Object group identification method and related equipment

Abstract

The invention discloses an object group identification method and related equipment. The method comprises the following steps: acquiring operation content information of a plurality of content publishing objects in at least one dimension; according to the operation content information, aggregating the content publishing objects to obtain a primary object group; for each primary object group, mining social relation data corresponding to each content publishing object in the primary object group so as to mine a target social association object having an influence on the primary object group; and combining the primary object groups according to the target social association object and the abnormity degree of the content publishing objects in the primary object groups to obtain a potential abnormal target object group. The method can be better suitable for an organized team discovering anomaly detection scene, the discovery efficiency of the abnormal object and the recall rate of the abnormal object are improved, and therefore the detection range of the abnormal object is widened.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an object group recognition method and related equipment. Background Art

[0002] With the development of Internet technology, various contents are emerging on the Internet. However, some contents contain fraudulent and illegal information, which will have a negative impact on users, enterprises and the entire Internet ecosystem. In order to build a good network environment, it is necessary to detect anomalies on the content on the network or the users who publish the content.

[0003] Among the current related technologies, existing work on anomaly detection is mainly focused on the task of detecting individual fraudulent users. However, with the development of the platform, fraudulent and illegal behaviors have become more and more complex, gradually shifting to a community model, forming a community scale of organized group evil. The current detection method cannot adapt well to the current complex fraud scenarios, resulting in a relatively low recall rate for abnormal objects and a small range of anomaly detection. Summary of the invention

[0004] The embodiments of the present application provide an object group identification method and related equipment. The related equipment may include an object group identification device, an electronic device, a computer-readable storage medium and a computer program product, which can be better applied to anomaly detection scenarios of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects.

[0005] The present application provides a method for identifying a group of objects, including:

[0006] Obtaining operation content information of multiple content publishing objects in at least one dimension;

[0007] Aggregating the plurality of content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each primary object group including at least one content publishing object;

[0008] For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to mine the target social associated object that has an impact on the primary object group;

[0009] According to the abnormality of the target social associated object and the content publishing object in the primary object group, the primary object group is merged to obtain at least one target object group with potential abnormality.

[0010] Accordingly, an embodiment of the present application provides an object group recognition device, including:

[0011] An acquisition unit, used to acquire operation content information of multiple content publishing objects in at least one dimension;

[0012] an aggregation unit, configured to aggregate the plurality of content publishing objects according to the operation content information corresponding to each content publishing object, to obtain at least one primary object group, each primary object group including at least one content publishing object;

[0013] A mining unit, configured to mine, for each primary object group, social relationship data corresponding to each content publishing object in the primary object group, so as to mine target social related objects that have an impact on the primary object group;

[0014] A merging unit is used to merge the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality.

[0015] Optionally, in some embodiments of the present application, the aggregation unit may include a construction subunit, a similarity determination subunit and an aggregation subunit, as follows:

[0016] The construction subunit is used to construct a content heterogeneous relationship graph corresponding to each content publishing object according to the operation content information corresponding to the content publishing object, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing object and the operation content information in at least one dimension;

[0017] A similarity determination subunit, configured to determine the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph;

[0018] The aggregation subunit is used to aggregate the multiple content publishing objects according to the object similarities to obtain at least one primary object group.

[0019] Optionally, in some embodiments of the present application, the content heterogeneous relationship graph includes at least one node and an edge between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents an association relationship between two nodes connected thereto;

[0020] The similarity determination subunit can be specifically used to, for each two content publishing objects, according to a preset meta-path, walk object nodes and content nodes in the content heterogeneous relationship graph through the edges between nodes, so as to query the meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, and the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph; according to the meta-path instance under the preset meta-path, calculate the object similarity between the two content publishing objects.

[0021] Optionally, in some embodiments of the present application, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0022] Determining the similarity between the two content publishing objects under the preset meta-path based on the number of meta-path instances under the preset meta-path;

[0023] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0024] Optionally, in some embodiments of the present application, the similarity determination subunit can be specifically used to determine the operational content similarity between each content publishing object based on the operational content information associated with each content publishing object in the content heterogeneous relationship graph; obtain the environment heterogeneous relationship graph corresponding to the content publishing object, the environment heterogeneous relationship graph characterizing the association relationship between the content publishing object and the operational environment information on at least one dimension; determine the operational environment similarity between each content publishing object based on the operational environment information associated with each content publishing object in the environment heterogeneous relationship graph; determine the object similarity between each content publishing object based on the operational content similarity and the operational environment similarity.

[0025] Optionally, in some embodiments of the present application, the mining unit may include a mining subunit and a selection subunit, as follows:

[0026] The mining subunit is used to mine, for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes social associated objects corresponding to each content publishing object in the primary object group;

[0027] The selection subunit is used to select a target social associated object corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group.

[0028] Optionally, in some embodiments of the present application, the mining sub-unit can be specifically used to construct a social relationship network based on the social relationship data of each content publishing object in the primary object group, the social relationship network including the association relationship between the content publishing object and social information on at least one dimension; based on a preset social association path for the content publishing object, perform node wandering in the social relationship network to query the social association path instance corresponding to the content publishing object under the preset social association path; determine the social association object corresponding to the content publishing object based on the social association path instance, and obtain the social object set corresponding to the primary object group.

[0029] Optionally, in some embodiments of the present application, the selection subunit can be specifically used to determine, for each social associated object in the social object set, quantity information of content publishing objects in the primary object group that have an associated relationship with the social associated object; determine, based on the quantity information, the influence of the social associated object on the primary object group; and select, from the social object set, a target social associated object corresponding to the primary object group.

[0030] Optionally, in some embodiments of the present application, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0031] Taking the node corresponding to the social association object as a root node and based on the social association path instance, constructing a social tree model corresponding to the social association object;

[0032] Determine the quantity information of the content publishing objects belonging to the primary object group among the content publishing objects corresponding to the leaf nodes in the social tree model.

[0033] Optionally, in some embodiments of the present application, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0034] Aggregating the social association path instances corresponding to the content publishing objects in the primary object group to obtain an aggregated network;

[0035] The in-degree of the primary object group to the social associated object is calculated according to the aggregated network, where the in-degree represents quantity information of content publishing objects that are associated with the social associated object.

[0036] Optionally, in some embodiments of the present application, the merging unit may include a similarity calculation subunit, a merging subunit and a group determination subunit, as follows:

[0037] The similarity calculation subunit is used to calculate the group similarity between each primary object group according to the target social associated object corresponding to each primary object group;

[0038] a merging subunit, configured to merge the primary object groups according to the group similarities to obtain at least one merged object group;

[0039] The group determination subunit is used to determine a target object group with potential abnormalities from the merged object group according to the abnormality degree of the content publishing object in the merged object group.

[0040] Optionally, in some embodiments of the present application, the similarity calculation subunit can be specifically used to determine, for each two primary object groups, the initial similarity corresponding to the two primary object groups according to the overlap of the target social associated objects corresponding to the two primary object groups; calculate the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups; and determine the group similarity between the two primary object groups based on the initial similarity and the overall influence.

[0041] Optionally, in some embodiments of the present application, the step of “calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups” may include:

[0042] For each target social association object corresponding to the two primary object groups, calculating the influence of the target social association object on the two primary object groups;

[0043] The influences of each target social associated object on the two primary object groups are merged to obtain the overall influences of the target social associated objects corresponding to the two primary object groups on the two primary object groups.

[0044] An electronic device provided in an embodiment of the present application includes a processor and a memory, wherein the memory stores a plurality of instructions, and the processor loads the instructions to execute the steps in the object group recognition method provided in the embodiment of the present application.

[0045] The embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps in the object group identification method provided in the embodiment of the present application are implemented.

[0046] In addition, an embodiment of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the steps in the object group identification method provided in the embodiment of the present application.

[0047] The embodiments of the present application provide an object group identification method and related devices; the operation content information of multiple content publishing objects in at least one dimension can be obtained; according to the operation content information corresponding to each content publishing object, the multiple content publishing objects are aggregated to obtain at least one primary object group, and each primary object group includes at least one content publishing object; for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group is mined to mine the target social associated objects that have an impact on the primary object group; according to the abnormality of the target social associated objects and the content publishing objects in the primary object group, the primary object groups are merged to obtain at least one target object group with potential abnormality.

[0048] The present application can first construct a primary object group through the operation content information corresponding to the content publishing object, and mine the social relationship data corresponding to the content publishing object to determine the actual manipulation object of the primary object group, that is, the target social related object, and then merge the primary object group according to the target social related object to obtain a potential abnormal target object group, which can be better applied to the anomaly detection scenario of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1a is a schematic diagram of a scene of an object group recognition method provided in an embodiment of the present application;

[0051] Figure 1b is a flow chart of the object group identification method provided by an embodiment of the present application;

[0052] Figure 1c is an illustration of an object group identification method provided in an embodiment of the present application;

[0053] Figure 1d is another illustration of the object group identification method provided by an embodiment of the present application;

[0054] Figure 1e is another illustration of the object group identification method provided by an embodiment of the present application;

[0055] Figure 1fis a page diagram of an object group identification method provided in an embodiment of the present application;

[0056] Figure 1g is another page schematic diagram of the object group identification method provided by an embodiment of the present application;

[0057] Figure 1h is another page schematic diagram of the object group identification method provided by an embodiment of the present application;

[0058] Figure 1i is another illustration of the object group identification method provided by an embodiment of the present application;

[0059] Figure 1j is another illustration of the object group identification method provided by an embodiment of the present application;

[0060] Figure 1k is another flow chart of the object group identification method provided by an embodiment of the present application;

[0061] Figure 1l is another illustration of the object group identification method provided by an embodiment of the present application;

[0062] Figure 1m is another page schematic diagram of the object group identification method provided by an embodiment of the present application;

[0063] Figure 1n is another page schematic diagram of the object group identification method provided by an embodiment of the present application;

[0064] Figure 1o is another flow chart of the object group identification method provided by an embodiment of the present application;

[0065] Figure 2 is another flow chart of the object group identification method provided by an embodiment of the present application;

[0066] Figure 3 is a schematic diagram of the structure of an object group identification device provided in an embodiment of the present application;

[0067] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0069] The present application provides an object group recognition method and related equipment, and the related equipment may include an object group recognition device, an electronic device, a computer readable storage medium and a computer program product. The object group recognition device may be integrated in an electronic device, and the electronic device may be a terminal or a server.

[0070] It is understandable that the object group identification method of this embodiment can be executed on a terminal, can be executed on a server, or can be executed by both a terminal and a server. The above examples should not be construed as limiting the present application.

[0071] like Figure 1a As shown, the object group recognition method is performed by a terminal and a server together as an example. The object group recognition system provided by the embodiment of the present application includes a terminal 10 and a server 11, etc. The terminal 10 and the server 11 are connected via a network, such as a wired or wireless network connection, etc., wherein the object group recognition device can be integrated in the server.

