6260183 entries, and the basic information data includes account identifier, account name, media name, platform name, number of fans, number of followers, authentication status, work identifier, work publishing location, work title, work link, work text, work publishing time, etc. The above-mentioned multiple user accounts involve a total of 46972 works in the basic information data.

[0078] For the above-mentioned multiple user accounts, a manual individual identification method is used to mark whether they are abnormal accounts. If any user account is identified by manual identification as a non-normal user account, the user account is marked as an abnormal account; if any user account is identified by manual identification as a normal user account, the user account is marked as a non-abnormal account. The above-mentioned 12361 user accounts are all marked as whether they are abnormal accounts, which serves as the identification result and as the target output for evaluating the trained random forest model, i.e., the benchmark result.

[0079] In some embodiments of the present application, in the above-mentioned method, step S120, the identification features corresponding to the user accounts are obtained by screening the derived features, account features, and work features based on correlation, including: performing normalization and discretization processing on the derived features, account features, and work features to obtain candidate features; using a descriptive statistical method to determine the difference ranking of the candidate features on the identification result of whether the user account is an abnormal account, and screening the first sub-candidate features from the candidate features according to the difference ranking; performing hypothesis testing on the first sub-candidate features to determine the second sub-candidate features; using a Spearman correlation coefficient method to determine the correlation ranking of the second sub-candidate features on the identification result of whether the user account is an abnormal account, and screening the identification features from the second sub-candidate features according to the correlation ranking.

[0080] In this embodiment, the identification features are gradually analyzed based on the basic information data.

[0081] First, the basic information data of multiple user accounts is extracted. The basic information data of user accounts is exemplarily shown in Table 1 below. The basic information data of user accounts shown is for the case where one user account corresponds to one work, which is intended to intuitively show the content of the basic information data. In actual cases, one user account often corresponds to multiple works, so the basic information data in actual cases is not limited to this.

[0082] Table 1:

[0083]

[0084] Based on the basic information data, the account features and the work features are extracted. The account features can include: account identifier, account name, media name, platform name, number of fans, number of followings, authentication status, etc. The work features can include: work identifier, work publishing territory, work title, work link, work text, work publishing time, etc.

[0085] For the extracted account features and work features, some preprocessing operations may be needed to ensure the quality and effectiveness of the account features and work features. For example, cleaning the account features and work features, the cleaning methods include but are not limited to discarding null values, discarding incomplete data, and removing outliers.

[0086] Based on the basic information data in the above Table 1, the work identifier of the three user accounts is null, so the work identifier is discarded.

[0087] Secondly, the derived features are determined based on the joint analysis of the account features and the work features.

[0088] In determining the derived features, the title text semantic fingerprint of each work and the sentiment classification of the work can be calculated first, and the derived features are determined based on this.

[0089] Continuing the example of the above Table 1, Table 2 exemplarily shows the derived features of the user accounts. The derived features in actual situations are not limited to this.

[0090] Table 2:

[0091]

[0092] Next, after determining the account features, work features and derived features, the features are normalized and discretized. The normalization and discretization method can use existing technology, which is not limited here. The purpose of normalization and discretization is to facilitate subsequent screening and identification of features. The normalized and discretized account features, work features and derived features are used as candidate features.

[0093] For example, for the media identity feature in the derived features, if the media identity is self-media, the corresponding field is marked as 1; if the media identity is an amateur, the corresponding field is marked as 2. In addition, based on the results of artificial identification of whether the user account is an abnormal account, the user account can also be normalized and discretized to determine whether it is an abnormal account. The user account is marked as 1 for abnormal account, and the user account is marked as 0 for non-abnormal account.

[0094] Then, a descriptive statistical method is used to preliminarily screen the candidate features.

[0095] The central tendency of the normal user accounts and the abnormal user accounts on each candidate feature is compared by using the mean and the median. The dispersion of the normal user accounts and the abnormal user accounts on each candidate feature is compared by using the standard deviation and the interquartile range. The distribution difference of the normal user accounts and the abnormal user accounts on each candidate feature is compared by using the box plot. The normal user accounts are the user accounts that are determined to be non-abnormal accounts by manual discrimination, and the abnormal user accounts are the user accounts that are determined to be abnormal accounts by manual discrimination.

[0096] By the above-described descriptive statistical method, the difference ranking of each candidate feature is determined, and the candidate features with greater difference are screened as first candidate sub-features.

