A data forgery detection method and device, electronic equipment and storage medium

Abstract

The application belongs to the technical field of data detection and identification, and discloses a data forgery detection method and device, an electronic device and a storage medium, which comprises the following steps: obtaining to-be-detected data; extracting data features of the to-be-detected data; comparing time sequence features with the time sequence of the to-be-detected data in the time sequences of multiple pieces of data to obtain a first comparison result; comparing content features with index content of the to-be-detected data and / or conversation content in a conversation file corresponding to the to-be-detected data to obtain a second comparison result; inputting syntax features into a pre-trained syntax feature classification model to obtain a feature type to which the syntax features belong; and determining that the to-be-detected data is forged data if a forgery data condition is met. It can be seen that the combination of the extracted multi-dimensional data features and the syntax feature classification model can efficiently and accurately detect data forgery.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data detection and identification, and particularly relates to a data forgery detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the rapid development of network communication technology, data interaction becomes increasingly frequent and important. However, in the process of data interaction, there may be cases of data forgery or tampering, which poses a serious threat to data security. Therefore, developing an efficient data forgery detection technology is of great significance for protecting data security and maintaining network order.

[0003] The technical solution in the related art is still limited to data collection and fixation, and there is currently no method for detecting and identifying the authenticity of data. Therefore, there is an urgent need to provide an efficient and accurate data forgery detection method. SUMMARY

[0004] The purpose of the present application is to efficiently and accurately detect data forgery.

[0005] In a first aspect, the present application provides a data forgery detection method, which comprises:

[0006] obtaining data to be detected;

[0007] extracting data features of the data to be detected; the data features include time sequence features, content features and syntax features of the data to be detected;

[0008] comparing the time sequence features with the time sequence of the data to be detected in a plurality of data time sequences to obtain a first comparison result; and comparing the content features with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the plurality of data includes the data to be detected, and the first comparison result and the second comparison result both include consistent comparison and inconsistent comparison;

[0009] inputting the syntax features into a pre-trained syntax feature classification model to obtain the feature type to which the syntax features belong; the feature type includes an unaltered feature type and an altered feature type;

[0010] determining the data to be detected as forged data under the condition of meeting the forged data condition; the forged data condition includes one or more of the following conditions: the first comparison result is inconsistent comparison, the second comparison result is inconsistent comparison, and the feature type is an altered feature type.

[0011] Optionally, in the case that the counterfeit data condition is not met, the method further comprises:

[0012] inputting the to-be-detected data into a pre-trained counterfeit data identification model; the counterfeit data identification model is trained by real data samples and counterfeit data samples;

[0013] identifying the to-be-detected data by the counterfeit data identification model to obtain a counterfeit type of the to-be-detected data, the counterfeit type including that the to-be-detected data is counterfeit data or the to-be-detected data is not counterfeit data.

[0014] Optionally, the counterfeit data identification model includes a plurality of counterfeit data identification sub-models;

[0015] identifying the to-be-detected data by the counterfeit data identification model to obtain a counterfeit type of the to-be-detected data, includes:

[0016] identifying the to-be-detected data by the plurality of counterfeit data identification sub-models respectively to obtain a plurality of counterfeit types of the to-be-detected data, and in the case that a target counterfeit type exists in the plurality of counterfeit types, determining that the to-be-detected data is counterfeit data; each counterfeit data identification sub-model outputs one counterfeit type; the target counterfeit type is that the to-be-detected data is counterfeit data.

[0017] or,

[0018] identifying the to-be-detected data by the plurality of counterfeit data identification sub-models respectively to obtain a plurality of counterfeit types of the to-be-detected data, and in the case that a proportion of a target counterfeit type in the plurality of counterfeit types is greater than a proportion of a non-target counterfeit type, determining that the to-be-detected data is counterfeit data; the non-target counterfeit type is that the to-be-detected data is not counterfeit data.

[0019] Optionally, comparing the time sequence feature with a time sequence of the to-be-detected data in a plurality of data time sequences to obtain a first comparison result, includes:

[0020] obtaining a plurality of data time sequences including the to-be-detected data; and finding a time sequence corresponding to the to-be-detected data in the plurality of data time sequences;

[0021] comparing the time sequence feature of the to-be-detected data with the found time sequence corresponding to the to-be-detected data;

[0022] in the case that the time sequence feature of the to-be-detected data is consistent with the found event sequence corresponding to the to-be-detected data, determining that the first comparison result is consistent comparison;

[0023] In a case where the time sequence feature of the to-be-detected data is inconsistent with the event sequence corresponding to the to-be-detected data found, it is determined that the first comparison result is inconsistent.

[0024] Optionally, the comparing the content feature with the index content of the to-be-detected data and / or the session content in the session file corresponding to the to-be-detected data to obtain a second comparison result comprises:

[0025] Obtaining a temporary session file corresponding to the to-be-detected data;

[0026] Parsing the temporary session file to obtain session content included in the temporary session file;

[0027] Comparing the content feature of the to-be-detected data with the session content;

[0028] In a case where the content feature of the to-be-detected data is consistent with the session content, it is determined that the second comparison result is consistent.

[0029] In a case where the content feature of the to-be-detected data is inconsistent with the session content, it is determined that the second comparison result is inconsistent.

[0030] Optionally, the comparing the content feature with the index content of the to-be-detected data and / or the session content in the session file corresponding to the to-be-detected data to obtain a second comparison result comprises:

[0031] Finding the index content corresponding to the to-be-detected data in a target data index table; the target data index table stores the index content corresponding to the to-be-detected data;

[0032] Comparing the content feature with the index content found;

[0033] In a case where the content feature of the to-be-detected data is consistent with the index content found, it is determined that the second comparison result is consistent.

[0034] In a case where the content feature of the to-be-detected data is inconsistent with the index content found, it is determined that the second comparison result is inconsistent.