[0072] The server 11 may be used to: obtain a content heterogeneous relationship graph corresponding to at least two content publishing objects, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing objects and the operation content information on at least one dimension; determine the object similarity between the content publishing objects according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph; perform aggregation processing on the at least two content publishing objects according to the object similarity to obtain at least one primary object group, each primary object group including at least one content publishing object; for each primary object group, perform mining on the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes the social associated objects corresponding to each content publishing object in the primary object group; select a target social associated object corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group; and perform merging processing on the primary object group according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality. The server 11 may be a single server, or a server cluster or a cloud server composed of multiple servers.

[0073] The terminal 10 can be used to receive at least one target object group with potential abnormality sent by the server 11, and detect and audit these target object groups. The terminal 10 can include a mobile phone, an intelligent voice interaction device, an intelligent home appliance, a vehicle terminal, an aircraft, a tablet computer, a laptop computer, or a personal computer (PC). A client can also be set on the terminal 10, and the client can be an application client or a browser client, etc.

[0074] The steps of object group recognition and the like in the server 11 may also be executed by the terminal 10 .

[0075] The object group recognition method provided in the embodiment of the present application relates to natural language processing and computer vision technology in the field of artificial intelligence.

[0076] Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science. It attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making. Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level technology and software-level technology. Among them, artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, as well as machine learning / deep learning, autonomous driving, smart transportation and other major directions.

[0077] Among them, natural language processing (NLP) is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language people use in daily life, so it is closely related to the study of linguistics. Natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question answering, knowledge graph and other technologies.

[0078] Among them, Computer Vision (CV) is a science that studies how to make machines "see". To put it more specifically, it refers to machine vision such as using cameras and computers to replace human eyes to identify and measure targets, and further perform graphic processing to make computer processing into images that are more suitable for human eye observation or transmission to instruments for detection. As a scientific discipline, computer vision studies related theories and technologies, and attempts to establish an artificial intelligence system that can obtain information from images or multidimensional data. Computer vision technology usually includes image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous positioning and map construction, automatic driving, smart transportation and other technologies, as well as common biometric recognition technologies such as face recognition and fingerprint recognition.

[0079] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0080] This embodiment will be described from the perspective of an object group recognition device. The object group recognition device may be integrated into an electronic device, which may be a server or a terminal.

[0081] It is understandable that in the specific implementation of this application, user information, such as social information and other related data, is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0082] like Figure 1b As shown, the specific process of the object group identification method can be as follows:

[0083] 101. Obtain operation content information of multiple content publishing objects in at least one dimension.

[0084] The content publishing object may be a content publishing account. Specifically, the content publishing object may publish content through a target application. The published content may include video, image, audio, and text, etc. This embodiment does not limit this. The target application may be an instant messaging application, etc.

[0085] Among them, the operation content information on at least one dimension may include the published content, the topics involved in the content, the modified object attributes, etc. The object attributes may include account avatar, nickname, signature, etc.

[0086] 102. Aggregate the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each primary object group including at least one content publishing object.

[0087] Optionally, in this embodiment, the step of “aggregating the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group” may include:

[0088] According to the operation content information corresponding to each content publishing object, a content heterogeneous relationship graph corresponding to the content publishing object is constructed, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing object and the operation content information in at least one dimension;

[0089] Determine the object similarity between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph;

[0090] According to the object similarities, the multiple content publishing objects are aggregated to obtain at least one primary object group.

[0091] Optionally, in this embodiment, the content heterogeneous relationship graph includes at least one node and edges between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents the association relationship between the two nodes connected thereto.

[0092] Among them, an edge is a line between two nodes, and the connected nodes on the content heterogeneous relationship graph have an association relationship, which can be specifically reflected in the existence of an interactive relationship or similar node content, etc. Specifically, the node types of the two connected nodes can be the same or different.

[0093] Optionally, this embodiment can generate object nodes corresponding to each content publishing object and content nodes corresponding to the operation content information on each dimension according to each content publishing object and the operation content information on at least one dimension corresponding to the content publishing object, and then connect each node according to the association between the content publishing object corresponding to each object node and the operation content information corresponding to each content node, so as to obtain a content heterogeneous relationship graph. For example, when content publishing object A has published dynamic 1, content publishing object B has published dynamic 2, and the content similarity between dynamic 1 and dynamic 2 is higher than 90%, then the object node corresponding to content publishing object A and the content node corresponding to dynamic 1 can be connected, the object node corresponding to content publishing object B and the content node corresponding to dynamic 2 can be connected, and then the content node corresponding to dynamic 1 and the content node corresponding to dynamic 2 can be connected. Among them, the published dynamic is the operation content information.

[0094] In a specific scenario, Figure 1c As shown, the heterogeneous relationship diagram based on the account owner behavior hierarchy is the content heterogeneous relationship diagram mentioned above. The account owner refers to the content publishing object, among which there are object nodes corresponding to the three content publishing objects of user A, user B and user C. The heterogeneous relationship diagram contains the association relationship between these three object nodes and other content nodes. These content nodes include the account owner's signature, dynamics, topics, and screen face library, etc. The association relationship between nodes may include posting dynamics, modifying signatures, dynamic screen similarity, etc.

[0095] Optionally, in this embodiment, the content heterogeneous relationship graph includes at least one node and an edge between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents the association relationship between the two nodes connected thereto;

[0096] The step of “determining the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph” may include:

[0097] For every two content publishing objects, according to a preset meta-path, object nodes and content nodes are roamed in the content heterogeneous relationship graph through the edges between the nodes to query a meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, wherein the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph;

[0098] The object similarity between the two content publishing objects is calculated according to the meta-path instance under the preset meta-path.

[0099] Among them, the meta-path is the network pattern defined in the graph A path type on can be represented as a path with a source node and the target node A is a directed acyclic graph of , where A represents a node and Q represents an edge between nodes. The meta-path can be defined as Among them A i Indicates the node type, R i It is represented as an association between two node types. A node sequence that satisfies a meta-path definition is called an instance of the meta-path.

[0100] The starting node and the ending node of the preset meta-path may be two content publishing objects, and the head and tail of the generated node sequences are also content nodes corresponding to the content publishing objects. The preset meta-path may be set according to actual conditions.

[0101] By defining the meta-path, you can get the instances of these meta-paths. The meta-path instance is the actual relationship list defined under the meta-path. If there exists a path ρ=(v1,v2,v2,…,v l ) and v i ∈V,Φ(v i )=A i ,(v i ,v i+1 )∈R i , then the path ρ is called a meta-path An example of where v i Represents a node. All paths that meet the conditions constitute a meta-path Example path set for

[0102] refer to Figure 1c , the preset meta-path built based on the account owner behavior hierarchy can be "User-Feed-TOPIC-Feed-User", "User-Feed-Feed-User", "User-DESC-TOPIC-DESC-User", "User-SIG-SIG-User" and "User-IMG-IMG-User", where the edge represents the association relationship of publish, mention, similar with, and modify. Feed represents dynamics, TOPIC represents the topic involved in the published content, DESC represents the corresponding content description of the published content, SIG represents signature, and IMG represents image.

[0103] For example, in the default meta path In "User-Feed-Feed-User", "Alice-X movie clip-X commentary short video-Bob" is a path instance, indicating that user Alice published a video clip related to movie X, and user Bob also published a similar short video commentary on movie X, so the two users have a relationship with similar content.

[0104] In heterogeneous networks, random walks are usually used to obtain these meta-path instances. Given a heterogeneous network and a meta path The random walk strategy follows the following formula (1) to obtain the sequence of nodes:

[0105]

[0106] Among them, p(n t+1 =x|n t =v,P) means that under the constraint of the preset meta-path P, from node n t Walk to node n t+1 The probability of n t represents the tth node of the path, (v,x)∈Ψ indicates that there is an edge association between node v and node x, Φ(x)=A t+1 Indicates that the node type of the x node belongs to A t+1 , N t+1 (v) indicates that the first-order neighbor nodes of node v belong to A t+1 A collection of nodes of type |N t+1 (v)| represents the number of elements in the corresponding set. Through formula (1), random walk can be performed under the constraint of the path. Specifically, the node walks on the heterogeneous graph according to the above probability formula to generate the node sequence under the corresponding path until the number of sequences reaches the threshold, and the random walk ends.

[0107] Optionally, in this embodiment, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0108] Determining the similarity between the two content publishing objects under the preset meta-path according to the weight information of the edges between the nodes in the meta-path instance under the preset meta-path;

[0109] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0110] In one embodiment, the meta-path similarity calculation of the number owner relationship is performed under these meta-path definitions, and the path similarity matrix A p The calculation is shown in formula (2):

[0111] A p =R1xR2x…xR i x…xR l (2)

[0112] Where R i Represents the path node v i and node v i+1 The adjacency matrix of node v can also be considered as i and node v i+1 The weight information of the edges.

[0113] However, in actual business implementation, this similarity calculation method may lead to huge consumption of computing resources. In other embodiments, the number owner similarity can be calculated by calculating the number of meta-path instances that are related between two users.

[0114] Optionally, in this embodiment, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0115] Determining the similarity between the two content publishing objects under the preset meta-path based on the number of meta-path instances under the preset meta-path;

[0116] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0117] When the random walk algorithm is finished, the number of meta-path instances associated between two account owners is calculated and used as the similarity between the two account owners on the current meta-path. In this way, the path similarity between account owners on each meta-path can be obtained in turn.

[0118] According to the weight information corresponding to each preset meta-path, the similarity of the two content publishing objects under each preset meta-path can be processed to obtain the processed similarity of the two content publishing objects under each preset meta-path, and then the object similarity between the two content publishing objects can be determined according to the processed similarity of the two content publishing objects under each preset meta-path. The processing method can be to multiply the weight information by the similarity.

[0119] The step of “determining the object similarity between the two content publishing objects according to the processed similarities of the two content publishing objects under each preset meta-path” may include:

[0120] Determining the maximum processed similarity as the object similarity between the two content publishing objects;

[0121] Alternatively, the processed similarities of the two content publishing objects under each preset meta-path are merged to obtain the object similarity between the two content publishing objects.

[0122] The fusion method may be weighted summation.

[0123] In the algorithm implementation, this embodiment can adopt a meta-path-based heterogeneous graph mining method. The complex association relationship of accounts is modeled using heterogeneous networks, and common association patterns are extracted in group association analysis as the initial meta-paths for heterogeneous graph mining, and the similarity of account owners is converted into similarity on these meta-paths. This meta-path-based heterogeneous network method can enrich the semantic expression of account owner similarity and has better explanatory power for aggregated groups.

[0124] Optionally, in this embodiment, the step of “determining the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph” may include:

[0125] Determine the similarity of operation contents between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph;

[0126] Acquire an environment heterogeneous relationship graph corresponding to the content publishing object, wherein the environment heterogeneous relationship graph represents an association relationship between the content publishing object and operating environment information in at least one dimension;

[0127] Determine the similarity of the operating environments between the content publishing objects according to the operating environment information associated with the content publishing objects in the environment heterogeneous relationship graph;

[0128] Based on the operation content similarity and the operation environment similarity, object similarity between respective content publishing objects is determined.