[0097] For example, the screened first candidate sub-features can include the number of fans, the number of follows, the authentication condition, the number of posts, the media identity, the existence of homogeneous scripts, the existence of multiple different negative works, the publication of negative works through a matrix, the post location abnormality, the intensive posting in a short time, the existence of negative works on different topics of the same brand, and the number of negative works.

[0098] Hypothesis testing is performed on the first candidate sub-features, and second candidate sub-features are determined.

[0099] For the features with continuous properties in the first candidate sub-features, independent sample t-tests can be used. For example, independent sample t-tests are performed on the number of fans, the number of follows, the number of posts, and the number of negative works. For the features with classification properties in the first candidate sub-features, chi-square tests can be used. For example, chi-square tests are performed on the authentication condition, the media identity, the existence of homogeneous scripts, the existence of multiple different negative works, the publication of negative works through a matrix, the post location abnormality, the intensive posting in a short time, and the existence of negative works on different topics of the same brand.

[0100] Based on the results of the hypothesis testing, second candidate sub-features are again screened from the first candidate sub-features. The screened second candidate sub-features can include the number of fans, the number of follows, the number of posts, the media identity, the existence of homogeneous scripts, the existence of multiple different negative works, the publication of negative works through a matrix, the post location abnormality, the intensive posting in a short time, and the existence of negative works on different topics of the same brand.

[0101] Finally, the Spearman correlation coefficient method is used to perform correlation ranking on the second candidate sub-features, and the identification features with higher correlation with the determination result of whether a user account is an abnormal account are screened and determined from the second candidate sub-features.

[0102] Spearman correlation coefficient method is the prior art for evaluating the correlation of two statistical variables in the field. Here, the correlation ranking results calculated based on the Spearman correlation coefficient method are exemplarily shown in Table 3.

[0103] Table 3:

[0104]

[0105] wherein |p| represents the absolute value of the Spearman correlation coefficient.

[0106] Based on the above Table 3, the features with strong correlation and moderate correlation in the second sub candidate features can be retained, and the features with weak correlation can be discarded, so as to screen out the identification features from the second sub candidate features. The identification features can include: existence of multiple different negative works, existence of homogeneous scripts, intensive publishing of works in a short period of time, publishing of negative works through a matrix, abnormal publishing of works, existence of negative works on different topics of the same brand, etc.

[0107] In some embodiments of the present application, in the above method, in step S130, the random forest model is trained by using the identification features corresponding to the user account and the target output, and the trained abnormal account identification model is obtained when the evaluation index of the random forest model reaches the preset standard, comprising: dividing the identification features corresponding to the user account into a training set, a validation set and a test set; assigning an initial proportion to each identification feature in the training set, taking the training set carrying the initial proportion as a training input, and inputting the training input into the constructed random forest model to determine a training output corresponding to the training input; determining an evaluation index according to the training output and the target output, and adjusting the initial proportion to obtain a target proportion with the evaluation index reaching the preset standard as the target; assigning the target proportion to each identification feature in the validation set, taking the validation set carrying the target proportion as a validation input, and assigning the target proportion to each identification feature in the test set, taking the test set carrying the target proportion as a test input; inputting the validation input into the random forest model for validation, and inputting the test input into the random forest model for testing to obtain the trained abnormal account identification model.

[0108] The identification features corresponding to the user account are divided into a training set, a validation set and a test set, and a random forest model is constructed. When dividing the training set, the validation set and the test set, the division can be performed according to the proportion of 70%:15%:15%. This division method is to ensure that the training set has sufficient data quantity to train the random forest model, and also ensures that the validation set and the test set have sufficient independence to evaluate the generalization ability of the random forest model and avoid overfitting or underfitting.

[0109] An initial initial ratio is set for each identified feature to provide a default value for the training of the random forest model. The training set carrying the initial ratio is input into the random forest model as training input to obtain the training output corresponding to the training input.

[0110] For example, under the condition of the initial ratio, for an identified feature corresponding to a user account, the random forest model outputs "1" (abnormal account); and for the user account, the result of manual discrimination of whether the user account is an abnormal account is "0" (non-abnormal account). For another identified feature corresponding to another user account, the random forest model outputs "0" (non-abnormal account); and for the user account, the result of manual discrimination of whether the user account is an abnormal account is "0" (non-abnormal account).

