Behavior analysis method and related device

Abstract

The embodiment of the invention discloses a behavior analysis method and a related device, which can cluster behavior information of target account behaviors corresponding to a plurality of abnormal accounts on the basis of similarity between behavior information capable of representing account behavior characteristics, so that the behavior information with relatively high similarity is clustered into the same behavior information cluster, and the behavior analysis efficiency is improved. Therefore, the generality of the plurality of abnormal accounts when executing the target account behavior can be accurately analyzed through the behavior information cluster, the generality is the account behavior feature represented by the representative behavior information corresponding to the behavior information cluster, and then whether the to-be-identified account is used for executing the abnormal behavior can be accurately identified based on the representative behavior information. According to the behavior analysis method, the account behavior generality of the multiple abnormal accounts can be automatically, efficiently and accurately analyzed from the behavior information dimension, the representative behavior information is extracted for account recognition, the information analysis range is expanded, and the comprehensiveness and accuracy of behavior analysis are improved.

Description

Technical Field

[0001] The present application relates to the field of information analysis, and in particular to a behavior analysis method and related devices. Background Art

[0002] With the continuous development of computer technology and software technology, more and more users have begun to communicate online through various software, and with it comes the emergence of more and more frequent online fraud.

[0003] In order to maintain network and user security, in related technologies, software accounts with fraudulent behavior are manually collected and analyzed to determine account behaviors that are more closely related to fraudulent behavior, and then detect accounts that may be used for fraud based on account behaviors.

[0004] However, it is difficult for relevant technologies to cover all accounts involved in fraudulent behavior through manual analysis, and the analysis of account behaviors related to fraudulent behavior is not comprehensive enough, resulting in poor detection of fraudulent accounts and difficulty in reducing the frequency of fraudulent behavior. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides a behavior analysis method, which can automatically analyze the common characteristics of the behavior information of accounts used to perform abnormal behaviors by clustering the behavior information, based on the dimension of behavior information generated by the accounts when performing account behaviors, thereby improving the efficiency and accuracy of account behavior analysis, and at the same time helping to expand the scope of accounts involved in account behavior analysis.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] In a first aspect, an embodiment of the present application discloses a behavior analysis method, the method comprising:

[0008] Acquire multiple abnormal accounts, where the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, where the behavior information is information generated by the abnormal accounts performing account behaviors;

[0009] For the target account behavior, according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, the behavior information of the multiple abnormal accounts corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior, where the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior;

[0010] Determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

[0011] In a second aspect, an embodiment of the present application discloses a behavior analysis device, the device comprising a first acquisition unit, a clustering unit and a first determination unit:

[0012] The first acquisition unit is used to acquire a plurality of abnormal accounts, wherein the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, and the behavior information is information generated by the abnormal accounts performing account behaviors;

[0013] The clustering unit is used to cluster the behavior information of the multiple abnormal accounts corresponding to the target account behavior according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, so as to obtain a behavior information cluster corresponding to the target account behavior, wherein the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior;

[0014] The first determination unit is used to determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

[0015] In a possible implementation manner, the device further includes a second acquiring unit and a second determining unit:

[0016] The second acquisition unit is used to acquire the behavior information to be analyzed of the behavior of the account to be identified corresponding to the target account;

[0017] The second determination unit is used to determine that the account to be identified is an account used to perform abnormal behavior based on the presence of representative behavior information corresponding to the behavior information cluster whose similarity with the behavior information to be analyzed is greater than a first similarity threshold.

[0018] In a possible implementation, the target account behavior is any one of a plurality of account behaviors, and the device further includes a third determination unit, a generation unit, and an identification unit:

[0019] The third determining unit is used to determine the account set corresponding to the behavior information clusters corresponding to the multiple account behaviors respectively, the account set corresponding to the target behavior information cluster includes abnormal accounts corresponding to the multiple behavior information included in the target behavior information cluster, and any one of the behavior information clusters corresponding to the multiple account behaviors respectively in the target behavior information cluster;

[0020] The generating unit is used to generate a behavior pattern according to the account overlap between the account sets corresponding to the behavior information clusters corresponding to different account behaviors, the target behavior pattern includes multiple representative behavior information, the account behaviors corresponding to the multiple representative behavior information are different, the first representative behavior information has corresponding second representative behavior information in the multiple representative behavior information, the number of overlapping accounts between the account set corresponding to the behavior information cluster corresponding to the first representative behavior information and the account set corresponding to the behavior information cluster corresponding to the second representative behavior information meets a first quantity threshold, the target behavior pattern is any one of the behavior patterns, the first representative behavior information is any one of the multiple representative behavior information, and the account behaviors corresponding to the second representative behavior information and the first representative behavior information are different;

[0021] The identification unit is used to identify whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the account information of multiple account behaviors corresponding to the account to be identified and the multiple representative behavior information included in the behavior pattern.

[0022] In a possible implementation, the target behavior pattern includes representative behavior information corresponding to a plurality of account behaviors to be analyzed, and the identification unit is specifically configured to:

[0023] The behavior patterns are respectively used as the target behavior patterns, and the multiple account behaviors to be analyzed are respectively determined as target account behaviors to be analyzed, and the similarity corresponding to the target account behaviors to be analyzed is determined, where the similarity corresponding to the target account behaviors to be analyzed is the similarity between the representative behavior information corresponding to the target account behaviors to be analyzed in the target behavior patterns and the behavior information of the account to be identified corresponding to the target account behaviors to be analyzed;

[0024] Determine the similarity between the target behavior pattern and the account to be identified based on the similarities corresponding to the behaviors of the multiple accounts to be analyzed, wherein the similarity between the account to be identified and the target behavior pattern is used to characterize the overall similarity between the account information of the account to be identified corresponding to the behaviors of the multiple accounts to be analyzed and the multiple representative behavior information included in the target behavior pattern;

[0025] Based on the fact that the similarity between the account to be identified and the target behavior pattern is greater than a second similarity threshold, the account to be identified is determined to be an account used to perform abnormal behavior.

[0026] In a possible implementation manner, the identification unit is specifically used to:

[0027] Determine the average of the similarities corresponding to the behaviors of the multiple accounts to be analyzed as the similarity of the account to be identified corresponding to the target behavior pattern;

[0028] Alternatively, the sum of the similarities corresponding to the behaviors of the multiple accounts to be analyzed is determined as the similarity of the account to be identified corresponding to the target behavior pattern.

[0029] In a possible implementation, the behavior information includes text information, and the device further includes an analyzing unit, a fourth determining unit, and a first replacing unit:

[0030] The analyzing unit is used to use the behavior information of the multiple abnormal accounts corresponding to the behavior of the target account as first target behavior information, and analyze the text constituent elements included in the first target behavior information, wherein the text constituent elements are used to constitute the text information in the first target behavior information;

[0031] The fourth determining unit is used to determine the element type corresponding to the text constituent element;

[0032] The first replacement unit is used to replace the text constituent elements in the first target behavior information with default text information corresponding to the element type, so as to obtain the processed first target behavior information, wherein different element types correspond to different default text information;

[0033] The clustering unit is specifically used for:

[0034] According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

[0035] In a possible implementation manner, the element type includes any one or more combinations of a digital type, a text type, a name type, and a number type, and the fourth determining unit is specifically configured to:

[0036] Based on the fact that the text constituent element is digital text information and the number of digits included in the text constituent element is a preset number of digits, determining that the element type corresponding to the text constituent element is a number type;

[0037] Based on the fact that the text constituent element is digital text information and the number of digital digits included in the text constituent element is not the preset number of digits, determining that the element type corresponding to the text constituent element is a digital type;

[0038] Based on the fact that the text constituent element is text information and that the text constituent element conforms to a name text structure, determining that the element type corresponding to the text constituent element is a name type;

[0039] Based on the fact that the text constituent element is text information of characters and the text constituent element does not conform to the name text structure, it is determined that the element type corresponding to the text constituent element is a text type.

[0040] In a possible implementation manner, the apparatus further includes a fifth determining unit:

[0041] The fifth determination unit is used to determine the target processing strength corresponding to the first target behavior information according to the information representation strength corresponding to the first target behavior information, wherein the information representation strength is the representation strength of the execution mode characteristics of the first target behavior information executing the target account behavior on the corresponding abnormal account;

[0042] The first replacement unit is specifically used for:

[0043] Determine the types of processable elements corresponding to the target processing strength, the number of processable element types corresponding to the processing strength corresponding to the behavior information is inversely correlated with the information representation strength corresponding to the behavior information;

[0044] Based on the fact that the processable element types corresponding to the target processing strength include the element type, the text constituent elements in the first target behavior information are replaced with default text information corresponding to the element type to obtain the processed first target behavior information.

[0045] In a possible implementation, the analysis unit is specifically used to:

[0046] Analyzing text constituent elements included in the first target behavior information according to the first target behavior information through an element analysis model;

[0047] The element analysis model is trained in the following way:

[0048] Acquire a sample information set, the sample information set including a plurality of sample behavior information, the sample behavior information having corresponding sample constituent elements, the target sample constituent element corresponding to the target sample behavior information being a text constituent element actually included in the target sample behavior information, the target sample behavior information being any one of the plurality of sample behavior information;

[0049] The plurality of sample behavior information are respectively used as the target sample behavior information, and the undetermined constituent elements corresponding to the target sample behavior information are analyzed by the initial element analysis model, wherein the undetermined constituent elements are text constituent elements included in the target sample behavior information analyzed by the initial element analysis model;

[0050] The model parameters corresponding to the initial element analysis model are adjusted according to the difference between the undetermined constituent element and the target sample constituent element to obtain the element analysis model.

[0051] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0052] Determine the element type corresponding to the text constituent element according to the text constituent element through a type determination model;

[0053] The type determination model is trained in the following way:

[0054] Acquire a sample element set, the sample element set includes a plurality of sample text constituent elements, the sample text constituent elements have corresponding sample element types, the target element type corresponding to the target sample text constituent element is the element type actually corresponding to the target sample text constituent element, and the target sample text constituent element is any one of the plurality of sample text constituent elements;

[0055] The plurality of sample text constituent elements are respectively used as the target sample text constituent elements, and the to-be-determined element types corresponding to the target sample text constituent elements are determined by an initial type determination model;

[0056] The model parameters corresponding to the initial type determination model are adjusted according to the difference between the element type to be determined and the element type of the target sample to obtain the type determination model.

