Black product identification and blocking method and device, electronic equipment and storage medium

Abstract

The invention provides a black product identification and blocking method and device, electronic equipment and a storage medium, and relates to the technical field of data processing, at a consumer end, black product identification information provided by a black product database is received in real time, whether equipment submitting a request is black product equipment or not is detected based on the black product identification information, and if yes, the black product identification and blocking method is started. Processing according to a preset interception mechanism; at the administrator end, analyzing the collected first behavior data of the user based on a convolutional neural network, and obtaining a first identification result indicating whether the corresponding behavior is a normal user behavior or an abnormal user behavior, and presetting an additional verification mechanism for the abnormal user behavior; and analyzing the collected second behavior data of the user based on the recurrent neural network, and obtaining a second identification result of the potential black birth behavior. Therefore, in combination with multiple verification means and a deep learning model, the black production equipment and the black production behaviors are comprehensively judged, the accuracy of black production identification is improved, and false visit requests are effectively prevented.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and more specifically, to a method, device, electronic device and storage medium for identifying and blocking illegal activities. Background Art

[0002] With the rapid development of mobile Internet, various mobile applications (Apps) have become an important part of people's daily life and work.

[0003] However, criminals use black market devices to conduct fraudulent activities such as fake visits and fake orders, which seriously affects the healthy development of apps and user experience. Existing solutions often rely on a single verification method, such as IP address detection and device ID identification. These methods are easily bypassed by black market and cannot effectively curb black market activities. In addition, some current methods for identifying black market include: (1) device fingerprint technology, which generates device fingerprints to identify different devices by collecting unique features of the device (such as operating system version, browser version, screen resolution, etc.); behavioral analysis; (2) analyzing user behavior patterns, such as click speed, operation frequency, access path, etc., to distinguish normal users from automated scripts or robots; (3) artificial intelligence and machine learning, using AI and machine learning models to analyze user behavior data, automatically learn and identify potential black market behaviors. Despite these methods, the complexity and variability of black market behaviors make it difficult for a single technology to fully respond, and there is a lack of a more systematic and comprehensive solution to effectively identify and block black market behaviors. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a method, device, electronic device and storage medium for identifying and blocking black industries, which can combine multiple verification methods and deep learning models to make comprehensive judgments on black industry equipment and black industry behaviors, improve the accuracy of black industry identification, and effectively prevent false visit requests.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying and blocking illegal activities, the method comprising the following steps:

[0006] At the consumer end, the black industry identification information provided by the black industry database is received in real time, and based on the black industry identification information, whether the device submitting the request is a black industry device is detected, and if so, it is processed according to the preset interception mechanism;

[0007] On the administrator side, the collected user first behavior data is analyzed based on the convolutional neural network, and a first identification result of whether the corresponding behavior is normal user behavior or abnormal user behavior is obtained, wherein an additional verification mechanism is preset for abnormal user behavior; and the collected user second behavior data is analyzed based on the recurrent neural network, and a second identification result of potential black industry behavior is obtained.

[0008] In some embodiments, the processing according to a preset interception mechanism includes the following steps:

[0009] Block requests submitted by black market devices and notify users to perform secondary verification.

[0010] In some embodiments, the method of analyzing the collected user first behavior data based on a convolutional neural network and obtaining a first recognition result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior includes the following steps:

[0011] Collecting the user's first behavior data; the user's first behavior data includes the user's click, browse, and slide operations within the application;

[0012] Convert the collected user first behavior data into a heat map in the form of an image; the heat map represents the frequency or intensity of different user operations through different colors or brightness;

[0013] The heat map is input into a convolutional neural network to obtain a first recognition result of whether the corresponding behavior is normal user behavior or abnormal user behavior; wherein the convolutional neural network is trained based on heat map sample data labeled with normal user behavior and abnormal user behavior.

[0014] In some embodiments, the additional verification mechanism preset for abnormal user behavior includes one or more of SMS verification code and face recognition.