[0111] That is, the training output obtained by inputting the training set with the initial ratio into the random forest model may deviate from the target output, and the deviation leads to inaccurate recognition results of the random forest model. Therefore, an evaluation index can be determined according to the training output and the target output, and the initial ratio is adjusted to obtain a target ratio when the evaluation index reaches a preset standard.

[0112] Specifically, the evaluation index is determined according to the training output and the target output, and the initial ratio is adjusted to obtain a target ratio when the evaluation index reaches a preset standard, including: determining precision, recall, and F1 score according to the training output and the target output; and adjusting the initial ratio to obtain a target ratio when the precision, recall, and F1 score reach a preset standard by using grid search, random search, or Bayesian optimization.

[0113] During the training of the random forest model, the initial ratio of each identified feature can be dynamically adjusted according to the change of the evaluation index. The evaluation index can include precision, recall, and F1 score.

[0114] The precision can be represented as Precision. For a normal user account (i.e., a user account discriminated as a non-abnormal account by manual discrimination), For a non-normal user account (i.e., a user account discriminated as an abnormal account by manual discrimination), where TP represents that the real category is a non-abnormal account and the result of model recognition is also a non-abnormal account; TN represents that the real category is an abnormal account and the result of model recognition is also an abnormal account; FP represents that the real category is an abnormal account but the result of model recognition is a non-abnormal account; and FN represents that the real category is a non-abnormal account but the result of model recognition is an abnormal account.

[0115] The recall can be represented as Recall. For a normal user account (i.e., a user account discriminated as a non-abnormal account by manual discrimination), For non-normal user accounts (i.e., user accounts that are manually identified as abnormal accounts),

[0116] The F1 score can be expressed as F1 Score .

[0117] After determining the above evaluation indicators according to the training output and the target output, the evaluation indicators can be compared with the preset standard to determine whether the evaluation indicators meet the preset standard. For example, the preset standard of the evaluation indicators can be determined as 0.8, and when some of the evaluation indicators do not meet 0.8, the initial proportion is dynamically adjusted.

[0118] When adjusting the initial proportion, the correlation of each identification feature can also be combined. For example, the identification feature with a higher correlation (absolute value of Spearman correlation coefficient) has a higher initial proportion, and the identification feature with a lower correlation (absolute value of Spearman correlation coefficient) has a lower initial proportion.

[0119] Adjusting the initial proportion only once cannot make all evaluation indicators meet the preset standard. Therefore, the optimal proportion set that makes all evaluation indicators meet the preset standard can be found through multiple iterations, and the optimal proportion set is combined as the target proportion. When multiple iterations are used, methods such as grid search, random search, and Bayesian optimization can be used. The above iteration methods are common iteration methods in the prior art, and will not be explained in detail here.

[0120] After determining the target proportion, the target proportion is assigned to each identification feature in the verification set, and the verification set carrying the target proportion is used as the verification input. The target proportion is assigned to each identification feature in the test set, and the test set carrying the target proportion is used as the test input.

[0121] The verification input is sent to the random forest model for verification to evaluate the performance of the random forest model on unseen verification inputs to identify potential overfitting problems. The test input is sent to the random forest model for testing to evaluate the final performance and generalization ability of the random forest model.

[0122] After the above steps, a trained abnormal account identification model is obtained. The final performance of the trained abnormal account identification model on normal user accounts and non-normal user accounts is exemplarily shown in Table 4 as follows.

[0123] Table 4:

[0124]

[0125]

[0126] As can be seen from Table 4, the trained abnormal account identification model performs better in classifying normal users than abnormal users. The abnormal account identification model has achieved a high level of accuracy and recall rate in detecting abnormal users, and the identification effect is good. The abnormal account identification model performs better in detecting normal users.

[0127] The construction method of the abnormal account identification model provided in the present application analyzes the feature data contained in the basic information data, finds out the identification features that affect the identification of abnormal account behavior and normal behavior, determines a reasonable target proportion for these identification features, and finally applies the target proportion through the random forest model to obtain the trained abnormal account identification model, so that the abnormal account identification model can efficiently distinguish abnormal accounts and non-abnormal accounts.

[0128] On the other hand, the present application provides an abnormal account identification method.

[0129] Figure 2 The flowchart of the abnormal account identification method provided in an embodiment of the present application is shown.

[0130] According to Figure 2 As shown in the figure, the method of the present embodiment includes steps S210-S230:

[0131] Step S210, obtaining to-be-identified article data, and determining a user account according to the to-be-identified article data.

