Abnormal account identification method and device, equipment and storage medium

Abstract

The invention discloses an abnormal account identification method and device, equipment and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: acquiring an exposure stream of a user account, wherein the exposure stream is used for recording an exposure condition of the user account; according to the exposure flow, the exposure amount corresponding to the user account is obtained, and the exposure amount is used for indicating the number of times that the user account is checked; under the condition that the exposure quantity is greater than or equal to a first threshold value, obtaining feature data of the user account; wherein the feature data is used for recording behaviors of the user account and content related to the user account; and obtaining an abnormal label of the user account according to the feature data, the abnormal label being used for indicating whether the user account is an abnormal user account. According to the embodiment of the invention, the abnormal user account is identified by combining the exposure and the feature data of the user account, and the essential appeal that the abnormal user account needs to be continuously drained is considered, so that the identification accuracy of the abnormal user account is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and storage medium for identifying abnormal accounts. Background Art

[0002] With the development of artificial intelligence technology, neural network models are often used to identify abnormal user accounts to maintain the health of the network environment.

[0003] Taking chat applications as an example, relevant technologies obtain multimodal data corresponding to the user account, such as text information, image information, and video information, based on the basic information of the user account and the dynamics of the circle of friends. Then, a multimodal model is used to infer whether the user account is an abnormal user account based on the multimodal data.

[0004] However, since the owners of abnormal user accounts will continue to fight back, such as constantly modifying the corresponding multimodal data, this will cause the recall accuracy of the multimodal model to decrease, and the identification of abnormal user accounts will not be accurate enough. Summary of the Invention

[0005] The present invention provides a method, apparatus, device, and storage medium for identifying abnormal user accounts, which can improve the accuracy of identifying abnormal user accounts. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for identifying abnormal accounts is provided, the method comprising:

[0007] Obtaining an exposure flow of a user account, where the exposure flow is used to record exposure information of the user account;

[0008] Obtaining, according to the exposure flow, an exposure amount corresponding to the user account, where the exposure amount is used to indicate the number of times the user account has been viewed;

[0009] When the exposure amount is greater than or equal to a first threshold, acquiring characteristic data of the user account; wherein the characteristic data is used to record the behavior of the user account and content related to the user account;

[0010] An abnormality label of the user account is obtained according to the characteristic data, where the abnormality label is used to indicate whether the user account is an abnormal user account.

[0011] According to one aspect of an embodiment of the present application, a device for identifying abnormal accounts is provided, the device comprising:

[0012] An exposure flow acquisition module, configured to acquire an exposure flow of a user account, wherein the exposure flow is used to record exposure information of the user account;

[0013] an exposure acquisition module, configured to acquire the exposure corresponding to the user account according to the exposure flow, wherein the exposure is used to indicate the number of times the user account has been viewed;

[0014] a feature data acquisition module, configured to acquire feature data of the user account when the exposure amount is greater than or equal to a first threshold; wherein the feature data is used to record the behavior of the user account and content related to the user account;

[0015] The abnormal label acquisition module is used to obtain the abnormal label of the user account according to the characteristic data, and the abnormal label is used to indicate whether the user account is an abnormal user account.

[0016] According to one aspect of an embodiment of the present application, a computer device is provided, comprising a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the above-mentioned abnormal account identification method.

[0017] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the above-mentioned abnormal account identification method.

[0018] According to one aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described abnormal account identification method.

[0019] The technical solutions provided by the embodiments of the present application may have the following beneficial effects:

[0020] By identifying whether a user account is an abnormal user account based on the behavior and content corresponding to the user account when the exposure of the user account is greater than or equal to the first threshold, and taking into account the actual demand of abnormal user accounts to continuously attract traffic (i.e., large exposure), abnormal user accounts can be effectively distinguished, thereby improving the accuracy of identifying abnormal user accounts.

[0021] In addition, since the actual demands of abnormal user accounts are not as variable as the multimodal data of abnormal user accounts, by adopting exposure, the technical solution provided in the embodiment of this application can improve the anti-adversarial ability to a certain extent, and thus can maintain the recognition accuracy of abnormal user accounts to a certain extent without the need for frequent iterative updates of the multimodal model, which is conducive to reducing maintenance costs.

[0022] In addition, by identifying abnormal user accounts based on the exposure of user accounts, the technical solution provided in the embodiment of the present application has a certain ability to identify abnormal user accounts with high influence, which is conducive to reducing the difficulty of identifying abnormal user accounts with high influence. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 This is a schematic diagram of an implementation environment for a solution provided by an embodiment of the present application;

[0025] Figure 2 This is a flowchart of a method for identifying abnormal accounts provided by an embodiment of the present application;

[0026] Figure 3 This is a flowchart of a method for obtaining abnormal labels provided by an embodiment of the present application;

[0027] Figure 4 This is a flowchart of a method for obtaining an abnormality label provided by another embodiment of the present application;

[0028] Figure 5 is a schematic diagram of a multimodal model training method provided by one embodiment of the present application;

[0029] Figure 6 This is a schematic diagram of an abnormal account identification method provided by an embodiment of the present application;

[0030] Figure 7 This is a block diagram of an abnormal account identification device provided by one embodiment of the present application;

[0031] Figure 8 is a block diagram of an abnormal account identification device provided by another embodiment of the present application;

[0032] Figure 9 This is a block diagram of a computer device provided by one embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0034] Artificial Intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also studies the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making.

[0035] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, pre-trained models, operating / interaction systems, and mechatronics. Pre-trained models, also known as large models or basic models, can be fine-tuned and widely applied to downstream tasks across various AI disciplines. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0036] Computer vision (CV) is the science of making machines "see." Specifically, it refers to using cameras and computers to replace the human eye in identifying, tracking, and measuring objects, and then performing image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, aiming to build artificial intelligence systems that can extract information from images or multidimensional data. Large model technology has brought significant changes to the development of computer vision technology. Pre-trained models in the field of vision, such as Swin-Transformer, ViT (Vision Transformer), V-MOE (Vision Mixture-of-Experts), and MAE (Masked Autoencoders), can be fine-tuned to quickly and widely apply to specific downstream tasks. Computer vision technology generally includes image processing, image recognition, image semantic understanding, image retrieval, OCR (Optical Character Recognition), video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D (Three-Dimensional) technology, virtual reality, augmented reality, simultaneous positioning and map construction, and other technologies.

[0037] Machine learning (ML) is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is at the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of AI. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learning by demonstration. Pretrained models are the latest development in deep learning, integrating these techniques.

[0038] The technical solutions provided by the embodiments of this application involve artificial intelligence computer vision and machine learning technologies. First, computer vision technologies can be used to perform image, video, and text recognition to statistically obtain content feature information of user accounts. Second, computer vision and machine learning technologies can be used to train a multimodal model, resulting in a trained multimodal model that can be used to identify abnormal user accounts. A multimodal model can refer to a neural network model that simultaneously receives input data from multiple modalities.