[0015] In some embodiments, the method of analyzing the collected user second behavior data based on a recurrent neural network and obtaining a second identification result of potential black market behavior includes the following steps:

[0016] After the user visits, collect the user's second behavior data; the user's second behavior data includes device information, IP address, access time, and operation sequence;

[0017] The user's second behavior data is input into a recurrent neural network, and a second recognition result of potential black market behavior is obtained based on the features learned through training; wherein the features learned through training of the recurrent neural network include the dependency and dynamic changes of the user's second behavior data in the time series.

[0018] In some embodiments, the method further comprises the following steps:

[0019] Filtering out real data from the collected user second behavior data based on the second recognition result;

[0020] Generate a report with the real data in a set format and send it to the operation server.

[0021] In some embodiments, the convolutional neural network adopts a multi-layer CNN structure; the recurrent neural network adopts a multi-layer RNN structure including a gated recurrent unit or a long short-term memory unit.

[0022] In a second aspect, an embodiment of the present application provides a device for identifying and blocking illegal activities, the device comprising:

[0023] The first identification module is used to receive the black industry identification information provided by the black industry database in real time at the consumer end, and detect whether the device submitting the request is a black industry device based on the black industry identification information, and if so, process it according to a preset interception mechanism;

[0024] The second identification module is used to analyze the collected user first behavior data based on the convolutional neural network on the administrator side, and obtain a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior, wherein an additional verification mechanism is preset for abnormal user behavior; and to analyze the collected user second behavior data based on the recurrent neural network, and obtain a second identification result of potential black industry behavior.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the black market identification and blocking method described in any one of the first aspects are performed.

[0026] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the black market identification and blocking method described in any one of the first aspects are executed.

[0027] The present application describes a method, device, electronic device and storage medium for identifying and blocking black industries. On the consumer side, the black industry identification information provided by the black industry database is received in real time, and based on the black industry identification information, whether the device submitting the request is a black industry device is detected. If so, it is processed according to the preset interception mechanism; on the administrator side, the collected user first behavior data is analyzed based on the convolutional neural network, and a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior is obtained, wherein an additional verification mechanism is preset for abnormal user behavior; and the collected user second behavior data is analyzed based on the recurrent neural network, and a second identification result of potential black industry behavior is obtained. Thus, a combination of multiple verification methods and deep learning models is used to make a comprehensive judgment on black industry devices and black industry behaviors, improve the accuracy of black industry identification, and effectively prevent false visit requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A flowchart of the method for identifying and blocking illegal activities described in an embodiment of the present application is shown;

[0030] Figure 2 A flowchart of analyzing the collected user first behavior data based on a convolutional neural network and obtaining a first recognition result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior according to an embodiment of the present application is shown;

[0031] Figure 3 A flowchart of analyzing the collected user second behavior data based on a recurrent neural network and obtaining a second identification result of potential black market behavior according to an embodiment of the present application is shown;

[0032] Figure 4 A schematic diagram of the structure of the black market identification and blocking device described in the embodiment of the present application is shown;

[0033] Figure 5 A structural block diagram of an electronic device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0034] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0035] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0036] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0037] In view of the technical problems raised by the background technology, the present application provides a method, device, electronic device and storage medium for identifying and blocking black industries, which can combine multiple verification methods and deep learning models to make comprehensive judgments on black industry equipment and black industry behaviors, improve the accuracy of black industry identification, and effectively prevent false visit requests.

[0038] See the instruction manual Figure 1 , a method for identifying and blocking illegal activities provided in an embodiment of the present application includes the following steps:

[0039] S1. At the consumer end, the black industry identification information provided by the black industry database is received in real time, and based on the black industry identification information, whether the device submitting the request is a black industry device is detected, and if so, it is processed according to a preset interception mechanism;

[0040] S2. On the administrator side, the collected user first behavior data is analyzed based on a convolutional neural network, and a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior is obtained, wherein an additional verification mechanism is preset for abnormal user behavior; and the collected user second behavior data is analyzed based on a recurrent neural network, and a second identification result of potential black industry behavior is obtained.