[0132] When identifying an abnormal account, to-be-identified article data can be obtained, and the user account that published the to-be-identified article data can be traced back, so as to identify whether the user account is an abnormal account.

[0133] For example, for an article under any topic on a microblog platform, the article is obtained as to-be-identified article data. According to the article, the publishing account that published the article is traced back as a user account.

[0134] Step S220, obtaining basic information data corresponding to the user account in a backtracking time period, and performing feature extraction on the basic information data to obtain identification features.

[0135] After determining the user account, the basic information data corresponding to the user account is obtained from multiple platforms according to a backtracking time period. The backtracking time period can be 6 months, 3 months, or 1 month, etc.

[0136] Continuing the above example, after determining the publishing account on the microblog platform, the same user account as the publishing account is searched on other multiple platforms such as Xiaohongshu, Douyin, Kuaishou, and Yiche, and then the basic information data in the backtracking time period is collected from the multiple platforms.

[0137] The basic information data includes multi-dimensional information data such as user interaction behavior characteristics, user content characteristics, and user propagation characteristics. Based on the basic information data, the account characteristics and the work characteristics are extracted, and the derived characteristics are determined by joint analysis of the account characteristics and the work characteristics. The derived characteristics, the account characteristics, and the work characteristics are filtered based on the correlation to obtain the identification characteristics corresponding to the user account. The specific method of determining the identification characteristics can refer to the content involved in step S120 of the construction method of the abnormal account identification model proposed in the present application. Here, no longer described.

[0138] In step S230, the identification characteristics are sent to the abnormal account identification model for identification to obtain the identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the construction method of the abnormal account identification model proposed in the present application.

[0139] Through the abnormal account identification model, whether the user account is an abnormal account can be directly identified. Thus, the user account is directly classified as an abnormal account or a non-abnormal account.

[0140] For example, for the three user accounts in Table 2, the identification result obtained after identification by the abnormal account identification model is all abnormal accounts.

[0141] In some cases, considering that the classification performance of the abnormal account identification model on normal users is better than that on non-normal users. The following method can also be used for identification. In some embodiments of the present application, the identification characteristics include primary identification characteristics and secondary identification characteristics; obtaining the identification result of whether the user account is an abnormal account includes: determining other user accounts except the non-abnormal accounts as suspected abnormal accounts; if the primary identification characteristics of the suspected abnormal account include the hit result, the suspected abnormal account is determined as an abnormal account; if the primary identification characteristics of the suspected abnormal account do not include the hit result, the suspected abnormal account is determined as an abnormal account-tendency account.

[0142] In the present embodiment, the user account is identified by the abnormal account identification model. If the identification result is a normal user, the user account is directly determined as a non-abnormal account. For other user accounts except the non-abnormal accounts, the primary identification characteristics corresponding to the other user accounts are further used for refined judgment.

[0143] Referring to the correlation ranking given in Table 3, the existence of script homogeneity and multiple different negative works which are strongly related to the determination result of whether the user account is an abnormal account can be taken as the primary identification characteristics, and the publishing of negative works through the matrix, the abnormality of the writing location, the intensive writing in a short time, and the existence of negative works on different topics of the same brand which are moderately related to the determination result of whether the user account is an abnormal account can be taken as the secondary identification characteristics.

[0144] If the primary identification feature of any other user account includes the hit result, the user account is determined as an abnormal account.

[0145] If the primary identification feature of any other user account includes the hit result, the user account is determined as an abnormal account.

[0146] For example, for the user account "IT * home" in Table 2, it is not determined as a non-abnormal account based on the abnormal account identification model, and therefore the identification features thereof are analyzed. Since the primary identification feature "there are multiple different negative works" is "yes", the user account is determined as an abnormal account.

[0147] For the user account "Ni * car" in Table 2, it is not determined as a non-abnormal account based on the abnormal account identification model, and therefore the identification features thereof are analyzed. Since the primary identification features are all "yes", the user account is determined as an abnormal account.

[0148] If the primary identification feature of any other user account does not include the hit result, the user account is determined as an abnormal account-tendency account.

[0149] If the primary identification feature of any other user account does not include the hit result, the user account is determined as an abnormal account-tendency account.

