Abnormal subject identification method and device, equipment and storage medium

Abstract

The invention discloses an abnormal subject identification method and device, equipment and a storage medium, and belongs to the field of artificial intelligence. The method comprises the following steps: displaying a first exception identification task in a task management page; in a configuration page of the first exception identification task, receiving an operation of configuring a main body cluster for which the first exception identification task aims as a first main body cluster, the first main body cluster comprising a plurality of first main bodies, and the target of the first exception identification task being to identify an exception main body in the plurality of first main bodies; displaying first N subjects obtained by sorting the plurality of first subjects according to the feature values in a result page of the first anomaly recognition task; and displaying feature values corresponding to the first N main bodies, and receiving a sending auditing operation for at least one main body in the first N main bodies, and after the auditing is finished, displaying an auditing result that the at least one main body is an abnormal main body or a non-abnormal main body. The invention further provides a monitoring system for the abnormal main body.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to a method, device, equipment and storage medium for identifying an abnormal subject. Background Art

[0002] On various online platforms, there are abnormal entities whose behaviors are significantly different from those of ordinary users. For example, user accounts that use plug-ins to send a large number of friend requests, social media accounts that are suspected of cheating, etc.

[0003] The related technology has provided a method for identifying abnormal subjects. After the background technicians calculate the abnormal score of the subject through the related technology, they will associate the abnormal score with the subject. However, when the relevant personnel query, they can only obtain the abnormal score, and the relevant personnel obtain less information. Summary of the invention

[0004] The present application provides a method, apparatus, device and storage medium for identifying an abnormal subject. The present application provides a monitoring system for an abnormal subject, which supports displaying the sorting information and feature value information of the subject.

[0005] According to one aspect of the present application, a method for identifying an abnormal subject is provided, and the method includes the following contents.

[0006] The first anomaly identification task is displayed in the task management page;

[0007] receiving, in a configuration page of the first anomaly identification task, an operation of configuring a subject cluster targeted by the first anomaly identification task as a first subject cluster, the first subject cluster including a plurality of first subjects, and a goal of the first anomaly identification task being to identify an abnormal subject among the plurality of first subjects;

[0008] Displaying the first N subjects obtained by sorting the multiple first subjects according to feature values ​​on the result page of the first anomaly identification task, the first subject having at least one feature, and the feature value being the value of the feature of the first subject;

[0009] And, display the characteristic values ​​corresponding to the first N subjects respectively, where N is a positive integer;

[0010] A sending review operation for at least one of the first N subjects is received, and after the review is completed, a review result of whether the at least one subject is an abnormal subject or a non-abnormal subject is displayed.

[0011] According to another aspect of the present application, a device for identifying an abnormal subject is provided, and the device includes the following contents.

[0012] A display module, used to display the first abnormality identification task in the task management page;

[0013] a receiving module, configured to receive, in a configuration page of the first anomaly identification task, an operation of configuring a subject cluster targeted by the first anomaly identification task as a first subject cluster, wherein the first subject cluster includes a plurality of first subjects, and a goal of the first anomaly identification task is to identify an abnormal subject among the plurality of first subjects;

[0014] The display module is further configured to display, in a result page of the first abnormality identification task, the first N subjects obtained by sorting the multiple first subjects according to feature values, wherein the first subject has at least one feature, and the feature value is a value of the feature of the first subject;

[0015] The display module is further used to display the feature values ​​corresponding to the first N subjects in the result page of the first anomaly identification task, where N is a positive integer;

[0016] The receiving module is further used to receive a sending review operation for at least one of the first N subjects;

[0017] The display module is further used to display the audit result of whether the at least one subject is an abnormal subject or a non-abnormal subject after the audit is completed.

[0018] According to one aspect of the present application, a computer device is provided, the computer device comprising: a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the above-mentioned method for identifying an abnormal subject.

[0019] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the method for identifying an abnormal subject as described above.

[0020] According to another aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned abnormal subject identification method.

[0021] The beneficial effects brought about by the technical solution provided in the embodiments of the present application include at least the following.

[0022] The present application provides a monitoring system for abnormal subjects, which supports displaying abnormal identification tasks in the task management page, receiving configuration operations of subject clusters in the configuration page of abnormal identification tasks, and displaying the first N subjects sorted by feature values ​​in the result page of abnormal identification tasks. The first N subjects have a high suspicion of abnormality, and the feature values ​​corresponding to each of the first N subjects are also displayed in the result page to provide an intuitive perception of the degree of abnormality. The monitoring system also supports receiving a sending review operation for at least one of the first N subjects. After the review is completed, the review result that at least one subject is an abnormal subject or a non-abnormal subject is displayed.

[0023] Compared with related technologies, the above monitoring system supports the display of identified abnormal subjects and also displays the characteristic values ​​of the abnormal subjects. Operators who log in to the monitoring system can obtain more information.

[0024] In addition, the above-mentioned monitoring system supports operators to configure the subject clusters for monitoring anomaly identification tasks, view the identified abnormal subjects, obtain relevant abnormal information (feature values) of the abnormal subjects, and send the subjects for review. It integrates and schedules multiple process steps through an interface system (monitoring system), thereby improving the efficiency of operators in discovering abnormal features and abnormal subjects. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 It is a schematic diagram of the abnormal subject identification process provided by the relevant technology.

[0027] Figure 2 It is a schematic diagram of an abnormal subject identification process provided by an exemplary embodiment of the present application.

[0028] Figure 3 It is a schematic diagram of the principle of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application.

[0029] Figure 4 It is a flowchart of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application.

[0030] Figure 5 It is a flowchart of a method for identifying an abnormal subject provided by another exemplary embodiment of the present application.

[0031] Figure 6It is a schematic diagram of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application.

[0032] Figure 7 It is a flowchart of a method for identifying an abnormal subject provided by another exemplary embodiment of the present application.

[0033] Figure 8 It is a schematic diagram of a method for identifying an abnormal subject provided by another exemplary embodiment of the present application.

[0034] Fig. 9 It is a schematic diagram of the architecture of a detection system for abnormal subjects provided by an exemplary embodiment of the present application.

[0035] Fig.10 It is a schematic diagram of a task scheduling method provided by an exemplary embodiment of the present application.

[0036] Fig.11 is a flowchart of an anomaly detection algorithm provided by an exemplary embodiment of the present application.

[0037] Fig.12 is a schematic diagram of an anomaly detection algorithm provided by an exemplary embodiment of the present application.

[0038] Fig.13 It is a structural block diagram of an abnormal subject identification device provided by an exemplary embodiment of the present application.

[0039] Fig.14 It is a structural block diagram of a computer device provided by an exemplary embodiment of the present application.

[0040] Fig.15 It is a structural block diagram of a computer device provided by another exemplary embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0042] First, the nouns involved in the embodiments of the present application are briefly introduced.

[0043] Artificial Intelligence (AI): It is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0044] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. Basic artificial intelligence technologies generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, pre-trained model technology, operation / interaction systems, mechatronics, etc. Among them, pre-trained models are also called large models and basic models. After fine-tuning, they can be widely used in downstream tasks in various major directions of artificial intelligence. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0045] Abnormal subjects: refers to subjects whose behaviors on the network platform are significantly different from those of ordinary subjects. For example: user accounts that use plug-ins to send a large number of friend requests, short video accounts that are suspected of cheating, and chat groups that continuously send red envelopes that may involve illegal activities, etc.

[0046] Anomaly identification: that is, using a variety of algorithms (which may be statistical methods, deep learning methods, etc.) to evaluate the suspiciousness of the subject, determine whether the subject is involved in black and gray industries, whether it has malicious behavior, etc.