[0041] Specifically, in step S1, on the C-end, by establishing an effective integration mechanism with the back-end server of the App, real-time docking with the black industry database can be achieved. The black industry database is an important resource for storing various types of black industry related information, and the black industry identification information contained therein is crucial for identifying potential risks. This real-time receiving method of the present application ensures that the App can obtain the latest black industry related clues in a timely manner so as to respond quickly and prevent possible threats from the black industry.

[0042] Once a situation that meets the interception rules is identified, that is, a visit request from a black industry device, action will be automatically taken to block the further transmission of the request. This step is like setting up a solid line of defense at the network entrance to prevent malicious requests related to the black industry from entering the core business processing flow of the App, thereby protecting the security of the App and its users. In addition, while blocking the request, it will also be responsible for recording the relevant data. These recorded data are of great significance for subsequent analysis, tracking, and further improvement of prevention strategies. The recorded content may include information such as the source IP address of the request, the request time, and the key features of the request content, so that when necessary, the event can be traced back to understand the attack mode and characteristics of the black industry.

[0043] Furthermore, in one embodiment, black market devices can be classified into different levels based on the information provided by the black market database and the past analysis and experience of black market activities. Different black market devices may be classified into different risk levels, such as high risk, medium risk, low risk, etc., based on factors such as the frequency of their participation in black market activities, the degree of harm, and the black market fields involved. Differentiated interception mechanisms are implemented for different black market levels.

[0044] For example, the most stringent measures are taken for black market devices that are judged to be high-risk. Once the submission of such devices is identified, not only will the request be directly blocked to prevent any possible malicious operations from being carried out further, but the user will also be notified in time for secondary verification. The user can be notified through message push, SMS or email within the App, etc., requiring the user to reconfirm the identity or perform additional verification steps to ensure that the current operation is indeed the user himself and not a black market element impersonating the user; for medium-risk black market devices, the request will be blocked first, and then the relevant data will be analyzed and investigated more deeply to determine whether further measures such as restricting the use of some functions and requiring users to provide more proof information are needed; and for low-risk black market devices, while blocking the request, detailed data will be recorded and their subsequent behavior will be continuously observed to determine whether the response strategy needs to be upgraded.

[0045] It should be noted that in this application, the black industry database is regularly updated and maintained by a professional team, and its data sources cover a variety of channels, including but not limited to shared data within the industry, data provided by law enforcement agencies, etc., to ensure the accuracy and timeliness of the black industry identification information obtained.

[0046] In step S2, at end A, by deeply integrating the convolutional neural network (CNN) and recurrent neural network (RNN) large model algorithms, it has the ability to conduct comprehensive and in-depth analysis of multi-dimensional data. This integration is not a simple patchwork, but gives full play to the advantages of different algorithms in processing specific data types, aiming to accurately identify various abnormal behaviors.

[0047] See the attached manual for details. Figure 2 The method of analyzing the collected user first behavior data based on a convolutional neural network and obtaining a first recognition result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior includes the following steps:

[0048] S201, collecting user first behavior data; the user first behavior data includes the user's click, browse, and slide operations in the application;

[0049] S202, converting the collected user first behavior data into a heat map in the form of an image; the heat map represents the frequency or intensity of different user operations through different colors or brightness;

[0050] S203. Input the heat map into a convolutional neural network to obtain a first recognition result of whether the corresponding behavior is normal user behavior or abnormal user behavior; wherein the convolutional neural network is trained based on heat map sample data labeled with normal user behavior and abnormal user behavior.