[0035] In a second aspect, the present application provides a data forgery detection device, which comprises:

[0036] A data acquisition module for acquiring to-be-detected data;

[0037] A feature extraction module for extracting data features of the to-be-detected data; the data features comprise time sequence features, content features and syntax features of the to-be-detected data;

[0038] a feature comparison module, configured to compare the time sequence feature with a time sequence of the to-be-detected data in time sequences of a plurality of pieces of data to obtain a first comparison result, and compare the content feature with an index content of the to-be-detected data and / or a session content in a session file corresponding to the to-be-detected data to obtain a second comparison result, wherein the plurality of pieces of data include the to-be-detected data, and the first comparison result and the second comparison result each include a comparison consistency and a comparison inconsistency;

[0039] a feature classification module, configured to input the syntax feature into a pre-trained syntax feature classification model to obtain a feature type to which the syntax feature belongs, wherein the feature type includes an unaltered feature type and an altered feature type;

[0040] a data detection module, configured to determine that the to-be-detected data is counterfeit data in a case where a counterfeit data condition is met, wherein the counterfeit data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is an altered feature type.

[0041] Optionally, the apparatus further includes a counterfeit data identification module, configured to:

[0042] in a case where the counterfeit data condition is not met, input the to-be-detected data into a pre-trained counterfeit data identification model, wherein the counterfeit data identification model is trained by using real data samples and counterfeit data samples;

[0043] identify the to-be-detected data by using the counterfeit data identification model to obtain a counterfeit type of the to-be-detected data, wherein the counterfeit type includes that the to-be-detected data is counterfeit data or that the to-be-detected data is not counterfeit data.

[0044] Optionally, the counterfeit data identification model includes a plurality of counterfeit data identification sub-models.

[0045] The counterfeit data identification module is specifically configured to:

[0046] identify the to-be-detected data by using the plurality of counterfeit data identification sub-models respectively to obtain a plurality of counterfeit types of the to-be-detected data, and determine that the to-be-detected data is counterfeit data in a case where a target counterfeit type exists in the plurality of counterfeit types, wherein each counterfeit data identification sub-model outputs one counterfeit type, and the target counterfeit type is that the to-be-detected data is counterfeit data.

[0047] or,

[0048] The plurality of counterfeit data identification sub-models are used to identify the to-be-detected data respectively, to obtain a plurality of counterfeit types of the to-be-detected data, and in a case where a proportion of a target counterfeit type in the plurality of counterfeit types is greater than a proportion of a non-target counterfeit type, it is determined that the to-be-detected data is counterfeit data; the non-target counterfeit type is that the to-be-detected data is not counterfeit data.

[0049] Optionally, the feature comparison module is specifically configured to:

[0050] obtain a time sequence of a plurality of data including the to-be-detected data; and find a time sequence corresponding to the to-be-detected data in the time sequence of the plurality of data;

[0051] compare the time sequence feature of the to-be-detected data with the found time sequence corresponding to the to-be-detected data;

[0052] in a case where the time sequence feature of the to-be-detected data is consistent with the found time sequence corresponding to the to-be-detected data, determine that a first comparison result is consistent;

[0053] in a case where the time sequence feature of the to-be-detected data is inconsistent with the found time sequence corresponding to the to-be-detected data, determine that the first comparison result is inconsistent.

[0054] Optionally, the feature comparison module is specifically configured to:

[0055] obtain a temporary session file corresponding to the to-be-detected data;

[0056] parse the temporary session file to obtain session content included in the temporary session file;

[0057] compare the content feature of the to-be-detected data with the session content;

[0058] in a case where the content feature of the to-be-detected data is consistent with the session content, determine that a second comparison result is consistent;

[0059] in a case where the content feature of the to-be-detected data is inconsistent with the session content, determine that the second comparison result is inconsistent.

[0060] Optionally, the feature comparison module is specifically configured to:

[0061] find index content corresponding to the to-be-detected data in a target data index table; the target data index table stores the index content corresponding to the to-be-detected data;

[0062] compare the content feature with the found index content;

[0063] In a case where the content feature of the to-be-detected data is consistent with the found index content, determining that the second comparison result is consistent in comparison.

[0064] In a case where the content feature of the to-be-detected data is inconsistent with the found index content, determining that the second comparison result is inconsistent in comparison.

[0065] In a case where the content feature of the to-be-detected data is inconsistent with the found index content, determining that the second comparison result is inconsistent in comparison.

[0066] at least one processor;

[0067] a memory for storing instructions executable by the at least one processor;

[0068] The at least one processor is configured to execute the instructions to implement the above-described counterfeit data detection method.

[0069] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, when instructions in the computer readable storage medium are executed by a processor of an electronic device, the electronic device can execute the above-described counterfeit data detection method.

[0070] In a fifth aspect, an embodiment of the present application further provides a computer program product, comprising a computer program, when the computer program is executed by a processor, the above-described counterfeit data detection method is implemented.

[0071] The technical solution provided by the embodiment of the present application, when detecting counterfeit data, first acquires to-be-detected data; then extracts multi-dimensional data features of the to-be-detected data, including time sequence features, content features, and syntax features, etc. For the time sequence features, the time sequence features can be compared with the time sequence of the to-be-detected data in the time sequences of multiple data, so as to directly, efficiently and accurately judge whether the to-be-detected data is counterfeit data. For the content features, the content features can be compared with index content of to-be-detected content and / or conversation content in a conversation file, so as to directly, efficiently and accurately judge whether the to-be-detected data is counterfeit data. For the syntax features, the syntax features can be combined with a syntax feature classification model to accurately judge whether the to-be-detected data is counterfeit data. It can be seen that by combining the extracted multi-dimensional data features and the syntax feature classification model, the counterfeit data can be efficiently and accurately detected. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 a flowchart of the complete technical solution provided by the embodiment of the present application;

[0073] Figure 2 a schematic diagram of multiple data features provided by the embodiment of the present application;

[0074] Figure 3A flowchart of a training process of a syntax feature classification model provided for an embodiment of the present application is shown in FIG. 1.

[0075] Figure 4 A flowchart of a training process of a fake data identification model provided for an embodiment of the present application is shown in FIG. 2.

[0076] Figure 5 A flowchart of a data fake detection method provided for an embodiment of the present application is shown in FIG. 3.

[0077] Figure 6 A flowchart of another data fake detection method provided for an embodiment of the present application is shown in FIG. 4.