[0047] In related technologies, there are many methods and strategies for discovering and identifying abnormal subjects, which are mainly divided into the following core directions:

[0048] 1. Rule-based systems: This approach dates back to early technologies and relies on pre-set rules to catch malicious activity, such as sending repeated messages or multiple login attempts within a short period of time.

[0049] 2. Identification based on behavioral statistics: First, various behavioral features are counted to construct the user's behavior vector, and then these vectors are classified and analyzed. Typical algorithms in this type of method include decision trees, random forests, support vector machines (SVM), and Xgboost.

[0050] 3. Analysis based on behavior sequences: This approach emphasizes the importance of behavior patterns in identifying malicious behavior. For example, a common malicious behavior sequence pattern may include: first joining a chat group, then inviting others, issuing red envelopes, and posting text messages within 10 minutes. This approach usually involves encoding behaviors to form behavior sequences, and then applying appropriate sequence algorithms, such as LSTM (Long Short-Term Memory) or Transformers, to effectively identify users with malicious patterns.

[0051] 4. Social network graph-based strategy: This method constructs a user's social relationship graph from the perspective of a graph (or network). These graphs are represented by user accounts as nodes and the social connections between them as edges. Once there are known malicious users, a node classification model can be trained and further predictions and analysis can be performed on the entire network.

[0052] Although the technical methods provided by relevant technologies are effective in discovering and identifying abnormal entities on social platforms, they still have the following core problems:

[0053] 1. High computing resource requirements: Methods such as behavior sequence and graph models require a lot of computing resources to support. Especially in the scenario of large platforms, the scale of the graph may easily exceed billions of nodes and trillions of edges. This means that the training and prediction process of the graph model will consume a lot of computing power and storage space.

[0054] 2. Model opacity: Deep learning and graph models are often viewed as “black boxes”. This means they lack transparency and intuitive explanations. It is difficult to provide people with intuitive reasons or explanations for detected malicious or abnormal accounts.

[0055] 3. Lack of an integrated system framework: Most of the above methods focus on specific technical implementations rather than the overall system architecture. From the initial conception to the actual implementation of a solution, if there is no supporting system support, the time cost may be very high. This model is not only not conducive to rapid experimentation and iteration, but may also cause the development team to repeat work in the interface and integration with other systems, resulting in a waste of resources.

[0056] These limitations highlight the urgent need for the development of new technologies and strategies to better meet the challenges of malicious account identification on social platforms. With the rapid expansion of various businesses on social platforms (such as short videos, live broadcasts, e-commerce, etc.), the detection task of malicious entities faces unprecedented pressure. First, the types of malicious entities have increased from the initial user accounts to group numbers, short video accounts, short video dynamics and other forms. Second, the methods of malicious behavior are becoming more and more diverse, which requires continuous investment of resources to identify and respond to new malicious strategies. Both trends emphasize that the operation system must be efficient and able to flexibly respond to different entities to maximize operational efficiency.

[0057] In the related art, the process of identifying abnormal subjects includes: Figure 1 For a feature, the relevant technology will go through the following steps:

[0058] Finding data and features 101;

[0059] Writing SQL and sorting data 102;

[0060] Send the data to the audit station 103;

[0061] Auditors fish out audit data 104;

[0062] Save audit data 105;

[0063] Write SQL and feature tables 106;

[0064] The operator opens each system to view the data 107.

[0065] Although each process step seems simple, the overall operation efficiency is actually relatively low due to the need for daily execution and the large number of operators involved in such work.

[0066] Based on the need to solve the above-mentioned cumbersome process, this application provides an "abnormal subject monitoring system", which is positioned as an auxiliary tool for operations. Its core function is to realize automated operation and system integration. Among them, the advantages of automation are mainly reflected in the automatic scheduling of data tasks, the automatic extraction and association of audit results, and the sharing function of audit results. Integration is to centralize multiple portal systems and aggregate the tasks and audit data of all users, thereby reducing redundancy and duplication of work. Figure 2The user only needs to register the feature once in the system 201 (or the system will automatically register frequently used features), and all subsequent processes are automatically completed by the system background (system scheduling, data sorting, algorithm suggestions, storing the results of the algorithm suggestions in the result library, synchronizing to the audit library, and the audit desk extracting and auditing the data in the library). Users log in to the system to view the results as needed. Users can also log in to each portal system to view specific subject information. Compared with Figure 1 This process significantly simplifies time management through system scheduling; the tasks registered by the user are visible to other users, and the sharing scope can be controlled through permission management. This sharing of user tasks and audit data further optimizes Figure 1 , thereby achieving lower operating costs and higher work efficiency.

[0067] Figure 3 A schematic diagram showing the principles of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application is shown. Figure 3 A computer device 30 is shown, and the computer device 30 is used to perform the identification of abnormal subjects. In this application, subjects refer to various core elements in the network platform, such as user accounts, chat group numbers, short video accounts, and short video dynamics, etc. Abnormal subjects refer to subjects whose behaviors are significantly different from ordinary subjects, such as user accounts that use plug-ins to send a large number of friend requests, short video dynamics that are suspected of brushing likes, and chat group numbers that continuously send red envelopes that may involve illegal behaviors.

[0068] Figure 3 A task management page 31 is shown, which includes multiple anomaly identification tasks. The goal of an anomaly identification task is to identify an abnormal subject among multiple subjects. Figure 3 The task management page 31 shows an anomaly identification task 311 whose task type is single feature (SINGLE_FEATURE). The anomaly identification task 311 will perform abnormal subject identification based on the single feature. A query result button 312 is provided in the project column of the anomaly identification task 311.

[0069] Figure 3 The task management page 31 also shows an anomaly identification task 313 whose task type is multiple features (MULTIPLE_FEATURE). The anomaly identification task 313 will perform abnormal subject identification based on multiple features. A query result button 314 is provided in the project column of the anomaly identification task 313.

[0070] For single feature anomaly identification, in response to the query result button 312 receiving a trigger operation, a result page 32 is displayed. The result page 32 displays the first N subjects 321 obtained by sorting multiple subjects according to the value of the single feature, and displays the value 322 of the single feature corresponding to each of the first N subjects.

[0071] For multi-feature anomaly identification, in response to the query result button 314 receiving a trigger operation, a result page 33 will be displayed. The result page 33 displays the first N subjects 331 obtained by sorting the multiple subjects in descending order of anomaly scores, and displays the comprehensive feature values ​​332 corresponding to each of the first N subjects. For any subject in the first N subjects, the anomaly score of the subject has a positive correlation with the comprehensive feature value, that is, the larger the anomaly score, the higher the comprehensive feature value.

[0072] For any subject, the anomaly score is calculated based on multiple features of the subject, and the comprehensive feature value is calculated based on at least one abnormal feature of the subject.

[0073] It can be understood that the present application provides a monitoring system for abnormal subjects, which supports displaying abnormal subject identification tasks in the task management page, and displays the top N subjects sorted by feature values ​​in the result page of the abnormal identification task. The top N subjects have a higher suspicion of abnormality. The result page also displays the feature values ​​corresponding to each of the top N subjects to provide an intuitive perception of the degree of abnormality.

[0074] Compared with related technologies, the above monitoring system supports operators to log in to the system to view the identified abnormal subjects and obtain relevant abnormal information (feature values) of the abnormal subjects, thereby improving the efficiency of operators in discovering abnormal features and abnormal subjects.

[0075] In one embodiment, the computer device 30 is a terminal device. The device types of the terminal device include: at least one of a smart phone, a smart watch, a vehicle-mounted terminal, a wearable device, a smart TV, a tablet computer, an e-book reader, an MP3 player, an MP4 player, a laptop computer, and a desktop computer. The terminal device includes but is not limited to a mobile phone, a computer, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, etc.