[0039] The technical solutions provided by the embodiments of this application are applicable to any scenario requiring the identification of abnormal user accounts, such as social entertainment scenarios, online shopping scenarios, online payment scenarios, and any scenario requiring the use of user accounts for communication. The technical solutions provided by the embodiments of this application can improve the accuracy of identifying abnormal user accounts.

[0040] Please refer to Figure 1 , which shows a schematic diagram of an implementation environment of a solution provided by an embodiment of the present application. The implementation environment may include: a terminal device 10 and a server 20.

[0041] The terminal device 10 can be an electronic device such as a mobile phone, tablet computer, multimedia player, PC (Personal Computer), intelligent robot, vehicle-mounted terminal, smart home appliance, intelligent voice interaction device, etc. The terminal device 10 can be installed with a client of a target application, which can be an account verification application, a social entertainment application (such as a chat application), a shopping application, a payment application, a gaming application, a live broadcast application, or any application with a communication function.

[0042] The server 20 is used to provide background services for the client of the target application (such as a social entertainment application) in the terminal device 10. For example, the server 20 can be the background server of the above application (such as a social entertainment application). The server 20 can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0043] The terminal device 10 and the server 20 can communicate with each other via a network 30. The network 30 can be a wired network or a wireless network.

[0044] For example, taking a chat application as an example, upon receiving an abnormal account identification request from a terminal device 10, the server 20 obtains a list of user accounts corresponding to the client of the chat application. For each user account in the user account list, the server 20 determines whether the user account is an abnormal user account based on the user account's exposure and the corresponding behavior and content of the user account. After obtaining the abnormal identification result, the server 20 returns the abnormal identification result to the terminal device 10. The abnormal identification result is used to indicate an abnormal user account. Optionally, the server 20 can also be configured to periodically and automatically identify abnormal user accounts and process abnormal user accounts to maintain the health of the network environment, which is not limited in this embodiment of the present application.

[0045] Optionally, the abnormal user account identification process may also be performed by the terminal device 10. For example, in response to an operation for triggering the identification of abnormal user accounts in a chat application, the terminal device 10 determines whether each user account in the chat application is an abnormal user account based on the user account's exposure, the user account's corresponding behavior and content, and displays the abnormality identification result to the user.

[0046] Below, the technical solution provided by this application will be introduced and explained through method embodiments.

[0047] Please refer to Figure 2 , which shows a flowchart of an abnormal account identification method provided by an embodiment of the present application. The execution subject of each step of the method can be Figure 1 The terminal device 10 or the server 20 in the implementation environment of the solution shown is described below using the server 20 as an example. The method may include the following steps (201-204).

[0048] Step 201: Obtain the exposure flow of the user account, where the exposure flow is used to record the exposure status of the user account.

[0049] A user account may refer to an account registered by a user in an application, through which the user can access the application's features. For example, for chat applications, users may use their user accounts to chat and communicate; for gaming applications, users may use their user accounts to play games and communicate; and for shopping applications, users may use their user accounts to make purchases and inquire, etc., although this is not a limitation in the present embodiment. Optionally, when identifying abnormal user accounts for a particular application, the user account may refer to any user account within that application.

[0050] Abnormal user account identification in the embodiments of this application refers to the process of determining whether a user account is an abnormal user account, which can also be simply referred to as abnormal account identification. Among them, abnormal user accounts can refer to user accounts that generate abnormal behavior, such as posting unhealthy information or inducing users to engage in bad behavior.

[0051] In an embodiment of the present application, the above-mentioned exposure stream may refer to a sequence obtained by arranging the exposure records of the user account in chronological order, or the above-mentioned exposure stream may refer to a collection obtained by statistically analyzing the exposure records of the user account in the first time period, which is not limited in the embodiment of the present application.

[0052] Among them, the exposure record is used to record the exposure of a user account at a certain time. The exposure record may include at least one of the following information: the user account being exposed, the user account performing the exposure, and the exposure time, such as: stranger user account A viewed your user account at xx:00 on xx day. Optionally, for a certain user account, the stranger user account corresponding to the user account does not have a communication relationship with the user account, and the added stranger user account has a communication relationship with the user account. For example, the stranger user account corresponding to the user account does not have a friend relationship with the user account, that is, the two cannot communicate (such as chatting, sending messages). If the user account adds a stranger user account, the stranger user account has a friend relationship with the user account, that is, the two can communicate (such as chatting, sending messages).

[0053] In one example, an abnormal user account has a substantial demand for continuous traffic diversion, hoping that its user account will be exposed to as many different user accounts as possible. The user account's profile card can serve as the exposure entry point for the user account. By counting the unfamiliar user accounts that view the profile card of a certain user account, the exposure flow of the user account can be obtained. The profile card is used to introduce the basic information of the user account, such as a nickname, signature, friend circle entry, and add application control. The profile card can be implemented in the form of an interface, window, page, etc., which is not limited in this embodiment of the application.

[0054] Exemplarily, the acquisition process of the above exposure stream may be as follows:

[0055] 1. During the third time period, if the user account's personal profile card is viewed by an unfamiliar user account, an exposure record is generated.

[0056] The third time period can be set and adjusted based on actual usage needs, and this embodiment of the present application does not limit this. Optionally, when an unfamiliar user account views the user account's personal information for the first time, an exposure record is generated, and no exposure record is generated for the second or subsequent times. For the same unfamiliar user account, an exposure record can also be generated each time the unfamiliar user account views the user account's personal information, and this embodiment of the present application does not limit this.

[0057] In one example, an unfamiliar user account may expose its own profile card or view the profile cards of other user accounts in a variety of ways, such as conversations (such as chat groups), friend requests, virtual business cards, account searches (such as searching for nearby user accounts), personal codes (such as personal QR codes), and other scenarios, which are not limited in this embodiment of the present application.

[0058] Illustratively, the generation of the exposure record includes at least one of the following:

[0059] 1) If an unfamiliar user account views a user account's profile card through a session, an exposure record is generated.

[0060] Optionally, a user account's profile picture is associated with the session, and the user account can use the profile picture to attract stranger user accounts to view their profile card, thereby exposing themselves. For example, in response to a trigger action by a stranger user account on the profile picture, the stranger user account can obtain and view the user account's profile card, thereby generating an exposure record for the user account on the client or server.

[0061] 2) If an unfamiliar user account views a profile card through a friend request from a user account, an exposure record is generated.

[0062] Alternatively, a user account may send a friend request to an unfamiliar user account to achieve the purpose of exposing itself. For example, in response to a triggering action by an unfamiliar user account in response to a friend request, the unfamiliar user account may obtain and view the user account's profile card, thereby generating an exposure record for the user account on the client or server.