[0057] In a possible implementation manner, the behavior information includes text information, and the device further includes a sixth determining unit, a seventh determining unit, and a second replacing unit:

[0058] The sixth determining unit is used to use the behavior information of the multiple abnormal accounts corresponding to the target account behavior as second target behavior information, and determine the target replacement text information included in the second target behavior information, the target replacement text information is used to represent the information content corresponding to the target replaced text information, and the target replacement text information and the target replaced text information are different text information;

[0059] The seventh determining unit is used to determine the target replaced text information corresponding to the target replacement text information;

[0060] The second replacing unit is used to replace the target replacement text information in the second target behavior information with the target replaced text information to obtain the processed second target behavior information;

[0061] The clustering unit is specifically used for:

[0062] According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

[0063] In a possible implementation manner, the sixth determining unit is specifically configured to:

[0064] Acquire a mapping relationship set, wherein the mapping relationship set includes a plurality of mapping relationships, and the mapping relationship is a mapping relationship between replacement text information and replaced text information;

[0065] Determine the target alternative text information included in the second target behavior information according to the alternative text information in the mapping relationship set, wherein the target alternative text information is any one or more of the alternative text information in the mapping relationship set;

[0066] The seventh determining unit is specifically configured to:

[0067] The target replaced text information corresponding to the target replacement text information is determined according to the mapping relationship corresponding to the target replacement text information in the mapping relationship set.

[0068] In a possible implementation manner, the clustering unit is specifically used to:

[0069] Clustering the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain multiple initial behavior information clusters corresponding to the target account behaviors;

[0070] Determine an initial behavior information cluster whose amount of behavior information among the multiple initial behavior information clusters meets a second amount threshold as the behavior information cluster corresponding to the target account behavior;

[0071] In a third aspect, an embodiment of the present application discloses a computer device, wherein the computer device includes a processor and a memory:

[0072] The memory is used to store a computer program and transmit the computer program to the processor;

[0073] The processor is used to execute the behavior analysis method described in any one of the first aspects according to the instructions in the computer program;

[0074] In a fourth aspect, an embodiment of the present application discloses a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the behavior analysis method described in any one of the first aspects;

[0075] In a fifth aspect, an embodiment of the present application discloses a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the behavior analysis method described in any one of the first aspects.

[0076] It can be seen from the above technical solution that in order to realize the automated analysis of account behavior, the present application can analyze the behavior information generated by executing account behavior. After obtaining multiple abnormal accounts, for the target account behavior, the behavior information of multiple abnormal accounts corresponding to the target account behavior can be clustered according to the similarity between the behavior information of multiple abnormal accounts corresponding to the target account behavior, and the behavior information cluster corresponding to the target account behavior is obtained. The behavior information with higher similarity will be clustered into the same behavior information cluster. Since the behavior information of the abnormal account corresponding to the target account behavior is generated by executing the target account behavior, the behavior information can reflect the behavior characteristics of the abnormal account when executing the target account behavior. At the same time, since the abnormal account is an account used to execute abnormal behavior, the commonalities of the account used to execute abnormal behavior when executing the target account behavior can be analyzed by clustering the behavior information. Therefore, after determining the target representative behavior information that can characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster, the target representative behavior information can, to a certain extent, characterize the common characteristics of multiple abnormal accounts when executing the target account behavior. Therefore, the target representative behavior information can be used to identify whether the account to be identified is used to execute abnormal behavior. For example, if the behavior information generated by the account to be identified when executing the target account behavior is similar to the target representative behavior information, it can be explained that the execution mode characteristics of the account to be identified and the abnormal account used to execute abnormal behavior when executing the target account behavior are similar. Therefore, to a certain extent, it can be determined that the account to be identified is an account used to execute abnormal behavior. It can be seen that the present application can realize automatic and effective analysis of the commonality of the execution mode when abnormal accounts perform account behaviors, and obtain representative behavior information closely related to abnormal accounts, and through the representative behavior information, effective identification of the account to be identified can be realized. Since the present application can complete the effective analysis of representative behavior information without human participation, the amount of behavior information of the number of abnormal accounts used for analysis can be expanded, which can effectively improve the accuracy of analysis while improving the comprehensiveness and efficiency of account behavior analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0078] Figure 1 A schematic diagram of a behavior analysis method in an actual application scenario provided by an embodiment of the present application;

[0079] Figure 2 A flowchart of a behavior analysis method provided in an embodiment of the present application;

[0080] Figure 3 A schematic diagram of a behavior analysis method provided in an embodiment of the present application;

[0081] Figure 4 A flowchart of a behavior analysis method in an actual application scenario provided by an embodiment of the present application;

[0082] Figure 5 A structural block diagram of a behavior analysis device provided in an embodiment of the present application;

[0083] Figure 6 A structural diagram of a terminal provided in an embodiment of the present application;

[0084] Figure 7 A structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The embodiments of the present application are described below in conjunction with the accompanying drawings.

[0086] In related technologies, in order to identify accounts used to perform abnormal behaviors, multiple abnormal accounts used to perform abnormal behaviors are first collected, and then the account behaviors involved in the abnormal accounts are manually analyzed to find out the commonalities of the abnormal accounts when performing account behaviors. Based on the commonalities, each account behavior performed by the account to be identified is analyzed to determine whether the account to be identified has account behaviors close to those of the abnormal account, and then to analyze whether the account to be identified is an account used to perform abnormal behaviors.

[0087] However, in the related art, when analyzing the commonalities of account behaviors, there is an excessive reliance on manual participation and human experience. On the one hand, the number of accounts that can be analyzed through manual analysis is small, so the amount of information based on the behavior analysis is small, and it is difficult to conduct a more comprehensive analysis of the account behavior characteristics of abnormal accounts, and the accuracy of the behavior analysis is low; on the other hand, the efficiency of manual analysis is low, and the pattern of abnormal behavior usually changes rapidly, so the account behavior performed by the abnormal account used to perform abnormal behavior also changes rapidly, and manual analysis is difficult to keep up with the iteration speed of abnormal behavior. Therefore, the behavioral commonalities obtained from the analysis are of little help in identifying abnormal accounts, and the effectiveness of the behavior analysis is poor.

[0088] In order to solve the above technical text, the present application provides a behavior analysis method, which can cluster the behavior information of multiple abnormal accounts corresponding to the target account behavior based on the similarity between the behavior information that can characterize the account behavior characteristics, so that the behavior information with higher similarity is clustered into the same behavior information cluster, so that the commonality of multiple abnormal accounts when executing the target account behavior can be accurately analyzed through the behavior information cluster. The commonality is the account behavior feature characterized by the representative behavior information corresponding to the behavior information cluster, and then based on the representative behavior information, it can be accurately identified whether the account to be identified is used to perform abnormal behavior. The behavior analysis method of the present application can automatically, efficiently and accurately analyze the commonality of account behaviors of multiple abnormal accounts from the dimension of behavior information, and extract representative behavior information for account identification, which helps to expand the scope of information analysis and improve the comprehensiveness and accuracy of behavior analysis.

[0089] It is understandable that the method can be applied to a computer device, which is a computer device capable of performing behavior analysis, such as a terminal device or a server. The method can be executed independently by a terminal device or a server, or can be applied to a network scenario in which a terminal device and a server communicate, and is executed by the cooperation of the terminal device and the server. Among them, the terminal device can be a mobile phone, a tablet computer, a laptop computer, a desktop computer and other devices. The server can be understood as an application server or a Web server. In actual deployment, the server can be an independent server, a cluster server, or a cloud server, etc.

[0090] In order to facilitate understanding of the technical solution provided by the present application, a behavior analysis method provided by an embodiment of the present application will be introduced below in combination with an actual application scenario.

[0091] See also Figure 1 , Figure 1 A schematic diagram of a behavior analysis method in an actual application scenario provided in an embodiment of the present application. In the actual application scenario, the computer device is a server 101 for behavior analysis.

[0092] The server 101 can first obtain N abnormal accounts including abnormal account 1 to abnormal account N, which are accounts used to perform abnormal behaviors. For the target account behavior, the server 101 can determine the behavior information generated when the N abnormal accounts perform the target account behavior, and obtain N behavior information 1 to behavior information N, each of which can characterize the execution characteristics of the corresponding abnormal account when performing the target account behavior.

[0093] Server 101 can cluster N pieces of behavior information based on the similarity between them, and obtain multiple behavior information clusters corresponding to the target account behavior. Since the behavior information in each behavior information cluster is relatively similar, the execution characteristics of the multiple abnormal accounts represented when executing the target account behavior are also relatively similar, and thus the multiple abnormal accounts whose corresponding behavior information is located in the same behavior information cluster have strong commonality when executing the target account behavior. Thus, for each behavior information cluster, server 101 can determine representative behavior information used to represent the overall information characteristics of the multiple behavior information included in the behavior information cluster, including representative behavior information 1 and representative behavior information 2. These two representative behavior information can represent the commonality of multiple abnormal accounts when executing the target account behavior. Thus, after obtaining the account to be identified, server 101 can analyze whether the commonality of the account to be identified and multiple abnormal accounts when executing the target account behavior is close. For example, in this actual application scenario, the server 101 can determine the behavior information to be identified that is generated when the account to be identified executes the target account behavior, and determine the similarity between the behavior information to be identified and the two representative behavior information. If there is representative behavior information in the representative behavior information 1 and the representative behavior information 2 whose similarity with the behavior information to be identified is not less than a preset threshold, it means that there are multiple abnormal accounts that are relatively consistent with the execution method of the account to be identified when executing the target account behavior. Therefore, it can be determined that the account to be identified is an account used to execute abnormal behavior; conversely, if the similarity between the behavior information to be identified and the two representative behavior information is less than the preset threshold, it means that the execution method of the account to be identified when executing the target account behavior is relatively similar to that of the abnormal account. Therefore, it can be determined that the account to be identified is not an account used to execute abnormal behavior.