[0076] In one embodiment, the above-mentioned method for identifying abnormal entities is also supported and run by a server. The server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0077] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the subject features involved in this application are all obtained with full authorization.

[0078] Moreover, when it comes to relevant information, the relevant information processors will follow the principles of legality, legitimacy and necessity, clarify the purpose, method and scope of relevant information processing, obtain the consent of the relevant information subjects, and take necessary technical and organizational measures to ensure the security of relevant information.

[0079] Figure 4 A flowchart of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application is shown. Figure 3 The computer device 30 shown is used for example to perform the method, which includes:

[0080] Step 420, displaying the first abnormality identification task in the task management page;

[0081] Subject refers to various core elements in the network platform, such as user accounts, chat group numbers, short video accounts, short video dynamics, etc. The present application provides a monitoring system for abnormal subjects, which can be applied to various business scenarios, such as social chat scenarios, short video scenarios, live broadcast scenarios, etc.

[0082] Abnormal subjects refer to subjects whose behaviors are significantly different from those of ordinary subjects, such as user accounts that use plug-ins to send a large number of friend requests, short video updates that are suspected of inflating likes, and chat group numbers that continuously send red envelopes that may be involved in illegal activities.

[0083] The anomaly identification task refers to a task of identifying an abnormal subject among multiple subjects based on subject features. Optionally, the types of anomaly identification tasks include single-feature type and multi-feature type. The single-feature type represents that abnormal subject identification is performed based on a single feature, and the multi-feature type represents that abnormal subject identification is performed based on multiple features.

[0084] Indicatively, if the subject is a user account, the subject characteristics include the user account login time, the number of user account friends, the user account level, etc. If the subject is a chat group number, the subject characteristics include the number of group members, the total number of group messages, the number of group red envelopes, etc. If the subject is a short video dynamic, the subject characteristics include the short video dynamic exposure time, the number of short video forwardings, the number of short video likes, etc.

[0085] In the embodiment of the present application, the task management page will display multiple abnormal identification tasks, the first abnormal identification task is one of the multiple abnormal identification tasks, and the goal of the first abnormal identification task is to identify abnormal subjects among multiple first subjects of the network platform. In the embodiment of the present application, the task management page will also display the task type of each abnormal identification task. Figure 3 , the task management page 31 shows multiple anomaly identification tasks and the task type (SINGLE_FEATURE / MULTIPLE_FEATURE) of each anomaly identification task.

[0086] Optionally, the first abnormality identification task is executed again every preset period in the background program. For example, the first abnormality identification task is executed once every hour, every day, or every week. The preset period can be configured by the operator, or it can be written into the background program as a fixed parameter and automatically executed by the background program. The background program executes the first abnormality task every preset period, so that the monitoring system of the present application has the characteristics of automation.

[0087] Step 440, receiving an operation of configuring the subject cluster targeted by the first anomaly identification task as a first subject cluster in the configuration page of the first anomaly identification task, where the first subject cluster includes a plurality of first subjects;

[0088] The goal of the first anomaly identification task is to identify an abnormal subject among multiple first subjects.

[0089] The configuration page of the first anomaly identification task includes a configuration interface for subject clusters. Subject clusters correspond to business scenarios. For example, for social platforms, subject clusters are user accounts or chat group numbers. For short video platforms, subject clusters are short video accounts or short video dynamics.

[0090] The monitoring system for abnormal subjects provided by the present application supports multiple business scenarios, each of which has at least one subject cluster. Multiple business scenarios correspond to multiple subject clusters, and each subject cluster includes multiple subjects. Generally speaking, an abnormal identification task is used to perform abnormal subject identification in a subject cluster. Therefore, through the configuration operation of the subject cluster, the abnormal subject identification of multiple business systems can be integrated, that is, the monitoring system provided by the present application will simultaneously support the abnormal subject identification of multiple business systems.

[0091] In one embodiment, in conjunction with reference Figure 6 In the configuration page 61, the subject cluster is configured through the "Account Field / Type" interface. Schematically, it is configured as "Social Account" through the "Account Field / Type" interface.

[0092] Step 460: displaying the first N subjects obtained by sorting the plurality of first subjects according to the feature values ​​on the result page of the first anomaly identification task, and displaying the feature values ​​corresponding to the first N subjects, where N is a positive integer;

[0093] In the embodiment of the present application, the first subject has at least one feature, and the feature value is the value of the feature of the first subject. The result page will display the first N subjects sorted by the feature value, and the feature values ​​corresponding to the first N subjects. The first N subjects are suspected of abnormality, and the feature value serves as an intuitive explanation of the suspicion of abnormality.

[0094] In an embodiment of the present application, in response to a result query button of the first abnormality identification task in the task management page receiving a trigger operation, a result page of the first abnormality identification task is displayed.

[0095] Step 480, receiving a sending audit operation for at least one of the first N subjects, and after the audit is completed, displaying the audit result of whether at least one subject is an abnormal subject or a non-abnormal subject.

[0096] In one embodiment, the result page in the above step 460 has displayed the first N subjects, and each of the N subjects corresponds to a send review button. In response to the review button receiving a trigger operation, the corresponding subject will be reviewed at the review desk, and the review desk will return the review result (abnormal subject or non-abnormal subject) to the monitoring system, and the monitoring system will display the review result of the corresponding subject on the result page.

[0097] In another embodiment, the result page in the above step 460 has displayed the first N subjects, and the result page displays an audit button for submitting the audit operation of the first N subjects at one time. In response to the audit button receiving a trigger operation, the first N subjects will be audited at the audit desk, and the audit desk will return the audit results (abnormal subjects or non-abnormal subjects) to the monitoring system, and the monitoring system will display the audit results on the result page.

[0098] In summary, the present application provides a monitoring system for abnormal subjects, which supports displaying abnormal subject identification tasks in the task management page, and displays the top N subjects sorted by feature values ​​in the result page of the abnormal identification task. The top N subjects have a higher suspicion of abnormality. The result page also displays the feature values ​​corresponding to each of the top N subjects to provide an intuitive perception of the degree of abnormality.

[0099] Compared with related technologies, the above monitoring system supports operators to log in to the system to view the identified abnormal subjects and obtain relevant abnormal information (feature values) of the abnormal subjects, thereby improving the efficiency of operators in discovering abnormal features and abnormal subjects.

[0100] Figure 5A flowchart of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application is shown. Figure 3 The computer device 30 shown is used for example to perform the method, which includes:

[0101] Step 510, displaying a first abnormality identification task in the task management page, where the first abnormality identification task is an abnormality identification task executed based on a single feature;

[0102] Subject refers to various core elements in the network platform, such as user accounts, chat group numbers, short video accounts, and short video dynamics, etc. Abnormal subject refers to a subject whose behavior is significantly different from that of an ordinary subject. In this embodiment, the first abnormal identification task refers to the task of identifying an abnormal subject based on a single feature among multiple subjects. Figure 6 , in the task management page 60 , an abnormality recognition task with a task type of single feature is displayed.

[0103] Step 520, receiving an operation of configuring the subject cluster targeted by the first exception identification task as a first subject cluster in the configuration page of the first exception identification task, where the first subject cluster includes a plurality of first subjects;

[0104] The monitoring system for abnormal subjects provided by the present application supports multiple business scenarios, each of which has at least one subject cluster. Multiple business scenarios correspond to multiple subject clusters, and each subject cluster includes multiple subjects. Generally speaking, an abnormal identification task is used to perform abnormal subject identification in a subject cluster. Therefore, through the configuration operation of the subject cluster, the abnormal subject identification of multiple business systems can be integrated, that is, the monitoring system provided by the present application will simultaneously support the abnormal subject identification of multiple business systems.