[0129] Among them, this embodiment can evaluate the similarity of account owners through two dimensions, which are the account owner behavior level and the account owner environment level. The correlation relationship at the account owner behavior level is very intuitive and obvious. For example, if two users publish multiple similar contents recently, they are likely to be in the same group (it is emphasized that the group here does not necessarily have malicious intent, but is closer to a social community). However, in actual applications, a single model definition is difficult to cope with some reasonable scenarios. For example, fans often post content dynamics related to idols out of their admiration for idols. These behaviors are spontaneous tendencies, and most fans do not have direct social or organizational connections. Under normal circumstances, these spontaneous behaviors should not be regarded as abnormal group behaviors due to contingency. This embodiment can define a co-occurrence rule constraint, which is the similarity at the account owner environment level. Under this co-occurrence rule constraint, the similarity of users at the content behavior level will be limited to the association based on the environment level behind it.

[0130] The similarity of the operation content and the similarity of the operation environment may be fused to obtain the object similarity between the various content publishing objects, and the fusion method may be multiplication or the like.

[0131] In this embodiment, based on the heterogeneous relationship between the account owner's behavior and the account owner's environment, possible meta-path patterns between various group members can be extracted through data analysis and behavior pattern decomposition of the group. The definition of these meta-paths is an abstraction of the similarity of the account owners.

[0132] The step of “determining the similarity of operation contents between the respective content publishing objects according to the operation content information associated with the respective content publishing objects in the content heterogeneous relationship graph” may include:

[0133] For every two content publishing objects, according to a preset meta-path, object nodes and content nodes are roamed in the content heterogeneous relationship graph through the edges between the nodes to query a meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, wherein the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph;

[0134] The operation content similarity between the two content publishing objects is calculated according to the meta-path instance under the preset meta-path.

[0135] Specifically, after the random walk algorithm ends, the number of meta-path instances associated between two account owners can be used as the similarity of the operation contents of the two account owners on the current meta-path.

[0136] like Figure 1c The following table shows representative key metapaths. For example, in the metapath In the meta-path, the meta-path can describe that two users will publish similar video content at the level of account owner behavior. This can describe that two account owners from the same group would use similar account avatars.

[0137] In this embodiment, the environment heterogeneous relationship graph includes at least one node and edges between nodes, the node includes an object node corresponding to the content publishing object and an environment node corresponding to the operating environment information, and the edge represents the association relationship between the two nodes connected thereto;

[0138] The step of “determining the similarity of the operating environments between the content publishing objects according to the operating environment information associated with the content publishing objects in the environment heterogeneous relationship graph” may include:

[0139] For every two content publishing objects, according to a preset meta-path, the object nodes and the environment nodes are roamed in the environment heterogeneous relationship graph through the edges between the nodes to query a meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, wherein the preset meta-path is used to represent a connection relationship between the nodes in the environment heterogeneous relationship graph;

[0140] The similarity of the operating environments between the two content publishing objects is calculated according to the meta-path instance under the preset meta-path.

[0141] The operating environment information may include the wifi (Wireless Fidelity) to which the device used by the content publishing object is connected, the device used, and the discussion group involved.

[0142] Among them, when the random walk algorithm ends, the number of meta-path instances associated between two account owners can be used as the similarity of the operating environments of the two account owners on the current meta-path.

[0143] In a specific scenario, Figure 1c As shown in the figure, the heterogeneous relationship diagram based on the account owner environment level, that is, the environment heterogeneous relationship diagram mentioned above, the account owner refers to the content publishing object, among which there are object nodes corresponding to the three content publishing objects, user A, user B and user C. The heterogeneous relationship diagram contains the association relationship between these three object nodes and other environment nodes, which include devices, wifi, registration information, certification units, discussion groups, and administrators corresponding to the groups. The association relationship between nodes may include login, authentication, connection, organization, joining a discussion group, etc.

[0144] Specifically, the preset meta-paths constructed based on the number owner environment hierarchy can be D1 "User-WIFI-User", D2 "User-DEC-User", D3 "User-ROOM-USER-ROOM-User", and D4 "User-AUTH-User", where the edge representations of the associations can be connect, login, active in, organize, and certified. DEC represents the device, ROOM represents the discussion group joined, and AUTH represents the certification unit.

[0145] like Figure 1c As shown, for each number master environment level preset meta-path, the preset meta-path D can be obtained. j The multi-relational isomorphic graph similarity matrix under Each isomorphic graph similarity matrix may include the similarity of the operating environment between two hosts on the corresponding meta-path; similarly, for each host behavior level preset meta-path, the preset meta-path P can be obtained. i The multi-relational isomorphic graph similarity matrix under Each isomorphic graph similarity matrix may include the similarity of operation contents between two nodes on corresponding meta-paths.

[0146] The similarity matrices under multiple paths are fused, and finally the pairwise similarity relationship between the account owners is calculated. Considering that the degree of association between different paths is different in reality. In the fusion of multiple relationships, we weighted these meta-paths, and the account owner similarity is also characterized as the weighted similarity of these paths, giving higher prior weights to paths with higher degree of association. For example, in terms of the degree of environmental association, the device association of the account owner is stronger than its association at the WiFi level. The similarity between account owners in terms of device similarity is more credible than the WiFi similarity. The weighted matrix similarity calculation is shown in the following formula (3):

[0147]

[0148] Among them, the meta-path strength weight can be set through formula (3), Represents the meta-path P i The weighted primary similarity matrix of Represents the meta-path D j The weighted primary similarity matrix, δ i and δ j For each path number master similarity matrix obtained, the final number master similarity calculation of the primary group can be completed according to the following formula (4) and formula (5) multi-path aggregation logic:

[0149] S(P)=max{S1,S2,…,S i ,…} (4)

[0150] S(D)=max{S1,S2,…,S j ,…} (5)

[0151] Considering the problem of low group purity caused by weakly associated paths, this embodiment defines a co-occurrence rule constraint, as shown in formula (6):

[0152] S′=S(P)*S(D) (6)

[0153] Among them, the similarity matrix S(P) based on the owner's behavior and the similarity matrix S(D) based on the owner's environment level are fused to finally obtain the owner's similarity matrix S'. The similarity matrix can include the owner similarity between two owners, such as Figure 1c As shown, the similarity matrix corresponding to the account owners u1, u2, u3, u4 and u5 is shown. In some embodiments, the account owner similarity greater than the preset value can be set to 1, and the account owner similarity not greater than the preset value can be set to 0, so as to obtain an updated similarity matrix, and then according to the "0" and "1" values ​​in the updated similarity matrix, the account owners are connected. Specifically, the account owners with an account owner similarity of 1 are connected, and the account owners with an account owner similarity of 0 are not connected.

[0154] This similarity calculation method based on heterogeneous associations of meta-paths is an unsupervised algorithm that does not rely on any label system but relies on the definition of meta-paths, which enhances interpretability.

[0155] After obtaining the object similarity, two or more content publishing objects with object similarity greater than a preset value can be aggregated together as a group. The primary object group is specifically the primary group obtained by aggregation. It should be noted that the group here is closer to the meaning of a social community and does not necessarily have malicious intent. Specifically, the object similarity between the content publishing objects in the primary object group is greater than a preset value, which can be set according to actual conditions.

[0156] Based on the account owner similarity matrix, we can construct the relationship isomorphism graph similarity matrix between account owners, and use community discovery methods such as the connected component algorithm, Keams clustering method, and fast unfolding to perform cluster calculations on content publishing objects based on the similarity matrix, and finally obtain several primary object groups.

[0157] Specifically, the process of aggregating content publishing objects based on the Keams clustering method is as follows.

[0158] Optionally, in this embodiment, the step of “aggregating the at least two content publishing objects according to the object similarity to obtain at least one primary object group” may include:

[0159] Selecting a preset number of target content publishing objects from the content publishing objects as cluster centers of each primary object group;

[0160] According to the object similarity between each content publishing object and each cluster center, each content publishing object is added to the primary object group to which the cluster center having the highest object similarity with the content publishing object belongs;

[0161] For each primary object group, a content publishing object that meets the cluster center conditions is selected from the primary object group as a new cluster center, and the step of adding each content publishing object to the primary object group to which the cluster center with the highest object similarity to the content publishing object belongs is returned to be executed, until the cluster centers of each primary object group meet the clustering end conditions, thereby obtaining a preset number of primary object groups.

[0162] The preset number can be set according to actual conditions, and can be specifically set according to the number of cluster sets to be obtained. Each primary object group is a cluster set.

[0163] Among them, in the step of "selecting content publishing objects that meet the cluster center conditions from the primary object group as new cluster centers", the cluster center condition can be the minimum distance from the distribution center of gravity of the cluster set. Specifically, the distribution center of gravity of the cluster set can be determined based on the distribution information of the content publishing objects in each cluster set, and the content publishing object with the minimum distance from the distribution center of gravity can be used as the new cluster center.

[0164] For each cluster set, calculate whether the latest cluster center of the cluster set is the same as the cluster center used most recently in the clustering process. If they are the same, it can be considered that the cluster center of the cluster set has not changed. If the cluster centers of all cluster sets no longer change, the clustering process is completed and a preset number of cluster sets are obtained. If the cluster centers of not all cluster sets have not changed, return to the step of "adding each content publishing object to the primary object group to which the cluster center with the highest object similarity to the content publishing object belongs according to the object similarity between each content publishing object and each cluster center" until the cluster center of each cluster set no longer changes.

[0165] It should be noted that the fact that the latest cluster center of each cluster set in the clustering process is the same as the cluster center most recently adopted by the cluster set is only an optional condition for ending the loop. The optional condition can also be that the difference between the two cluster centers is less than a preset value, which can be set according to actual conditions.

[0166] 103. For each primary object group, the social relationship data corresponding to each content publishing object in the primary object group is mined to mine target social related objects that have an impact on the primary object group.

[0167] Optionally, in this embodiment, the step of “for each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to mine target social associated objects that have an impact on the primary object group” may include:

[0168] For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes social associated objects corresponding to each content publishing object in the primary object group;

[0169] According to the influence of each social associated object in the social object set on the primary object group, a target social associated object corresponding to the primary object group is selected from the social object set.

[0170] Among them, the social relationship data corresponding to the content publishing object may include the social account related to the account registration corresponding to the content publishing object, the account attribute information corresponding to the social account (such as avatar and nickname), the content information published by the social account, the group information of the joined group (including group organizers, ordinary group members, and group tags, etc.), etc. This embodiment does not limit this.

[0171] The social associated object may be a social account associated with the content publishing object, and the associated social account may specifically refer to a related social account in the social relationship data corresponding to the content publishing object. For example, the social associated object may be a social account associated with the registration of the account corresponding to the content publishing object (that is, the social account corresponding to the content publishing object); for another example, the social associated object may be a social account of the group organizer (or group manager) of the group to which the social account corresponding to the content publishing object joins.