[0094] It can be seen that the embodiment of the present application starts from the dimension of behavior information, and can accurately analyze the commonality of the execution mode when the abnormal account executes the target account behavior through clustering, and can determine the representative behavior information used to characterize the commonality of the execution mode when the abnormal account executes the target account behavior, so that the account can be accurately identified based on the representative behavior information. Since the behavior analysis method provided by the present application can realize automatic analysis, it can increase the amount of information used for analysis, improve the comprehensiveness of behavior analysis, and thus improve the accuracy and analysis efficiency of behavior analysis.

[0095] Next, a behavior analysis method provided by the present application will be introduced in conjunction with the accompanying drawings.

[0096] See also Figure 2 , Figure 2 A flowchart of a behavior analysis method provided in an embodiment of the present application. In this embodiment, the computer device may be any of the above-mentioned computer devices with behavior analysis capabilities. The method includes:

[0097] S201: Acquire multiple abnormal accounts.

[0098] Among them, an abnormal account is an account used to perform abnormal behavior, and the abnormal behavior can be any abnormal behavior performed by the account, such as online fraud, etc. The abnormal account has corresponding behavior information, and the behavior information is the information generated by the abnormal account performing account behavior. Account behavior refers to the behavior that can be performed by the account. For example, when the account is a social application account, the account behavior may include adding friends, greeting, communicating, etc. The corresponding behavior information may be the information filled in when sending a friend application, the information sent when greeting, etc.

[0099] Since behavior information is generated by abnormal accounts through account behaviors, different execution methods of account behaviors may generate different behavior information. Therefore, behavior information can, to a certain extent, characterize the execution method characteristics of abnormal devices when executing account behaviors. For example, the information sent by normal accounts during communication is usually different from the information sent by abnormal accounts during communication.

[0100] S202: For the target account behavior, based on the similarity between the behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, cluster the behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior to obtain a behavior information cluster corresponding to the target account behavior.

[0101] In the present application, in order to be able to identify accounts used to perform abnormal behaviors, the computer device can first analyze the commonality of execution methods of abnormal accounts used to perform abnormal behaviors when performing account behaviors. This commonality is the execution method that accounts used to perform abnormal behaviors usually have, so that whether the account is used to perform abnormal behaviors can be identified through the commonality of the execution method.

[0102] As mentioned above, behavior information can characterize the execution mode characteristics of abnormal accounts when performing account behaviors. Based on this, computer devices can analyze the common execution modes of abnormal accounts through behavior information.

[0103] For example, for the target account behavior, the computer device can determine the behavior information of each abnormal account corresponding to the target account behavior, and the target account behavior can be any account behavior. The behavior information of the abnormal account corresponding to the target account behavior is the information generated by the abnormal account executing the target account behavior. Since the similarity between the behavior information can characterize the similarity of the execution mode of the abnormal account when executing the target account behavior, the computer device can cluster the behavior information of multiple abnormal accounts corresponding to the target account behavior according to the similarity between the behavior information of multiple abnormal accounts corresponding to the target account behavior, cluster the behavior information with high similarity into the same behavior information cluster, and obtain the behavior information cluster corresponding to the target account behavior. The multiple abnormal accounts corresponding to the multiple behavior information in the same behavior information cluster are multiple abnormal accounts with strong commonality in the execution mode when executing the target account behavior.

[0104] The behavior information cluster corresponding to the target account behavior may be one or more behavior information clusters, which is not limited here.

[0105] S203: Determine representative behavior information corresponding to the behavior information cluster.

[0106] Based on the behavior information clustering in step S202, the computer device may cluster the behavior information corresponding to multiple abnormal devices with strong commonality in execution modes into the same behavior information cluster, and then the computer device may analyze the commonality of execution modes corresponding to each behavior information cluster.

[0107] The computer device can determine the representative behavior information corresponding to each behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. Therefore, the execution mode represented by the target representative behavior information corresponds to the common execution mode of multiple abnormal behaviors corresponding to the target behavior information cluster when executing the target account behavior. The target behavior information cluster can be any one of the behavior information clusters.

[0108] Furthermore, through the commonality of execution methods represented by the representative behavior information, it is possible to analyze whether the execution method of the target account behavior executed by the account to be identified is consistent with the commonality of the execution method of the abnormal account. It can be seen that the representative behavior information can be used to identify whether the account to be identified is used to perform abnormal behavior. For example, if the account information generated by the account to be identified when executing the target account behavior is similar to the representative sample information, it means that the execution method of the account to be identified when executing the target account behavior is relatively consistent with the commonality of the execution method of the abnormal account executing the target account behavior. Therefore, to a certain extent, it can be determined that the account to be identified is an account used to perform abnormal behavior. The account to be identified can be any account that needs to be identified whether it is used to perform abnormal behavior.

[0109] It can be seen from the above technical solution that the present application can analyze the behavior information generated by executing account behaviors, realize automatic and effective analysis of the commonality of execution methods when abnormal accounts execute account behaviors, obtain representative behavior information closely related to abnormal accounts, and realize effective identification of accounts to be identified through representative behavior information. Since the present application can complete the effective analysis of representative behavior information without human participation, the amount of behavior information of the number of abnormal accounts used for analysis can be expanded, which can effectively improve the accuracy of analysis while improving the comprehensiveness and efficiency of account behavior analysis.

[0110] Specifically, in a possible implementation, the computer device may identify the account to be identified according to the representative behavior information in the following manner:

[0111] The computer device may obtain the behavior information to be analyzed of the behavior of the target account corresponding to the account to be identified, and the behavior information to be analyzed is the behavior information generated when the account to be identified performs the behavior of the target account. The computer device may preset a first similarity threshold, and the first similarity threshold is used to determine whether the behavior information has a high degree of similarity.

[0112] The computer device can determine the similarity between the behavior information to be analyzed and each representative behavior information. If there is representative behavior information in the representative behavior information corresponding to the behavior information cluster whose similarity with the behavior information to be analyzed is greater than a first similarity threshold, it means that there is representative behavior information with a high similarity with the behavior information to be analyzed, which means that the behavior mode of the account to be identified in executing the target account behavior is more consistent with the commonality of the execution modes when multiple abnormal accounts execute the target account behavior, so the probability that the account to be identified is also used to execute abnormal behavior is relatively high. Based on this, the computer device can determine that the account to be identified is an account used to execute abnormal behavior.

[0113] It is understandable that an abnormal behavior is usually composed of multiple account behaviors. For example, when committing online fraud, the account used for fraud usually performs a series of account behaviors such as creating an account, modifying account information, adding friends, greeting, and communicating. Because abnormal behaviors are usually more hidden and are usually closer to people's daily lives, it may be difficult to accurately identify whether a single account behavior in a series of account behaviors is an account used to perform abnormal behaviors.

[0114] For example, many abnormal accounts used for fraud usually change their account nicknames to the format of "name + mobile phone number" when creating an account. The account nickname is the behavioral information corresponding to the account behavior of "creating an account". In daily life, there are also many normal accounts that are not used to perform abnormal behaviors and their account nicknames also adopt this format. Therefore, if the analysis is based only on the behavioral information of the account nickname, misidentification may occur.

[0115] Based on this, in order to further improve the accuracy of account identification, the computer device can comprehensively identify the account by combining the behavioral information generated when the account performs multiple account behaviors.

[0116] First, in one possible implementation, a computer device may combine the behavioral information generated by an abnormal account when performing multiple account behaviors to analyze the correlation between the common execution methods of the abnormal account when performing multiple account behaviors, thereby determining the unique behavioral pattern of the abnormal account when performing multiple account behaviors.

[0117] In this implementation, the target account behavior can be any one of multiple account behaviors, and the computer device can determine the account set corresponding to the behavior information clusters corresponding to the multiple account behaviors, wherein the account set corresponding to the target behavior information cluster includes abnormal accounts corresponding to the multiple behavior information included in the target behavior information cluster, and the target behavior information cluster can be any one of the behavior information clusters corresponding to the multiple account behaviors.

[0118] It is understandable that if the corresponding account sets in the behavior information clusters corresponding to two different account behaviors have a high degree of overlap, then to a certain extent, it can be explained that the commonality of the execution methods represented by the two behavior information clusters is more consistent with the execution methods of the same abnormal account when performing the two account behaviors, that is, the execution methods represented by the two behavior information clusters are most likely the execution methods corresponding to the two account behaviors in the behavior pattern of the same abnormal behavior. Therefore, combined with the above, by combining the commonality of the execution methods represented by the two account behavior information clusters, a more accurate analysis can be made on whether the account is used to perform abnormal behavior.

[0119] Based on this, the computer device can generate a behavior pattern according to the account overlap between the account sets corresponding to the behavior information clusters corresponding to different account behaviors, wherein the target behavior pattern includes multiple representative behavior information, the account behaviors corresponding to the multiple representative behavior information are different, the first representative behavior information has corresponding second representative behavior information in the multiple representative behavior information, the number of overlapping accounts between the account set corresponding to the behavior information cluster corresponding to the first representative behavior information and the account set corresponding to the behavior information cluster corresponding to the second representative behavior information satisfies a first quantity threshold, the target behavior pattern is any one of the behavior patterns, the first representative behavior information is any one of the multiple representative behavior information, and the account behaviors corresponding to the second representative behavior information are different from those of the first representative behavior information.

[0120] That is, a behavior pattern is composed of representative behavior information corresponding to multiple different account behaviors, where for each representative behavior information, there is at least one representative behavior information that is relatively similar in the abnormal account dimension among the multiple representative behavior information of the same behavior pattern. Therefore, the same behavior pattern can characterize the common overall execution methods of similar abnormal accounts when performing multiple account behaviors, and thus the behavior pattern is highly similar to the execution methods of abnormal accounts when performing multiple account behaviors.