[0150] For example, for the user account "EE * gas?? " in Table 2, it is not determined as a non-abnormal account based on the abnormal account identification model, and therefore the identification features thereof are analyzed. Since the primary identification features are all "no", the user account is determined as an abnormal account-tendency account. The user account needs to be focused on and continuously observed.

[0151] Figure 3 A structure schematic diagram of a construction device of an abnormal account identification model according to an embodiment of the present application is shown. According to the embodiment of the present application, the construction device of the abnormal account identification model includes: Figure 3 As shown in the figure, the device 300 includes:

[0152] A target output determination unit 310 is configured to acquire the basic information data of a plurality of user accounts, manually determine whether the user accounts are abnormal accounts, and determine the determination result of whether the user accounts are abnormal accounts as a target output.

[0153] The identification feature screening unit 320 is configured to extract account features and work features based on the basic information data of the plurality of user accounts, jointly analyze the account features and the work features to determine derivative features, and screen the derivative features, the account features, and the work features based on correlations to obtain identification features corresponding to the user account.

[0154] The model training unit 330 is configured to train a random forest model by using the identification features corresponding to the user account and the target output, and obtain a trained abnormal account identification model when an evaluation index of the random forest model reaches a preset standard.

[0155] In some embodiments of the present application, in the device 300 described above, the target output determination unit 310 is specifically configured to: obtain basic information data of a plurality of user accounts in a plurality of platforms within a preset time range; manually distinguish whether the user accounts are abnormal accounts; if any user account is an abnormal account, mark the user account as an abnormal account mark; if any user account is not an abnormal account, mark the user account as a non-abnormal account mark; and take the distinguishing result of whether the user account is an abnormal account as the target output.

[0156] In some embodiments of the present application, in the device 300 described above, the identification feature screening unit 320 is specifically configured to: perform normalization and discretization processing on the derivative features, the account features, and the work features to obtain candidate features; determine a difference ordering of the candidate features on the distinguishing result of whether the user account is an abnormal account by using a descriptive statistical method, and screen a first sub-candidate feature from the candidate features according to the difference ordering; perform hypothesis testing on the first sub-candidate feature to determine a second sub-candidate feature; determine a correlation ordering of the second sub-candidate feature on the distinguishing result of whether the user account is an abnormal account by using a Spearman correlation coefficient method, and screen the identification features from the second sub-candidate features according to the correlation ordering.

[0157] In some embodiments of the present application, in the device 300 described above, the model training unit 330 is specifically configured to: divide the identification features corresponding to the user account into a training set, a validation set, and a test set; assign an initial proportion to each identification feature in the training set, take the training set carrying the initial proportion as a training input, input the training input into a constructed random forest model, and determine a training output corresponding to the training input; determine an evaluation index according to the training output and the target output, and adjust the initial proportion to obtain a target proportion when the evaluation index reaches a preset standard; assign the target proportion to each identification feature in the validation set, and assign the target proportion to each identification feature in the test set; input the validation input into the random forest model for validation, and input the test input into the random forest model for testing, to obtain the trained abnormal account identification model.

[0158] It should be noted that the above-mentioned abnormal account identification model construction device 300 can implement the above-mentioned abnormal account identification model construction method, and details are not repeated.

[0159] Figure 4 The structure diagram of the abnormal account identification device according to an embodiment of the present application is shown.

[0160] According to Figure 4 As shown in the figure, the device 400 includes:

[0161] The user account determination unit 410 is configured to obtain to-be-identified article data, and determine a user account according to the to-be-identified article data.

[0162] The identification feature determination unit 420 is configured to obtain basic information data corresponding to the user account in a backtracking time period, and perform feature extraction on the basic information data to obtain identification features.

[0163] The abnormal account identification unit 430 is configured to input the identification features into an abnormal account identification model for identification, to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the abnormal account identification model construction method proposed in the present application.

[0164] In some embodiments of the present application, in the above-mentioned device 400, the identification features include main identification features and secondary identification features; and the abnormal account identification unit 430 is specifically configured to: determine other user accounts except for non-abnormal accounts as suspected abnormal accounts; if the main identification features of the suspected abnormal account include a hit result, determine the suspected abnormal account as an abnormal account; and if the main identification features of the suspected abnormal account do not include a hit result, determine the suspected abnormal account as an abnormal account-tendency account.

[0165] Figure 5 The structure diagram of the computer device according to an embodiment of the present application is shown. Figure 5 As shown in the figure, the internal structure of the computer device can include a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium, an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with an external client through a network connection. The computer program is executed by the processor to implement the functions or steps of the abnormal account identification model construction method or the abnormal account identification method.