[0078] Figure 7 A structural schematic diagram of a data fake detection device provided for an embodiment of the present application is shown in FIG. 5.

[0079] Figure 8 A structural schematic diagram of an electronic device provided for an embodiment of the present application is shown in FIG. 6. DETAILED DESCRIPTION

[0080] The present application will be described in detail below through embodiments.

[0081] It should be noted that the information (including but not limited to device information, personal information, etc.) and related data (including but not limited to text data) involved in the present application are all information authorized by various parties.

[0082] With the rapid development of network communication technology, data interaction has become increasingly frequent and important. However, in the process of data interaction, there may be cases of data being falsified or tampered with, which poses a serious threat to data security. Therefore, developing an efficient data fake detection technology is of great significance for protecting data security and maintaining network order.

[0083] The technical solutions in the related art are still limited to data collection and fixation, and there is currently no method for detecting and identifying the authenticity of data, so there is an urgent need to provide an efficient and accurate data fake detection method.

[0084] The present application can efficiently and accurately detect data falsification by combining various data feature extraction methods and data fake identification models. The various data features can include time series features, content features, and statistical features of the data. The content features include session features and index features, and the statistical features include syntax features. These data features will be described in detail in the following embodiments.

[0085] Moreover, a feedback correction mechanism can be used to continuously optimize the data forgery identification model. In actual applications, multiple data forgery identification models can be integrated to improve the accuracy and efficiency of data forgery detection. At the same time, the data forgery data identification model can be updated regularly to adapt to new forgery methods and changes, and improve the adaptability and robustness of the system.

[0086] The complete technical solution of the application will be described in detail below in combination with a specific application scenario. As shown in Figure 1 the flowchart of the complete technical solution of the application.

[0087] S110, data preprocessing. Specifically, before data forgery detection, data preprocessing can be performed on the data. Specifically, it includes collecting and preprocessing the data to be detected, removing irrelevant data and retaining only useful data, i.e. standardizing the data to be detected to obtain a standard data stream, so as to extract the data features of the data to be detected in the subsequent steps.

[0088] S120, extracting data features of the data to be detected. Specifically, after obtaining the standard data stream, multiple data features of the standard data stream can be extracted, as shown in Figure 2 the multiple data features include time series features, session features, index content features, statistical features (mainly including syntax features such as punctuation marks, frequency of idioms, etc.) and data directly tampered features, and the data features can assist in subsequent data forgery detection and identification.

[0089] S130, data forgery detection. Specifically, for time series features, session features, index content features and data directly tampered features, it can be directly detected whether the data is forged data. For statistical features, machine learning algorithms such as SVM (Support Vector Machine) classification model, random forest model, etc. can be used to classify statistical features (i.e. syntax features) to assist decision-making to detect real and fake message data.

[0090] How to detect forged data through time series features, session features, index content features, data directly tampered features and syntax features will be described in detail below.

[0091] 1. For time series features, multiple data entries in a database can be sorted according to their chronological order of creation. If the time of the data to be tested is tampered with, the time series features of the data to be tested will not match the time of the data stored in the database. For example, if the time of a data entry in a chat log table is tampered with, the time series in the database may not match the time of that data entry. For instance, the data entry that was originally earlier might appear as the last entry in the database. Therefore, by comparing the time series features of the data to be tested with the time stored in the database, if they do not match, it indicates that the time series of the data to be tested has been modified, and the data to be tested can be determined to be forged data.

[0092] 2. For session features, the temporary session file corresponding to the data to be detected can be obtained; and the temporary session file can be parsed to obtain the session content included in the temporary session file; the session features of the data to be detected are compared with the parsed session content; if the content features of the data to be detected are inconsistent with the session content, it indicates that the content of the data to be detected has been tampered with, therefore, the data to be detected can be determined to be forged data.

[0093] 3. Regarding index content characteristics: In practical applications, some big data applications create index tables for text messages. There might be situations where only the display interface is modified, while the indexed text remains unchanged. Therefore, the index content corresponding to the data to be detected can be found in the data index table stored in the local database. The index content characteristics are then compared with the found index content. If the content characteristics of the data to be detected do not match the found index content, it indicates that the content of the data to be detected has been modified, and therefore, the data to be detected can be determined to be forged data.

[0094] 4. If the data has been directly tampered with, the server may retain operation logs and recoverable data blocks. In this case, it can be directly determined that the data has been tampered with.

[0095] 5. Regarding grammatical features, grammatical features can be input into a pre-trained grammatical feature classification model, such as an SVM (Support Vector Machine) classification model or a random forest model. If the grammatical feature type output from the grammatical feature classification model is a tampering feature type, it indicates that the grammar of the data to be detected has been tampered with. In this case, the data to be detected can be determined to be forged data.

[0096] Among them, such as Figure 3 As shown, the training process of the pre-trained syntax feature classification model can include the following steps:

[0097] S131, Obtain grammatically correct training data as positive sample data; and obtain training data with grammatical errors as negative sample data.

[0098] S132, input positive and negative sample data into the grammar feature classification model to be trained, and train the grammar feature classification model to be trained.

[0099] S133, if the accuracy of the feature types output from the grammatical feature classification model to be trained is greater than a preset threshold, the trained grammatical feature classification model is determined.

[0100] Specifically, when training a grammatical feature classification model, a large number of training samples are first collected, consisting of positive samples composed of grammatically correct training data and negative samples composed of grammatically incorrect training data. Then, the positive and negative samples are input into the grammatical feature classification model to be trained, and the model is continuously trained. If the accuracy of the feature types output by the model is greater than a preset threshold, it indicates that the classification accuracy of the grammatical feature classification model is high. At this point, the trained grammatical feature classification model is determined.

[0101] S140, Data Forgery Detection. Specifically, in practical applications, to improve the accuracy of data forgery detection and identification, after detecting forged data through S130, if the detection result indicates that the data is not forged, further identification can be performed using a forgery data identification model. For example, for suspected forged data, deep learning algorithms, such as convolutional neural networks and recurrent neural networks, can be used for further identification to improve the accuracy of data forgery detection and identification.