[0172] Specifically, this embodiment can be applied to an instant messaging application. The instant messaging application may include two account systems, namely, an account system corresponding to a content publishing object and an account system corresponding to a personal social account. A socially associated object may be an account under the account system corresponding to a personal social account. The account corresponding to the content publishing object may be obtained by registering through a personal social account.

[0173] In this embodiment, the shallow user relationship chain can be traced in depth. In actual business, the group activities of many content publishing accounts are not separated from the basic social scenes. For the primary object group, this application can use the strongly associated social relationship network to further extract the core control users behind it.

[0174] Specifically, we can deeply explore the basic social interaction scenarios behind these content publishing accounts in instant messaging applications, and build a directed social heterogeneous network of strongly associated activities by mining social relationships. In this heterogeneous network, the random walk sequence generation algorithm is used for deep mining of paths. Based on a specific meta-path pattern, the node sequence is generated using the random walk principle until the sequence length reaches a given threshold, and the social association path instance under the meta-path pattern is obtained, thereby quickly obtaining the high-order user set under these social association path instances.

[0175] Optionally, in this embodiment, the step of “for each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group” may include:

[0176] constructing a social relationship network according to the social relationship data of each content publishing object in the primary object group, wherein the social relationship network includes an association relationship between the content publishing object and social information in at least one dimension;

[0177] Based on a preset social association path for the content publishing object, performing node wandering in the social relationship network to query a social association path instance corresponding to the content publishing object under the preset social association path;

[0178] According to the social association path instance, the social association object corresponding to the content publishing object is determined, and a social object set corresponding to the primary object group is obtained.

[0179] Among them, the social relationship network is a social heterogeneous network, which includes at least one node and edges between nodes. The nodes here may include object nodes corresponding to content publishing objects and nodes corresponding to social information in various dimensions. The edge represents the association relationship between the two nodes it connects, that is, the connection between the two nodes.

[0180] Specifically, the nodes connected on the social relationship network have an association relationship, and this association relationship can be specifically reflected in the existence of an interactive relationship, or similar node content, etc. Specifically, the node types of two connected nodes can be the same or different. For example, content publishing object A is registered through social account a, that is, social account a is the social account corresponding to content publishing object A, and social account a joins group 1, and the group organizer of group 1 is social account b; then the object node corresponding to content publishing object A can be connected to the node corresponding to social account a, the node corresponding to social account a can be connected to the node corresponding to group 1, and the node corresponding to group 1 can be connected to the node corresponding to social account b.

[0181] Among them, the social associated objects in the social object set can be considered as high-order users. The high-order users here are relative to the content publishing objects, and the content publishing objects can be considered as low-order users.

[0182] Among them, the preset social association path can be "group->group member->malicious group->group organizer", etc. This embodiment does not limit this. "Group" can refer to a primary object group, and "group member" can refer to a content publishing object in the primary object group.

[0183] Among them, the social information on at least one dimension may include the associated personal social account, the content published by the personal social account, the group joined, the group label, and the group organizer corresponding to the group, etc. This embodiment does not limit this.

[0184] In the social relationship network, a random walk strategy may be specifically adopted for node walking. The random walk strategy may refer to formula (1) in the above embodiment to obtain a social association path instance. After obtaining the social association path instance, the object involved in the social association path instance (specifically, a social account) may be determined as the social association object corresponding to the content publishing object.

[0185] In this embodiment, multiple preset social association paths can be constructed. Considering the time complexity of the algorithm, a few strong association paths can be used to expand multi-order relationships in actual applications. For example, in actual applications, many of the group evil deeds of content publishing accounts have some characteristics of social aggregation. For example, they have been active in social groups under the same malicious group label, and some groups have committed evil deeds in some number-making groups. In this case, an association pattern can be extracted, specifically the directed association path of "group->group member->malicious group->group organizer". In addition, there are some association relationships that will be extended to multi-order associations, and associated members can also be obtained through multi-order association paths. Therefore, in a directed heterogeneous relationship network, a random walk of a directed graph under a defined path pattern can quickly obtain a set of high-order users (i.e., a set of social objects) under these path patterns.

[0186] Among them, these high-level users are not all users related to group behavior. In order to better separate ordinary users from actual controllers, this embodiment can calculate the influence of these high-level users on the group to determine the control of these high-level users on specific groups.

[0187] The selected target socially associated objects may be regarded as the manipulated objects of the primary object group.

[0188] In some embodiments, the socially associated objects in the social object set whose influence on the primary object group is greater than a preset value may be determined as target socially associated objects corresponding to the primary object group. In other embodiments, the socially associated objects in the social object set may also be arranged according to the influence, such as from large to small, to obtain arranged socially associated objects, and the first n socially associated objects in the arranged socially associated objects may be determined as target socially associated objects corresponding to the primary object group.

[0189] Optionally, in this embodiment, the step of “selecting target social associated objects corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group” may include:

[0190] For each social associated object in the social object set, determining the quantity information of content publishing objects in the primary object group that have an associated relationship with the social associated object;

[0191] Determining the influence of the socially associated object on the primary object group according to the quantity information;

[0192] According to the influence, a target social associated object corresponding to the primary object group is selected from the social object set.

[0193] Among them, the social associated objects whose influence is greater than a preset value can be determined as the target social associated objects, or the top k social associated objects with the highest influence can be selected from the social object set according to the number of target social associated objects to be selected as the manipulators behind the primary object group, i.e., the target social associated objects.

[0194] Optionally, in this embodiment, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0195] Taking the node corresponding to the social association object as a root node and based on the social association path instance, constructing a social tree model corresponding to the social association object;

[0196] Determine the quantity information of the content publishing objects belonging to the primary object group among the content publishing objects corresponding to the leaf nodes in the social tree model.

[0197] Among them, the social tree model corresponding to the social association object can be constructed by various social association path instances containing the social association object. The social tree model can take the node corresponding to the social association object as the root node and the node corresponding to the content publishing object as the leaf node. The path between the root node and the leaf node is determined based on the social association path instance.

[0198] Among them, this embodiment can use the subtree with the social association object as the root node to mine the number and proportion of terminals (i.e., leaf nodes) in these subtrees that belong to the primary object group (i.e., the above-mentioned quantitative information), so as to measure the influence of the social association object on the primary object group.

[0199] Optionally, in this embodiment, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0200] Aggregating the social association path instances corresponding to the content publishing objects in the primary object group to obtain an aggregated network;

[0201] The in-degree of the primary object group to the social associated object is calculated according to the aggregated network, where the in-degree represents quantity information of content publishing objects that are associated with the social associated object.

[0202] Among them, we can first obtain the social association path instance corresponding to each content publishing object in the primary object group, and construct the network according to the node relationship in each social association path instance to obtain the aggregated network. There are two nodes connected in the social association path instance, and there is also a connection between the two nodes in the aggregated network.

[0203] The in-degree refers to the number of arrows pointing to a node. In this embodiment, the in-degree of the primary object group to the social association object may be the number of content publishing objects in the primary object group that have an association relationship with the social association object. The association relationship here may be a connection in the aggregated network, which may be a direct connection or an indirect connection (i.e., a connection across nodes).

[0204] The step of "determining the influence of the social associated object on the primary object group according to the quantity information" may include: determining the influence of the social associated object on the primary object group according to the in-degree and the number of objects in the primary object group.

[0205] The in-degree here includes direct in-degree and indirect in-degree. The number of objects in the primary object group is the number of content publishing objects included in the primary object group. In this embodiment, the in-degree can be divided by the number of objects in the primary object group to obtain the influence of the social associated object on the primary object group.

[0206] like Figure 1d As shown, the construction of a directed isomorphic graph of high-order user strong dependency relationships is demonstrated. Specifically, for each member in the primary object group, the social relationship data of each member can be mined based on the preset social association path to obtain the social association object corresponding to each member. The social association object here can include first-order users, second-order users, third-order users, etc. The first-order user here can be a social account directly associated with the content publishing object, such as a social account related to the registration of the content publishing object, and the second-order user and the third-order user can be social accounts indirectly associated with the content publishing object, such as a group organizer who joins a group, etc.; specifically, in the mined social association path instance, the social account can be determined according to the connection relationship between the node corresponding to the social account and the node of the content publishing object to determine whether it is a first-order user, a second-order user, or a third-order user. Through mining, a set of social objects (i.e., a high-order user set) can be obtained, and then the influence of each high-order user in the high-order user set on the primary object group can be determined, thereby obtaining a high-order user influence matrix. The row attributes of the high-order user influence matrix can be high-order users (such as u1, u2, u3, u4, and u5), and the column attributes can be primary object groups (such as groups M1, M2, and M3). The element value corresponding to the element in the high-order user influence matrix is ​​the influence of the high-order user in its row on the primary object group in its column. According to the high-order user influence matrix, the top k high-order users with the greatest influence on a certain group can be determined, and these high-order users can be determined as the control objects of the group.

[0207] Specifically, a random walk is used in the social network to obtain several relationship instances, and these instances are aggregated by alignment to calculate the degree of dependence of these nodes on the members of the primary object group (i.e., the in-degree). In this embodiment, the influence of high-order user a on the primary object group K can be defined as shown in the following formula (7):

[0208]

[0209] Where |K| represents the number of members of the primary object group K, that is, the number of objects in the above primary object group, M K (a) represents the in-degree of members of primary object group K to high-order user a, and F(a,K) represents the influence of high-order user a (social related object) on primary object group K.

[0210] In specific scenarios, since a large number of path indexes will bring huge computing consumption, they can be properly pruned according to the characteristics of the group. For example, before the step of "building a social relationship network based on the social relationship data of each content publishing object in the primary object group", the social relationship data of each content publishing object in the primary object group can be preprocessed. For example, multiple users can be filtered out first in the preprocessing. Generally, malicious groups will not be too easy to directly face too many complex malicious social relationships. Filtering out such users can not only improve the quality and efficiency of the roaming path, but also avoid introducing too much impurities. Among them, multiple users refer to users with relatively complex social relationships.

[0211] In addition, reference Figure 1d This embodiment can further reduce the waste of computing resources by pruning optimization means such as limiting the number of high-order user sets, delineating users, limiting the maximum step length of random walks, and adjusting the minimum influence threshold.

[0212] 104. According to the abnormality of the target social associated object and the content publishing object in the primary object group, the primary object group is merged to obtain at least one target object group with potential abnormality.

[0213] In this embodiment, the deep mining of high-level users can obtain clues about the operators behind the scenes, and the mined high-level user set features are used to measure the closeness between different primary object groups, and this closeness is also measured using the similarity between primary object groups. After obtaining the similarity between primary object groups, the target object groups obtained by merging can be specifically divided into multiple levels of groups according to the similarity.

[0214] Optionally, in this embodiment, the step of “merging the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality” may include:

[0215] Calculate the group similarity between each primary object group according to the target social associated object corresponding to each primary object group;

[0216] Merging the primary object groups according to the group similarity to obtain at least one merged object group;

[0217] According to the abnormality degree of the content publishing objects in the merged object group, a target object group with potential abnormality is determined from the merged object group.