[0051] Specifically, in step S201, in order to gain an in-depth understanding of the user's behavior patterns within the App, it is first necessary to comprehensively collect various types of relevant behavior data. These data cover common operations of users in the process of using the App, such as click operations, which may reflect the user's attention and choice of specific functions or content; browsing behavior, which can reflect the user's browsing path and interest preferences; sliding operations, which can show the user's switching between pages and browsing of long page content, etc. By collecting these rich and diverse behavioral data, sufficient materials can be provided for subsequent analysis. Furthermore, in addition to common behaviors such as clicks, browsing, and sliding, it can also include the user's input content in the App (such as search keywords, comment content, etc.), residence time distribution, switching frequency between different functional modules, etc. This can provide richer information to the CNN model, enabling it to more accurately learn and distinguish different behavior patterns.

[0052] In step S201, the collected user behavior data is converted into a heat map in the form of an image. The heat map is a graphical representation method that presents data distribution and heat in a visual manner. In the present application, the user's behavior data can be mapped to a two-dimensional plane, with different colors or brightness used to represent the frequency or intensity of different behaviors. For example, areas that users frequently click on may appear higher in heat (such as brighter colors) on the heat map, while areas that are less involved are relatively darker. The heat map generated in this way becomes image data that can intuitively reflect user behavior patterns, and can be used as a source of input data for a convolutional neural network (CNN).

[0053] In step S203, the convolutional neural network (CNN) is a deep learning model specifically used for processing data with a grid structure (such as images). In the present application, the converted user behavior heat map is used as input to carry out targeted training on the CNN model. The training process involves providing a large amount of heat map sample data labeled with "normal user behavior" and "abnormal user behavior" to the CNN model. By continuously adjusting parameters such as the neuron connection weights in the CNN model, it is possible to learn the different pattern characteristics of normal user behavior and abnormal user behavior on the heat map. The training process of the convolutional neural network should be a technical means well known to those skilled in the art, and will not be repeated here. The fully trained CNN model can analyze and judge the newly input user behavior heat map by virtue of its learned pattern recognition ability. When faced with an unknown heat map, the CNN model can accurately distinguish whether the behavior pattern belongs to normal user behavior or abnormal user behavior based on the pattern knowledge it has mastered.

[0054] Compared with traditional verification methods, this behavior pattern differentiation capability based on deep learning is expected to significantly improve the accuracy of user behavior verification, thereby more effectively preventing various abnormal behaviors from posing threats to App and user rights. However, it should be noted that although the CNN model can accurately distinguish normal user behavior from abnormal user behavior to a certain extent, there is still a certain possibility of misjudgment, or some more complex abnormal behavior situations may be encountered, resulting in initial verification failure. In order to further ensure the authenticity of the user's identity and the legitimacy of the behavior, it is necessary to introduce additional verification mechanisms for situations where verification fails or is judged to be abnormal behavior. Common methods include SMS verification code verification, that is, when an abnormal situation occurs, a text message containing a verification code will be sent to the user's registered mobile phone number. The user needs to enter the received verification code into the App for verification to prove the authenticity of his identity; another commonly used method is face recognition verification, which calls the camera on the user's device to collect the user's facial image, and then compares it with the user's pre-registered facial image to determine whether the current user is the real person. These additional verification measures can further verify the user's identity from different angles, enhance the reliability of verification, and play an important supplementary role in dealing with verification failures or abnormal behavior.

[0055] See the instruction manual Figure 3 The method of analyzing the collected user second behavior data based on a recurrent neural network and obtaining a second identification result of potential black market behavior includes the following steps:

[0056] S204, after the user visits, collect the user's second behavior data; the user's second behavior data includes device information, IP address, access time, and operation sequence;

[0057] S205. Input the user's second behavior data into a recurrent neural network, and obtain a second recognition result of the potential black market behavior based on the features learned through training; wherein the features learned through training of the recurrent neural network include the dependency and dynamic changes of the user's second behavior data in the time series.