[0063] 3) If an unfamiliar user account views the personal profile card through the user account's virtual business card, an exposure record is generated.

[0064] Alternatively, a user account can push a virtual business card to an unfamiliar user account through another user account (e.g., a friend of the unfamiliar user account) to expose the user account. For example, in response to a triggering operation on the virtual business card by the unfamiliar user account, the unfamiliar user account can obtain and view the user account's personal profile card, thereby generating a record of the user account's exposure on the client or server. The virtual business card is used to trigger the display of the personal profile card.

[0065] 4) If an unfamiliar user account views a profile card through a visiting account search, an exposure record is generated.

[0066] Alternatively, a user account can distribute its identification information (such as an account code) so that an unfamiliar account can search for its profile card based on the identification information. Alternatively, an unfamiliar user account can set itself to be visible, that is, the unfamiliar user account can obtain its profile card through a nearby search.

[0067] 5) If an unfamiliar user account scans the personal code to view the personal profile card, an exposure record is generated.

[0068] Optionally, the user account may show its personal code to an unfamiliar user account, so that the unfamiliar user account can obtain its personal information card by scanning the personal code.

[0069] In this way, by counting the exposure records of user accounts in various situations, it is helpful to improve the comprehensiveness of the exposure flow, thereby improving the accuracy of the exposure volume, and further improving the accuracy of identifying abnormal user accounts.

[0070] 2. Collect statistics on the exposure records in the third time period to obtain the exposure flow of the user account.

[0071] Optionally, the exposure records within the third time period are sorted in chronological order to obtain the exposure flow of the user account. Alternatively, the exposure records within the third time period are combined to obtain the exposure flow of the user account.

[0072] Step 202: Obtain the exposure amount corresponding to the user account according to the exposure flow. The exposure amount is used to indicate the number of times the user account has been viewed.

[0073] The exposure amount in the embodiment of the present application may refer to the number of times the personal profile card of the user account is viewed by an unfamiliar user account, such as the number of times the personal profile card of the user account is viewed by an unfamiliar user account within the third time period.

[0074] Optionally, the above-mentioned exposure record indicates that the personal profile card of the user account is viewed once by an unfamiliar user account, and the number of exposure records in the exposure stream is the exposure amount of the user account. That is, the total number of exposure records in the exposure stream is counted to obtain the exposure amount corresponding to the user account.

[0075] Step 203 : When the exposure amount is greater than or equal to the first threshold, characteristic data of the user account is obtained. The characteristic data is used to record the behavior of the user account and content related to the user account.

[0076] Optionally, the characteristic data may be stored in a database and associated with a user account. When the exposure is greater than or equal to a first threshold, the server may retrieve the characteristic data for the user account from the database based on the user account. If the execution subject is a client in a terminal device, the server may send the characteristic data to the client.

[0077] The first threshold value can be set and adjusted based on actual usage requirements, and is not limited in this embodiment of the present application. For example, the exposure of multiple abnormal user accounts during the third time period can be counted, and the total exposure corresponding to these multiple abnormal user accounts can be averaged to obtain a first average value. The first average value can then be adjusted to obtain a first threshold value to distinguish abnormal user accounts from ordinary user accounts. Optionally, the exposure of abnormal user accounts is generally much higher than that of ordinary user accounts, so the first threshold value can also refer to any threshold value that can distinguish abnormal user accounts from ordinary user accounts.

[0078] The characteristic data may refer to data generated by the user account in the application. Optionally, the characteristic data includes behavioral characteristic information and content characteristic information, wherein the behavioral characteristic information includes behavioral data related to the user account and the content characteristic information includes content related to the user account.

[0079] For example, the above-mentioned behavioral characteristic information may include data generated by actions such as adding friends, deleting friends, posting to Moments, and modifying profile pictures. The above-mentioned content characteristic information may include data such as the content in the personal profile card, the content in dynamic data (such as text, images, and videos), and profile pictures. Dynamic data includes content published online by the user account, such as content published in the Moments by the user account.

[0080] Optionally, when the exposure amount is less than a first threshold, the user account is determined to be a common user account, and feature data of the user account is no longer obtained.

[0081] In this way, ordinary user accounts are filtered by exposure volume, and abnormal user accounts are identified for the remaining user accounts. This can effectively reduce the workload in the abnormal user account identification process and thus improve the efficiency of abnormal user account identification.

[0082] Step 204 : Obtain an abnormality label of the user account based on the characteristic data. The abnormality label is used to indicate whether the user account is an abnormal user account.

[0083] Optionally, if the anomaly tag is the first tag, the server determines the user account as an abnormal user account; if the anomaly tag is the second tag, the server determines the user account as a normal user account. The first tag and the second tag are different, and a normal user account refers to a user account that has not engaged in any abnormal behavior, as opposed to an abnormal user account.

[0084] In one example, if Figure 3 As shown, step 204 may further include the following sub-steps.

[0085] Step 204a: If the behavior characteristic information satisfies the first condition, the user account is determined as a candidate user account.

[0086] The candidate user account is a user account that may be an abnormal user account. Optionally, since the ultimate purpose of an abnormal user account is to have the user account added by an unfamiliar user account, the first condition may be related to the adding of the unfamiliar user account. Exemplarily, the process of determining the candidate user account may be as follows:

[0087] 1. Determine, based on the behavior characteristic information, multiple unfamiliar user accounts added by the user account within a first time period, wherein the unfamiliar user accounts do not have a communication relationship with the user account, and the added unfamiliar user accounts have a communication relationship with the user account.

[0088] Optionally, the server retrieves behavioral characteristic information of the user account within a first time period from a database and, based on the behavioral characteristic information within the first time period, determines the number of unfamiliar user accounts added by the user account within the first time period. The first time period can be set and adjusted based on actual usage. In one feasible example, the first time period is the same as the third time period described above. For example, the first time period can be the period between a certain historical moment and the current moment.

[0089] In one example, after obtaining multiple unfamiliar user accounts added by a user account within a first time period, the server calculates a first total number of the multiple unfamiliar user accounts. If the first total number is greater than or equal to a third threshold, the server performs the following attribute percentage acquisition process. Optionally, after obtaining the first total number, the server may also directly perform the following attribute percentage acquisition process, which is not limited in this embodiment of the present application.

[0090] 2. Determine attribute proportions based on the attributes of the plurality of unfamiliar user accounts. The attribute proportions are used to indicate the proportions of the first category of attributes. User accounts with the first category of attributes are targets of abnormal operations performed by abnormal user accounts.

[0091] Optionally, the server determines the number of user accounts belonging to the first type of attribute among the plurality of unfamiliar user accounts, and then divides the number by the first total number to obtain the attribute proportion.