[0218] In some embodiments, if the number of content publishing objects with an abnormality higher than a preset abnormality in the merged object group exceeds a preset number, the merged object group can be determined as a potential abnormal target object group.

[0219] Specifically, two dimensions can be considered in terms of group similarity: the similarity of the high-order user set corresponding to the primary object group and the overall influence of these screened high-order users on the two groups. For the former, the Jaccard similarity formula can be used to measure the similarity of the high-order user set of two different primary object groups. The assumption established in this way is that when the high-order users of two different primary object groups have a very high degree of overlap, they can be considered to belong to the same account resource. However, this very high overlap requirement will make the similarity of the primary object group too strict and reduce the recall. This strictness is reflected in the fact that the high-order user set behind the two primary object groups must have a high purity and control, which requires the high-order user set to be purified and filtered. Therefore, this embodiment also considers the actual influence of these high-order users on the group, and measures the control of these high-order users on different groups to judge the closeness of the group. When the same high-order user has the same high influence on two groups, it can be considered that the connection of this high-order user plays an extraordinary role. Based on the influence of these high-level users on each primary object group and the degree of overlap of these high-level users, the similarity of the primary object groups can be basically determined. Through calculation, a similarity matrix containing the group similarities between two primary object groups can be obtained. Each element in the similarity matrix represents the group similarity between two primary object groups. Then, the groups can be merged according to the similarity matrix to obtain a multi-level group. This multi-level group is a higher degree of recall of the primary object group, which will have a further recall gain on the magnitude of the original primary object group.

[0220] In actual applications, some mergers may not be malicious groups that risk control business wants. From the perspective of the quality of the accounts used, high-level users are accounts used by real natural persons, and they also have complex and rich role aspects. For example, a high-level user will have some manpower to engage in account maintenance and trading. This high-level user may also be the owner of an art studio and run a normal business, so he has the ability to call on human resources. Therefore, the maliciousness of the group will also be taken into account in the merger of this aspect, so as to better control the scale and trend of the group's evil deeds.

[0221] Optionally, in this embodiment, the step of “calculating the group similarity between each primary object group according to the target social associated object corresponding to each primary object group” may include:

[0222] For each two primary object groups, determining the initial similarity corresponding to the two primary object groups according to the overlap of the target social association objects corresponding to the two primary object groups;

[0223] Calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups;

[0224] The group similarity between the two primary object groups is determined based on the initial similarity and the overall influence.

[0225] The overlap degree of the target social association objects corresponding to the two primary object groups may be calculated by the number of objects in the intersection and union between the target social association objects corresponding to the two primary object groups.

[0226] The overall influence can also be regarded as a similarity. The step of "determining the group similarity between the two primary object groups based on the initial similarity and the overall influence" can specifically select a larger value from the initial similarity and the overall influence as the group similarity between the two primary object groups, or can fuse the initial similarity and the overall influence, and the fusion method can be weighted operation, etc., to obtain the group similarity between the two primary object groups.

[0227] Optionally, in this embodiment, the step of “calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups” may include:

[0228] For each target social association object corresponding to the two primary object groups, calculating the influence of the target social association object on the two primary object groups;

[0229] The influences of each target social associated object on the two primary object groups are merged to obtain the overall influences of the target social associated objects corresponding to the two primary object groups on the two primary object groups.

[0230] In a specific scenario, refer to Figure 1e , the influence degree F of the target social associated object (denoted as a) corresponding to two primary object groups (denoted as A and B respectively) on these two primary object groups a The calculation of (A, B) can be shown as formula (8):

[0231]

[0232] Where A and B are two primary object groups, respectively. F(a, A) represents the influence of target social association object a on primary object group A, and F(a, B) represents the influence of target social association object a on primary object group B. After obtaining the influence of each target social association object on the two primary object groups, the overall influence of all target social association objects on the two primary object groups F(A, B) can be calculated. Here, all target social association objects refer to all target social association objects corresponding to the two primary object groups, as shown in formula (9):

[0233]

[0234] Among them, F i (A, B} represents the influence of the target social associated object i on the two primary object groups, H(A) represents the number of target social associated objects corresponding to primary object group A, and H(B) represents the number of target social associated objects corresponding to primary object group B. F(A, B) is the maximum average influence of high-level users on the two primary groups.

[0235] After obtaining the overall influence of all target socially associated objects on the two primary object groups, the group similarity between the two primary object groups (denoted as Sim(A, B)) can be calculated, as shown in formula (10):

[0236]

[0237] After calculating the group similarity between every two primary object groups, a primary group similarity matrix can be obtained. The primary group similarity matrix can include the group similarities between any two primary groups, and groups can be merged according to the primary group similarity matrix to obtain multi-level groups, wherein specifically, two primary groups whose group similarity is greater than a preset similarity can be merged.

[0238] In a specific scenario, the object group identification method of the present application can identify primary object groups and perform top k (front K) detection on potentially malicious primary object groups. Specifically, a complete survey of the group aggregation of the content publishing object market is conducted, and these primary object groups are continuously operated and audited. Under the survey of the market, 2% of users have a tendency to aggregate in groups, and some groups with malicious nature will be dealt with accordingly. Specifically, the top k lists of potentially malicious primary object groups can be summarized in various dimensions, such as the number of group members (matrix size), the growth rate of the number of members, the overall malicious rate of the group, the average malicious rate of members, the proportion of risky members in the group, the group audit risk score, etc., and their traffic levels can be detected, such as Figure 1f shown.

[0239] In addition, this application can also improve the recall gain of abnormal objects. Figure 1g As shown, it is an example of the recall gain of a multi-level group, which shows the group information of two primary object groups belonging to the same multi-level group (including matrix number, number of matrix number members, average risk score, high risk ratio, etc.). By initially comparing the group numbers of the primary object groups, the average member level recall gain of the multi-level group reaches 110%. Figure 1g The relevant information of the specific content publishing objects (i.e., video account owners) in the two primary object groups is also displayed, including avatars, nicknames, owner penalty marks, owner signatures, etc. Among them, the owner penalty marks corresponding to the content publishing objects in the primary groups may include "Account A blacklisted", "Account B blacklisted" and "Account blocked". "Account A blacklisted" may be caused by account A filing a complaint against the corresponding content publishing object, and "Account B blacklisted" may be caused by account B not recommending the content published by the corresponding content publishing object.

[0240] Moreover, this application can perform TOPK (top K) detection on high-level users. Specifically, a corresponding list is formulated for high-level users, such as Figure 1h and Figure 1i As shown, these high-level users can be personal social accounts, and the lists can include their corresponding video account number, personal social account nickname, signature, total number of matrices (specifically, the number of primary object groups affected), total number of matrices (that is, the number of members in the primary object groups affected), maliciousness, sampling number, keywords, etc. In addition to formulating corresponding lists, it is also possible to detect the content publishing accounts of these high-level users and their behaviors such as publishing short videos to ensure that the short video content related to them is reviewed. In addition, these high-level UINs (user information, user information identification code, that is, user identity) can be pushed on a daily basis, and the maliciousness rate of the matrix groups associated with them can be checked in a timely manner.

[0241] In the security punishment system for content publishing accounts, this application can build an operation mechanism for primary object groups to submit for review and sample review, and continuously carry out group activity inspections under the content publishing account ecosystem. Here, multiple branch tests can be performed, as follows:

[0242] 1. Review of malicious account owners: Review will be conducted based on the account owner’s unit, and the account owner who violates the rules will be punished accordingly based on the violation label.

[0243] 2. Assessment of the maliciousness of primary target groups and detection of the spread of highly malicious groups: For highly malicious primary target groups within the punishment system, overall blacklisting measures are adopted to limit the traffic exposure of their group activities.

[0244] 3. Automatically detect and block new users who have joined a known blacklisted group.

[0245] like Figure 1j As shown in the figure, the group detection project can contribute 10% to 30% of the account detection in the entire content publishing account detection market, where the horizontal axis is time and the vertical axis is the account detection contribution rate. In addition, the audit annotation of this operation link is also a precious annotation data. For those groups with malicious but low maliciousness, the security side will continue to conduct in-depth research, and this information will also be further provided for specific malicious strategy countermeasures.

[0246] The object group identification method provided in this application can use the similarity of meta-paths to finally obtain the similarity between account owners (i.e., the object similarity between content publishing objects); use the account owner similarity for aggregation to obtain primary object groups; then, calculate the influence of each high-order user on each primary object group (the influence here uses the social relationship chain), thereby obtaining the topk most influential high-order users of each primary object group; based on the topk high-order user set obtained for each primary object group, it is used to calculate the pairwise similarity of the primary object groups. Based on the pairwise similarity of the primary object groups, clustering is performed, and the primary object groups can be merged to obtain high-level groups (i.e., target object groups).

[0247] In consideration of specific business needs and versatility, this application can divide the entire group identification framework into the following three network levels: primary group aggregation, high-level user mining, and multi-level group aggregation. Figure 1k and Figure 1l , the three network layers are described as follows:

[0248] In the primary group aggregation, we focus on mining similar aggregated groups. The similarities here can include similar behavior content and resource environment between account owners. These groups usually operate a group of accounts to complete malicious content promotion in a short period of time to achieve malicious purposes such as traffic diversion and fraud. Among them, behavioral content similarity can include consistent descriptions, consistent traffic diversion, similar dynamic content, similar personal information, similar discussion topics, similar avatars, etc. Similar resources and environments can include similar IP (Internet Protocol) / WIFI, equipment used, authentication, and registration information.

[0249] The main purpose of high-level user mining is to mine the main associated accounts behind the members of these primary target groups under the aggregation of social, interest, subject, and resources, and to characterize the control and influence of these accounts on these primary target groups. The high-level users mined at this level will serve as a bridge between primary and multi-level group mining, bridging shallow malicious accounts with underwater accounts in a deeper way, and assisting the mining of multi-level groups.

[0250] This application mainly proposes an explainable group discovery algorithm based on heterogeneous network meta-path similarity. The algorithm constructs a social network into three layers: the first layer of the social network is used to mine primary object groups with similar behaviors and environments, the second layer directly targets the resource controllers behind these groups, and the third layer relies on these controllers to spread dependencies and mine actual account resource collections. It mainly solves the following problems:

[0251] 1) Improve the interpretability of the algorithm and provide sufficient correlation evidence support for real-time detection of malicious groups.

[0252] 2) Conduct continuous operational detection of potential malicious group behaviors and conduct a survey of clustered groups in the content publishing account ecosystem. Specifically, we identify accounts with clustered groups in the market, conduct a review of potential highly malicious groups or highly exposed groups, dismantle possible security risk points, and conduct further review and detection.

[0253] 3) Improve the versatility of group discovery. Group discovery does not rely on the spread of specific malicious behavior patterns, but clusters based on similar behaviors and similar content, which is conducive to in-depth mining of potential malicious groups in the account ecosystem and active discovery of new malicious behaviors.

[0254] 4) Organizer mining. In addition to the surface account resource diffusion, we dig deeper into the resource controllers behind the content publishing accounts, and through these controllers, we can reversely diffuse their account resources to detect their account movements.