[0102] Among them, such as Figure 4 As shown, the specific process of training a fake data detection model can include the following steps:

[0103] S141, Obtain real data samples as positive sample data; and obtain fake data samples as negative sample data.

[0104] S142, input positive sample data and negative sample data into the fake data recognition model to be trained, and train the fake data recognition model to be trained.

[0105] S143, if the accuracy of the forgery type output from the forgery data identification model to be trained is greater than a preset threshold, the trained forgery data identification model is determined. Here, the forgery type includes both forged data and non-forged data.

[0106] Specifically, in training the fake data recognition model, a large number of training samples are first collected, including positive sample data composed of real data and negative sample data composed of fake data. Then, the positive sample data and the negative sample data are input into the fake data recognition model to be trained, and the fake data recognition model is continuously trained. If the accuracy of the fake type output from the fake data recognition model to be trained is greater than a preset threshold, it indicates that the recognition accuracy of the fake data recognition model is high, and at this time, the trained fake data recognition model is determined. The preset threshold can be set according to the actual situation. It can be understood that the smaller the preset threshold is set, the higher the recognition accuracy of the fake data recognition model is.

[0107] As can be seen from the above description, the technical scheme provided by the embodiment of the application first pre-processes the to-be-detected data before performing fake detection and identification on the to-be-detected data, and eliminates the interference of useless information. Then, the multi-dimensional data features of the pre-processed data are extracted, including time sequence features, session features, index content features, and syntax features. For the time sequence features, the session features, and the index content features, the to-be-detected data can be directly and efficiently and accurately judged to be fake data by comparing the time sequence, the temporary session content, and the data index table of the to-be-detected data. For the syntax features, the to-be-detected data can be accurately judged to be fake data by combining the syntax feature classification model. It can be seen that the technical scheme provided by the embodiment of the application can efficiently and accurately detect fake data by combining the extraction of multi-dimensional data features and the syntax feature classification model. Moreover, in the case that the detection result is that the data is non-fake data, the fake data recognition model can be further used for identification, thereby further improving the accuracy of data fake detection and identification.

[0108] After accurately detecting and identifying the fake data, the syntax feature classification model and the fake data recognition model can be modified and optimized according to the detection and identification results, so as to improve the generalization ability of the syntax feature classification model and the fake data recognition model, thereby further improving the accuracy of data fake detection and identification.

[0109] Moreover, in actual application, in order to further improve the efficiency and accuracy of data fake detection, the fake data recognition model can include multiple fake data recognition sub-models. In this way, the multiple fake data recognition sub-models can simultaneously perform fake detection on the data, and the multiple fake data recognition sub-models output the fake types of the data.

[0110] In one embodiment, if there is a case that the data is fake data in the fake types output by the multiple fake data recognition sub-models, it can be determined that the data is fake data.

[0111] Or, in another embodiment, if the proportion of the forged type of data being forged data is large among the forged types output by the plurality of forged data identification sub-models, it can be determined that the data is forged data. For example, the forged data identification model includes 5 forged data identification sub-models, which are forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3, forged data identification sub-model 4 and forged data identification sub-model 5. Among them, the forged types output by forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3 and forged data identification sub-model 4 are all: the data is forged data, and only the forged type output by forged data identification sub-model 5 is: the data is not forged data. It can be seen that the proportion of the forged type of data being forged data is 80%, and the proportion of the forged type of data not being forged data is 20%, so it can be determined that the proportion of the forged type of data being forged data is large, and the data is determined to be forged data.

[0112] In addition, in order to adapt the data forgery identification model to new forgery means and changes, that is, to further improve the identification accuracy of forged data. The data forgery identification model can be updated once every pre-set time. Specifically, the real data can be forged by a plurality of different forgery methods to obtain forged data of different forgery methods, thereby improving the generalization ability of the data forgery identification model.

[0113] After the overall technical solution of the application is described in detail, a data forgery detection method provided by the embodiment of the application will be described in detail. The execution subject of the data forgery detection method can be a server capable of executing the data forgery detection method.

[0114] As shown in Figure 5 The data forgery detection method provided by the embodiment of the application can include the following steps:

[0115] S510, obtaining the data to be detected.

[0116] If a piece of data is to be detected whether it is forged data, the data is the data to be detected. After obtaining the data to be detected, the data to be detected can be preprocessed to obtain a standard data stream. The specific implementation mode has been described in the above embodiment, and will not be repeated here.

[0117] S520, extracting the data features of the data to be detected.

[0118] Among them, the data features include the time sequence features, content features and syntax features of the data to be detected.

[0119] Specifically, the data content of the to-be-detected data can include the generation time of the to-be-detected data, what the to-be-detected data specifically includes, what the to-be-detected data includes, and the number of the conventional words and punctuation marks included in the to-be-detected data. Therefore, after obtaining the to-be-detected data, a plurality of data features of the to-be-detected data can be extracted, the plurality of data features including time sequence features, content features, and syntax features, wherein the content features include session features and index content features, and the syntax features include punctuation marks and the number of conventional words. Through the extraction of the data features, subsequent data forgery detection can be facilitated.

[0120] S530, comparing the time sequence features with the time sequence of the to-be-detected data in the time sequences of the plurality of data to obtain a first comparison result, and comparing the content features with the index content of the to-be-detected data and / or the session content in the session file corresponding to the to-be-detected data to obtain a second comparison result.

[0121] The plurality of data includes the to-be-detected data, and the first comparison result and the second comparison result both include consistent comparison and inconsistent comparison.

[0122] In actual application, the time sequences of the plurality of data can be stored in a database, which can be stored locally by the server as an execution subject, or can be obtained by the server as an execution subject from other servers, both of which are reasonable. The index content of the to-be-detected data and / or the session file corresponding to the to-be-detected data can also be stored locally by the server as an execution subject, or can be obtained by the server as an execution subject from other servers.