[0092] In this embodiment of the present application, user account attributes are used to characterize the user account and may include at least one of the following: location, interest tags, and user-related information. The primary purpose of the abnormal user account is to add as many user accounts with the first type of attributes as possible to conduct abnormal operations and profit. This embodiment of the present application does not limit the first type of attributes; they can be set and adjusted according to actual usage needs.

[0093] 3. If the attribute ratio is greater than or equal to the second threshold, the user account is determined as a candidate user account.

[0094] Optionally, if the attribute ratio is less than a second threshold, the user account is determined to be a common user account. The second threshold can be set and adjusted according to actual usage requirements, and the present embodiment does not limit this.

[0095] This approach, based on exposure volume, further screens user accounts using characteristic information, helping to further reduce the workload of identifying abnormal user accounts. Furthermore, since the ultimate goal of abnormal user accounts is to be added by unfamiliar users, further screening user accounts using behavioral characteristic information (such as friend additions) can help further improve the accuracy of abnormal user account identification.

[0096] Step 204b: Obtain an abnormal label of the candidate user account based on the content feature information of the candidate user account.

[0097] Optionally, an abnormal user account may expose its user account through dynamic data, avatar, personal profile card, etc. The server may determine whether the candidate user account is an abnormal user account based on the content feature information such as the dynamic data, avatar, personal profile card, etc. of the candidate user account.

[0098] Exemplarily, the content feature information includes at least one of the following:

[0099] 1) The dynamic data of the user account in the second time period includes a first total number of abnormal keywords.

[0100] Dynamic data includes content published online by user accounts, such as text, images, and videos posted by user accounts in Moments. The probability that an abnormal user account uses an abnormal keyword is greater than or equal to a first probability threshold. In other words, the abnormal keyword may refer to a user account frequently used by the abnormal user account. The first probability threshold can be set and adjusted based on actual usage needs. For example, the abnormal keyword may be "open for business" or "available," etc., but this embodiment of the application does not limit this.

[0101] For example, for multiple confirmed abnormal user accounts, the text in the dynamic data of each of the multiple abnormal user accounts is segmented to obtain multiple words, and then the word frequency of each word is counted. Finally, based on the word frequency, a group of high-frequency keywords are extracted as abnormal keywords.

[0102] The second time period can be set and adjusted according to actual usage. In a feasible example, the second time period is the same as the third time period or the first time period.

[0103] Optionally, the number of dynamic data containing abnormal keywords is counted, and this number can be determined as the first total number. Alternatively, the number of all abnormal keywords in the dynamic data within the second time period is counted to obtain the first total number, which is not limited in this embodiment of the present application.

[0104] 2) A first proportion of images of a specified type included in the dynamic data of the user account within a second time period.

[0105] The probability that an abnormal user account uses a specified type of image is greater than or equal to a second probability threshold. Specifically, the specified type of image may refer to images of a type frequently used by abnormal user accounts. The second probability threshold can be set and adjusted based on actual usage requirements. For example, the specified type of image may include an image of a beautiful woman, an image containing a website address, or an image containing information describing an abnormal operation, etc., although this embodiment of the present application is not limited thereto.

[0106] Optionally, the server first counts a second total number of images included in the dynamic data within the second time period, and a third total number of images of a specified type; and then divides the third total number by the second total number to obtain a first proportion.

[0107] Alternatively, the server first counts a second total amount of dynamic data including images in the second time period, and a third total amount of dynamic data including images of a specified type; and then divides the third total amount by the second total amount to obtain the first proportion.

[0108] Optionally, the specified type of image can be identified using a simple neural network model (which takes up less machine resources), such as CNN (Convolutional Neural Network), R-CNN (Region-CNN), SSD (Single Shot MultiBox Detector), etc., or it can be identified using a pre-trained model or manually, which is not limited in the embodiments of the present application.

[0109] 3) The second percentage of times the user account's profile picture was changed to an image of a specified type.

[0110] Optionally, the server first counts the number of times the avatar is modified and the number of times it is modified to a specified type of image within the second time period, and then divides the number of times the avatar is modified to a specified type of image by the number of times the avatar is modified to obtain the second proportion.

[0111] Optionally, based on the above embodiment, the method for determining abnormal labels includes at least one of the following:

[0112] 1. When at least two types of content feature information among the first total number of times, the first proportion, and the second proportion meet respective second conditions, the abnormal label of the user account is determined as the first label.

[0113] The first tag is used to indicate that the user account is an abnormal user account.

[0114] Optionally, the second condition for the first total number of times may be: the first total number of times is greater than or equal to a fourth threshold; the second condition for the first percentage may be: the first percentage is greater than or equal to a fifth threshold; and the second condition for the second percentage may be: the second percentage is greater than or equal to a sixth threshold. The fourth, fifth, and sixth thresholds can be set and adjusted according to actual usage requirements.

[0115] For example, if the first total number of times is greater than or equal to the fourth threshold, and the first proportion is greater than or equal to the fifth threshold, the server determines the abnormal label of the user account as the first label. For another example, if the first total number of times is greater than or equal to the fourth threshold, the first proportion is greater than or equal to the fifth threshold, and the second proportion is greater than or equal to the sixth threshold, the server determines the abnormal label of the user account as the first label.

[0116] Optionally, when none of the above content feature information satisfies the respective second conditions, the abnormal label of the user account is determined as the second label. The second label is used to indicate that the user account is a normal user account.

[0117] 2. When any one of the content feature information among the first total number of times, the first proportion, and the second proportion meets the respective second conditions, obtain the manual review result of the user account; if the manual review result indicates that the user account is an abnormal user account, determine the abnormal label of the user account as the first label.

[0118] For example, if the first total number of times is greater than or equal to the fourth threshold, the characteristic data of the user account is sent to the terminal device for display to the reviewer. The reviewer then reviews the user account according to the review criteria and obtains a manual review result. After receiving the manual review result returned by the terminal device, the server determines an abnormality label for the user account based on the manual review result.

[0119] In one example, after obtaining the abnormality tag of the user account, the user account may be processed according to the abnormality tag. Then, the embodiment of the present application may further include the following contents:

[0120] 1. According to the abnormal labels of the multiple user accounts, multiple abnormal user accounts are determined from the multiple user accounts.

[0121] Optionally, the server determines the user account with the abnormal label being the first label as an abnormal user account, and determines the user account with the abnormal label being the second label as a normal user account.

[0122] 2. Determine the processing priority of each of the multiple abnormal user accounts based on their respective exposure amounts. The exposure amount and processing priority are positively correlated.

[0123] Optionally, the server sorts the multiple abnormal user accounts in order of exposure from large to small to obtain an abnormal account sequence, and then assigns processing priorities to the abnormal user accounts in the abnormal account sequence from head to tail in order of processing priority from high to low, thereby obtaining the processing priorities of each of the multiple abnormal user accounts.