[0255] In a specific scenario, you can query the matrix group (i.e., the primary object group) based on the account owner (i.e., the content publishing account). Figure 1mAs shown, the user can enter the account owner ID / matrix number (i.e., matrix group) ID (Identity document, identification number) and view the situation of the matrix group to which the account owner belongs through the query page. The query page will perform a background search and display the basic statistical information of the matrix group and the matrix group member information list. Among them, the basic statistical information of the matrix group may include the matrix number, the total number of members, the number of new members added on the day, the average risk score, the creation time, the last active time, the audit malicious rate, the marking date, the matrix number audit notes, etc. The member information list may include the account owner ID, account owner, account owner penalty status, account owner profile, number of fans, account owner active characteristics, account owner risk level, etc. corresponding to the members in the matrix group.

[0256] Among them, the creation date in the matrix number information is the creation time of the corresponding primary object group or the time when it forms a certain scale, and the marking date is the time when the primary object group meets certain conditions, such as when the violation rate reaches a preset value, and is submitted for review and marking.

[0257] like Figure 1n As shown, the top k list information of the matrix groups in various dimensions can also be displayed. The dimensions can include the number of members, the largest number of new members, the highest review malicious rate, the highest group risk score, the maximum activity on the day, the activity in the past week, influence, etc. The background can integrate the information of the aggregated matrix groups and count the group characteristics; sort the specified group characteristics in reverse order, and take the top k matrix groups for display.

[0258] In a specific embodiment, if Figure 1o As shown in the figure, the activities of the account owner in the content publishing account ecosystem will trigger a calculation of the account owner similarity, and based on the calculated account owner similarity, determine the group affiliation of the current account owner, and add the current account owner to the closest account owner group to build an account owner-group affiliation network. When the group reaches a certain level of activity, a portion of members can be randomly sampled from each group and pushed to the group review platform for review. When there are problems with the group review, such as the review malicious rate reaches a certain threshold, these groups will be subject to diffusion detection, which can greatly improve the diffusion detection capability.

[0259] As can be seen from the above, this embodiment can obtain the operation content information of multiple content publishing objects in at least one dimension; according to the operation content information corresponding to each content publishing object, the multiple content publishing objects are aggregated to obtain at least one primary object group, and each primary object group includes at least one content publishing object; for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group is mined to mine the target social related objects that have an impact on the primary object group; according to the abnormality of the target social related objects and the content publishing objects in the primary object group, the primary object groups are merged to obtain at least one target object group with potential abnormalities.

[0260] The present application can first construct a primary object group through the relationship network between content publishing objects, and mine the social relationship data corresponding to the content publishing objects to determine the actual manipulation object of the primary object group, that is, the target social related object, and then merge the primary object group according to the target social related object to obtain a potential abnormal target object group, which can be better applied to the anomaly detection scenario of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects.

[0261] According to the method described in the above embodiment, the object group recognition device is integrated into a server as an example for further detailed description.

[0262] The present application embodiment provides a method for identifying a group of objects. Figure 2 As shown, the specific process of the object group identification method can be as follows:

[0263] 201. The server obtains a content heterogeneous relationship graph corresponding to at least two content publishing objects, where the content heterogeneous relationship graph represents an association relationship between the content publishing objects and operation content information in at least one dimension.

[0264] The content publishing object may be a content publishing account. Specifically, the content publishing object may publish content through a target application. The published content may include video, image, audio, and text, etc. This embodiment does not limit this. The target application may be an instant messaging application, etc.

[0265] Among them, the operation content information on at least one dimension may include the published content, the topics involved in the content, the modified object attributes, etc. The object attributes may include account avatar, nickname, signature, etc.

[0266] Optionally, in this embodiment, the content heterogeneous relationship graph includes at least one node and edges between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents the association relationship between the two nodes connected thereto.

[0267] Among them, an edge is a line between two nodes, and the connected nodes on the content heterogeneous relationship graph have an association relationship, which can be specifically reflected in the existence of an interactive relationship or similar node content, etc. Specifically, the node types of the two connected nodes can be the same or different.

[0268] 202. The server determines the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph.

[0269] Optionally, in this embodiment, the content heterogeneous relationship graph includes at least one node and an edge between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents the association relationship between the two nodes connected thereto;

[0270] The step of “determining the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph” may include:

[0271] For every two content publishing objects, according to a preset meta-path, object nodes and content nodes are roamed in the content heterogeneous relationship graph through the edges between the nodes to query a meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, wherein the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph;

[0272] The object similarity between the two content publishing objects is calculated according to the meta-path instance under the preset meta-path.

[0273] The starting node and the ending node of the preset meta-path may be two content publishing objects, and the head and tail of the generated node sequences are also content nodes corresponding to the content publishing objects. The preset meta-path may be set according to actual conditions.

[0274] Optionally, in this embodiment, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0275] Determining the similarity between the two content publishing objects under the preset meta-path according to the weight information of the edges between the nodes in the meta-path instance under the preset meta-path;

[0276] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0277] Optionally, in this embodiment, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0278] Determining the similarity between the two content publishing objects under the preset meta-path based on the number of meta-path instances under the preset meta-path;

[0279] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0280] When the random walk algorithm is finished, the number of meta-path instances associated between two account owners is calculated and used as the similarity between the two account owners on the current meta-path. In this way, the path similarity between account owners on each meta-path can be obtained in turn.

[0281] According to the weight information corresponding to each preset meta-path, the similarity of the two content publishing objects under each preset meta-path can be processed to obtain the processed similarity of the two content publishing objects under each preset meta-path, and then the object similarity between the two content publishing objects can be determined according to the processed similarity of the two content publishing objects under each preset meta-path. The processing method can be to multiply the weight information by the similarity.

[0282] In the algorithm implementation, this embodiment can adopt a meta-path-based heterogeneous graph mining method. The complex association relationship of accounts is modeled using heterogeneous networks, and common association patterns are extracted in group association analysis as the initial meta-paths for heterogeneous graph mining, and the similarity of account owners is converted into similarity on these meta-paths. This meta-path-based heterogeneous network method can enrich the semantic expression of account owner similarity and has better explanatory power for aggregated groups.

[0283] Optionally, in this embodiment, the step of “determining the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph” may include:

[0284] Determine the similarity of operation contents between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph;

[0285] Acquire an environment heterogeneous relationship graph corresponding to the content publishing object, wherein the environment heterogeneous relationship graph represents an association relationship between the content publishing object and operating environment information in at least one dimension;

[0286] Determine the similarity of the operating environments between the content publishing objects according to the operating environment information associated with the content publishing objects in the environment heterogeneous relationship graph;

[0287] Based on the operation content similarity and the operation environment similarity, object similarity between respective content publishing objects is determined.

[0288] The similarity of the operation content and the similarity of the operation environment may be fused to obtain the object similarity between the various content publishing objects, and the fusion method may be multiplication or the like.

[0289] In this embodiment, based on the heterogeneous relationship between the account owner's behavior and the account owner's environment, possible meta-path patterns between various group members can be extracted through data analysis and behavior pattern decomposition of the group. The definition of these meta-paths is an abstraction of the similarity of the account owners.

[0290] 203. The server aggregates the at least two content publishing objects according to the object similarity to obtain at least one primary object group, each of which includes at least one content publishing object.

[0291] Among them, two or more content publishing objects whose object similarity is greater than a preset value may be aggregated together as a group.

[0292] The primary object group is specifically the primary group obtained by aggregation. It should be noted that the group here is closer to the meaning of a social community and does not necessarily carry malicious intent. Specifically, the object similarity between the content publishing objects in the primary object group is greater than a preset value, which can be set according to actual conditions.

[0293] Based on the account owner similarity matrix, we can construct the relationship isomorphism graph similarity matrix between account owners, and use community discovery methods such as the connected component algorithm, Keams clustering method, and fast unfolding to perform cluster calculations on content publishing objects based on the similarity matrix, and finally obtain several primary object groups.

[0294] 204. The server mines the social relationship data corresponding to each content publishing object in each primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes social associated objects corresponding to each content publishing object in the primary object group.

[0295] Among them, the social relationship data corresponding to the content publishing object may include the social account related to the account registration corresponding to the content publishing object, the account attribute information corresponding to the social account (such as avatar and nickname), the content information published by the social account, the group information of the joined group (including group organizers, ordinary group members, and group tags, etc.), etc. This embodiment does not limit this.

[0296] The social associated object may be a social account associated with the content publishing object, and the associated social account may specifically refer to a related social account in the social relationship data corresponding to the content publishing object. For example, the social associated object may be a social account associated with the registration of the account corresponding to the content publishing object (that is, the social account corresponding to the content publishing object); for another example, the social associated object may be a social account of the group organizer (or group manager) of the group to which the social account corresponding to the content publishing object joins.

[0297] Specifically, this embodiment can be applied to an instant messaging application. The instant messaging application may include two account systems, namely, an account system corresponding to a content publishing object and an account system corresponding to a personal social account. A socially associated object may be an account under the account system corresponding to a personal social account. The account corresponding to the content publishing object may be obtained by registering through a personal social account.

[0298] In this embodiment, the shallow user relationship chain can be traced in depth. In actual business, the group activities of many content publishing accounts are not separated from the basic social scenes. For the primary object group, this application can use the strongly associated social relationship network to further extract the core control users behind it.

[0299] Optionally, in this embodiment, the step of “for each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group” may include:

[0300] constructing a social relationship network according to the social relationship data of each content publishing object in the primary object group, wherein the social relationship network includes an association relationship between the content publishing object and social information in at least one dimension;

[0301] Based on a preset social association path for the content publishing object, performing node wandering in the social relationship network to query a social association path instance corresponding to the content publishing object under the preset social association path;

[0302] According to the social association path instance, the social association object corresponding to the content publishing object is determined, and a social object set corresponding to the primary object group is obtained.

[0303] Among them, the social associated objects in the social object set can be considered as high-order users. The high-order users here are relative to the content publishing objects, and the content publishing objects can be considered as low-order users.

[0304] Among them, the preset social association path can be "group->group member->malicious group->group organizer", etc. This embodiment does not limit this. "Group" can refer to a primary object group, and "group member" can refer to a content publishing object in the primary object group.

[0305] Among them, the social information on at least one dimension may include the associated personal social account, the content published by the personal social account, the group joined, the group label, and the group organizer corresponding to the group, etc. This embodiment does not limit this.

[0306] 205. The server selects a target socially associated object corresponding to the primary object group from the social object set according to the influence of each socially associated object in the social object set on the primary object group.

[0307] Among them, these high-level users are not all users related to group behavior. In order to better separate ordinary users from actual controllers, this embodiment can calculate the influence of these high-level users on the group to determine the control of these high-level users on specific groups.

[0308] The selected target socially associated objects may be regarded as the manipulated objects of the primary object group.