[0123] For the time sequence features, the time sequence features can be directly compared with the time sequence of the to-be-detected data in the time sequences of the plurality of data to obtain the first comparison result. For the content features, if the content features are index content features, the index content of the to-be-detected data can be directly compared with the index content of the to-be-detected data to obtain the second comparison result. If the content features are session content features, the session content in the session file corresponding to the to-be-detected data can be directly compared with the session content in the session file corresponding to the to-be-detected data to obtain the second comparison result.

[0124] In an embodiment, comparing the time sequence features with the time sequence of the to-be-detected data in the time sequences of the plurality of data to obtain the first comparison result can include the following steps, respectively, steps a1 to a4:

[0125] Step a1, obtaining the time sequences of the plurality of data including the to-be-detected data, and searching for the time sequence corresponding to the to-be-detected data in the time sequences of the plurality of data.

[0126] Step a2, comparing the time sequence feature of the to-be-detected data with the time sequence corresponding to the to-be-detected data found.

[0127] Step a3, in the case where the time sequence feature of the to-be-detected data is consistent with the event sequence corresponding to the to-be-detected data found, determining that the first comparison result is consistent.

[0128] Step a4, in the case where the time sequence feature of the to-be-detected data is inconsistent with the event sequence corresponding to the to-be-detected data found, determining that the first comparison result is inconsistent.

[0129] For the time sequence feature, the plurality of data in the database can be sorted according to the time sequence of data generation. If the time of the to-be-detected data is tampered with, the time sequence feature of the to-be-detected data will not correspond to the time of the to-be-detected data stored in the database. For example, the time of a data in a chat record table is tampered with, which may result in the case that the time sequence of the database does not correspond to the time of the data. For example, the data is originally an earlier data, but appears at the last data in the database. Therefore, by comparing the time sequence feature of the to-be-detected data with the time stored in the database, if the two are inconsistent, the first comparison result is inconsistent. If the two are consistent, the first comparison result is consistent.

[0130] In an embodiment, comparing the content feature with the index content of the to-be-detected data and / or the conversation content in the conversation file corresponding to the to-be-detected data to obtain the second comparison result can include the following steps, steps b1 to b4:

[0131] Step b1, obtaining a temporary conversation file corresponding to the to-be-detected data.

[0132] Step b2, parsing the temporary conversation file to obtain the conversation content included in the temporary conversation file.

[0133] Step b3, comparing the content feature of the to-be-detected data with the conversation content.

[0134] Step b4, in the case where the content feature of the to-be-detected data is consistent with the conversation content, determining that the second comparison result is consistent.

[0135] Step b5, in the case where the content feature of the to-be-detected data is inconsistent with the conversation content, determining that the second comparison result is inconsistent.

[0136] Specifically, for the session feature, a temporary session file corresponding to the to-be-detected data can be acquired; and the temporary session file is parsed to obtain session content included in the temporary session file; the session feature of the to-be-detected data is compared with the parsed session content; if the content feature of the to-be-detected data is inconsistent with the session content, the second comparison result is inconsistent comparison; if the content feature of the to-be-detected data is consistent with the session content, the second comparison result is consistent comparison.

[0137] In another implementation, comparing the content feature with the index content of the to-be-detected data and / or the session content in the session file corresponding to the to-be-detected data to obtain the second comparison result can include the following steps:

[0138] Step c1, searching for the index content corresponding to the to-be-detected data in a target data index table; the target data index table stores the index content corresponding to the to-be-detected data.

[0139] Step c2, comparing the content feature with the searched index content.

[0140] Step c3, in the case that the content feature of the to-be-detected data is consistent with the searched index content, determining that the second comparison result is consistent comparison.

[0141] Step c4, in the case that the content feature of the to-be-detected data is inconsistent with the searched index content, determining that the second comparison result is inconsistent comparison.

[0142] Specifically, for the index content feature, in actual application, some big data applications can create an index table of text messages, and there can be a case that only the display interface is tampered with, and the index text is not tampered with. Therefore, the index content corresponding to the to-be-detected data can be searched in a data index table storing the index content corresponding to the to-be-detected data; the index content feature is compared with the searched index content; if the content feature of the to-be-detected data is inconsistent with the searched index content, the second comparison result is inconsistent comparison; if the content feature of the to-be-detected data is consistent with the searched index content, the second comparison result is consistent comparison.

[0143] S540, inputting the syntax feature into a pre-trained syntax feature classification model to obtain a feature type to which the syntax feature belongs.

[0144] The feature type includes an un-tampered feature type and a tampered feature type.

[0145] For the syntax feature, the syntax feature can be input into a pre-trained syntax feature classification model, such as a support vector machine (SVM) classification model or a random forest model, to output a feature type to which the syntax feature belongs. The feature type can be an unaltered feature type or an altered feature type.

[0146] It should be noted that the training process of the syntax feature classification model has been described in the above embodiments, and will not be repeated here.

[0147] S550, in the case of meeting the counterfeit data condition, determining that the to-be-detected data is counterfeit data. The counterfeit data condition includes one or more of the following conditions: the first comparison result is inconsistent comparison, the second comparison result is inconsistent comparison, and the feature type is an altered feature type.

[0148] Specifically, if the first comparison result is inconsistent comparison, it indicates that the time sequence of the to-be-detected data is counterfeit, and the to-be-detected data can be determined as counterfeit data. If the second comparison result is inconsistent comparison, it indicates that the content of the to-be-detected data is counterfeit, and the to-be-detected data can also be determined as counterfeit data. If the feature type of the syntax feature is an altered feature type, it indicates that the syntax of the to-be-detected data is counterfeit, and the to-be-detected data can also be determined as counterfeit data. That is, in the three conditions of the first comparison result being inconsistent comparison, the second comparison result being inconsistent comparison, and the feature type being an altered feature type, any one or more of the conditions can determine that the to-be-detected data is counterfeit data.

[0149] The technical scheme provided by the embodiments of the present application, when performing counterfeit detection on to-be-detected data, first acquires the to-be-detected data; then extracts multi-dimensional data features of the to-be-detected data, including time sequence features, content features, and syntax features. For the time sequence features, they can be compared with the time sequence of the to-be-detected data in the time sequences of multiple data, so as to directly and efficiently and accurately determine whether the to-be-detected data is counterfeit data. For the content features, they can be compared with the index content of the to-be-detected content and / or the conversation content in the conversation file, so as to directly and efficiently and accurately determine whether the to-be-detected data is counterfeit data. For the syntax feature, a syntax feature classification model can be combined to accurately determine whether the to-be-detected data is counterfeit data. It can be seen that by combining the extracted multi-dimensional data features and the syntax feature classification model, counterfeit detection on data can be efficiently and accurately performed.