[0124] The processing priority is used to indicate the priority of abnormal user accounts. The higher the processing priority of an abnormal user account, the more priority the abnormal user account needs to be processed.

[0125] In a feasible example, the server can perform a weighted summation of the exposure and attribute proportion of the user account to obtain the processing priority of the user account, thereby improving the accuracy of obtaining the processing priority. The embodiment of the present application does not limit the method of obtaining the processing priority.

[0126] 3. Process multiple abnormal user accounts in order of priority from high to low.

[0127] Based on the exposure volume, the server can effectively identify abnormal user accounts with higher influence and give priority to processing abnormal user accounts with higher influence. This helps to quickly reduce the impact of abnormal user accounts with high influence on the network environment.

[0128] To sum up, the technical solution provided in the embodiment of the present application identifies whether the user account is an abnormal user account based on the behavior and content corresponding to the user account when the exposure of the user account is greater than or equal to the first threshold. Since the actual demand of abnormal user accounts for continuous traffic diversion (i.e., large exposure) is taken into consideration, abnormal user accounts can be effectively distinguished, thereby improving the accuracy of identifying abnormal user accounts.

[0129] In addition, since the actual demands of abnormal user accounts are not as variable as the multimodal data of abnormal user accounts, by adopting exposure, the technical solution provided in the embodiment of this application can improve the anti-adversarial ability to a certain extent, and thus can maintain the recognition accuracy of abnormal user accounts to a certain extent without the need for frequent iterative updates of the multimodal model, which is conducive to reducing maintenance costs.

[0130] In addition, by identifying abnormal user accounts based on the exposure of user accounts, the technical solution provided in the embodiment of the present application has a certain ability to identify abnormal user accounts with high influence, which is conducive to reducing the difficulty of identifying abnormal user accounts with high influence.

[0131] In addition, the present application only needs to adopt a simple statistical method to obtain content feature information and use the content feature information to identify abnormal user accounts, without the need to adopt a multimodal model that occupies a large amount of machine resources to identify abnormal user accounts, which effectively reduces the cost of abnormal user account identification and makes the technical solution provided by the embodiment of the present application applicable to more scenarios (such as scenarios with fewer machine resources), thereby expanding the scope of application of the technical solution provided by the embodiment of the present application.

[0132] In some feasible embodiments, the above-mentioned content feature information may include text information, image information, and video information. The text information may include text in a personal profile card, dynamic data, etc., the image information may include images in a personal profile card, dynamic data, etc., and the video information may include videos in a personal profile card, dynamic data, etc.

[0133] After determining the candidate user account, the embodiment of the present application can also obtain the abnormal label of the candidate user account according to the content feature information of the candidate user account through the multimodal model, referring to Figure 4 , the above step 204b may also include the following content.

[0134] Step S1: Obtain text features of the user account based on text information through a multimodal model.

[0135] A multimodal model may refer to a neural network model that simultaneously takes data from multiple modalities as input. In embodiments of the present application, a multimodal model may refer to a multimodal model that simultaneously supports input data from at least two modalities, such as text, images, video, and audio. This multimodal model may be used to obtain anomaly labels for user accounts based on multimodal input.

[0136] Optionally, a single-stream model with a Transformer structure and relatively low model inference time is selected as the multimodal model in the embodiment of the present application. Exemplarily, the multimodal model may include three pre-trained models: Image Encoder, Video Encoder, and Text Encoder.

[0137] Among them, Image Encoder is used to extract the features of image information, which can be constructed based on ViT, VisualBERT (visual pre-training model), ViBERT (Vision-and-language BERT, visual language pre-training model), etc.

[0138] Video Encoder is used to extract features of video information, which can be constructed based on methods such as Video SwinT, Swin-Transformer, ViT, and FastRCNN (Faster Region based Convolutional Neural Network, a target detection network).

[0139] Text Encoder is used to extract features of text information. It can be built based on models such as CNN, Transformer, RNN (Recurrent Neural Network), DNN (Deep Neural Networks), and BERT (Bidirectional Encoder Representation From Transformers).

[0140] Optionally, the above-mentioned Image Encoder, Video Encoder and Text Encoder can also exist independently from the multimodal model, that is, the following fusion features can be directly determined as the input of the multimodal model. This embodiment of the present application does not limit this.

[0141] Optionally, a text encoder in the multimodal model is used to extract features from the text information to obtain text features of the user account. The text features may refer to feature vectors used to characterize the user account.

[0142] Step S2: Obtain visual features of the user account based on image information and video information through a multimodal model.

[0143] Optionally, the image encoder in the multimodal model extracts features from the image information to obtain image features of the user account, and the video encoder in the multimodal model extracts features from the video information to obtain video features of the user account. The image features and video features of the user account are then determined as visual features of the user account. The visual features may refer to feature vectors used to represent the user account.

[0144] Step S3: Fusing the text features and visual features to obtain fused features of the user account.

[0145] Optionally, the text features and visual features of the user account are spliced ​​together through a multimodal model to obtain a fused feature of the user account. The fused feature integrates features in three dimensions: text, image, and video to represent the user account.

[0146] In step S4, the user account is classified based on the fusion features using a multimodal model to obtain an abnormal label.

[0147] Optionally, a classifier is further deployed in the multimodal model, and the classifier is used to classify user accounts based on fusion features to obtain abnormal labels of user accounts.

[0148] In one example, reference Figure 5 , the training process of the above multimodal model can be as follows:

[0149] 1. Obtain training samples for the multimodal model 500.

[0150] Manually select a batch of positive and negative samples for training from abnormal user accounts and normal user accounts. Positive samples refer to the content feature information of abnormal user accounts, while negative samples can refer to the content feature information of normal user accounts.

[0151] 2. Selection and preparation of multimodal model 500.

[0152] Optionally, a single-stream model with a Transformer structure and relatively low model inference time is selected as the multimodal model 500 in the embodiment of the present application.

[0153] 3. Feature extraction and fusion.

[0154] The text features, image features and video features of the training samples are extracted through the multimodal model 500, and then the text features, image features and video features are fused based on the Transformer to obtain fused features.

[0155] 4. Model training and distillation.

[0156] The fused features are fed into the multimodal model 500 for training, and the BERT-PKD (BERT-Patient Knowledge Distillation, BERT-based patient knowledge distillation) method is used to distill the multimodal model 500 to improve the training speed of the multimodal model 500.

[0157] 5. Model online reasoning.

[0158] The trained multimodal model 500 is deployed online to identify abnormal user accounts in real time.

[0159] 6. Model iterative optimization.