[0058] In step S204, after the user's access request is executed, the data collection mechanism is automatically started to comprehensively obtain various information related to user behavior. Including: (1) Device information, covering the model, system version, hardware configuration and other details of the device used by the user. This information helps to understand the basic situation of the device. Some black market behaviors may implement operations through specific device models or tampered device configurations. (2) IP address, which is a key identifier for identifying the user's network access point. IP addresses of different regions and natures can provide clues for determining the user's source and whether there are abnormalities. For example, some black industries may use some proxy IPs to hide their true identities. (3) Access time, which records the specific time when the user performs the access operation. By analyzing the pattern of access time, such as whether there are frequent visits outside of normal working hours, whether there are a large number of concentrated visits in a short period of time, etc., some abnormal signs that do not conform to normal user behavior patterns can be found. (4) Operation sequence, which records in detail a series of operation steps performed by the user during the visit. This is the most direct content reflecting the user behavior pattern. Normal users usually have a relatively fixed operation process, while black market behaviors often show completely different characteristics from normal users in the operation sequence, such as frequently repeating certain meaningless operations and skipping normal necessary steps.

[0059] In step S205, a recurrent neural network (RNN) is used to conduct an in-depth analysis of the collected user behavior data, with particular emphasis on the analysis of the operation sequence. Among them, RNN has the advantage of processing sequence data and can capture the dependency and dynamic changes of data in time series. During the analysis process, the RNN model will compare and judge the input user operation sequence and other data based on the patterns and features learned by its training. For example, it can identify whether a certain operation sequence is significantly different from the operation sequence of a normal user in a similar visit scenario. If a significant deviation from the normal mode is found, it indicates the existence of potential black production behavior. Further, in this application, according to the analysis results of RNN, real data is also screened, and those data that are judged to be in line with the normal user behavior pattern are screened out to ensure that the data faced by subsequent operators are mainly true and reliable, reducing the misjudgment caused by black production interference. And the analysis results are organized into a report form in a clear and standardized format, and the report content may include statistical information of various types of user behavior data, the number and specific characteristics of suspected cases of black production behavior, and the frequency of occurrence of black production behavior in different time periods. These reports will be provided to the operation server or operation personnel so that they can conduct more in-depth research and analysis and formulate targeted response strategies and measures.

[0060] It should be noted that in the present application, the convolutional neural network adopts a multi-layer CNN structure; the recurrent neural network adopts a multi-layer RNN structure including a gated recurrent unit or a long short-term memory unit. Among them, the reason for combining the convolutional neural network (CNN) and the recurrent neural network (RNN) is that CNN has excellent performance in the field of image recognition, and can accurately capture the various feature information contained in the heat map, and these features actually reflect the characteristics of the user's behavior pattern. By learning and training a large number of normal and abnormal behavior patterns, the key points of distinguishing the two are gradually mastered, thereby realizing accurate analysis and judgment of the user's behavior pattern; unlike CNN, RNN has a natural advantage in analyzing the user's operation sequence. By learning and training a large number of normal and abnormal operation sequences, according to its internal neuron connection and weight adjustment mechanism, it can accurately identify those operation sequences that deviate from the normal mode. For example, when a normal user completes a visit operation, he usually follows certain routine steps, while abnormal behavior may skip certain key steps, frequently repeat certain operations, etc. RNN can keenly perceive these anomalies and judge that there may be abnormal behavior based on this. Therefore, when the convolutional neural network (CNN) and the recurrent neural network (RNN) are combined, the accuracy of identifying abnormal user behavior can be greatly improved, providing a more reliable basis for subsequent processing measures.

[0061] It can be seen that the black industry identification and blocking method provided by this application, combined with the black industry database and multiple verification mechanisms, especially the introduction of deep learning models, significantly improves the accuracy of identifying black industry devices and behaviors, reduces the success rate of false visits, enhances user experience, and provides users with a healthier and safer application environment.