[0150] On the basis of the above embodiments, in one implementation, in the case of not meeting the counterfeit data condition; as Figure 6 It should be noted that the training process of the syntax feature classification model has been described in the above embodiments, and will not be repeated here.

[0151] S560, input the to-be-detected data into the pre-trained fake data identification model.

[0152] The fake data identification model is trained by real data samples and fake data samples.

[0153] S570, identify the to-be-detected data by the fake data identification model to obtain a fake type of the to-be-detected data.

[0154] The fake type includes that the to-be-detected data is fake data or the to-be-detected data is not fake data.

[0155] Specifically, in order to improve the data fake detection and identification accuracy, after the to-be-detected data is detected by S510 to S550, if the detection result is not fake data, the to-be-detected data can be further detected to improve the accuracy of data fake detection. At this time, the to-be-detected data can be input into the pre-trained fake data identification model to be further identified by the fake data identification model. For example, a deep learning algorithm such as a convolutional neural network and a recurrent neural network can be used for further identification to improve the data fake detection and identification accuracy.

[0156] As an implementation manner of the present application, the training process of the fake data identification model can include the following steps, steps d1 to d4:

[0157] Step d1, obtain real data as positive sample data, and obtain fake data as negative sample data. The fake data is obtained by faking the real data in multiple different fake ways.

[0158] Step d2, input the positive sample data and the negative sample data into the to-be-trained fake data identification model to train the to-be-trained fake data identification model.

[0159] Step d3, in the case that the accuracy of the fake type output from the to-be-trained fake data identification model is greater than a preset threshold, a trained fake data identification model is determined.

[0160] Specifically, when training the fake data recognition model, a large number of training samples are first collected, including positive sample data composed of real data and negative sample data composed of fake data. In the present application, the real data is forged by different forging methods to obtain negative samples, thereby helping the fake data recognition model to recognize various types of fake data and helping to improve the recognition accuracy of the fake data recognition model. The forging method can include multiple methods, for example, including deleting part of the content of the real data, adding part of the content of the real data, tampering with part of the content of the real data, etc., and the present application does not specifically limit the forging method.

[0161] After obtaining the positive sample data and the negative sample data, the positive sample data and the negative sample data are input into the fake data recognition model to be trained, and the fake data recognition model is continuously trained. If the accuracy of the fake type output from the fake data recognition model to be trained is greater than a preset threshold, it indicates that the recognition accuracy of the fake data recognition model is high. At this time, the fake data recognition model with high recognition accuracy is obtained.

[0162] As an implementation manner of the present application, the fake data recognition model includes multiple fake data recognition sub-models.

[0163] Specifically, in actual application, in order to further improve the data fake detection efficiency and accuracy, the fake data recognition model can include multiple fake data recognition sub-models, so that multiple fake data recognition sub-models can simultaneously perform fake detection on data, and multiple fake data recognition sub-models output the fake types of data.

[0164] At this time, in one embodiment, S570, the fake data recognition model is used to recognize the to-be-detected data to obtain the fake type of the to-be-detected data, which can include the following step e1:

[0165] Step e1, multiple fake data recognition sub-models are used to recognize the to-be-detected data respectively to obtain multiple fake types of the to-be-detected data, and in the case that a target fake type exists in the multiple fake types, it is determined that the to-be-detected data is fake data.

[0166] Among them, each fake data recognition sub-model outputs one fake type; the target fake type is that the to-be-detected data is fake data.

[0167] In this embodiment, if there is a case that the data is fake data in the fake types output by the multiple fake data recognition sub-models, it can be determined that the data is fake data. As can be seen, through multiple fake data recognition sub-models, it can be further determined whether the data is fake data.

[0168] In another implementation, S570, the identification of the to-be-detected data by the fake data identification model to obtain the fake type of the to-be-detected data can include the following step f1:

[0169] In step f1, the to-be-detected data is identified by a plurality of fake data identification sub-models to obtain a plurality of fake types of the to-be-detected data, and in a case where a proportion of a target fake type in the plurality of fake types is greater than a proportion of a non-target fake type, it is determined that the to-be-detected data is fake data.

[0170] The non-target fake type is that the to-be-detected data is not fake data.

[0171] In this implementation, if the proportion of the fake type in which the data is fake data in the fake types output by the plurality of fake data identification sub-models is large, it can be determined that the data is fake data. For example, the fake data identification model includes five fake data identification sub-models, namely, fake data identification sub-model 1, fake data identification sub-model 2, fake data identification sub-model 3, fake data identification sub-model 4, and fake data identification sub-model 5. Among them, the fake types output by the fake data identification sub-model 1, the fake data identification sub-model 2, the fake data identification sub-model 3, and the fake data identification sub-model 4 are all: the data is fake data, and only the fake type output by the fake data identification sub-model 5 is: the data is not fake data. As can be seen, the proportion of the fake type in which the data is fake data is 80%, and the proportion of the fake type in which the data is not fake data is 20%, so it can be determined that the data is fake data.

[0172] The application also provides a data fake detection device, as shown in Figure 7 The device comprises:

[0173] The data acquisition module 710 is configured to acquire to-be-detected data.

[0174] The feature extraction module 720 is configured to extract data features of the to-be-detected data; the data features include time sequence features, content features, and syntax features of the to-be-detected data.

[0175] The feature comparison module 730 is configured to compare the time sequence features with a time sequence of the to-be-detected data in a plurality of data to obtain a first comparison result; and compare the content features with index content of the to-be-detected data and / or session content in a session file corresponding to the to-be-detected data to obtain a second comparison result; the plurality of data includes the to-be-detected data, and the first comparison result and the second comparison result both include: consistent comparison and inconsistent comparison.