[0160] According to the online abnormality recognition results, misjudgment samples are collected, and the multimodal model 500 is iteratively optimized based on the misjudgment samples, and the iteratively optimized multimodal model 500 is redeployed online.

[0161] To sum up, the technical solution provided in the embodiment of the present application obtains candidate user accounts based on exposure and behavioral feature information, and then identifies abnormal user accounts based on the content feature information of the candidate user accounts through a multimodal model. This can effectively improve the anti-adversarial ability of the multimodal model, and at the same time take into account the actual demand of abnormal user accounts to continuously attract traffic (i.e., large exposure) and the ultimate goal (adding as many unfamiliar user accounts as possible), thereby effectively improving the identification accuracy of abnormal user accounts.

[0162] In some embodiments, as Figure 6 As shown, taking a chat application as an example, the abnormal account identification method provided in the embodiment of the present application may also include the following content.

[0163] 1. The server obtains the user account 600.

[0164] Optionally, the server automatically and periodically identifies abnormal user accounts, and the user account 600 may be any user account registered in a chat application.

[0165] 2. The server counts the exposure of user account 600 in real time.

[0166] Optionally, when the server detects that an unfamiliar user account corresponding to the user account 600 views the personal profile card of the user account 600 in any of the following ways, the server increases the exposure value of the user account 600: viewing the personal profile card through group chat, viewing the personal profile card through a friend request, viewing the personal profile card through the "People Nearby" function, viewing the personal profile card through a virtual business card, and viewing the personal profile card by scanning a personal code.

[0167] 3. When the server detects that the exposure amount of the user account 600 is greater than or equal to the first threshold, it obtains the percentage of males among the newly added friends corresponding to the user account 600.

[0168] Optionally, if the server detects that the time threshold has been exceeded and the exposure of the user account 600 has not exceeded the first threshold, the user account 600 is determined to be a common user account. The time threshold corresponds to the length of the first time period.

[0169] 4. When the proportion of males in the newly added friends is greater than or equal to the second threshold, the server obtains content feature information of the user account 600.

[0170] Optionally, the content feature information includes the friend circle text, friend circle images and avatar of the user account 600.

[0171] Optionally, if the server detects that the time threshold has been exceeded and the proportion of males in the newly added friends corresponding to the user account 600 has not exceeded the second threshold, the user account 600 is determined to be a common user account.

[0172] 5. If the server detects any two of the following: the number of times abnormal keywords are hit in the Moments post of user account 600 reaches the fourth threshold, the proportion of beautiful women images in the Moments reaches the fifth threshold, and the number of times the avatar is modified to a beautiful women image reaches the sixth threshold, the server will determine user account 600 as an abnormal user account.

[0173] Optionally, when the server detects that the number of times the friend circle text of user account 600 hits abnormal keywords reaches the fourth threshold, the proportion of beautiful girl images in the friend circle reaches the fifth threshold, and the number of times the avatar is modified to a beautiful girl image reaches the sixth threshold, the server switches to manual review to determine whether user account 600 is an abnormal user account.

[0174] Optionally, if the server does not detect that the number of times the friend circle text of user account 600 hits abnormal keywords reaches the fourth threshold, the proportion of beautiful woman images in the friend circle reaches the fifth threshold, and the number of times the avatar is modified to a beautiful woman image reaches the sixth threshold, the server determines user account 600 as an ordinary user account.

[0175] To sum up, the technical solution provided in the embodiment of the present application identifies whether the user account is an abnormal user account based on the behavior and content corresponding to the user account when the exposure of the user account is greater than or equal to the first threshold. Since the actual demand of abnormal user accounts for continuous traffic diversion (i.e., large exposure) is taken into consideration, abnormal user accounts can be effectively distinguished, thereby improving the accuracy of identifying abnormal user accounts.

[0176] The following are device embodiments of the present application, which can be used to implement the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0177] refer to Figure 7 , which shows a block diagram of an abnormal account identification device provided by an embodiment of the present application. The device has the function of implementing the above method example, and the function can be implemented by hardware or by hardware executing corresponding software. The device can be the computer device described above, or it can be set in a computer device. Figure 7 As shown, the device 700 includes: an exposure flow acquisition module 701, an exposure amount acquisition module 702, a feature data acquisition module 703 and an abnormal label acquisition module 704.

[0178] The exposure flow acquisition module 701 is used to acquire the exposure flow of the user account, where the exposure flow is used to record the exposure status of the user account.

[0179] The exposure acquisition module 702 is configured to acquire the exposure corresponding to the user account according to the exposure flow, where the exposure indicates the number of times the user account has been viewed.

[0180] The feature data acquisition module 703 is used to acquire feature data of the user account when the exposure amount is greater than or equal to a first threshold; wherein the feature data is used to record the behavior of the user account and content related to the user account.

[0181] The abnormality label acquisition module 704 is configured to obtain an abnormality label of the user account according to the feature data, wherein the abnormality label is used to indicate whether the user account is an abnormal user account.

[0182] In some embodiments, the characteristic data includes behavioral characteristic information and content characteristic information, the behavioral characteristic information includes behavioral data related to the user account, and the content characteristic information includes content related to the user account;

[0183] like Figure 8 As shown, the abnormal label acquisition module 704 includes: a candidate account acquisition submodule 704a and an abnormal label acquisition submodule 704b.

[0184] The candidate account acquisition submodule 704a is configured to determine the user account as a candidate user account if the behavior characteristic information satisfies a first condition.

[0185] The abnormal label acquisition submodule 704b is configured to obtain the abnormal label of the candidate user account according to the content feature information of the candidate user account.

[0186] In some embodiments, the candidate account acquisition submodule 704a is configured to:

[0187] determining, based on the behavior characteristic information, a plurality of unfamiliar user accounts added by the user account within a first time period, wherein no communication relationship exists between the unfamiliar user accounts and the user account, and a communication relationship exists between the added unfamiliar user accounts and the user account;

[0188] determining attribute proportions based on the attributes of the plurality of unfamiliar user accounts, the attribute proportions being used to indicate proportions of first-category attributes, the user accounts of the first-category attributes being targets of abnormal operations performed by the abnormal user accounts;

[0189] When the attribute proportion is greater than or equal to a second threshold, the user account is determined as the candidate user account.

[0190] In some embodiments, the content feature information includes at least one of the following:

[0191] The dynamic data of the user account in the second time period includes a first total number of abnormal keywords; wherein the dynamic data includes content published online by the user account, and the probability that the abnormal user account uses the abnormal keyword is greater than or equal to a first probability threshold;

[0192] a first proportion of images of a specified type included in the dynamic data of the user account within the second time period; wherein the probability that the abnormal user account uses images of the specified type is greater than or equal to a second probability threshold;

[0193] a second proportion of the number of times the avatar of the user account is modified to an image of the specified type.