[0105] In one embodiment, in conjunction with reference Figure 6 In the configuration page 61, the subject cluster is configured through the "Account Field / Type" interface. Schematically, it is configured as "Social Account" through the "Account Field / Type" interface.

[0106] Step 530, receiving an operation of configuring the feature based on the first abnormality identification task as a target first feature in the configuration page of the first abnormality identification task;

[0107] In the embodiments of this application, Figure 6 A configuration button 602 is provided in the project column of the first abnormality identification task 601 in the task management page 60. In response to the configuration button 602 receiving a trigger operation, a configuration page 61 of the first abnormality identification task 601 will be displayed.

[0108] The configuration page 61 provides a feature configuration column 611, which receives an operation of configuring the feature based on the first anomaly identification task 601 as a target first feature. In one embodiment, the configured target first feature is one of the multiple first features corresponding to the configured first subject cluster.

[0109] In one embodiment, the configuration page 61 also supports at least one of the following configuration operations.

[0110] (1) The configuration page 61 receives N's configuration operation;

[0111] In the result page of the anomaly recognition task, the top N entities sorted by feature values ​​will be displayed. The configuration page provides a configuration interface for the sorting threshold N.

[0112] (2) The configuration page 61 receives a configuration operation for configuring the sorting mode to ascending or descending order;

[0113] In the result page of the anomaly identification task, the top N entities sorted by feature values ​​will be displayed. The configuration page provides a configuration interface for the sorting method. The sorting method can be ascending or descending.

[0114] (3) Configuration operation of the filtering conditions for receiving feature values.

[0115] Before using the feature values ​​to identify abnormal subjects, the acquired feature values ​​are also filtered.

[0116] Step 540: displaying the first N subjects obtained by sorting the plurality of first subjects according to the values ​​of the target first feature on the result page of the first anomaly identification task, and displaying the values ​​of the target first feature corresponding to each of the first N subjects;

[0117] In the embodiments of this application, Figure 6 A result query button 603 is provided in the project column of the first abnormality identification task 601 in the task management page 60. In response to the result query button 603 receiving a trigger operation, a result page 62 of the first abnormality identification task 601 will be displayed.

[0118] The result page 62 displays the first N subjects 621 obtained by sorting the multiple first subjects according to the values ​​of the target first feature, and displays the values ​​of the target first feature 622 corresponding to each of the first N subjects. For example, the result page 62 displays the top 20 short video accounts in terms of "exposure time".

[0119] Step 550, receiving a sending audit operation for at least one of the first N subjects, and after the audit is completed, displaying the audit result of whether at least one subject is an abnormal subject or a non-abnormal subject.

[0120] In one embodiment, the result page has displayed the first N subjects, each of the N subjects has a corresponding send review button, and / or the result page displays a review button for submitting the review operation of the first N subjects at one time. In response to the review button receiving a trigger operation, the corresponding subject will be reviewed at the review desk, and the review desk will return the review result (abnormal subject or non-abnormal subject) to the monitoring system, and the monitoring system will display the review result of the corresponding subject on the result page.

[0121] In summary, the monitoring system provided by the present application is logically divided into single-feature anomaly recognition and multi-feature anomaly recognition. Under single-feature anomaly recognition, the single feature on which it is based is obtained through configuration, and the result page will also display the sorting results sorted by the single feature, as well as the feature value of the single feature. The sorting results are convenient for operators to know the abnormal subject of the head, and the feature value is convenient for operators to perceive the degree of abnormality of the subject. For example, the feature is the exposure time of a short video. The value of the subject ranked first among the top N subjects is "2381393.68" seconds, and the duration of a day is more than 80,000 seconds. Obviously, the degree of abnormality of this feature is relatively large.

[0122] In addition, the monitoring system supports configuring multiple subject clusters in multiple business scenarios, that is, the monitoring system supports multiple business scenarios. Different subject clusters have their own subjects and characteristics, and each abnormal identification task can select a target subject cluster from them. The monitoring system can significantly simplify the abnormal subject identification process in multiple business scenarios, achieving lower operating costs and higher work efficiency.

[0123] Figure 7 A flowchart of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application is shown. Figure 3 The computer device 30 shown is used for example to perform the method, which includes:

[0124] Step 710, displaying a first abnormality recognition task in the task management page, where the first abnormality recognition task is an abnormality recognition task executed based on multiple features;

[0125] Subject refers to various core elements in the network platform, such as user accounts, chat group numbers, short video accounts, and short video dynamics, etc. Abnormal subject refers to a subject whose behavior is significantly different from that of an ordinary subject. In this embodiment, the first abnormal identification task refers to the task of identifying abnormal subjects based on multiple features among multiple subjects. Figure 8 , in the task management page 80 , it is displayed that the task type is an abnormality recognition task of the multi-feature type.

[0126] In the embodiments of this application, Figure 8A configuration button 802 is provided in the project column of the first abnormality identification task 801 in the task management page 80. In response to the configuration button 802 receiving a trigger operation, the configuration page of the first abnormality identification task 801 will be displayed.

[0127] Step 720, receiving an operation of configuring the subject cluster targeted by the first exception identification task as a first subject cluster in the configuration page of the first exception identification task, where the first subject cluster includes a plurality of first subjects;

[0128] The monitoring system for abnormal subjects provided by the present application supports multiple business scenarios, each of which has at least one subject cluster. Multiple business scenarios correspond to multiple subject clusters, and each subject cluster includes multiple subjects. Generally speaking, an abnormal identification task is used to perform abnormal subject identification in a subject cluster. Therefore, through the configuration operation of the subject cluster, the abnormal subject identification of multiple business systems can be integrated, that is, the monitoring system provided by the present application will simultaneously support the abnormal subject identification of multiple business systems.

[0129] In one embodiment, the multiple features used in the multi-feature anomaly recognition are the features of the corresponding subject cluster, and the multiple features are all the features of the corresponding subject cluster or multiple feature dimensions obtained through screening. In the configuration page, the subject cluster is configured through the "Account Field / Type" interface, and schematically, it is configured as "social account" through the "Account Field / Type" interface.

[0130] Optionally, the configuration page also supports at least one of the following configuration operations.

[0131] (1) The configuration page receives N's configuration operation;

[0132] In the result page of the anomaly recognition task, the top N entities sorted by feature values ​​will be displayed. The configuration page provides a configuration interface for the sorting threshold N.

[0133] (2) The configuration page receives configuration operations for the maximum number of features used by the anomaly detection algorithm;

[0134] For multi-feature abnormal subject identification, for a subject, an abnormality score of the subject will be calculated using an anomaly detection algorithm based on multiple features of the subject. The details of the anomaly detection algorithm will be introduced below. In the embodiment of the present application, a configuration interface for the maximum number of features used by the anomaly detection algorithm will be opened, and the operator will configure the maximum number of features used.

[0135] (3) Receive configuration operations for the supplementary algorithm of the anomaly detection algorithm.

[0136] The anomaly detection algorithm will be combined with the supplementary algorithm to participate in the calculation. The configuration page provides a configuration interface for the supplementary algorithm. The supplementary algorithm can be Isolation-Forest, etc.

[0137] Step 730, obtaining multiple first entities;

[0138] A plurality of first subjects for which abnormal subject identification is to be performed indicated by the first abnormal identification task is obtained.

[0139] Step 740, for any first subject among the multiple first subjects, based on the values ​​of the multiple features of the first subject and according to the anomaly detection algorithm, calculate an anomaly score of the first subject;

[0140] For any first subject, an anomaly score is generated, and the higher the anomaly score is, the more abnormal the subject is. For multiple first subjects, multiple anomaly scores corresponding to each other are generated.