[0062] Based on the same inventive concept, a device for identifying and blocking illegal activities is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned method for identifying and blocking illegal activities in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0063] As the instruction manual Figure 4 As shown, the present application also provides a black market identification and blocking device, the device comprising:

[0064] The first identification module 401 is used to receive the black industry identification information provided by the black industry database in real time at the consumer end, and detect whether the device submitting the request is a black industry device based on the black industry identification information, and if so, process it according to a preset interception mechanism;

[0065] The second identification module 402 is used to analyze the collected user first behavior data based on the convolutional neural network on the administrator side, and obtain a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior, wherein an additional verification mechanism is preset for abnormal user behavior; and to analyze the collected user second behavior data based on the recurrent neural network, and obtain a second identification result of potential black industry behavior.

[0066] In some embodiments, the first identification module 401 performs processing according to a preset interception mechanism, including: blocking requests submitted by black market devices, and notifying users to perform secondary verification.

[0067] In some embodiments, the second identification module 402 analyzes the collected user first behavior data based on a convolutional neural network, and obtains a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior, including: collecting the user first behavior data; the user first behavior data includes the user's click, browse, and slide operations in the application; converting the collected user first behavior data into a heat map in the form of an image; the heat map represents the frequency or intensity of different user operations through different colors or brightness; inputting the heat map into the convolutional neural network to obtain a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior; wherein the convolutional neural network is trained based on the heat map sample data labeled with normal user behavior and abnormal user behavior. Among them, the preset additional verification mechanism for abnormal user behavior includes one or more of SMS verification code and face recognition.

[0068] In some embodiments, the second identification module 402 analyzes the collected user second behavior data based on a recurrent neural network, and obtains a second identification result of the potential black industry behavior, including: collecting the user's second behavior data after the user visits; the user's second behavior data includes device information, IP address, access time, and operation sequence; inputting the user's second behavior data into the recurrent neural network, and obtaining a second identification result of the potential black industry behavior based on the features learned through training; wherein the features learned through training of the recurrent neural network include the dependency and dynamic changes of the user's second behavior data in the time series.

[0069] In some embodiments, the apparatus further comprises:

[0070] A generation module is used to filter out real data from the collected user second behavior data based on the second recognition result; generate a report with the real data in a set format and send it to the operation server.

[0071] The present application provides a black industry identification and blocking device. On the consumer side, the first identification module receives the black industry identification information provided by the black industry database in real time, and detects whether the device submitting the request is a black industry device based on the black industry identification information. If so, it is processed according to the preset interception mechanism; on the administrator side, the second identification module analyzes the collected user first behavior data based on the convolutional neural network, and obtains the first identification result of whether the corresponding behavior is normal user behavior or abnormal user behavior, wherein an additional verification mechanism is preset for abnormal user behavior; and the collected user second behavior data is analyzed based on the recurrent neural network, and the second identification result of potential black industry behavior is obtained. In this way, a variety of verification methods and deep learning models are combined to make a comprehensive judgment on black industry devices and black industry behaviors, improve the accuracy of black industry identification, and effectively prevent false visit requests.

[0072] Based on the same concept of the present invention, the specification is attached Figure 5 As shown, the structure of an electronic device 500 provided in an embodiment of the present application includes: at least one processor 501, at least one network interface 504 or other user interface 503, a memory 505, and at least one communication bus 502. The communication bus 502 is used to realize the connection and communication between these components. The electronic device 500 optionally includes a user interface 503, including a display (for example, a touch screen, LCD, CRT, holographic imaging (Holographic) or projection (Projector), etc.), a keyboard or a pointing device (for example, a mouse, a trackball (trackball), a touch pad or a touch screen, etc.).

[0073] The memory 505 may include a read-only memory and a random access memory, and provides instructions and data to the processor 501. A portion of the memory 505 may also include a non-volatile random access memory (NVRAM).

[0074] In some embodiments, the memory 505 stores the following elements, which may be protected modules or data structures, or subsets thereof, or extended sets thereof:

[0075] Operating system 5051, including various system programs, used to implement various basic services and process hardware-based tasks;

[0076] The application module 5052 includes various application programs, such as a launcher, a media player, a browser, etc., which are used to implement various application services.