[0121] Based on this, if the execution mode of the account to be identified when performing multiple account behaviors is relatively consistent with the commonality of the overall execution mode represented by the behavior pattern, it can be more accurately determined that the similarity between the account to be identified and the abnormal account is high, and the probability of being used to perform abnormal behavior is greater. Therefore, the computer device can identify whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the account information of the account to be identified corresponding to the multiple account behaviors and the multiple representative behavior information included in the behavior pattern. The behavior pattern can be one or more, which is not limited here. In this way, the computer device can not only perform abnormal identification based on the single account behavior involved in the abnormal behavior, but also analyze the execution mode of the account to be identified in multiple account behaviors, reduce the misidentification rate of abnormal accounts, and further improve the accuracy of behavior analysis and account identification.

[0122] Specifically, in a possible implementation, the computer device may analyze the overall similarity between multiple behavior information in the following manner to identify abnormal accounts.

[0123] In this implementation, the target behavior pattern may include representative behavior information corresponding to a plurality of account behaviors to be analyzed, and the plurality of account behaviors to be analyzed are account behaviors corresponding to the representative behavior information included in the target behavior pattern.

[0124] When identifying whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the account information of multiple account behaviors corresponding to the account to be identified and the multiple representative behavior information respectively included in the behavior patterns, the computer device can use the above-mentioned behavior patterns as target behavior patterns, and determine the multiple account behaviors to be analyzed as target account behaviors to be analyzed, and determine the similarities corresponding to the target account behaviors to be analyzed. The similarity corresponding to the target account behaviors to be analyzed is the similarity between the representative behavior information corresponding to the target account behavior to be analyzed in the target behavior pattern and the behavior information corresponding to the target account behavior to be analyzed of the account to be identified, which can characterize the similarity in the execution methods of the account to be identified and the abnormal account under the target behavior pattern when executing the target account behavior to be analyzed.

[0125] The computer device can determine the similarity of the target behavior pattern corresponding to the account to be identified based on the similarities corresponding to the behaviors of multiple accounts to be analyzed. The similarity of the target behavior pattern corresponding to the account to be identified is used to characterize the overall similarity between the account information of the account to be identified corresponding to the behaviors of multiple accounts to be analyzed and the multiple representative behavior information included in the target behavior pattern, so as to characterize the similarity between the execution mode of the account to be identified when executing the behaviors of multiple accounts to be analyzed and the target behavior pattern. The higher the similarity, the closer the execution mode of the account to be identified when executing the behaviors of multiple accounts to be analyzed is to the behavior pattern. Since the behavior pattern is the behavior pattern of an abnormal account, the probability that the account to be identified is an account used to execute abnormal behavior is also greater.

[0126] Therefore, the computer device may preset a second similarity threshold, which is used to determine whether the account to be identified has a high similarity to a certain behavior pattern. The computer device may analyze the similarity of the account to be identified to the target behavior pattern through the second similarity threshold. If the similarity of the account to be identified to the target behavior pattern is greater than the second similarity threshold, it means that the account to be identified has a high similarity to the target behavior pattern, and therefore has a high probability of being used to perform abnormal behavior, so the account to be identified can be determined as an account used to perform abnormal behavior.

[0127] like Figure 3As shown, through the similarity between the behavior information clusters, three behavior patterns can be analyzed. The behavior information clusters are the behavior information clusters corresponding to the three account behaviors, namely, nickname modification behavior, signature modification behavior and adding friends behavior. Taking behavior pattern 1 as an example, through account overlap analysis, it can be determined that the account overlap between the behavior information cluster N-1 corresponding to the nickname modification behavior and the behavior information cluster Q-3 corresponding to the signature modification behavior is relatively high, and the account overlap between the behavior information cluster N-1 and the behavior information cluster S-2 corresponding to the adding friends behavior is relatively high. Therefore, the three behavior information clusters will be identified as behavior information clusters of the same behavior pattern, and the representative behavior information corresponding to these three behavior information clusters is the representative behavior information in the behavior pattern 1.

[0128] Among them, when determining the similarity of the target behavior pattern corresponding to the account to be identified based on the similarities corresponding to the behaviors of multiple accounts to be analyzed, the computer device can make the determination in the following multiple ways.

[0129] In one possible implementation, the computer device may determine the average of the similarities corresponding to the behaviors of multiple accounts to be analyzed as the similarity of the target behavior pattern corresponding to the account to be identified. Or, in another possible implementation, the computer device may determine the sum of the similarities corresponding to the behaviors of multiple accounts to be analyzed as the similarity of the target behavior pattern corresponding to the account to be identified. The similarities determined by these two methods are affected by the similarities corresponding to each of the behaviors of the account to be analyzed, and therefore can characterize the overall similarity between the account to be identified and the target behavior pattern in the behaviors of multiple accounts to be analyzed to a certain extent, and thus can be effectively applied to the present application. Other similarity determination methods with similar functions can also be applied in the present application, which are not limited here.

[0130] Next, the above behavior information clustering process will be introduced in detail.

[0131] It is understandable that, although the differences between different behavior information can usually characterize the differences in the execution methods of account behaviors, there are also some differences between behavior information that have little effect on the characterization of the differences in execution methods. For example, this application has found through analysis that when the behavior information is text information, the differences between the types of text constituent elements included in different behavior information have a greater characterization effect on the differences in execution methods. For example, if behavior information A is text information composed of text constituent elements of two types of elements, namely, name + mobile phone number, and behavior information B is text information that does not include text constituent elements of these two types of elements, then behavior information A and behavior information B have a large difference in the execution methods they characterize. If the text elements included in different behavior information are of similar element types, but differ in the text elements, then the representation of the difference in execution methods will be greater. For example, behavior information C is text information composed of text elements of the two element types of "name A" + "mobile phone number A", and behavior information D is text information composed of text elements of the two element types of "name B" + "mobile phone number B". When these two behavior information are used for the account behavior of "saying hello", although the specific behavior information is different, when executing the account behavior, it is implemented by sending the name + mobile phone number, so the execution method is consistent.

[0132] At the same time, since the clustering of behavior information is based on the similarity between the behavior information, any difference will affect the clustering result. Based on this, in order to accurately cluster the behavior information representing similar execution methods into the same behavior information cluster while reducing the clustering difficulty and improving the clustering efficiency, in a possible implementation method, the computer device can reduce the interference of the behavior information difference that has a smaller representation of the execution method difference on the clustering.

[0133] In this implementation, the behavior information includes text information, and the computer device can use the behavior information of multiple abnormal accounts corresponding to the target account behavior as the first target behavior information, analyze the text constituent elements included in the first target behavior information, and the text constituent elements are used to constitute the text information in the first target behavior information. For example, the behavior information "name 1234567" includes the two text constituent elements "name" and "1234567".

[0134] The computer device can determine the element type corresponding to the text constituent element, and pre-set the corresponding default text information for each element type, and then replace the text constituent element in the first target behavior information with the default text information corresponding to the element type, to obtain the processed first target behavior information, wherein the default text information corresponding to different element types is different. In this way, the computer device can reduce the difference in the element type of the text constituent elements included in the different behavior information while retaining the difference in the element type, thereby reducing the information difference between different text constituent elements of the same element type without affecting the clustering accuracy, thereby facilitating more efficient information clustering.

[0135] When executing step S202, the computer device may execute step S2021 (not shown in the figure), which is a possible implementation of step S202, including:

[0136] S2021: Based on the similarity between the processed behavior information of the target account behaviors corresponding to the multiple abnormal accounts, the processed behavior information of the target account behaviors corresponding to the multiple abnormal accounts are clustered to obtain the behavior information cluster corresponding to the target account behaviors.

[0137] Specifically, in a possible implementation, the above-mentioned element type may include any one or more combinations of digital types, text types, name types, and number types. When determining the element type corresponding to the text constituent element, the computer device may determine it in the following manner:

[0138] Since number information such as mobile phone numbers, landline numbers, and social account numbers are usually numbers with a fixed number of digits, based on the fact that the text constituent element is digital text information and the number of digits included in the text constituent element is a preset number of digits, the element type corresponding to the text constituent element is determined to be a number type. The preset number of digits can be set based on the actual scenario. The default text information corresponding to the number type can be M. For example, the text constituent element "176xxxxxxxx" can be replaced with "M", thereby reducing the impact of differences between different numbers on clustering.

[0139] Based on the fact that the text constituent element is digital text information, and the number of digits included in the text constituent element is not the preset number of digits, the computer device can determine that the digital text information does not have a number meaning, and therefore can determine that the element type corresponding to the text constituent element is a digital type. The default text information corresponding to the digital type can be D, for example, "11" can be replaced with "DD" to reduce the impact of different numbers on clustering.

[0140] Based on the fact that the text composition element is text information and the text composition element conforms to the name text structure, the computer device can determine that the element type corresponding to the text composition element is the name type. For example, if the text information includes the name text structure of surname + given name, it can be determined as the name type. The default text information corresponding to the name type can be "person name", "place name", etc. For example, the person name information "Xiaomei" can be replaced with "person name" to reduce the impact of name differences on clustering.

[0141] Based on the fact that the text composition element is text information and the text composition element does not conform to the name text structure, the computer device can determine that the element type corresponding to the text composition element is the text type. The default text information corresponding to the text type can be "C", "S", etc. For example, the Chinese text information "hahaha" can be replaced with "CCCC", and the English text information "happy" can be replaced with "SSSSS" to reduce the impact of text information differences with less representational power for the execution method on clustering.

[0142] Of course, it can also include more other type determination methods, which will not be elaborated here. Combining the above methods, the computer device can achieve the replacement of text composition elements of each element type. For example, "Hello, I'm Xiaomei" will be replaced with "Hello, I'm person name", and "Xiaomei 176xxxxxxxx" will be replaced with "person name M".