[0166] In one embodiment, the computer device provided in the present application comprises a memory and a processor, the memory stores a database and a computer program executable on the processor, and the processor implements the following steps when executing the computer program:

[0167] obtaining basic information data of a plurality of user accounts, manually discriminating whether the user accounts are abnormal accounts, and taking the discrimination result of whether the user accounts are abnormal accounts as a target output;

[0168] extracting account features and work features based on the basic information data of the plurality of user accounts, jointly analyzing the account features and the work features to determine derivative features, and screening the derivative features, the account features and the work features based on correlations to obtain identification features corresponding to the user accounts;

[0169] training a random forest model using the identification features corresponding to the user accounts and the target output, and obtaining a trained abnormal account identification model when an evaluation index of the random forest model reaches a preset standard.

[0170] Alternatively, the computer device provided in the present application comprises a memory and a processor, the memory stores a database and a computer program executable on the processor, and the processor implements the following steps when executing the computer program:

[0171] obtaining to-be-identified article data, and determining a user account according to the to-be-identified article data;

[0172] obtaining basic information data corresponding to the user account in a backtracking time period, and extracting identification features from the basic information data;

[0173] sending the identification features into an abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the construction method of the abnormal account identification model provided in the present application.

[0174] In one embodiment, a computer readable storage medium having a computer program stored thereon is also provided, and the computer program is executed by a processor to implement the following steps:

[0175] obtaining basic information data of a plurality of user accounts, manually discriminating whether the user accounts are abnormal accounts, and taking the discrimination result of whether the user accounts are abnormal accounts as a target output;

[0176] extracting account features and work features based on the basic information data of the plurality of user accounts, jointly analyzing the account features and the work features to determine derivative features, and screening the derivative features, the account features and the work features based on correlations to obtain identification features corresponding to the user accounts;

[0177] The random forest model is trained by using the identification feature corresponding to the user account and the target output, and the trained abnormal account identification model is obtained when the evaluation index of the random forest model reaches the preset standard.

[0178] Alternatively, a computer-readable storage medium is also provided, and the computer-readable storage medium stores a computer program. The computer program is executed by a processor to implement the following steps:

[0179] Obtaining to-be-identified article data, determining a user account according to the to-be-identified article data;

[0180] Obtaining basic information data corresponding to the user account in a backtracking time period, and performing feature extraction on the basic information data to obtain identification features;

[0181] The identification features are sent to the abnormal account identification model for identification to obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the construction method of the abnormal account identification model provided in the application.

[0182] It should be noted that the functions or steps that can be implemented by the computer device or the computer-readable storage medium described above can be referred to the related description in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0183] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0184] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above.

[0185] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for constructing an abnormal account identification model, characterized in that, The method includes: The system acquires basic information data from multiple user accounts, manually determines whether each user account is an abnormal account, and outputs the determination result as the target output. The multiple user accounts include different user accounts from multiple platforms. Identical user accounts from different platforms are merged into a single user account, and basic information data from different platforms is aggregated for the merged user account. Based on the basic information data of multiple user accounts, account features and work features are extracted. The account features and work features are jointly analyzed to determine derived features. The derived features, account features, and work features are filtered based on correlation to obtain identification features corresponding to the user account. Among them, the derived features include at least publishing negative works through a matrix. The method for determining the publishing of negative works through a matrix includes: if the same user account publishes works with the same title and text semantic fingerprint on different platforms, then the user account has published negative works through a matrix. The random forest model is trained using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, the trained abnormal account identification model is obtained.

2. The method for constructing an abnormal account identification model according to claim 1, characterized in that, The process of acquiring basic information data from multiple user accounts, manually determining whether the user accounts are abnormal, and outputting the determination results as the target output includes: Acquire basic information data from multiple platforms and multiple user accounts within a preset time range; The user account is manually identified as an abnormal account. If any of the user accounts is an abnormal account, then the user account is marked as an abnormal account. If any of the user accounts is not an abnormal account, then the user account is marked as a non-abnormal account. The result of determining whether the user account is an abnormal account is used as the target output.