[0141] Step 750: displaying the first N subjects obtained by sorting the plurality of first subjects in descending order of the anomaly scores on the result page of the first anomaly identification task, and displaying the comprehensive feature values ​​corresponding to the first N subjects, and for any first subject among the first N subjects, the anomaly score of the first subject has a positive correlation with the comprehensive feature value;

[0142] In the embodiments of this application, Figure 8 A result query button 803 is provided in the project column of the first abnormality identification task 801 in the task management page 80. In response to the result query button 803 receiving a trigger operation, a result page 81 of the first abnormality identification task 801 will be displayed.

[0143] The result page 81 displays the first N subjects 811 obtained by sorting the multiple first subjects according to the comprehensive feature values, and displays the comprehensive feature values ​​812 corresponding to each of the first N subjects.

[0144] In fact, the result page 81 will be sorted according to the multiple anomaly scores corresponding to the multiple subjects, and the subjects with higher anomaly scores will be ranked higher. This application avoids displaying (or only displaying) the anomaly scores on the interface. The anomaly scores are the results of the algorithm and cannot provide an easier to understand degree of anomaly. Therefore, the comprehensive feature values ​​will be displayed on the result page 81. The comprehensive feature values ​​are generated based on the real feature values ​​and can intuitively display the degree of anomaly. Optionally, the comprehensive feature values ​​are generated based on abnormal features, and the abnormal features can be identified by an anomaly detection algorithm. This will be pointed out when introducing the anomaly detection algorithm below.

[0145] Step 760, receiving a sending audit operation for at least one of the first N subjects, and after the audit is completed, displaying the audit result of whether at least one subject is an abnormal subject or a non-abnormal subject.

[0146] In one embodiment, the result page has displayed the first N subjects, each of the N subjects has a corresponding send review button, and / or the result page displays a review button for submitting the review operation of the first N subjects at one time. In response to the review button receiving a trigger operation, the corresponding subject will be reviewed at the review desk, and the review desk will return the review result (abnormal subject or non-abnormal subject) to the monitoring system, and the monitoring system will display the review result of the corresponding subject on the result page.

[0147] In summary, the monitoring system provided by this application is logically divided into single-feature anomaly recognition and multi-feature anomaly recognition. Under multi-feature anomaly recognition, the anomaly score will be calculated based on multiple features, and the result page will also display the sorting results sorted by the anomaly score, as well as the comprehensive feature values. The sorting results are convenient for operators to know the abnormal subject of the head. Compared with the anomaly score, the comprehensive feature value is convenient for operators to directly perceive the degree of abnormality of the subject.

[0148] In addition, the monitoring system supports configuring multiple subject clusters in multiple business scenarios, that is, the monitoring system supports multiple business scenarios. Different subject clusters have their own subjects and characteristics, and each abnormal identification task can select a target subject cluster from them. The monitoring system can significantly simplify the abnormal subject identification process in multiple business scenarios, achieving lower operating costs and higher work efficiency.

[0149] based on Figure 5 and Figure 7 The method for identifying the abnormal subject shown, the result page of the first abnormality identification task will also display at least one of the following contents.

[0150] (1) Display the abnormal causes corresponding to the first N subjects;

[0151] An abnormality cause column is displayed in the result page, and the abnormality cause column will display the abnormality cause corresponding to each of the first N subjects. In one embodiment, if the first abnormality identification task is an abnormality identification task performed based on a single feature, the abnormality cause column is empty. If the first abnormality identification task is an abnormality identification task performed based on multiple features, then for a first subject among the first N subjects, the abnormality cause column will display that the abnormality cause of an abnormal feature of the first subject is a higher probability of the left tail or a higher probability of the right tail. The display content of this abnormality cause is related to the abnormality detection algorithm, which will be introduced below.

[0152] It should be noted that, since the anomaly detection algorithm provided by this application has good interpretability, the cause of the anomaly at the algorithm level can be displayed on the page.

[0153] (2) displaying the abnormal history corresponding to each of the first N subjects, where the abnormal history includes at least one of the historical abnormal characteristics of the first subject and the abnormal number of times of the historical abnormal characteristics;

[0154] An abnormal history column is displayed on the result page. For any first subject among the first N subjects, if the subject is determined to be an abnormal subject in the historical abnormal identification, the abnormal history column will display at least one of the historical abnormal features of the subject and the abnormal number of historical abnormal features. For example, 2 types of features have been hit, and the 2 types of features have been used as abnormal features 3 times in total.

[0155] (3) displaying multiple query entries, each query entry is used to jump to a corresponding information query system to query information of a first subject among the first N subjects, the multiple query entries correspond one to one with the multiple information query systems, and different information query systems are used to query different information of the first subject;

[0156] Multiple query entrances are displayed on the result page, each query entrance is used to jump to the corresponding information query system to query the information of the current first subject, and different information query systems are used to query different information of the first subject. For example, for subject 1, query entrances of information query systems A, B, C and D are provided; for subject 2, query entrances of information query systems A, B, C and D are also provided; for subject 3, query entrances of information query systems A, B, C and D are also provided.

[0157] For subject 1, by clicking on the information query system A corresponding to subject 1, the A-side information of subject 1 will be queried, and by clicking on the information query system B corresponding to subject 1, the B-side information of subject 1 will be queried.

[0158] It can be understood that, by providing jump interfaces of multiple information query systems, the abnormal subject monitoring system provided by the present application centrally connects to multiple information query systems, thereby speeding up the query of subject information.

[0159] (4) displaying an audit entry, which is used to jump to the audit desk to review whether the first subject is an abnormal subject or a non-abnormal subject;

[0160] The result page displays an audit entry, which is used to jump to the audit desk to audit at least one of the first N subjects. After the audit is completed, the result page will display the audit result of whether it is an abnormal subject. Optionally, the result page supports auditing one subject at a time or multiple subjects at a time.

[0161] In one embodiment, N audit entries are displayed, and the N audit entries correspond one-to-one to the first N subjects. The audit entry is used to jump to the audit station to audit the corresponding first subject.

[0162] There are multiple audit entrances displayed on the result page. Each of the first N subjects has a corresponding audit entrance. The audit entrance is used to jump to the audit desk to audit the corresponding subject. After the audit is completed, the result page will display the audit result of whether it is an abnormal subject.

[0163] It is understandable that the monitoring system is connected to the audit desk. By providing a jump interface of the audit desk, the monitoring system not only supports rapid audit of suspicious subjects, but also allows rapid audit of multiple suspicious subjects obtained through aggregation.

[0164] Overall system framework.

[0165] This application provides a monitoring system for abnormal subjects. The overall design framework of the system is shown in Fig. 9 . In the selection of components, this application adopts an open source framework that is generally recognized and widely used in the industry. SpringBoot is used in the background, and the front end is developed based on Vue. In terms of scheduled task scheduling, this application chooses the xxl-job scheduling system. At the same time, for different task types, this application is combined with external systems: for single-feature anomaly recognition tasks, this application integrates TDW and SuperSQL, and for multi-feature anomaly recognition tasks, this application is combined with the Tai Chi system to drive the execution of comprehensive feature algorithms.

[0166] The finite state machine of the task.

[0167] In the embodiment of the present application, the background program will execute the abnormality identification task at a preset interval period. The execution of the scheduled task depends on the rotation of the state machine. Therefore, the present application designs a finite state machine for each registered abnormality identification task, such as Fig.10 As shown. In the state machine, firstly, task submission 1001 is performed, then task start 1002 is performed, and data preparation stage 1003 is entered. After data preparation is completed, task 1004 is performed. If the preparation fails in data preparation stage 1003, data acquisition is attempted again. If task 1004 fails to be executed, task execution is attempted again. If task 1004 is executed successfully, the data of the next partition is waited for. The waiting interval is a preset interval period. The data of the next partition can be the data of the next hour, the data of the next day, the data of the next week, etc.