[0143] It can be understood that the representational power corresponding to different behavior information may be different. This representational power is the representational power of the behavior information for the execution method characteristics of the abnormal account to execute the account behavior. The greater the representational power of the information, the greater the help for the commonality analysis of the execution method and the greater the impact on the clustering effect of the behavior information. When replacing text composition elements through the above method, the more text composition elements are replaced, the greater the information loss may be to a certain extent, and the information loss may reduce the representational power corresponding to the behavior information. Therefore, in a possible implementation manner, the computer device can adjust the replacement strength of the behavior information according to the representational power corresponding to the behavior information.

[0144] First, the computer device can determine the target processing strength corresponding to the first target behavior information according to the representational power corresponding to the first target behavior information. This representational power is the representational power of the first target behavior information for the execution method characteristics of the abnormal account to execute the target account behavior. This target processing strength is used to determine the replacement method of the text composition elements in the target behavior information.

[0145] When replacing the text constituent elements in the first target behavior information with the default text information corresponding to the element type to obtain the processed first target behavior information, the computer device can first determine the processable element type corresponding to the target processing strength, and the processable element type is the element type that can replace the text constituent elements in the first target behavior information by the default text information. The number of processable element types corresponding to the processing strength corresponding to the behavior information is inversely correlated with the information representation strength corresponding to the behavior information, that is, the greater the information representation strength, the smaller the number of corresponding processable element types, and thus the less information loss, and the greater the retention strength of the representation effect of the behavior information on the execution mode characteristics, so that the behavior information with a greater representation strength on the execution mode characteristics can have a greater impact on clustering, thereby improving the effect of analyzing the commonalities of execution modes through clustering.

[0146] When making replacements, the computer device can determine whether the element types of the text constituent elements included in each determined first target behavior information are among the processable element types. Based on the fact that the processable element types corresponding to the target processing intensity include the element types, the computer device can replace the text constituent elements in the first target behavior information with the default text information corresponding to the element type to obtain the processed first target behavior information.

[0147] Specifically, when analyzing text constituent elements, in order to further improve the automation, analysis efficiency and analysis accuracy of the behavior analysis of the present application, when analyzing the text constituent elements included in the first target behavior information, the computer device can realize automatic analysis through model processing.

[0148] The computer device can analyze the text constituent elements included in the first target behavior information according to the first target behavior information through an element analysis model. The element analysis model is a model used to determine the text constituent elements included in the behavior information of the text information class. It can be any model structure that can achieve this function and is not limited here.

[0149] The element analysis model can be trained in the following ways:

[0150] The computer device can first obtain a sample information set, which includes multiple sample behavior information. The sample behavior information has corresponding sample constituent elements. The target sample constituent elements corresponding to the target sample behavior information are text constituent elements actually included in the target sample behavior information. The target sample behavior information is any one of the multiple sample behavior information.

[0151] The computer device can use multiple sample behavior information as target sample behavior information respectively, and analyze the pending constituent elements corresponding to the target sample behavior information through the initial element analysis model. The pending constituent elements are text constituent elements included in the target sample behavior information analyzed by the initial element analysis model. Therefore, the accuracy of the initial element analysis model in determining the text constituent elements corresponding to the target sample behavior information can be characterized by the difference between the pending constituent elements and the target sample constituent elements. The higher the accuracy, the smaller the difference should be. Based on this, the computer device can adjust the model parameters corresponding to the initial element analysis model according to the difference between the pending constituent elements and the target sample constituent elements, so that the pending constituent elements determined by the initial element analysis model gradually approach the target sample constituent elements. In this process, the initial element analysis model can learn how to accurately analyze the text constituent elements included in the behavior information, thereby obtaining an element analysis model.

[0152] Not only can the model be used to perform efficient analysis of text constituent elements, in another possible implementation, a computer device can also apply the model to accurately identify the types of elements.

[0153] When determining the element type corresponding to a text constituent element, a computer device may determine the element type corresponding to the text constituent element according to the text constituent element through a type determination model. The type determination model is a model for determining the element type corresponding to the text constituent element and may be any model structure that can achieve this function, which is not limited here.

[0154] The type determination model can be trained in the following ways:

[0155] The computer device may first obtain a sample element set, which may include multiple sample text constituent elements, and the sample text constituent elements have corresponding sample element types, wherein the target element type corresponding to the target sample text constituent element is the element type actually corresponding to the target sample text constituent element, and the target sample text constituent element may be any one of the multiple sample text constituent elements.

[0156] The computer device can use multiple sample text constituent elements as target sample text constituent elements respectively, and determine the pending element type corresponding to the target sample text constituent element through the initial type determination model. The pending element type is the pending element type that the initial type determination model believes the target sample text constituent element should correspond to through analysis. Therefore, the difference between the pending element type and the target sample element type can characterize the accuracy of the initial type determination model in analyzing the element type. The higher the accuracy, the smaller the difference between the two. Based on this, the computer device can adjust the model parameters corresponding to the initial type determination model according to the difference between the pending element type and the target sample element type, so that the pending element type determined by the initial type determination model gradually approaches the target sample element type. In this process, the initial type determination model can learn how to accurately analyze the element types of the text constituent elements, thereby obtaining a type determination model.

[0157] In addition to replacement based on text constituent elements, other text information replacement methods may also be included in the present application.

[0158] For example, in a text message, in order to conceal certain text information and avoid being detected as abnormal, some other text information may be used to replace the original text information. For example, in the related art, a text can be decomposed into its corresponding multiple text components by text decomposition, and these text components are used to replace the original text, so as to achieve the implicit expression of the original semantics without being recognized.

[0159] Based on this, in one possible implementation, a computer device can identify such text replacement methods that do not affect semantics, and restore the text information to its state before replacement, so as to make the semantics of the text information more prominent. Thus, when clustering behavioral information based on text information, it helps to more accurately analyze the execution methods represented by each behavioral information, thereby obtaining more accurate clustering results.

[0160] In this implementation, the behavior information may include text information, and the computer device may use the behavior information of the target account behaviors corresponding to the multiple abnormal accounts as the second target behavior information, and determine the target replacement text information included in the second target behavior information, wherein the target replacement text information is used to characterize the information content corresponding to the target replaced text information, and the target replacement text information and the target replaced text information are different text information. That is, the target replacement text information and the target replaced text information are relatively consistent in the information content (i.e., semantics) to be expressed, and the target replaced text information in the behavior information is replaced with the target replacement text information only to hide the original target replaced text information.

[0161] Among them, there are various ways to perform text substitution. In addition to the above-mentioned substitution by disassembling characters, substitution can also be performed through homophonic characters, homonymic characters, pinyin, traditional and simplified characters, similar-shaped characters, scrambled characters, etc. For example, "银行" can be replaced with the pinyin "yinhang" or the traditional Chinese character "銀行", etc.

[0162] The computer device can determine the target text to be replaced corresponding to the target substitution text information, and then replace the target substitution text information in the second target behavior information with the target text to be replaced, obtaining the processed second target behavior information, so that the information content of the processed second target behavior information can be made more obvious, and further the representation strength of the second target behavior information for the execution method can be improved, which helps to improve the accuracy of clustering.

[0163] When executing step S202, the computer device can execute step S2022 (not shown in the figure). Step S2022 is a possible implementation manner of step S202 and includes:

[0164] S2022: Cluster the processed behavior information of multiple abnormal accounts corresponding to the target account behavior according to the similarity between the processed behavior information of multiple abnormal accounts corresponding to the target account behavior, and obtain the behavior information cluster corresponding to the target account behavior.

[0165] In a possible implementation manner, when replacing the substitution text information with the text to be replaced, the computer device can be implemented based on the mapping relationship preset between the substitution text information and the text to be replaced.

[0166] When determining the target substitution text information included in the second target behavior information, the computer device can first obtain the mapping relationship set. The mapping relationship set includes multiple mapping relationships, and the mapping relationship is the mapping relationship between the substitution text information and the text to be replaced. That is, if there is a mapping relationship between a certain substitution text information and a certain text to be replaced, then the substitution text information is the substitution text information representing the information content of the text to be replaced, and the text to be replaced can be used to replace the substitution text information.

[0167] The computer device can determine the target substitution text information included in the second target behavior information according to the substitution text information in the mapping relationship set, that is, check whether there is the substitution text information in the set in the second target behavior information. If so, determine the substitution text information as the target substitution text information, and the target substitution text information is any one or more of the substitution text information in the mapping relationship set.

[0168] When determining the target replaced text information corresponding to the target replacement text information, the computer device may determine the target replaced text information corresponding to the target replacement text information according to the mapping relationship corresponding to the target replacement text information in the mapping relationship set, thereby completing the replacement of the target replacement text information.

[0169] It can be seen from the above content that the accuracy of behavior analysis in this application is more dependent on the effectiveness of the clustering results. It can be understood that the effectiveness of the clustering results is usually positively correlated with the number of objects in the cluster. For example, the more behavior information included in a behavior information cluster, the more execution methods represented by the behavior information have the same commonality, and therefore the commonality of the execution methods represented by the behavior information cluster is more reliable; conversely, the less behavior information included in the behavior information cluster, the greater the randomness of the commonality of the execution methods represented by the behavior information cluster, and therefore the lower the reliability.

[0170] In a possible implementation of the content, in order to further improve the effectiveness and accuracy of clustering, when executing step S202, the computer device may execute steps S2023-S2024 (not shown in the figure), and steps S2023-S2024 are a possible implementation of step S202, including:

[0171] S2023: Clustering the behavior information of the target account behaviors corresponding to the multiple abnormal accounts according to the similarity between the behavior information of the target account behaviors corresponding to the multiple abnormal accounts to obtain multiple initial behavior information clusters corresponding to the target account behaviors.

[0172] The multiple initial behavior information clusters are clustering results obtained by directly clustering the behavior information based on similarity, and the multiple initial behavior information clusters include the behavior information clusters in the above content.

[0173] S2024: Determine an initial behavior information cluster, among the multiple initial behavior information clusters, in which the amount of behavior information included meets a second quantity threshold, as the behavior information cluster corresponding to the target account behavior.