[0194] In some embodiments, the abnormal label acquisition submodule 704b is used to:

[0195] If at least two of the content feature information among the first total number of times, the first proportion, and the second proportion meet respective second conditions, determining the abnormal label of the user account as a first label;

[0196] Alternatively, when any one of the content feature information among the first total number of times, the first proportion and the second proportion meets the respective second conditions, the manual review result of the user account is obtained; if the manual review result indicates that the user account is the abnormal user account, the abnormal label of the user account is determined to be the first label; wherein, the first label is used to indicate that the user account is the abnormal user account.

[0197] In some embodiments, the content feature information includes text information, image information, and video information;

[0198] like Figure 8 As shown, the abnormal label acquisition module 704 further includes: a text feature acquisition submodule 704c, a visual feature acquisition submodule 704d and a fusion feature acquisition submodule 704e.

[0199] The text feature acquisition submodule 704c is configured to acquire the text features of the user account according to the text information using a multimodal model.

[0200] The visual feature acquisition submodule 704d is configured to acquire the visual features of the user account according to the image information and the video information using the multimodal model.

[0201] The fusion feature acquisition submodule 704e is configured to fuse the text feature and the visual feature to obtain the fusion feature of the user account.

[0202] The abnormal label acquisition submodule 704b is configured to classify the user account based on the fusion features using the multimodal model to obtain the abnormal label.

[0203] In some embodiments, the exposure flow acquisition module 701 is configured to:

[0204] During the third time period, if the personal profile card of the user account is viewed by an unfamiliar user account, an exposure record is generated;

[0205] Statistics are collected on the exposure records in the third time period to obtain an exposure flow of the user account; wherein the number of exposure records in the exposure flow is the exposure amount of the user account.

[0206] In some embodiments, the exposure flow acquisition module 701 is further configured to:

[0207] If the stranger user account views the personal profile card through a session, an exposure record is generated;

[0208] Alternatively, if the stranger user account views the personal profile card through a friend request from the user account, an exposure record is generated;

[0209] Alternatively, if the unfamiliar user account views the personal profile card through the virtual business card of the user account, an exposure record is generated;

[0210] Alternatively, if the stranger user account views the personal profile card through a guest account search, an exposure record is generated;

[0211] Alternatively, if the unfamiliar user account views the personal information card by scanning the personal code, an exposure record is generated.

[0212] In some embodiments, as Figure 8 As shown, the apparatus 700 further includes: an abnormal account determination module 705 , a priority determination module 706 and an abnormal account processing module 707 .

[0213] The abnormal account determining module 705 is configured to determine a plurality of abnormal user accounts from the plurality of user accounts according to the abnormal tags of the plurality of user accounts.

[0214] The priority determination module 706 is configured to determine a processing priority for each of the plurality of abnormal user accounts according to the exposure amount of each of the plurality of abnormal user accounts, wherein the exposure amount is positively correlated with the processing priority.

[0215] The abnormal account processing module 707 is configured to process the multiple abnormal user accounts in sequence according to the processing priority from high to low.

[0216] To sum up, the technical solution provided in the embodiment of the present application identifies whether the user account is an abnormal user account based on the behavior and content corresponding to the user account when the exposure of the user account is greater than or equal to the first threshold. Since the actual demand of abnormal user accounts for continuous traffic diversion (i.e., large exposure) is taken into consideration, abnormal user accounts can be effectively distinguished, thereby improving the accuracy of identifying abnormal user accounts.

[0217] In addition, since the actual demands of abnormal user accounts are not as variable as the multimodal data of abnormal user accounts, by adopting exposure, the technical solution provided in the embodiment of this application can improve the anti-adversarial ability to a certain extent, and thus can maintain the recognition accuracy of abnormal user accounts to a certain extent without the need for frequent iterative updates of the multimodal model, which is conducive to reducing maintenance costs.

[0218] In addition, by identifying abnormal user accounts based on the exposure of user accounts, the technical solution provided in the embodiment of the present application has a certain ability to identify abnormal user accounts with high influence, which is conducive to reducing the difficulty of identifying abnormal user accounts with high influence.

[0219] It should be noted that the apparatus provided in the above embodiments, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0220] Please refer to Figure 9 , which shows a block diagram of a computer device provided in one embodiment of the present application. The computer device can be used to implement the abnormal account identification method provided in the above embodiment, which may specifically include the following contents.

[0221] The computer device 900 includes a central processing unit (CPU, central processing unit), GPU (graphics processing unit), and FPGA (field programmable gate array) 901, a system memory 904 including RAM (random-access memory) 902 and ROM (read-only memory) 903, and a system bus 905 connecting the system memory 904 and the central processing unit 901. The computer device 900 also includes a basic input / output system (I / O system) 906 for facilitating information transmission between various components within the server, and a mass storage device 907 for storing an operating system 913, application programs 914, and other program modules 915.

[0222] The basic input / output system 906 includes a display 908 for displaying information and an input device 909 such as a mouse and a keyboard for user input. The display 908 and the input device 909 are connected to the central processing unit 901 via an input / output controller 910 connected to the system bus 905. The basic input / output system 906 may also include an input / output controller 910 for receiving and processing input from a variety of other devices such as a keyboard, a mouse, or an electronic stylus. Similarly, the input / output controller 910 also provides output to a display screen, a printer, or other types of output devices.

[0223] The mass storage device 907 is connected to the central processing unit 901 via a mass storage controller (not shown) connected to the system bus 905. The mass storage device 907 and its associated computer-readable media provide non-volatile storage for the computer device 900. In other words, the mass storage device 907 may include a computer-readable medium (not shown) such as a hard disk or a CD-ROM (Compact Disc Read-Only Memory) drive.

[0224] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid-state storage technology, CD-ROM, DVD (Digital Video Disc) or other optical storage, tape cassettes, magnetic tape, disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that the computer storage media is not limited to the above-mentioned ones. The above-mentioned system memory 904 and mass storage device 907 can be collectively referred to as memory.

[0225] According to an embodiment of the present application, the computer device 900 can also be connected to a remote computer on a network such as the Internet for operation. That is, the computer device 900 can be connected to a network 912 via a network interface unit 911 connected to the system bus 905. Alternatively, the network interface unit 911 can be used to connect to other types of networks or remote computer systems (not shown).

[0226] The memory further includes a computer program, which is stored in the memory and configured to be executed by one or more processors to implement the above-mentioned abnormal account identification method.

[0227] In some embodiments, a computer-readable storage medium is further provided, wherein a computer program is stored in the storage medium. When the computer program is executed by a processor, the abnormal account identification method described above is implemented.

[0228] Optionally, the computer-readable storage medium may include: ROM (Read-Only Memory), RAM (Random-Access Memory), SSD (Solid State Drives), or an optical disk, etc. Among them, the random access memory may include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0229] In some embodiments, a computer program product is further provided, comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described abnormal account identification method.