[0168] Business system associated callback.

[0169] During the use of the monitoring system, this application is associated with multiple other business systems. Most of these associations are for data query, and only need to jump through the link. However, the interaction with the audit desk is slightly special: in addition to transmitting data to the audit desk, the monitoring system also needs to obtain the audit results from the audit desk and display the audit results on the result page. Fig. 9 To achieve this function, this application deploys a Pulsar Client in the background, which is specifically used to consume the result data message queue reported by the audit platform, and then read the audit results and write them back to the database.

[0170] The following introduces the anomaly detection algorithm used in multi-feature anomaly recognition.

[0171] Fig.11 A flowchart of a method for identifying an abnormal subject provided by an exemplary embodiment of the present application is shown. The method can be Figure 3 The method is executed by the computer device 30 shown, and may also be executed by a server, which is not limited in the present application. The method includes:

[0172] Step 1110, obtaining a first subject in the network platform, where the first subject has multiple features;

[0173] The anomaly detection algorithm provided in the present application will generate respective anomaly scores for respective first subjects. Each first subject has a plurality of features.

[0174] Step 1120, for any one of the multiple features, based on the value of the first subject in the feature, combined with the left cumulative distribution function corresponding to the feature, obtain a left tail probability; determine to obtain multiple left tail probabilities corresponding to the first subject in the multiple features respectively, wherein the input of the left cumulative distribution function is the feature value, and the output is the probability that the feature value is greater than the multiple historical feature values;

[0175] Assume that there are d-dimensional features. The first subject to perform anomaly score calculation is X i , for the j-th dimension feature, the obtained left tail probability is expressed as: in is the left-tail cumulative distribution function for the j-th dimension feature. For the j-th dimension feature, the obtained right-tail probability is expressed as: in is the right-tailed cumulative distribution function for the j-th dimension feature.

[0176] It is understandable that if is greater than the left tail probability threshold, indicating that the first subject is X i The j-th dimension feature of is an abnormal feature; or, if is greater than the right tail probability threshold, indicating that the first subject is X iThe j-th dimension feature of is an abnormal feature; or, if is greater than the probability threshold, it means that the first subject is X i The j-th dimension feature of is the abnormal feature.

[0177] In one embodiment, the left and right tail cumulative distribution functions of the j-th dimension feature are fitted based on the values ​​of multiple historical features corresponding to the j-th dimension feature of multiple historical sample subjects.

[0178] For example, there are n historical sample subjects whose historical feature values ​​of the j-th dimension feature are A split point z is sampled (or set) from it, and the value of the split point z is greater than the number of n historical feature values ​​divided by n to obtain a probability value corresponding to the split point z. Multiple samplings are performed to obtain multiple probability values ​​corresponding to multiple split points z. The value of the split point z is used as input and the probability value is used as output to fit the left-tailed cumulative distribution function.

[0179] Similarly, there are n historical sample subjects whose historical feature values ​​for the j-th dimension feature are A split point z is sampled (or set) from it, and the value of the split point z is less than the number of n historical feature values ​​divided by n to obtain another probability value corresponding to the split point z. Multiple samplings are performed to obtain multiple probability values ​​corresponding to multiple split points z. The value of the split point z is used as input and the probability value is used as output to fit the right-tailed cumulative distribution function.

[0180] The fitted left and right tail cumulative distribution functions are expressed as follows:

[0181]

[0182]

[0183] in, Characterizes when z is greater than or equal to When , the value is 1; Characterizes when z is less than or equal to , the value is 1.

[0184] Step 1130, based on the value of the first subject in the feature, combined with the right cumulative distribution function corresponding to the feature, obtain the right tail probability; determine to obtain multiple right tail probabilities corresponding to the first subject in multiple features, wherein the input of the right cumulative distribution function is the feature value, and the output is the probability that the feature value is less than the multiple historical feature values;

[0185] The right tail probability has been introduced in the above step 1120 and will not be repeated here.

[0186] Step 1140, concatenating multiple left tail probabilities and multiple right tail probabilities to obtain an embedding vector;

[0187] In the embodiment of the present application, assuming that the dimension of the feature is d, the dimension of the concatenated embedding vector is 2d.

[0188] Step 1150: input the embedding vector into the neural network model to predict the anomaly score of the first subject.

[0189] In an embodiment of the present application, the embedding vector is input into a fully connected neural network to predict the abnormal score of the first subject. Schematically, the fully connected neural network includes two hidden layers, and the number of neural units included in the first hidden layer is the same as the dimension of the multiple features, that is, the number of neural units included in the first hidden layer is d, and the number of neural units included in the second hidden layer is a preset value (such as 256).

[0190] In one embodiment, the embedding vector is input into an input layer, a first hidden layer, a second hidden layer, and an output layer having a cascade relationship, and an abnormality score of the first subject is predicted.

[0191] In summary, the above embodiments provide detailed information about the anomaly detection algorithm. The anomaly detection algorithm introduced above has good interpretability. The left tail probability and / or right tail probability can measure the degree of abnormality of a feature. The higher the probability, the higher the degree of abnormality. The above anomaly detection algorithm supports displaying the cause of the abnormality at the algorithm level on the interface (higher left tail probability / higher right tail probability).

[0192] Moreover, most of the data on the network platform conform to a specific probability distribution rather than a random distribution. These data usually conform to long-tail distributions such as Lognorm distribution or Gama distribution. Therefore, anomaly detection algorithms based on probability distribution can better fit the actual data background of the application scenario.

[0193] Furthermore, the anomaly detection algorithm provided by the above-mentioned embodiment avoids common problems in deep learning, such as the need for a large amount of computing resources, the reliance on a large amount of labeled data, and the lack of model interpretability.

[0194] Fig.11 Further discussion of the beneficial effects of the illustrated anomaly detection algorithm.

[0195] In an abandoned model construction method, for a subject, multiple left-tail probabilities corresponding to multiple features are accumulated to obtain the left-tail probability of the subject; multiple right-tail probabilities corresponding to multiple features are accumulated to obtain the right-tail probability of the subject; and the maximum value of the left-tail probability and the right-tail probability of the subject is used as the abnormal score of the subject. This construction method cannot accurately detect abnormal subjects.

[0196] If we consider the two features of posting social updates and using public accounts, a user account that frequently posts social updates and browses public accounts a lot is more likely to be identified as abnormal by the model built by the above method. However, in fact, some abnormal accounts may be unusually active in posting social updates, but have relatively low views on public accounts. Such accounts are difficult to be detected as abnormal accounts by the model built by the above method.

[0197] Therefore, the anomaly detection algorithm of this application will concatenate the left-tail probabilities and right-tail probabilities corresponding to multiple features to obtain an embedded vector. Based on the embedded vector, the anomaly score is predicted using a neural network model. Using a neural network model instead of a single accumulation or maximum value operation can capture the internal relationship between probabilities, and the generated anomaly score is more accurate.

[0198] based on Fig.11 In an optional embodiment, the left and right cumulative distribution functions will be fitted through an independent fitting step, which step includes: for any one of the multiple features, based on multiple historical feature values ​​of the feature of multiple historical normal subjects, fitting the left and right cumulative distribution functions corresponding to the feature, and the multiple historical normal subjects correspond one to one to the multiple historical feature values.

[0199] In this step, the accumulated whitelist data (historical normal samples) are used to fit the distribution, which effectively reduces the distribution range of the features and thus more keenly captures abnormal phenomena.