[0077] In an embodiment of the present application, by calling the program or instructions stored in the memory 505, the processor 501 is used to execute steps in a method for identifying and blocking black industries, and can combine multiple verification methods and deep learning models to make comprehensive judgments on black industry devices and black industry behaviors, thereby improving the accuracy of black industry identification and effectively preventing false visit requests.

[0078] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the black market identification and blocking method are executed.

[0079] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is run, the above-mentioned black industry identification and blocking method can be executed.

[0080] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0081] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0082] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0083] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0084] Finally, it should be noted that the above embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for identifying and blocking illegal activities, characterized in that: The method comprises the following steps: At the consumer end, the black industry identification information provided by the black industry database is received in real time, and based on the black industry identification information, whether the device submitting the request is a black industry device is detected, and if so, it is processed according to the preset interception mechanism; On the administrator side, the collected user first behavior data is analyzed based on the convolutional neural network, and a first identification result of whether the corresponding behavior is normal user behavior or abnormal user behavior is obtained, wherein an additional verification mechanism is preset for abnormal user behavior; and the collected user second behavior data is analyzed based on the recurrent neural network, and a second identification result of potential black industry behavior is obtained.

2. According to claim 1, a method for identifying and blocking illegal activities is characterized in that: The processing according to the preset interception mechanism includes the following steps: Block requests submitted by black market devices and notify users to perform secondary verification.

3. A method for identifying and blocking illegal activities according to claim 2, characterized in that: The method of analyzing the collected user first behavior data based on a convolutional neural network and obtaining a first recognition result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior includes the following steps: Collecting the user's first behavior data; the user's first behavior data includes the user's click, browse, and slide operations within the application; Convert the collected user first behavior data into a heat map in the form of an image; the heat map represents the frequency or intensity of different user operations through different colors or brightness; The heat map is input into a convolutional neural network to obtain a first recognition result of whether the corresponding behavior is normal user behavior or abnormal user behavior; wherein the convolutional neural network is trained based on heat map sample data labeled with normal user behavior and abnormal user behavior.

4. A method for identifying and blocking illegal activities according to claim 3, characterized in that: in, The additional verification mechanisms preset for abnormal user behavior include one or more of SMS verification code and face recognition.

5. A method for identifying and blocking illegal activities according to claim 4, characterized in that: The method of analyzing the collected user second behavior data based on a recurrent neural network and obtaining a second identification result of potential black market behavior includes the following steps: After the user visits, collect the user's second behavior data; the user's second behavior data includes device information, IP address, access time, and operation sequence; The user's second behavior data is input into a recurrent neural network, and a second recognition result of potential black market behavior is obtained based on the features learned through training; wherein the features learned through training of the recurrent neural network include the dependency and dynamic changes of the user's second behavior data in the time series.

6. A method for identifying and blocking illegal activities according to claim 5, characterized in that: The method further comprises the following steps: Filtering out real data from the collected user second behavior data based on the second recognition result; Generate a report with the real data in a set format and send it to the operation server.

7. A method for identifying and blocking illegal activities according to claim 6, characterized in that: in, The convolutional neural network adopts a multi-layer CNN structure; the recurrent neural network adopts a multi-layer RNN structure including a gated recurrent unit or a long short-term memory unit.

8. A device for identifying and blocking illegal activities, characterized in that: The device comprises: The first identification module is used to receive the black industry identification information provided by the black industry database in real time at the consumer end, and detect whether the device submitting the request is a black industry device based on the black industry identification information, and if so, process it according to a preset interception mechanism; The second identification module is used to analyze the collected user first behavior data based on the convolutional neural network on the administrator side, and obtain a first identification result of whether the corresponding behavior is a normal user behavior or an abnormal user behavior, wherein an additional verification mechanism is preset for abnormal user behavior; and to analyze the collected user second behavior data based on the recurrent neural network, and obtain a second identification result of potential black industry behavior.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via the bus. When the machine-readable instructions are executed by the processor, the steps of the black market identification and blocking method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the black market identification and blocking method as described in any one of claims 1 to 7.

Images