[0174] The computer device can analyze the validity of the clustering results of each initial behavior information cluster based on the amount of behavior information included in each initial behavior information cluster. The computer device can set a second quantity threshold, which is used to determine whether there is enough behavior information in the initial behavior information cluster. If the initial behavior information cluster contains behavior information that meets the second quantity threshold, it means that there is enough behavior information in the initial behavior information cluster, and the clustering result of the initial behavior information cluster has high validity. Based on this, the computer device can determine the initial behavior information cluster as the behavior information cluster corresponding to the target account behavior, so as to analyze the commonality of the execution method of executing the target account behavior. In this way, the accuracy of clustering can be further improved, thereby further improving the accuracy of behavior analysis.

[0175] In order to facilitate understanding of the technical solution provided by the present application, the behavior analysis method provided by the present application will be introduced below in combination with an actual application scenario.

[0176] See also Figure 4 , Figure 4 This is a flowchart of a behavior analysis method in an actual application scenario provided by the present application. In this actual application scenario, the computer device may be any of the above-mentioned computer devices with a behavior analysis function, the account may be an account in a social application, the abnormal behavior may be a fraudulent behavior performed through a social application, etc. The method includes:

[0177] S401: Acquire multiple abnormal accounts.

[0178] Among them, abnormal accounts are accounts that have committed fraudulent activities in social applications, and can be obtained based on reporting behavior of users of social applications, etc.

[0179] S402: Classify multiple abnormal accounts according to the time when the abnormal behaviors were performed.

[0180] Since abnormal accounts that perform abnormal behaviors at similar times usually have similar account behaviors involved in the process of performing abnormal behaviors, in order to more effectively analyze the commonality of the execution methods of abnormal accounts when performing abnormal behaviors, the computer device can perform behavior analysis on multiple abnormal accounts with relatively consistent account behaviors. The computer device can first classify multiple abnormal accounts according to the time when the abnormal behaviors were performed. For example, multiple abnormal accounts that perform abnormal behaviors within seven days after performing the account behavior of "adding friends" can be classified into one category for behavior analysis.

[0181] S403: For multiple abnormal accounts in a single category, replace the behavior information corresponding to the multiple abnormal accounts.

[0182] In this actual application scenario, the behavior information corresponding to the abnormal account may include behavior information corresponding to multiple account behaviors performed by the abnormal account in the social application. The account behavior may include account behaviors such as registering an account, changing a nickname, changing a signature, greeting, and communicating.

[0183] Computer devices can perform different text information replacements for different behavioral information based on the information representation strength of the behavioral information corresponding to different account behaviors. For example, based on the ranking of behavioral information from weak to strong based on the information representation strength, the computer device can use the default information corresponding to multiple element types to replace the nickname information, for example, the nickname "abc11" is directly replaced with "SSSDD", where S represents English and D represents numbers; for greeting texts, only the text information of element types such as names of people and places can be replaced; for communication text information, each sentence of text information can be processed separately, punctuation marks, links, numbers, etc. can be removed, and then the replacement text information can be replaced to restore it to the replaced text information.

[0184] S404: clustering the behavior information according to the similarity between the processed behavior information.

[0185] After the above processing, the computer device can cluster the behavior information based on the similarity between the behavior information. For example, the computer device can represent the similarity between two behavior information by weighted average sentence vector (smooth inverse frequency, referred to as SIF), and the behavior information with a similarity calculation result greater than 0.9 will be clustered into the same behavior information cluster.

[0186] S405: Screening the behavior information clusters obtained through clustering.

[0187] The computer device may retain only the behavior information cluster including more behavior information.

[0188] S406: Determine multiple behavior patterns according to the overlap between the accounts corresponding to the behavior information clusters.

[0189] The computer device can arrange multiple account behaviors in the order in which they are executed in the abnormal behavior. For two behavior information clusters corresponding to different account behaviors, if there are two or more overlapping accounts in the accounts corresponding to the two behavior information clusters, the two behavior information clusters are determined to be behavior information clusters corresponding to the same behavior pattern, and the representative behavior information corresponding to the two behavior information clusters will be determined to be in the same behavior pattern.

[0190] S407: Obtain the account to be identified.

[0191] The account to be identified may be any account that needs to be identified in a social application.

[0192] S408: Determine whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the behavior information corresponding to the account to be identified and the behavior pattern.

[0193] Based on the overall similarity between the behavior information corresponding to the multiple account behaviors performed by the account to be identified in the social application and the multiple representative behavior information corresponding to the behavior pattern, it can be determined whether the account to be identified is used to perform abnormal behavior. If the overall similarity is high, it can be said that the probability of the account to be identified being used to perform abnormal behavior is high, and the computer device can timely control the account to be identified to avoid abnormal behavior.

[0194] Based on the behavior analysis method provided in the above embodiment, the present application also provides a behavior analysis device, see Figure 5 , Figure 5 This is a structural block diagram of a behavior analysis device 500 provided in the present application, the device includes a first acquisition unit 501, a clustering unit 502 and a first determination unit 503:

[0195] The first acquisition unit 501 is used to acquire multiple abnormal accounts, where the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, and the behavior information is information generated by the abnormal accounts performing account behaviors;

[0196] The clustering unit 502 is used to cluster the behavior information of the multiple abnormal accounts corresponding to the target account behavior according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, to obtain a behavior information cluster corresponding to the target account behavior, wherein the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior;

[0197] The first determination unit 503 is used to determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

[0198] In a possible implementation manner, the device further includes a second acquiring unit and a second determining unit:

[0199] The second acquisition unit is used to acquire the behavior information to be analyzed of the behavior of the account to be identified corresponding to the target account;

[0200] The second determination unit is used to determine that the account to be identified is an account used to perform abnormal behavior based on the presence of representative behavior information corresponding to the behavior information cluster whose similarity with the behavior information to be analyzed is greater than a first similarity threshold.

[0201] In a possible implementation, the target account behavior is any one of a plurality of account behaviors, and the device further includes a third determination unit, a generation unit, and an identification unit:

[0202] The third determining unit is used to determine the account set corresponding to the behavior information clusters corresponding to the multiple account behaviors respectively, the account set corresponding to the target behavior information cluster includes abnormal accounts corresponding to the multiple behavior information included in the target behavior information cluster, and any one of the behavior information clusters corresponding to the multiple account behaviors respectively in the target behavior information cluster;

[0203] The generating unit is used to generate a behavior pattern according to the account overlap between the account sets corresponding to the behavior information clusters corresponding to different account behaviors, the target behavior pattern includes multiple representative behavior information, the account behaviors corresponding to the multiple representative behavior information are different, the first representative behavior information has corresponding second representative behavior information in the multiple representative behavior information, the number of overlapping accounts between the account set corresponding to the behavior information cluster corresponding to the first representative behavior information and the account set corresponding to the behavior information cluster corresponding to the second representative behavior information meets a first quantity threshold, the target behavior pattern is any one of the behavior patterns, the first representative behavior information is any one of the multiple representative behavior information, and the account behaviors corresponding to the second representative behavior information and the first representative behavior information are different;

[0204] The identification unit is used to identify whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the account information of multiple account behaviors corresponding to the account to be identified and the multiple representative behavior information included in the behavior pattern.

[0205] In a possible implementation, the target behavior pattern includes representative behavior information corresponding to a plurality of account behaviors to be analyzed, and the identification unit is specifically configured to:

[0206] The behavior patterns are respectively used as the target behavior patterns, and the multiple account behaviors to be analyzed are respectively determined as target account behaviors to be analyzed, and the similarity corresponding to the target account behaviors to be analyzed is determined, where the similarity corresponding to the target account behaviors to be analyzed is the similarity between the representative behavior information corresponding to the target account behaviors to be analyzed in the target behavior patterns and the behavior information of the account to be identified corresponding to the target account behaviors to be analyzed;

[0207] Determine the similarity between the target behavior pattern and the account to be identified based on the similarities corresponding to the behaviors of the multiple accounts to be analyzed, wherein the similarity between the account to be identified and the target behavior pattern is used to characterize the overall similarity between the account information of the account to be identified corresponding to the behaviors of the multiple accounts to be analyzed and the multiple representative behavior information included in the target behavior pattern;

[0208] Based on the fact that the similarity between the account to be identified and the target behavior pattern is greater than a second similarity threshold, the account to be identified is determined to be an account used to perform abnormal behavior.

[0209] In a possible implementation manner, the identification unit is specifically used to:

[0210] Determine the average of the similarities corresponding to the behaviors of the multiple accounts to be analyzed as the similarity of the account to be identified corresponding to the target behavior pattern;

[0211] Alternatively, the sum of the similarities corresponding to the behaviors of the multiple accounts to be analyzed is determined as the similarity of the account to be identified corresponding to the target behavior pattern.

[0212] In a possible implementation, the behavior information includes text information, and the device further includes an analyzing unit, a fourth determining unit, and a first replacing unit:

[0213] The analyzing unit is used to use the behavior information of the multiple abnormal accounts corresponding to the behavior of the target account as first target behavior information, and analyze the text constituent elements included in the first target behavior information, wherein the text constituent elements are used to constitute the text information in the first target behavior information;

[0214] The fourth determining unit is used to determine the element type corresponding to the text constituent element;

[0215] The first replacement unit is used to replace the text constituent elements in the first target behavior information with default text information corresponding to the element type, so as to obtain the processed first target behavior information, wherein different element types correspond to different default text information;

[0216] The clustering unit 502 is specifically used for:

[0217] According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

[0218] In a possible implementation manner, the element type includes any one or more combinations of a digital type, a text type, a name type, and a number type, and the fourth determining unit is specifically configured to:

[0219] Based on the fact that the text constituent element is digital text information and the number of digits included in the text constituent element is a preset number of digits, determining that the element type corresponding to the text constituent element is a number type;

[0220] Based on the fact that the text constituent element is digital text information and the number of digital digits included in the text constituent element is not the preset number of digits, determining that the element type corresponding to the text constituent element is a digital type;

[0221] Based on the fact that the text constituent element is text information and that the text constituent element conforms to a name text structure, determining that the element type corresponding to the text constituent element is a name type;

[0222] Based on the fact that the text constituent element is text information of characters and the text constituent element does not conform to the name text structure, it is determined that the element type corresponding to the text constituent element is a text type.