[0200] based on Fig.11 In an optional embodiment, the following steps are also included:

[0201] 1. For any one of the multiple features, calculate the skewness coefficient corresponding to the feature;

[0202] In the embodiment of the present application, the skewness coefficient is calculated after fitting the left and right cumulative distribution functions of the feature. Assume that there are n historical sample subjects whose historical feature values ​​of the j-th dimension feature are Calculate the average value of n historical feature values Then calculate the skewness coefficient γ of the j-th dimension feature j . Optionally, the skewness coefficient γ j The calculation method is as follows:

[0203]

[0204] 2. When the skewness coefficient is less than zero, the left-tail probability of the first subject corresponding to the feature is included in the accumulation. When the skewness coefficient is greater than or equal to zero, the right-tail probability of the first subject corresponding to the feature is included in the accumulation.

[0205] 3. Repeat the above steps for multiple features and accumulate the adaptive tail probability;

[0206] The calculation method of the adaptive tail probability based on step 2 and step 3 is expressed by the following formula:

[0207]

[0208] Among them, 1{γ j <0} characterizes when γ j <0, the value is 1; 1{γ j ≥0} represents when γ j When ≥0, the value is 1. Characterizes the left cumulative distribution function, Characterizes the right cumulative distribution function, The first subject X that is currently performing the anomaly score calculation i The feature value in the jth dimension includes d feature dimensions in total.

[0209] Fig.11 The illustrated step 1140 may be replaced by:

[0210] 4. Concatenate multiple left tail probabilities, multiple right tail probabilities, and adaptive tail probabilities to obtain an embedding vector.

[0211] In summary, the above embodiment also calculates an adaptive tail probability, and combines the adaptive tail probability to predict the abnormal score. The adaptive tail probability avoids the extreme use of only the left tail probability or only the right tail probability. The adaptive tail probability is obtained by integrating the left and right tail probabilities, and further combined with the adaptive tail probability for prediction, which can improve the accuracy of the predicted abnormal score.

[0212] Fig.12 A schematic diagram of an anomaly detection algorithm provided by an exemplary embodiment of the present application is shown.

[0213] Fig.12 Part (A) shows the feature values ​​of multiple historical subjects in multiple features. A rectangular box represents a historical subject, and multiple small circles in a rectangular box represent multiple feature values ​​of the historical subject.

[0214] Fig.12The upper part of part (B) shows the distribution of multiple historical feature values ​​under one feature dimension. For example, for "exposure time", there are feature values ​​of exposure time 3h, exposure time 5h, and exposure time 7h. There are 10 historical subjects with an exposure time of 3h (i.e., column A in the figure), 25 historical subjects with an exposure time of 5h (i.e., column B in the figure), and 15 historical subjects with an exposure time of 7h (i.e., column C in the figure). Fig.12 The lower part of part (B) fits the probability curve of the feature value, where the horizontal axis is the feature value and the vertical axis is the probability of obtaining the feature value.

[0215] Fig.12 The upper part of part (C) shows two probability value curves corresponding to the two types of features of the future subject (the subject performing anomaly recognition), with the horizontal axis being the feature value and the vertical axis being the probability of obtaining the feature value. In a probability curve, a straight line is drawn parallel to the vertical axis, and the left area enclosed by the straight line and the probability curve represents the left tail probability, and the right area enclosed by the straight line and the probability curve represents the right tail probability. Fig.12 The lower half of part (C) shows the embedded vector obtained by concatenating multiple left-tail probabilities and multiple right-tail probabilities. A rectangular box represents a subject, and multiple circles on the left side of the rectangular box represent multiple left-tail probabilities of multiple features. The multiple circles on the right side of the rectangular box represent multiple right-tail probabilities of multiple features.

[0216] Fig.12 Part (D) shows the prediction framework, which inputs the embedding vector of a future subject (the subject that performs anomaly recognition) into the input layer, the first hidden layer of the fully connected neural network, the second hidden layer of the fully connected neural network and the output layer with a cascade relationship to predict the anomaly score of the future subject.

[0217] Fig.13 : is a structural block diagram of an abnormal subject identification device provided by an exemplary embodiment of the present application, the device comprising:

[0218] Display module 1301, used to display the first abnormality identification task in the task management page;

[0219] A receiving module 1302 is configured to receive, in a configuration page of a first abnormality identification task, an operation of configuring a subject cluster targeted by the first abnormality identification task as a first subject cluster, where the first subject cluster includes a plurality of first subjects, and a goal of the first abnormality identification task is to identify an abnormal subject from the plurality of first subjects;

[0220] The display module 1301 is further used to display the first N subjects obtained by sorting the multiple first subjects according to the feature value in the result page of the first abnormality identification task, where the first subject has at least one feature, and the feature value is the value of the feature of the first subject;

[0221] The display module 1301 is also used to display the feature values ​​corresponding to the first N subjects in the result page of the first anomaly identification task, where N is a positive integer;

[0222] The receiving module is further used to receive a sending review operation for at least one of the first N subjects;

[0223] The display module is also used to display the audit result of whether at least one subject is an abnormal subject or a non-abnormal subject after the audit is completed.

[0224] In an optional embodiment, the first anomaly identification task is an anomaly identification task performed based on a single feature. The receiving module 1302 is also used to receive an operation of configuring the feature on which the first anomaly identification task is based as the target first feature in the configuration page of the first anomaly identification task. The display module 1301 is also used to display the first N subjects obtained by sorting the multiple first subjects according to the value of the target first feature in the result page of the first anomaly identification task, and display the value of the target first feature corresponding to each of the first N subjects.

[0225] In an optional embodiment, the first anomaly identification task is an anomaly identification task performed based on multiple features. The device also includes a processing module 1303. The processing module 1303 is used to obtain multiple first subjects; for any one of the multiple first subjects, based on the values ​​of multiple features of the first subject, according to the anomaly detection algorithm, the anomaly score of the first subject is calculated. The display module 1301 is also used to display the first N subjects obtained by sorting the multiple first subjects in order from large to small according to the anomaly scores in the result page of the first anomaly identification task, and to display the comprehensive feature values ​​corresponding to each of the first N subjects. For any one of the first N subjects, the anomaly score of the first subject has a positive correlation with the comprehensive feature value.

[0226] In an optional embodiment, the display module 1301 is further configured to perform at least one of the following:

[0227] Display the abnormal reasons corresponding to the first N subjects;

[0228] Displaying the abnormal history corresponding to each of the first N subjects, where the abnormal history includes at least one of the historical abnormal feature of the first subject and the abnormal number of the historical abnormal feature;

[0229] Displaying multiple query entrances, each query entrance is used to jump to a corresponding information query system to query information of a first subject among the first N subjects, the multiple query entrances correspond to the multiple information query systems one by one, and different information query systems are used to query different information of the first subject;

[0230] An audit entry is displayed, and the audit entry is used to jump to the audit desk to audit whether the first subject is an abnormal subject or a non-abnormal subject;

[0231] The first abnormality identification task is executed again every preset period in the background program.

[0232] In an optional embodiment, the first abnormality recognition task is an abnormality recognition task performed based on multiple features. The display module 1301 is further used to display, for a first subject among the first N subjects, that the abnormality cause of an abnormal feature of the first subject is a higher probability of a left tail or a higher probability of a right tail.

[0233] In an optional embodiment, the receiving module 1302 is further configured to perform at least one of the following in the configuration page of the first abnormality identification task:

[0234] Receive N's configuration operation;

[0235] Receive a configuration operation for configuring the sorting mode to ascending or descending;

[0236] Receives configuration operations for filtering conditions of feature values.

[0237] In an optional embodiment, the receiving module 1302 is further configured to perform at least one of the following in the configuration page of the first abnormality identification task:

[0238] Receive N's configuration operation;

[0239] Receives a configuration operation for the maximum number of features used by an anomaly detection algorithm;

[0240] Receives configuration operations for algorithms that complement the anomaly detection algorithm.