[0230] It should be noted that, in the embodiments of the present application, before collecting the relevant data of the user and during the process of collecting the relevant data of the user, a prompt interface, pop-up window or voice prompt information can be displayed. The prompt interface, pop-up window or voice prompt information is used to remind the user that its relevant data is currently being collected, so that the present application only starts to execute the relevant steps of obtaining the relevant data of the user after obtaining the confirmation operation issued by the user on the prompt interface or pop-up window. Otherwise (that is, when the confirmation operation issued by the user on the prompt interface or pop-up window is not obtained), the relevant steps of obtaining the relevant data of the user are terminated, that is, the relevant data of the user is not obtained. In other words, all user data collected by this application are processed strictly in accordance with the requirements of relevant national laws and regulations. The informed consent or separate consent of the personal information subject is obtained only when the user agrees and authorizes the collection, and the subsequent data use and processing behavior is carried out within the scope of the laws and regulations and the authorization of the personal information subject. The collection, use and processing of relevant user data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the exposure flow, behavioral feature information, content feature information, etc. involved in this application are all obtained with full authorization.

[0231] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application do not limit this.

[0232] The above description is merely an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for identifying abnormal accounts, characterized in that: The method comprises: Acquire an exposure stream of a user account, where the exposure stream is used to record exposure status of the user account; According to the exposure flow, acquiring the exposure amount corresponding to the user account, where the exposure amount is used to indicate the number of times the user account has been viewed; When the exposure amount is greater than or equal to a first threshold, acquiring characteristic data of the user account; wherein the characteristic data is used to record the behavior of the user account and content related to the user account; An abnormal label of the user account is obtained according to the characteristic data, and the abnormal label is used to indicate whether the user account is an abnormal user account.

2. The method according to claim 1, characterized in that The characteristic data includes behavior characteristic information and content characteristic information, wherein the behavior characteristic information includes behavior data related to the user account, and the content characteristic information includes content related to the user account; The obtaining, according to the characteristic data, an abnormal label of the user account includes: In the case where the behavior characteristic information satisfies a first condition, determining the user account as a candidate user account; An abnormal label of the candidate user account is obtained according to the content feature information of the candidate user account.

3. The method according to claim 2, characterized in that The step of determining the user account as a candidate user account when the behavior characteristic information satisfies a first condition includes: Determine, based on the behavior characteristic information, a plurality of unfamiliar user accounts added by the user account within a first time period, wherein the unfamiliar user accounts do not have a communication relationship with the user account, and the unfamiliar user accounts after being added have a communication relationship with the user account; determining attribute proportions according to the respective attributes of the plurality of unfamiliar user accounts, the attribute proportions being used to indicate proportions of first-category attributes, and user accounts of the first-category attributes being targets of abnormal operations performed by the abnormal user accounts; When the attribute proportion is greater than or equal to a second threshold, the user account is determined as the candidate user account.

4. The method according to claim 2, characterized in that: The content feature information includes at least one of the following: The dynamic data of the user account in the second time period includes a first total number of abnormal keywords; wherein the dynamic data includes content published online by the user account, and the probability that the abnormal user account uses the abnormal keyword is greater than or equal to a first probability threshold; a first proportion of images of a specified type included in the dynamic data of the user account in the second time period; wherein the probability that the abnormal user account uses images of the specified type is greater than or equal to a second probability threshold; a second proportion of the number of times the avatar of the user account is modified to the image of the specified type.

5. The method according to claim 4, characterized in that The obtaining, according to the characteristic data, an abnormal label of the user account includes: When at least two of the content feature information among the first total number of times, the first proportion, and the second proportion meet respective second conditions, determining the abnormal label of the user account as a first label; or, When any one of the content feature information of the first total number of times, the first proportion, and the second proportion satisfies the respective second conditions, obtaining a manual review result of the user account; if the manual review result indicates that the user account is the abnormal user account, determining the abnormal label of the user account as the first label; The first tag is used to indicate that the user account is the abnormal user account.

6. The method according to claim 2, characterized in that The content feature information includes text information, image information and video information; The obtaining, according to the characteristic data, an abnormal label of the user account includes: Acquire text features of the user account based on the text information through a multimodal model; Acquire visual features of the user account according to the image information and the video information through the multimodal model; fusing the text feature and the visual feature to obtain a fused feature of the user account; The user account is classified based on the fusion feature by using the multimodal model to obtain the abnormal label.

7. The method according to claim 1, characterized in that The obtaining of the exposure flow of the user account includes: During the third time period, if the personal information card of the user account is viewed by an unfamiliar user account, an exposure record is generated; Collecting statistics on the exposure records in the third time period to obtain an exposure flow of the user account; The number of exposure records in the exposure flow is the exposure amount of the user account.

8. The method according to claim 7, characterized in that If the personal information card of the user account is viewed by an unfamiliar user account, an exposure record is generated, including: If the stranger user account views the personal information card through a session, an exposure record is generated; or, If the stranger user account views the personal profile card through a friend request from the user account, an exposure record is generated; or, If the unfamiliar user account views the personal information card through the virtual business card of the user account, an exposure record is generated; or, If the stranger user account views the personal information card through a visiting account search, an exposure record is generated; or, If the unfamiliar user account views the personal information card by scanning the personal code, an exposure record is generated.

9. The method according to claim 1, characterized in that: After obtaining the abnormal label of the user account according to the characteristic data, the method further includes: Determining a plurality of abnormal user accounts from the plurality of user accounts according to the abnormal tags of the plurality of user accounts; Determining a processing priority of each of the multiple abnormal user accounts according to the exposure amount of each of the multiple abnormal user accounts, wherein the exposure amount is positively correlated with the processing priority; The multiple abnormal user accounts are processed in sequence according to the processing priority from high to low.

10. An abnormal account identification device, characterized in that: The device comprises: An exposure flow acquisition module, used to acquire an exposure flow of a user account, wherein the exposure flow is used to record exposure status of the user account; An exposure acquisition module, used to acquire the exposure corresponding to the user account according to the exposure flow, where the exposure is used to indicate the number of times the user account has been viewed; A feature data acquisition module, used to acquire feature data of the user account when the exposure amount is greater than or equal to a first threshold; wherein the feature data is used to record the behavior of the user account and content related to the user account; The abnormal label acquisition module is used to obtain the abnormal label of the user account according to the characteristic data, and the abnormal label is used to indicate whether the user account is an abnormal user account.

11. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the abnormal account identification method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the abnormal account identification method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product includes a computer program, which is stored in a computer-readable storage medium. The processor reads and executes the computer program from the computer-readable storage medium to implement the abnormal account identification method according to any one of claims 1 to 9.

Images