[0176] The feature classification module 740 is configured to input the syntax feature into a pre-trained syntax feature classification model to obtain a feature type to which the syntax feature belongs; the feature type includes an unaltered feature type and an altered feature type.

[0177] The data detection module 750 is configured to determine that the to-be-detected data is fake data if the to-be-detected data satisfies a fake data condition; the fake data condition includes one or more of the following conditions: the first comparison result is inconsistent, the second comparison result is inconsistent, and the feature type is an altered feature type.

[0178] The technical scheme provided by the embodiment of the application can be used for fake detection of to-be-detected data. First, the to-be-detected data is obtained. Then, multi-dimensional data features of the to-be-detected data are extracted, including time sequence features, content features, and syntax features. For the time sequence features, the time sequence features can be compared with a time sequence of the to-be-detected data in a plurality of data time sequences, so that whether the to-be-detected data is fake data can be directly, efficiently and accurately determined. For the content features, the content features can be compared with index content of to-be-detected content and / or conversation content in a conversation file, so that whether the to-be-detected data is fake data can be directly, efficiently and accurately determined. For the syntax features, a syntax feature classification model can be combined to accurately determine whether the to-be-detected data is fake data. It can be seen that the combination of the extracted multi-dimensional data features and the syntax feature classification model can efficiently and accurately detect whether the data is fake.

[0179] Optionally, the apparatus further includes a fake data identification module configured to:

[0180] In a case where the fake data condition is not satisfied, the to-be-detected data is input into a pre-trained fake data identification model; the fake data identification model is trained by using real data samples and fake data samples.

[0181] The to-be-detected data is identified by using the fake data identification model to obtain a fake type of the to-be-detected data; the fake type includes that the to-be-detected data is fake data or that the to-be-detected data is not fake data.

[0182] Optionally, the fake data identification model includes a plurality of fake data identification sub-models.

[0183] The fake data identification module is specifically configured to:

[0184] The plurality of counterfeit data identification sub-models are used to identify the to-be-detected data respectively, to obtain a plurality of counterfeit types of the to-be-detected data, and in a case where a target counterfeit type exists in the plurality of counterfeit types, it is determined that the to-be-detected data is counterfeit data; each of the counterfeit data identification sub-models outputs a counterfeit type; the target counterfeit type is that the to-be-detected data is counterfeit data.

[0185] Or,

[0186] The plurality of counterfeit data identification sub-models are used to identify the to-be-detected data respectively, to obtain a plurality of counterfeit types of the to-be-detected data, and in a case where a target counterfeit type exists in the plurality of counterfeit types, it is determined that the to-be-detected data is counterfeit data; each of the counterfeit data identification sub-models outputs a counterfeit type; the target counterfeit type is that the to-be-detected data is counterfeit data.

[0187] Optionally, the feature comparison module is specifically configured to:

[0188] Obtain a time sequence of a plurality of data including the to-be-detected data; and find a time sequence corresponding to the to-be-detected data in the time sequence of the plurality of data;

[0189] Compare the time sequence feature of the to-be-detected data with the found time sequence corresponding to the to-be-detected data;

[0190] In a case where the time sequence feature of the to-be-detected data is consistent with the found event sequence corresponding to the to-be-detected data, it is determined that the first comparison result is consistent with the comparison;

[0191] In a case where the time sequence feature of the to-be-detected data is inconsistent with the found event sequence corresponding to the to-be-detected data, it is determined that the first comparison result is inconsistent with the comparison.

[0192] Optionally, the feature comparison module is specifically configured to:

[0193] Obtain a temporary session file corresponding to the to-be-detected data;

[0194] Parse the temporary session file to obtain session content included in the temporary session file;

[0195] Compare the content feature of the to-be-detected data with the session content;

[0196] In a case where the content feature of the to-be-detected data is consistent with the session content, it is determined that the second comparison result is consistent with the comparison;

[0197] In a case where the content feature of the to-be-detected data is inconsistent with the session content, it is determined that the second comparison result is inconsistent with the comparison.

[0198] Optionally, the feature comparison module is specifically used for:

[0199] finding the index content corresponding to the to-be-detected data in a target data index table, wherein the target data index table stores the index content corresponding to the to-be-detected data;

[0200] comparing the content feature with the found index content;

[0201] in a case where the content feature of the to-be-detected data is consistent with the found index content, determining that the second comparison result is consistent in comparison;

[0202] in a case where the content feature of the to-be-detected data is inconsistent with the found index content, determining that the second comparison result is inconsistent in comparison.

[0203] In a third aspect, an electronic device is provided, as shown in the accompanying drawings, comprising: Figure 8

[0204] at least one processor 801;

[0205] a memory 802 for storing instructions executable by the at least one processor;

[0206] wherein the at least one processor is configured to execute the instructions to implement the above counterfeit data detection method.

[0207] The technical solution provided by the embodiments of the present application, in the process of counterfeit detection of to-be-detected data, first acquires the to-be-detected data; then extracts multi-dimensional data features of the to-be-detected data, including time sequence features, content features, and syntax features, etc. For the time sequence features, the time sequence features can be compared with the time sequence of the to-be-detected data in the time sequence of multiple data, so as to directly and efficiently and accurately judge whether the to-be-detected data is counterfeit data. For the content features, the content features can be compared with the index content of the to-be-detected content and / or the session content in the session file, so as to directly and efficiently and accurately judge whether the to-be-detected data is counterfeit data. For the syntax features, the syntax features can be combined with the syntax feature classification model to accurately judge whether the to-be-detected data is counterfeit data. It can be seen that by combining the extracted multi-dimensional data features and the syntax feature classification model, the counterfeit detection of data can be efficiently and accurately performed.

[0208] In a fourth aspect, a computer readable storage medium is provided, when instructions in the computer readable storage medium are executed by a processor of an electronic device, the electronic device can perform the above counterfeit data detection method.