[0309] Optionally, in this embodiment, the step of “selecting target social associated objects corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group” may include:

[0310] For each social associated object in the social object set, determining the quantity information of content publishing objects in the primary object group that have an associated relationship with the social associated object;

[0311] Determining the influence of the socially associated object on the primary object group according to the quantity information;

[0312] According to the influence, a target social associated object corresponding to the primary object group is selected from the social object set.

[0313] Among them, the influence of each high-level user on the group can be calculated, and the topk high-level users can be selected as the people behind the group.

[0314] Optionally, in this embodiment, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0315] Aggregating the social association path instances corresponding to the content publishing objects in the primary object group to obtain an aggregated network;

[0316] The in-degree of the primary object group to the social associated object is calculated according to the aggregated network, where the in-degree represents quantity information of content publishing objects that are associated with the social associated object.

[0317] Among them, we can first obtain the social association path instance corresponding to each content publishing object in the primary object group, and construct the network according to the node relationship in each social association path instance to obtain the aggregated network. There are two nodes connected in the social association path instance, and there is also a connection between the two nodes in the aggregated network.

[0318] The in-degree refers to the number of arrows pointing to a node. In this embodiment, the in-degree of the primary object group to the social association object may be the number of content publishing objects in the primary object group that have an association relationship with the social association object. The association relationship here may be a connection in the aggregated network, which may be a direct connection or an indirect connection (i.e., a connection across nodes).

[0319] The step of "determining the influence of the social associated object on the primary object group according to the quantity information" may include: determining the influence of the social associated object on the primary object group according to the in-degree and the number of objects in the primary object group.

[0320] The in-degree here includes direct in-degree and indirect in-degree. The number of objects in the primary object group is the number of content publishing objects included in the primary object group. In this embodiment, the in-degree can be divided by the number of objects in the primary object group to obtain the influence of the social associated object on the primary object group.

[0321] 206. The server calculates the group similarity between each primary object group according to the target social associated object corresponding to each primary object group.

[0322] Specifically, two dimensions can be considered in terms of group similarity: the similarity of the high-order user set corresponding to the primary object group and the overall influence of these screened high-order users on the two groups. For the former, the Jaccard similarity formula can be used to measure the similarity of the high-order user set of two different primary object groups. The assumption established in this way is that when the high-order users of two different primary object groups have a very high degree of overlap, they can be considered to belong to the same account resource. However, this very high overlap requirement will make the similarity of the primary object group too strict and reduce the recall. This strictness is reflected in the fact that the high-order user set behind the two primary object groups must have a high purity and control, which requires the high-order user set to be purified and filtered. Therefore, this embodiment also considers the actual influence of these high-order users on the group, and measures the control of these high-order users on different groups to judge the closeness of the group. When the same high-order user has the same high influence on two groups, it can be considered that the connection of this high-order user plays an extraordinary role. Based on the influence of these high-level users on each primary object group and the degree of overlap of these high-level users, the similarity of the primary object groups can be basically determined. Through calculation, a similarity matrix containing the group similarities between two primary object groups can be obtained. Each element in the similarity matrix represents the group similarity between two primary object groups. Then, the groups can be merged according to the similarity matrix to obtain a multi-level group. This multi-level group is a higher degree of recall of the primary object group, which will have a further recall gain on the magnitude of the original primary object group.

[0323] Optionally, in this embodiment, the step of “calculating the group similarity between each primary object group according to the target social associated object corresponding to each primary object group” may include:

[0324] For each two primary object groups, determining the initial similarity corresponding to the two primary object groups according to the overlap of the target social association objects corresponding to the two primary object groups;

[0325] Calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups;

[0326] The group similarity between the two primary object groups is determined based on the initial similarity and the overall influence.

[0327] The overlap degree of the target social association objects corresponding to the two primary object groups may be calculated by the number of objects in the intersection and union between the target social association objects corresponding to the two primary object groups.

[0328] The overall influence can also be regarded as a similarity. The step of "determining the group similarity between the two primary object groups based on the initial similarity and the overall influence" can specifically select a larger value from the initial similarity and the overall influence as the group similarity between the two primary object groups, or can fuse the initial similarity and the overall influence, and the fusion method can be weighted operation, etc., to obtain the group similarity between the two primary object groups.

[0329] Optionally, in this embodiment, the step of “calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups” may include:

[0330] For each target social association object corresponding to the two primary object groups, calculating the influence of the target social association object on the two primary object groups;

[0331] The influences of each target social associated object on the two primary object groups are merged to obtain the overall influences of the target social associated objects corresponding to the two primary object groups on the two primary object groups.

[0332] 207. The server merges the primary object groups according to the group similarities to obtain at least one merged object group.

[0333] 208. The server determines a target object group with potential abnormalities from the merged object group according to the abnormality degree of the content publishing objects in the merged object group.

[0334] In some embodiments, if the number of content publishing objects with an abnormality higher than a preset abnormality in the merged object group exceeds a preset number, the merged object group can be determined as a potential abnormal target object group.

[0335] As can be seen from the above, in this embodiment, a content heterogeneous relationship graph corresponding to at least two content publishing objects can be obtained through a server, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing objects and the operation content information on at least one dimension; according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph, the object similarity between each content publishing object is determined; according to the object similarity, the at least two content publishing objects are aggregated to obtain at least one primary object group, each primary object group includes at least one content publishing object; for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group is mined to obtain the A social object set corresponding to a primary object group, the social object set including social associated objects corresponding to each content publishing object in the primary object group; selecting a target social associated object corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group; calculating the group similarity between each primary object group according to the target social associated objects corresponding to each primary object group; merging the primary object groups according to the group similarity to obtain at least one merged object group; and determining a target object group with potential abnormality from the merged object group according to the abnormality of the content publishing object in the merged object group.

[0336] The present application can first construct a primary object group through the relationship network between content publishing objects, and mine the social relationship data corresponding to the content publishing objects to determine the actual manipulation object of the primary object group, that is, the target social related object, and then merge the primary object group according to the target social related object to obtain a potential abnormal target object group, which can be better applied to the anomaly detection scenario of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects.

[0337] In order to better implement the above method, the present application embodiment also provides an object group recognition device, such as Figure 3 As shown, the object group identification device may include an acquisition unit 301, an aggregation unit 302, a mining unit 303, and a merging unit 304, as follows:

[0338] (1) Acquisition unit 301;

[0339] The acquisition unit is used to acquire operation content information of multiple content publishing objects in at least one dimension.

[0340] (2) polymerization unit 302;

[0341] The aggregation unit is used to aggregate the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each of which includes at least one content publishing object.

[0342] Optionally, in some embodiments of the present application, the aggregation unit may include a construction subunit, a similarity determination subunit and an aggregation subunit, as follows:

[0343] The construction subunit is used to construct a content heterogeneous relationship graph corresponding to each content publishing object according to the operation content information corresponding to the content publishing object, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing object and the operation content information in at least one dimension;

[0344] A similarity determination subunit, configured to determine the object similarity between each content publishing object according to the operation content information associated with each content publishing object in the content heterogeneous relationship graph;

[0345] The aggregation subunit is used to aggregate the multiple content publishing objects according to the object similarities to obtain at least one primary object group.

[0346] Optionally, in some embodiments of the present application, the content heterogeneous relationship graph includes at least one node and an edge between nodes, the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents an association relationship between two nodes connected thereto;

[0347] The similarity determination subunit can be specifically used to, for each two content publishing objects, according to a preset meta-path, walk object nodes and content nodes in the content heterogeneous relationship graph through the edges between nodes, so as to query the meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, and the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph; according to the meta-path instance under the preset meta-path, calculate the object similarity between the two content publishing objects.

[0348] Optionally, in some embodiments of the present application, the step of “calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path” may include:

[0349] Determining the similarity between the two content publishing objects under the preset meta-path based on the number of meta-path instances under the preset meta-path;

[0350] According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

[0351] Optionally, in some embodiments of the present application, the similarity determination subunit can be specifically used to determine the operational content similarity between each content publishing object based on the operational content information associated with each content publishing object in the content heterogeneous relationship graph; obtain the environment heterogeneous relationship graph corresponding to the content publishing object, the environment heterogeneous relationship graph characterizing the association relationship between the content publishing object and the operational environment information on at least one dimension; determine the operational environment similarity between each content publishing object based on the operational environment information associated with each content publishing object in the environment heterogeneous relationship graph; determine the object similarity between each content publishing object based on the operational content similarity and the operational environment similarity.

[0352] (3) mining unit 303;

[0353] The mining unit is used to mine the social relationship data corresponding to each content publishing object in each primary object group, so as to mine the target social related object that has an impact on the primary object group.

[0354] Optionally, in some embodiments of the present application, the mining unit may include a mining subunit and a selection subunit, as follows:

[0355] The mining subunit is used to mine, for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes social associated objects corresponding to each content publishing object in the primary object group;

[0356] The selection subunit is used to select a target social associated object corresponding to the primary object group from the social object set according to the influence of each social associated object in the social object set on the primary object group.

[0357] Optionally, in some embodiments of the present application, the mining sub-unit can be specifically used to construct a social relationship network based on the social relationship data of each content publishing object in the primary object group, the social relationship network including the association relationship between the content publishing object and social information on at least one dimension; based on a preset social association path for the content publishing object, perform node wandering in the social relationship network to query the social association path instance corresponding to the content publishing object under the preset social association path; determine the social association object corresponding to the content publishing object based on the social association path instance, and obtain the social object set corresponding to the primary object group.

[0358] Optionally, in some embodiments of the present application, the selection subunit can be specifically used to determine, for each social associated object in the social object set, quantity information of content publishing objects in the primary object group that have an associated relationship with the social associated object; determine, based on the quantity information, the influence of the social associated object on the primary object group; and select, from the social object set, a target social associated object corresponding to the primary object group.

[0359] Optionally, in some embodiments of the present application, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0360] Taking the node corresponding to the social association object as a root node and based on the social association path instance, constructing a social tree model corresponding to the social association object;

[0361] Determine the quantity information of the content publishing objects belonging to the primary object group among the content publishing objects corresponding to the leaf nodes in the social tree model.

[0362] Optionally, in some embodiments of the present application, the step of “determining the number of content publishing objects in the primary object group that are associated with the socially associated object” may include:

[0363] Aggregating the social association path instances corresponding to the content publishing objects in the primary object group to obtain an aggregated network;

[0364] The in-degree of the primary object group to the social associated object is calculated according to the aggregated network, where the in-degree represents quantity information of content publishing objects that are associated with the social associated object.

[0365] (4) merging unit 304;

[0366] A merging unit is used to merge the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality.

[0367] Optionally, in some embodiments of the present application, the merging unit may include a similarity calculation subunit, a merging subunit and a group determination subunit, as follows:

[0368] The similarity calculation subunit is used to calculate the group similarity between each primary object group according to the target social associated object corresponding to each primary object group;

[0369] a merging subunit, configured to merge the primary object groups according to the group similarities to obtain at least one merged object group;

[0370] The group determination subunit is used to determine a target object group with potential abnormalities from the merged object group according to the abnormality degree of the content publishing object in the merged object group.