[0223] In a possible implementation manner, the apparatus further includes a fifth determining unit:

[0224] The fifth determination unit is used to determine the target processing strength corresponding to the first target behavior information according to the information representation strength corresponding to the first target behavior information, wherein the information representation strength is the representation strength of the execution mode characteristics of the first target behavior information executing the target account behavior on the corresponding abnormal account;

[0225] The first replacement unit is specifically used for:

[0226] Determine the types of processable elements corresponding to the target processing strength, the number of processable element types corresponding to the processing strength corresponding to the behavior information is inversely correlated with the information representation strength corresponding to the behavior information;

[0227] Based on the fact that the processable element types corresponding to the target processing strength include the element type, the text constituent elements in the first target behavior information are replaced with default text information corresponding to the element type to obtain the processed first target behavior information.

[0228] In a possible implementation, the analysis unit is specifically used to:

[0229] Analyzing text constituent elements included in the first target behavior information according to the first target behavior information through an element analysis model;

[0230] The element analysis model is trained in the following way:

[0231] Acquire a sample information set, the sample information set including a plurality of sample behavior information, the sample behavior information having corresponding sample constituent elements, the target sample constituent element corresponding to the target sample behavior information being a text constituent element actually included in the target sample behavior information, the target sample behavior information being any one of the plurality of sample behavior information;

[0232] The plurality of sample behavior information are respectively used as the target sample behavior information, and the undetermined constituent elements corresponding to the target sample behavior information are analyzed by the initial element analysis model, wherein the undetermined constituent elements are text constituent elements included in the target sample behavior information analyzed by the initial element analysis model;

[0233] The model parameters corresponding to the initial element analysis model are adjusted according to the difference between the undetermined constituent element and the target sample constituent element to obtain the element analysis model.

[0234] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0235] Determine the element type corresponding to the text constituent element according to the text constituent element through a type determination model;

[0236] The type determination model is trained in the following way:

[0237] Acquire a sample element set, the sample element set includes a plurality of sample text constituent elements, the sample text constituent elements have corresponding sample element types, the target element type corresponding to the target sample text constituent element is the element type actually corresponding to the target sample text constituent element, and the target sample text constituent element is any one of the plurality of sample text constituent elements;

[0238] The plurality of sample text constituent elements are respectively used as the target sample text constituent elements, and the to-be-determined element types corresponding to the target sample text constituent elements are determined by an initial type determination model;

[0239] The model parameters corresponding to the initial type determination model are adjusted according to the difference between the element type to be determined and the element type of the target sample to obtain the type determination model.

[0240] In a possible implementation manner, the behavior information includes text information, and the device further includes a sixth determining unit, a seventh determining unit, and a second replacing unit:

[0241] The sixth determining unit is used to use the behavior information of the multiple abnormal accounts corresponding to the target account behavior as second target behavior information, and determine the target replacement text information included in the second target behavior information, the target replacement text information is used to represent the information content corresponding to the target replaced text information, and the target replacement text information and the target replaced text information are different text information;

[0242] The seventh determining unit is used to determine the target replaced text information corresponding to the target replacement text information;

[0243] The second replacing unit is used to replace the target replacement text information in the second target behavior information with the target replaced text information to obtain the processed second target behavior information;

[0244] The clustering unit 502 is specifically used for:

[0245] According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

[0246] In a possible implementation manner, the sixth determining unit is specifically configured to:

[0247] Acquire a mapping relationship set, wherein the mapping relationship set includes a plurality of mapping relationships, and the mapping relationship is a mapping relationship between replacement text information and replaced text information;

[0248] Determine the target alternative text information included in the second target behavior information according to the alternative text information in the mapping relationship set, wherein the target alternative text information is any one or more of the alternative text information in the mapping relationship set;

[0249] The seventh determining unit is specifically configured to:

[0250] The target replaced text information corresponding to the target replacement text information is determined according to the mapping relationship corresponding to the target replacement text information in the mapping relationship set.

[0251] In a possible implementation, the clustering unit 502 is specifically configured to:

[0252] Clustering the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain multiple initial behavior information clusters corresponding to the target account behaviors;

[0253] An initial behavior information cluster whose amount of behavior information among the multiple initial behavior information clusters meets a second amount threshold is determined as the behavior information cluster corresponding to the target account behavior.

[0254] The present application also provides a computer device, see Figure 6 As shown, the computer device may be a terminal device, and a mobile phone is taken as an example:

[0255] Figure 6 FIG. 1 is a block diagram showing a partial structure of a mobile phone related to a terminal device provided in an embodiment of the present application. Figure 6 The mobile phone includes: a radio frequency (RF) circuit 710, a memory 720, an input unit 730, a display unit 740, a sensor 750, an audio circuit 760, a wireless fidelity (WiFi) module 770, a processor 780, and a power supply 790. Those skilled in the art will understand that Figure 6 The mobile phone structure shown in the figure does not constitute a limitation on the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0256] Combine the following Figure 6 A detailed introduction to the various components of the mobile phone:

[0257] The RF circuit 710 can be used for receiving and sending signals during the process of sending and receiving information or making calls. In particular, after receiving the downlink information of the base station, it is sent to the processor 780 for processing; in addition, the designed uplink data is sent to the base station. Usually, the RF circuit 710 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, referred to as LNA), a duplexer, etc. In addition, the RF circuit 710 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to the Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0258] The memory 720 can be used to store software programs and modules. The processor 780 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 720. The memory 720 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 720 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0259] The input unit 730 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 730 may include a touch panel 731 and other input devices 732. The touch panel 731, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 731 or near the touch panel 731 using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 731 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 780, and can receive and execute commands sent by the processor 780. In addition, the touch panel 731 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 731, the input unit 730 may further include other input devices 732. Specifically, the other input devices 732 may include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

[0260] The display unit 740 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 740 may include a display panel 741. Optionally, the display panel 741 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), etc. Further, the touch panel 731 may cover the display panel 741. When the touch panel 731 detects a touch operation on or near it, it is transmitted to the processor 780 to determine the type of touch event. Subsequently, the processor 780 provides a corresponding visual output on the display panel 741 according to the type of touch event. Although in Figure 6 In the embodiment, the touch panel 731 and the display panel 741 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 731 and the display panel 741 can be integrated to realize the input and output functions of the mobile phone.

[0261] The mobile phone may also include at least one sensor 750, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 741 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 741 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0262] The audio circuit 760, the speaker 761, and the microphone 762 can provide an audio interface between the user and the mobile phone. The audio circuit 760 can transmit the received audio data to the speaker 761 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 762 converts the collected sound signal into an electrical signal, which is received by the audio circuit 760 and converted into audio data, and then the audio data is output to the processor 780 for processing, and then sent to another mobile phone through the RF circuit 710, or the audio data is output to the memory 720 for further processing.

[0263] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse web pages and access streaming media through the WiFi module 770. It provides users with wireless broadband Internet access. Figure 6 A WiFi module 770 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0264] The processor 780 is the control center of the mobile phone. It uses various interfaces and lines to connect various parts of the entire mobile phone. By running or executing software programs and / or modules stored in the memory 720, and calling data stored in the memory 720, it executes various functions of the mobile phone and processes data, thereby performing overall detection of the mobile phone. Optionally, the processor 780 may include one or more processing units; preferably, the processor 780 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 780.

[0265] The mobile phone also includes a power supply 790 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 780 through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions.

[0266] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0267] In this embodiment, the processor 780 included in the terminal device also has the following functions:

[0268] Acquire multiple abnormal accounts, where the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, where the behavior information is information generated by the abnormal accounts performing account behaviors;

[0269] For the target account behavior, according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, the behavior information of the multiple abnormal accounts corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior, where the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior;

[0270] Determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

[0271] The present application also provides a server. Figure 7 As shown, Figure 7 The structural diagram of the server 800 provided in the embodiment of the present application, the server 800 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 822 (for example, one or more processors) and a memory 832, and one or more storage media 830 (for example, one or more mass storage devices) storing application programs 842 or data 844. Among them, the memory 832 and the storage medium 830 can be temporary storage or permanent storage. The program stored in the storage medium 830 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 822 can be configured to communicate with the storage medium 830 and execute a series of instruction operations in the storage medium 830 on the server 800.

[0272] The server 800 may also include one or more power supplies 826, one or more wired or wireless network interfaces 850, one or more input and output interfaces 858, and / or one or more operating systems 841, such as Windows Server 2000. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0273] The steps performed by the server in the above embodiment can be based on Figure 7 The server structure shown.

[0274] The embodiment of the present application further provides a computer-readable storage medium for storing a computer program, wherein the computer program is used to execute any one of the object information display methods described in the aforementioned embodiments.

[0275] An embodiment of the present application further provides a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the object information display method described in any one of the above embodiments.

[0276] It is understandable that in the specific implementation of this application, related data such as user information (such as behavior information, account information) is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0277] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the above-mentioned storage medium can be at least one of the following media: read-only memory (English: read-only memory, abbreviated: ROM), RAM, magnetic disk or optical disk, etc. Various media that can store program codes.

[0278] It should be noted that each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0279] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A behavior analysis method, characterized in that: The method comprises: Acquire multiple abnormal accounts, where the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, where the behavior information is information generated by the abnormal accounts performing account behaviors; For the target account behavior, according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, the behavior information of the multiple abnormal accounts corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior, where the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior; Determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining behavior information to be analyzed of the to-be-identified account corresponding to the target account behavior; Based on the presence of representative behavior information corresponding to the behavior information cluster whose similarity with the behavior information to be analyzed is greater than a first similarity threshold, the account to be identified is determined to be an account used to perform abnormal behavior.