[0209] ​The technical scheme provided by the embodiment of the present application, when detecting the to-be-detected data, first acquires the to-be-detected data; then extracts multi-dimensional data features of the to-be-detected data, including time sequence features, content features and syntax features, etc. For the time sequence features, the to-be-detected data can be compared with the time sequence of the to-be-detected data in the time sequences of multiple data, so as to directly, efficiently and accurately judge whether the to-be-detected data is fake data. For the content features, the to-be-detected content can be compared with the index content of the to-be-detected content and / or the session content in the session file, so as to directly, efficiently and accurately judge whether the to-be-detected data is fake data. For the syntax features, the syntax feature classification model can be combined to accurately judge whether the to-be-detected data is fake data. It can be seen that the multi-dimensional data features and the syntax feature classification model are combined, so that the data can be efficiently and accurately detected for forgery.

[0210] In a fifth aspect, the embodiment of the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the above-mentioned fake data detection method.

[0211] The technical scheme provided by the embodiment of the present application, when detecting the to-be-detected data, first acquires the to-be-detected data; then extracts multi-dimensional data features of the to-be-detected data, including time sequence features, content features and syntax features, etc. For the time sequence features, the to-be-detected data can be compared with the time sequence of the to-be-detected data in the time sequences of multiple data, so as to directly, efficiently and accurately judge whether the to-be-detected data is fake data. For the content features, the to-be-detected content can be compared with the index content of the to-be-detected content and / or the session content in the session file, so as to directly, efficiently and accurately judge whether the to-be-detected data is fake data. For the syntax features, the syntax feature classification model can be combined to accurately judge whether the to-be-detected data is fake data. It can be seen that the multi-dimensional data features and the syntax feature classification model are combined, so that the data can be efficiently and accurately detected for forgery.

[0212] Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and should not be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments without departing from the principles and purposes of the present application within the scope of the present application.

Claims

1. A method for detecting data forgery, characterized in that, The method includes: Acquire the data to be tested; Extract the data features of the data to be detected; the data features include the time series features, content features, and syntactic features of the data to be detected. The time series features are compared with the time series of the data to be detected in the time series of multiple data to obtain a first comparison result; and the content features are compared with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the multiple data include the data to be detected, and both the first comparison result and the second comparison result include: comparison consistent and comparison inconsistent; The grammatical features are input into a pre-trained grammatical feature classification model to obtain the feature type to which the grammatical features belong; the feature type includes unaltered feature type and tampered feature type. If the conditions for falsified data are met, the data to be detected is determined to be falsified data; the conditions for falsified data include the following: the first comparison result is inconsistent, the second comparison result is inconsistent, and the feature type is a tampered feature type; If the conditions for forged data are not met, the data to be detected is input into a pre-trained forged data identification model; the forged data identification model is trained using real data samples and forged data samples; the forged data identification model identifies the data to be detected to obtain the forgery type of the data to be detected, the forgery type including whether the data to be detected is forged data or whether the data to be detected is not forged data.

2. The method according to claim 1, characterized in that, The forged data identification model includes multiple forged data identification sub-models; The step of identifying the forgery type of the data to be detected through the forgery identification model includes: The data to be detected is identified by the multiple forgery identification sub-models to obtain multiple forgery types of the data to be detected. If a target forgery type exists among the multiple forgery types, the data to be detected is determined to be forged. Each forgery identification sub-model outputs a forgery type, and the target forgery type is: the data to be detected is forged. or, The data to be detected is identified by the multiple fake data identification sub-models to obtain multiple fake data types. If the proportion of target fake data types is greater than the proportion of non-target fake data types, the data to be detected is determined to be fake data. The non-target fake data types are: the data to be detected is not fake data.

3. The method according to claim 1 or 2, characterized in that, The time series features are compared with the time series of the data to be detected in multiple data time series to obtain a first comparison result, including: Obtain time series of multiple data points including the data to be detected; and find the time series corresponding to the data to be detected in the time series of the multiple data points; The time series features of the data to be detected are compared with the time series corresponding to the data to be detected that were found. If the time series features of the data to be detected are consistent with the event sequence corresponding to the data to be detected, the first comparison result is determined to be consistent. If the time series features of the data to be detected are inconsistent with the event sequence corresponding to the data to be detected, the first comparison result is determined to be inconsistent.

4. The method according to claim 1 or 2, characterized in that, The step of comparing the content features with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes: Obtain the temporary session file corresponding to the data to be detected; Parse the temporary session file to obtain the session content included in the temporary session file; The content features of the data to be detected are compared with the session content; If the content features of the data to be detected are consistent with the session content, the second comparison result is determined to be consistent. If the content features of the data to be detected are inconsistent with the session content, the second comparison result is determined to be inconsistent.

5. The method according to claim 1 or 2, characterized in that, The step of comparing the content features with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes: Search the target data index table for the index content corresponding to the data to be detected; the target data index table stores the index content corresponding to the data to be detected. Compare the content features with the found index content; If the content features of the data to be detected are consistent with the index content found, the second comparison result is determined to be consistent. If the content features of the data to be detected are inconsistent with the index content found, the second comparison result is determined to be inconsistent.

6. A data forgery detection device, characterized in that, The device includes: The data acquisition module is used to acquire the data to be detected. The feature extraction module is used to extract data features from the data to be detected; the data features include time series features, content features, and syntactic features of the data to be detected. The feature comparison module is used to compare the time series features with the time series of the data to be detected in the time series of multiple data to obtain a first comparison result; and to compare the content features with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the multiple data include the data to be detected, and both the first comparison result and the second comparison result include: comparison consistent and comparison inconsistent; The feature classification module is used to input the grammatical features into a pre-trained grammatical feature classification model to obtain the feature type to which the grammatical features belong; the feature type includes unaltered feature type and tampered feature type. The data detection module is used to determine that the data to be detected is forged data if the data to be detected meets the conditions for forged data; the conditions for forged data include the following: the first comparison result is inconsistent, the second comparison result is inconsistent, and the feature type is a tampering feature type; The data detection module is further configured to input the data to be detected into a pre-trained fake data identification model when the fake data conditions are not met; the fake data identification model is trained using real data samples and fake data samples; the fake data identification model identifies the data to be detected to obtain the fake type of the data to be detected, the fake type including whether the data to be detected is fake data or not fake data.

7. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-5.

Images