3. The method for constructing an abnormal account identification model according to claim 1, characterized in that, The step of filtering the derived features, account features, and work features based on correlation to obtain the identification features corresponding to the user account includes: The derived features, account features, and work features are normalized and discretized to obtain candidate features; Descriptive statistical methods are used to determine the difference ranking of the candidate features in the discrimination result of whether the user account is an abnormal account, and the first sub-candidate feature is selected from the candidate features based on the difference ranking; Perform hypothesis testing on the first sub-candidate feature to determine the second sub-candidate feature; The Spearman correlation coefficient method is used to determine the correlation ranking of the second sub-candidate features on the discrimination result of whether the user account is an abnormal account, and the identification features are selected from the second sub-candidate features according to the correlation ranking.

4. The method for constructing an abnormal account identification model according to claim 1, characterized in that, The process of training a random forest model using the identification features corresponding to the user account and the target output, and obtaining the trained abnormal account identification model when the evaluation metric of the random forest model reaches a preset standard, includes: The identification features corresponding to the user account are divided into a training set, a validation set, and a test set. An initial proportion is assigned to each of the recognition features in the training set, the training set carrying the initial proportion is used as the training input, the training input is fed into the constructed random forest model, and the training output corresponding to the training input is determined. The evaluation index is determined based on the training output and the target output, and the initial ratio is adjusted to obtain the target ratio with the evaluation index reaching the preset standard as the target. Assign the target ratio to each of the identified features in the verification set, and use the verification set carrying the target ratio as verification input; assign the target ratio to each of the identified features in the test set, and use the test set carrying the target ratio as test input; The verification input is fed into the random forest model for verification, and the test input is fed into the random forest model for testing, thus obtaining the trained abnormal account identification model.

5. A method for identifying abnormal accounts, characterized in that, The method includes: Obtain the article data to be identified, and determine the user account based on the article data to be identified; Obtain basic information data corresponding to the user account within the retrospective time period, and extract features from the basic information data to obtain identification features; The identification features are fed into the abnormal account identification model for identification to obtain the identification result of whether the user account is an abnormal account. The abnormal account identification model is constructed by the construction method of the abnormal account identification model according to any one of claims 1-4.

6. The abnormal account identification method according to claim 5, characterized in that, The identification features include primary identification features and secondary identification features; The process of obtaining the identification result of whether the user account is an abnormal account includes: Other user accounts that are not identified as normal accounts will be classified as suspected abnormal accounts. If the main identification features of the suspected abnormal account include a hit result, then the suspected abnormal account is identified as an abnormal account. If the main identification features of the suspected abnormal account do not include the hit result, then the suspected abnormal account is identified as an account with abnormal account tendencies.

7. A device for constructing an abnormal account identification model, characterized in that, The device includes: The target output determination unit is used to acquire basic information data of multiple user accounts, manually determine whether the user accounts are abnormal accounts, and use the determination result of whether the user accounts are abnormal accounts as the target output; wherein, multiple user accounts include different user accounts on multiple platforms; merge the same user accounts on different platforms into the same user account, and aggregate the basic information data of different platforms for the merged user account; The feature filtering unit is used to extract account features and work features based on the basic information data of multiple user accounts, perform joint analysis on the account features and work features to determine derived features, and filter the derived features, account features, and work features based on correlation to obtain the identification features corresponding to the user account; wherein, the derived features include at least publishing negative works through a matrix, and the method for determining that negative works are published through a matrix includes: if the same user account publishes works with the same title and text semantic fingerprint on different platforms, then the user account has published negative works through a matrix; The model training unit is used to train the random forest model using the identification features corresponding to the user account and the target output. When the evaluation index of the random forest model reaches the preset standard, the trained abnormal account identification model is obtained.

8. An abnormal account identification device, characterized in that, The device includes: The user account determination unit is used to acquire the article data to be identified and determine the user account based on the article data to be identified. The feature determination unit is used to obtain basic information data corresponding to the user account within the retrospective time period, and to extract features from the basic information data to obtain identification features. An abnormal account identification unit is used to input the identification features into the abnormal account identification model for identification, and obtain an identification result of whether the user account is an abnormal account, wherein the abnormal account identification model is constructed by the construction method of the abnormal account identification model according to any one of claims 1-4.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for constructing an abnormal account identification model as described in any one of claims 1 to 4, or the method for identifying abnormal accounts as described in claim 5 or 6.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is instructed by the processor, it implements the steps of the method for constructing the abnormal account identification model as described in any one of claims 1 to 4, or the abnormal account identification method as described in claim 5 or 6.

Images