3. The method according to claim 1, characterized in that The target account behavior is any one of a plurality of account behaviors, and the method further includes: Determine an account set corresponding to the behavior information clusters corresponding to the multiple account behaviors respectively, the account set corresponding to the target behavior information cluster includes abnormal accounts corresponding to the multiple behavior information included in the target behavior information cluster, and any one of the behavior information clusters corresponding to the multiple account behaviors respectively in the target behavior information cluster; Generate a behavior pattern according to the account overlap between the account sets corresponding to the behavior information clusters corresponding to different account behaviors, the target behavior pattern includes multiple representative behavior information, the account behaviors corresponding to the multiple representative behavior information are different, the first representative behavior information has corresponding second representative behavior information in the multiple representative behavior information, the number of overlapping accounts between the account set corresponding to the behavior information cluster corresponding to the first representative behavior information and the account set corresponding to the behavior information cluster corresponding to the second representative behavior information meets a first quantity threshold, the target behavior pattern is any one of the behavior patterns, the first representative behavior information is any one of the multiple representative behavior information, and the account behaviors corresponding to the second representative behavior information and the first representative behavior information are different; According to the overall similarity between the account information of the account to be identified corresponding to the multiple account behaviors and the multiple representative behavior information included in the behavior pattern, it is identified whether the account to be identified is used to perform abnormal behavior.

4. The method according to claim 3, characterized in that The target behavior pattern includes representative behavior information corresponding to a plurality of account behaviors to be analyzed, and identifying whether the account to be identified is used to perform abnormal behavior based on the overall similarity between the account information corresponding to the plurality of account behaviors of the account to be identified and the plurality of representative behavior information respectively included in the behavior pattern, includes: The behavior patterns are respectively used as the target behavior patterns, and the multiple account behaviors to be analyzed are respectively determined as target account behaviors to be analyzed, and the similarity corresponding to the target account behaviors to be analyzed is determined, where the similarity corresponding to the target account behaviors to be analyzed is the similarity between the representative behavior information corresponding to the target account behaviors to be analyzed in the target behavior patterns and the behavior information of the account to be identified corresponding to the target account behaviors to be analyzed; Determine the similarity between the target behavior pattern and the account to be identified based on the similarities corresponding to the behaviors of the multiple accounts to be analyzed, wherein the similarity between the account to be identified and the target behavior pattern is used to characterize the overall similarity between the account information of the account to be identified corresponding to the behaviors of the multiple accounts to be analyzed and the multiple representative behavior information included in the target behavior pattern; Based on the fact that the similarity between the account to be identified and the target behavior pattern is greater than a second similarity threshold, the account to be identified is determined to be an account used to perform abnormal behavior.

5. The method according to claim 4, characterized in that The determining, based on the similarities respectively corresponding to the behaviors of the multiple accounts to be analyzed, the similarity between the account to be identified and the target behavior pattern includes: Determine the average of the similarities corresponding to the behaviors of the multiple accounts to be analyzed as the similarity of the account to be identified corresponding to the target behavior pattern; Alternatively, the sum of the similarities corresponding to the behaviors of the multiple accounts to be analyzed is determined as the similarity of the account to be identified corresponding to the target behavior pattern.

6. The method according to claim 1, characterized in that The behavior information includes text information, and the method further includes: Taking the behavior information of the multiple abnormal accounts corresponding to the behavior of the target account as first target behavior information, analyzing the text constituent elements included in the first target behavior information, wherein the text constituent elements are used to constitute the text information in the first target behavior information; Determining the element type corresponding to the text constituent element; Replacing the text constituent elements in the first target behavior information with default text information corresponding to the element type to obtain the processed first target behavior information, where different element types correspond to different default text information; The clustering of the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain the behavior information cluster corresponding to the target account behaviors includes: According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

7. The method according to claim 6, characterized in that The element type includes any one or more combinations of digital type, text type, name type and number type. The determining the element type corresponding to the text constituent element includes: Based on the fact that the text constituent element is digital text information and the number of digits included in the text constituent element is a preset number of digits, determining that the element type corresponding to the text constituent element is a number type; Based on the fact that the text constituent element is digital text information and the number of digital digits included in the text constituent element is not the preset number of digits, determining that the element type corresponding to the text constituent element is a digital type; Based on the fact that the text constituent element is text information and that the text constituent element conforms to a name text structure, determining that the element type corresponding to the text constituent element is a name type; Based on the fact that the text constituent element is text information of characters and the text constituent element does not conform to the name text structure, it is determined that the element type corresponding to the text constituent element is a text type.

8. The method according to claim 6, characterized in that The method further comprises: Determining the target processing strength corresponding to the first target behavior information according to the information representation strength corresponding to the first target behavior information, wherein the information representation strength is the representation strength of the execution mode characteristics of the first target behavior information executing the target account behavior on the corresponding abnormal account; The replacing the text constituent element in the first target behavior information with default text information corresponding to the element type to obtain the processed first target behavior information includes: Determine the types of processable elements corresponding to the target processing strength, the number of processable element types corresponding to the processing strength corresponding to the behavior information is inversely correlated with the information representation strength corresponding to the behavior information; Based on the fact that the processable element types corresponding to the target processing strength include the element type, the text constituent elements in the first target behavior information are replaced with default text information corresponding to the element type to obtain the processed first target behavior information.

9. The method according to claim 6, characterized in that The analyzing the text elements included in the first target behavior information includes: Analyzing text constituent elements included in the first target behavior information according to the first target behavior information through an element analysis model; The element analysis model is trained in the following way: Acquire a sample information set, the sample information set including a plurality of sample behavior information, the sample behavior information having corresponding sample constituent elements, the target sample constituent element corresponding to the target sample behavior information being a text constituent element actually included in the target sample behavior information, the target sample behavior information being any one of the plurality of sample behavior information; The plurality of sample behavior information are respectively used as the target sample behavior information, and the undetermined constituent elements corresponding to the target sample behavior information are analyzed by the initial element analysis model, wherein the undetermined constituent elements are text constituent elements included in the target sample behavior information analyzed by the initial element analysis model; The model parameters corresponding to the initial element analysis model are adjusted according to the difference between the undetermined constituent element and the target sample constituent element to obtain the element analysis model.

10. The method according to claim 6, characterized in that The determining the element type corresponding to the text constituent element includes: Determine the element type corresponding to the text constituent element according to the text constituent element through a type determination model; The type determination model is trained in the following way: Acquire a sample element set, the sample element set includes a plurality of sample text constituent elements, the sample text constituent elements have corresponding sample element types, the target element type corresponding to the target sample text constituent element is the element type actually corresponding to the target sample text constituent element, and the target sample text constituent element is any one of the plurality of sample text constituent elements; The plurality of sample text constituent elements are respectively used as the target sample text constituent elements, and the to-be-determined element types corresponding to the target sample text constituent elements are determined by an initial type determination model; The model parameters corresponding to the initial type determination model are adjusted according to the difference between the element type to be determined and the element type of the target sample to obtain the type determination model.

11. The method according to claim 1, characterized in that: The behavior information includes text information, and the method further includes: Taking the behavior information of the multiple abnormal accounts corresponding to the behavior of the target account as the second target behavior information, determining the target replacement text information included in the second target behavior information, the target replacement text information is used to represent the information content corresponding to the target replaced text information, and the target replacement text information and the target replaced text information are different text information; Determine the target replaced text information corresponding to the target replacement text information; replacing the target replacement text information in the second target behavior information with the target replaced text information to obtain the processed second target behavior information; The clustering of the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain the behavior information cluster corresponding to the target account behaviors includes: According to the similarity between the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior, the processed behavior information of the multiple abnormal accounts respectively corresponding to the target account behavior is clustered to obtain a behavior information cluster corresponding to the target account behavior.

12. The method according to claim 11, characterized in that The step of determining the target alternative text information included in the second target behavior information includes: Acquire a mapping relationship set, wherein the mapping relationship set includes a plurality of mapping relationships, and the mapping relationship is a mapping relationship between replacement text information and replaced text information; Determine the target alternative text information included in the second target behavior information according to the alternative text information in the mapping relationship set, wherein the target alternative text information is any one or more of the alternative text information in the mapping relationship set; The step of determining the target replaced text information corresponding to the target replacement text information includes: The target replaced text information corresponding to the target replacement text information is determined according to the mapping relationship corresponding to the target replacement text information in the mapping relationship set.

13. The method according to claim 1, characterized in that The clustering of the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain the behavior information cluster corresponding to the target account behaviors includes: Clustering the behavior information of the multiple abnormal accounts corresponding to the target account behaviors according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behaviors to obtain multiple initial behavior information clusters corresponding to the target account behaviors; An initial behavior information cluster whose amount of behavior information among the multiple initial behavior information clusters meets a second amount threshold is determined as the behavior information cluster corresponding to the target account behavior.

14. A behavior analysis device, characterized in that: The device comprises a first acquisition unit, a clustering unit and a first determination unit: The first acquisition unit is used to acquire a plurality of abnormal accounts, wherein the abnormal accounts are accounts used to perform abnormal behaviors, and the abnormal accounts have corresponding behavior information, and the behavior information is information generated by the abnormal accounts performing account behaviors; The clustering unit is used to cluster the behavior information of the multiple abnormal accounts corresponding to the target account behavior according to the similarity between the behavior information of the multiple abnormal accounts corresponding to the target account behavior, so as to obtain a behavior information cluster corresponding to the target account behavior, wherein the behavior information of the abnormal account corresponding to the target account behavior is information generated by the abnormal account executing the target account behavior; The first determination unit is used to determine the representative behavior information corresponding to the behavior information cluster. The target representative behavior information corresponding to the target behavior information cluster is used to characterize the overall information characteristics of multiple behavior information included in the target behavior information cluster. The representative behavior information is used to identify whether the account to be identified is used to perform abnormal behavior. The target behavior information cluster is any one of the behavior information clusters.

15. A computer device, characterized in that: The computer device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is used to execute the behavior analysis method described in any one of claims 1-13 according to the instructions in the computer program.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the behavior analysis method described in any one of claims 1-13.

17. A computer program product comprising a computer program, which, when executed on a computer device, enables the computer device to execute the behavior analysis method according to any one of claims 1 to 13.

Images