[0371] Optionally, in some embodiments of the present application, the similarity calculation subunit can be specifically used to determine, for each two primary object groups, the initial similarity corresponding to the two primary object groups according to the overlap of the target social associated objects corresponding to the two primary object groups; calculate the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups; and determine the group similarity between the two primary object groups based on the initial similarity and the overall influence.

[0372] Optionally, in some embodiments of the present application, the step of “calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups” may include:

[0373] For each target social association object corresponding to the two primary object groups, calculating the influence of the target social association object on the two primary object groups;

[0374] The influences of each target social associated object on the two primary object groups are merged to obtain the overall influences of the target social associated objects corresponding to the two primary object groups on the two primary object groups.

[0375] As can be seen from the above, in this embodiment, the acquisition unit 301 can acquire the operation content information of multiple content publishing objects in at least one dimension; the aggregation unit 302 aggregates the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, and each primary object group includes at least one content publishing object; the mining unit 303 mines the social relationship data corresponding to each content publishing object in the primary object group for each primary object group, so as to mine the target social associated objects that have an impact on the primary object group; the merging unit 304 merges the primary object groups according to the abnormality of the target social associated objects and the content publishing objects in the primary object group to obtain at least one target object group with potential abnormality. The present application can first construct a primary object group through the operation content information corresponding to the content publishing object, and mine the social relationship data corresponding to the content publishing object to determine the actual manipulation object of the primary object group, that is, the target social related object, and then merge the primary object group according to the target social related object to obtain a potential abnormal target object group, which can be better applied to the anomaly detection scenario of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects.

[0376] The present application also provides an electronic device, such as Figure 4 As shown, it shows a schematic diagram of the structure of an electronic device involved in an embodiment of the present application, and the electronic device may be a terminal or a server, etc. Specifically:

[0377] The electronic device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will appreciate that Figure 4 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0378] The processor 401 is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 402, and calling data stored in the memory 402, the processor 401 performs various functions of the electronic device and processes data. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 401.

[0379] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0380] The electronic device also includes a power supply 403 for supplying power to each component. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 403 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0381] The electronic device may further include an input unit 404, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0382] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 401 in the electronic device will load the executable files corresponding to the processes of one or more application programs into the memory 402 according to the following instructions, and the processor 401 will run the application programs stored in the memory 402, thereby realizing various functions, as follows:

[0383] Acquire operation content information of multiple content publishing objects in at least one dimension; aggregate the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each primary object group including at least one content publishing object; for each primary object group, mine the social relationship data corresponding to each content publishing object in the primary object group to mine the target social associated object that has an impact on the primary object group; merge the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality.

[0384] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0385] As can be seen from the above, this embodiment can obtain the operation content information of multiple content publishing objects in at least one dimension; according to the operation content information corresponding to each content publishing object, the multiple content publishing objects are aggregated to obtain at least one primary object group, and each primary object group includes at least one content publishing object; for each primary object group, the social relationship data corresponding to each content publishing object in the primary object group is mined to mine the target social related objects that have an impact on the primary object group; according to the abnormality of the target social related objects and the content publishing objects in the primary object group, the primary object groups are merged to obtain at least one target object group with potential abnormalities.

[0386] The present application can first construct a primary object group through the operation content information corresponding to the content publishing object, and mine the social relationship data corresponding to the content publishing object to determine the actual manipulation object of the primary object group, that is, the target social related object, and then merge the primary object group according to the target social related object to obtain a potential abnormal target object group, which can be better applied to the anomaly detection scenario of organized group evil, improve the efficiency of abnormal object discovery and the recall rate of abnormal objects, thereby increasing the detection range of abnormal objects.

[0387] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0388] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any object group recognition method provided in the embodiment of the present application. For example, the instructions can execute the following steps:

[0389] Acquire operation content information of multiple content publishing objects in at least one dimension; aggregate the multiple content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each primary object group including at least one content publishing object; for each primary object group, mine the social relationship data corresponding to each content publishing object in the primary object group to mine the target social associated object that has an impact on the primary object group; merge the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality.

[0390] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0391] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0392] Since the instructions stored in the computer-readable storage medium can execute the steps in any object group identification method provided in the embodiments of the present application, the beneficial effects that can be achieved by any object group identification method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0393] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in various optional implementations of the above-mentioned object group recognition aspect.

[0394] The above is a detailed introduction to an object group recognition method and related equipment provided in an embodiment of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for identifying a group of objects, characterized in that: include: Obtaining operation content information of multiple content publishing objects in at least one dimension; Aggregating the plurality of content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group, each primary object group including at least one content publishing object; For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to mine the target social associated object that has an impact on the primary object group; According to the abnormality of the target social associated object and the content publishing object in the primary object group, the primary object group is merged to obtain at least one target object group with potential abnormality.

2. The method according to claim 1, characterized in that: The step of aggregating the plurality of content publishing objects according to the operation content information corresponding to each content publishing object to obtain at least one primary object group includes: According to the operation content information corresponding to each content publishing object, a content heterogeneous relationship graph corresponding to the content publishing object is constructed, wherein the content heterogeneous relationship graph represents the association relationship between the content publishing object and the operation content information in at least one dimension; Determine the object similarity between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph; According to the object similarities, the multiple content publishing objects are aggregated to obtain at least one primary object group.

3. The method according to claim 2, characterized in that The content heterogeneous relationship graph includes at least one node and edges between nodes, wherein the node includes an object node corresponding to the content publishing object and a content node corresponding to the operation content information, and the edge represents an association relationship between two nodes connected thereto; Determining the object similarity between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph includes: For every two content publishing objects, according to a preset meta-path, object nodes and content nodes are roamed in the content heterogeneous relationship graph through the edges between the nodes to query a meta-path instance connecting the object nodes corresponding to the two content publishing objects under the preset meta-path, wherein the preset meta-path is used to represent a connection relationship between nodes in the content heterogeneous relationship graph; The object similarity between the two content publishing objects is calculated according to the meta-path instance under the preset meta-path.

4. The method according to claim 3, characterized in that: The calculating the object similarity between the two content publishing objects according to the meta-path instance under the preset meta-path includes: Determining the similarity between the two content publishing objects under the preset meta-path based on the number of meta-path instances under the preset meta-path; According to the similarities between the two content publishing objects under each preset meta-path, the object similarity between the two content publishing objects is determined.

5. The method according to claim 2, characterized in that: Determining the object similarity between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph includes: Determine the similarity of operation contents between the content publishing objects according to the operation content information associated with the content publishing objects in the content heterogeneous relationship graph; Acquire an environment heterogeneous relationship graph corresponding to the content publishing object, wherein the environment heterogeneous relationship graph represents an association relationship between the content publishing object and operating environment information in at least one dimension; Determine the similarity of the operating environments between the content publishing objects according to the operating environment information associated with the content publishing objects in the environment heterogeneous relationship graph; Based on the operation content similarity and the operation environment similarity, object similarity between respective content publishing objects is determined.

6. The method according to claim 1, characterized in that For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to mine the target social associated object that has an impact on the primary object group includes: For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group, wherein the social object set includes social associated objects corresponding to each content publishing object in the primary object group; According to the influence of each social associated object in the social object set on the primary object group, a target social associated object corresponding to the primary object group is selected from the social object set.

7. The method according to claim 6, characterized in that For each primary object group, mining the social relationship data corresponding to each content publishing object in the primary object group to obtain a social object set corresponding to the primary object group includes: constructing a social relationship network according to the social relationship data of each content publishing object in the primary object group, wherein the social relationship network includes an association relationship between the content publishing object and social information in at least one dimension; Based on a preset social association path for the content publishing object, performing node wandering in the social relationship network to query a social association path instance corresponding to the content publishing object under the preset social association path; According to the social association path instance, the social association object corresponding to the content publishing object is determined, and a social object set corresponding to the primary object group is obtained.

8. The method according to claim 7, characterized in that The selecting, from the social object set, a target social associated object corresponding to the primary object group according to the influence of each social associated object in the social object set on the primary object group comprises: For each social associated object in the social object set, determining the quantity information of content publishing objects in the primary object group that have an associated relationship with the social associated object; Determining the influence of the socially associated object on the primary object group according to the quantity information; According to the influence, a target social associated object corresponding to the primary object group is selected from the social object set.

9. The method according to claim 8, characterized in that The determining of the number of content publishing objects in the primary object group that are associated with the socially associated object includes: Taking the node corresponding to the social association object as a root node and based on the social association path instance, constructing a social tree model corresponding to the social association object; Determine the quantity information of the content publishing objects belonging to the primary object group among the content publishing objects corresponding to the leaf nodes in the social tree model.

10. The method according to claim 8, characterized in that The determining of the number of content publishing objects in the primary object group that are associated with the socially associated object includes: Aggregating the social association path instances corresponding to the content publishing objects in the primary object group to obtain an aggregated network; The in-degree of the primary object group to the social associated object is calculated according to the aggregated network, where the in-degree represents quantity information of content publishing objects that are associated with the social associated object.

11. The method according to claim 1, characterized in that The step of merging the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality includes: Calculate the group similarity between each primary object group according to the target social associated object corresponding to each primary object group; Merging the primary object groups according to the group similarity to obtain at least one merged object group; According to the abnormality degree of the content publishing objects in the merged object group, a target object group with potential abnormality is determined from the merged object group.

12. The method according to claim 11, characterized in that The calculating the group similarity between each primary object group according to the target social associated object corresponding to each primary object group includes: For each two primary object groups, determining the initial similarity corresponding to the two primary object groups according to the overlap of the target social association objects corresponding to the two primary object groups; Calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups; The group similarity between the two primary object groups is determined based on the initial similarity and the overall influence.

13. The method according to claim 12, characterized in that The calculating the overall influence of the target social associated objects corresponding to the two primary object groups on the two primary object groups includes: For each target social association object corresponding to the two primary object groups, calculating the influence of the target social association object on the two primary object groups; The influences of each target social associated object on the two primary object groups are merged to obtain the overall influences of the target social associated objects corresponding to the two primary object groups on the two primary object groups.

14. An object group recognition device, characterized in that: include: An acquisition unit, used to acquire operation content information of multiple content publishing objects in at least one dimension; an aggregation unit, configured to aggregate the plurality of content publishing objects according to the operation content information corresponding to each content publishing object, to obtain at least one primary object group, each primary object group including at least one content publishing object; A mining unit, configured to mine, for each primary object group, social relationship data corresponding to each content publishing object in the primary object group, so as to mine target social related objects that have an impact on the primary object group; A merging unit is used to merge the primary object groups according to the abnormality of the target social associated object and the content publishing object in the primary object group to obtain at least one target object group with potential abnormality.

15. An electronic device, characterized in that: It comprises a memory and a processor; the memory stores an application program, and the processor is used to run the application program in the memory to perform the operations in the object group recognition method according to any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the object group recognition method according to any one of claims 1 to 13.

17. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps in the object group recognition method according to any one of claims 1 to 13 are implemented.

Images