[0241] In an optional embodiment, the processing module 1303 is further used to obtain a left tail probability for any one of the multiple features based on the value of the first subject in the feature and in combination with the left cumulative distribution function corresponding to the feature; determine to obtain multiple left tail probabilities corresponding to the first subject in the multiple features respectively, wherein the input of the left cumulative distribution function is the feature value, and the output is the probability that the feature value is greater than the multiple historical feature values;

[0242] The processing module 1303 is further used to obtain a right tail probability based on the value of the first subject in the feature and the right cumulative distribution function corresponding to the feature; determine to obtain multiple right tail probabilities corresponding to the first subject in multiple features, wherein the input of the right cumulative distribution function is the feature value, and the output is the probability that the feature value is less than the values ​​of multiple historical features;

[0243] The processing module 1303 is further used to concatenate the multiple left tail probabilities and the multiple right tail probabilities to obtain an embedding vector;

[0244] The processing module 1303 is further used to input the embedding vector into the neural network model to predict the anomaly score of the first subject.

[0245] In an optional embodiment, the processing module 1303 is further configured to input the embedding vector into a fully connected neural network to predict an anomaly score of the first subject.

[0246] In an optional embodiment, the fully connected neural network includes two hidden layers, the number of neural units included in the first hidden layer is the same as the dimension of the multiple features, and the number of neural units included in the second hidden layer is a preset value. The processing module 1303 is also used to input the embedded vector into the input layer, the first hidden layer, the second hidden layer and the output layer having a cascade relationship, and predict the abnormal score of the first subject.

[0247] In an optional embodiment, the processing module 1303 is also used to fit the left and right cumulative distribution functions corresponding to any one of the multiple features based on multiple historical feature values ​​of the feature by multiple historical normal subjects, and the multiple historical normal subjects correspond one-to-one to the multiple historical feature values.

[0248] In an optional embodiment, the processing module 1303 is further configured to calculate a skewness coefficient corresponding to any one of the multiple features;

[0249] The processing module 1303 is further configured to, when the skewness coefficient is less than zero, include the left tail probability of the first subject corresponding to the feature in the accumulation, and when the skewness coefficient is greater than or equal to zero, include the right tail probability of the first subject corresponding to the feature in the accumulation;

[0250] The processing module 1303 is further used to repeatedly perform the above steps on multiple features to accumulate and obtain an adaptive tail probability;

[0251] The processing module 1303 is further used to concatenate multiple left tail probabilities and multiple right tail probabilities to obtain an embedding vector, including:

[0252] The processing module 1303 is further used to concatenate multiple left tail probabilities, multiple right tail probabilities and the adaptive tail probability to obtain an embedding vector.

[0253] In summary, the present application provides a monitoring system for abnormal subjects, which supports displaying abnormal subject identification tasks in the task management page, and displays the top N subjects sorted by feature values ​​in the result page of the abnormal identification task. The top N subjects have a higher suspicion of abnormality. The result page also displays the feature values ​​corresponding to each of the top N subjects to provide an intuitive perception of the degree of abnormality.

[0254] Compared with related technologies, the above monitoring system supports operators to log in to the system to view the identified abnormal subjects and obtain relevant abnormal information (feature values) of the abnormal subjects, thereby improving the efficiency of operators in discovering abnormal features and abnormal subjects.

[0255] Please refer to Fig.14 , which shows a block diagram of a computer device 1400 provided by an exemplary embodiment of the present application. The computer device 1400 may be a portable mobile terminal, such as a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV). The computer device 1400 may also be called a user device, a portable terminal, a head-mounted computer device, or other names.

[0256] Typically, the computer device 1400 includes a processor 1401 and a memory 1402 .

[0257] The processor 1401 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1401 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1401 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1401 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1401 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0258] The memory 1402 may include one or more computer-readable storage media, which may be tangible and non-transitory. The memory 1402 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1402 is used to store at least one instruction, which is used to be executed by the processor 1401 to implement the information acquisition method in the customer service scenario provided in the embodiment of the present application.

[0259] In some embodiments, the computer device 1400 may further include: a peripheral device interface 1403 and at least one peripheral device. Specifically, the peripheral device includes: at least one of a radio frequency circuit 1404 , a display screen 1405 , a camera assembly 1406 , an audio circuit 1407 and a power supply 1408 .

[0260] The peripheral device interface 1403 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 1401 and the memory 1402. In some embodiments, the processor 1401, the memory 1402, and the peripheral device interface 1403 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1401, the memory 1402, and the peripheral device interface 1403 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0261] The radio frequency circuit 1404 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 1404 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 1404 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1404 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The radio frequency circuit 1404 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 1404 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0262] The display screen 1405 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. Optionally, the computer device 1400 includes an internal display screen and an external display screen close to the eyes of the user. The external display screen is used to display the eye image of the user when the surrounding objects interact with the user of the computer device 1400. Optionally, the display screen 1405 also has the ability to collect touch signals on the surface or above the surface of the display screen 1405. The touch signal can be input to the processor 1401 as a control signal for processing. The display screen 1405 is used to provide virtual buttons and / or comment keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 1405 can be one, and the front panel of the computer device 1400 is set; in other embodiments, the display screen 1405 can be at least two, which are respectively set on different surfaces of the computer device 1400 or are folded; in some other embodiments, the display screen 1405 can be a flexible display screen, which is set on the curved surface or folded surface of the computer device 1400. Even, the display screen 1405 can be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1405 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0263] The camera assembly 1406 is used to capture images or videos. Optionally, the camera assembly 1406 includes an internal camera and an external camera. Typically, the internal camera is used to capture and obtain user eye posture data. In some embodiments, there are at least two external cameras, which are any one of a main camera, a depth of field camera, and a wide-angle camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, and the fusion of the main camera and the wide-angle camera to realize panoramic shooting and AR (Augmented Reality) shooting functions. In some embodiments, the camera assembly 1406 may also include a flash. The flash can be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0264] The audio circuit 1407 is used to provide an audio interface between the user and the computer device 1400. The audio circuit 1407 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 1401 for processing, or input them into the radio frequency circuit 1404 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the computer device 1400. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 1401 or the radio frequency circuit 1404 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as distance measurement. In some embodiments, the audio circuit 1407 may also include a headphone jack.

[0265] The power supply 1408 is used to power various components in the computer device 1400. The power supply 1408 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 1408 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged through a wired line, and a wireless rechargeable battery is a battery that is charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0266] In some embodiments, the computer device 1400 further includes one or more sensors 1409 , including but not limited to: an acceleration sensor 1410 , a gyroscope sensor 1411 , a pressure sensor 1412 , an optical sensor 1413 , and a proximity sensor 1414 .

[0267] The acceleration sensor 1410 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the computer device 1400. For example, the acceleration sensor 1410 can be used to detect the components of gravity acceleration on the three coordinate axes. The processor 1401 can control the display screen 1405 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 1410. The acceleration sensor 1410 can also be used to collect game or user motion data.

[0268] The gyro sensor 1411 can detect the body direction and rotation angle of the computer device 1400, and the gyro sensor 1411 can cooperate with the acceleration sensor 1410 to collect the user's three-dimensional actions on the computer device 1400. The processor 1401 can implement the following functions based on the data collected by the gyro sensor 1411: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.

[0269] The pressure sensor 1412 can be set on the side frame of the computer device 1400 and / or the lower layer of the display screen 1405. When the pressure sensor 1412 is set on the side frame of the computer device 1400, it can detect the user's grip signal of the computer device 1400, and perform left and right hand recognition or shortcut operations according to the grip signal. When the pressure sensor 1412 is set on the lower layer of the display screen 1405, it can control the operability controls on the UI interface according to the user's pressure operation on the display screen 1405. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0270] The optical sensor 1413 is used to collect the ambient light intensity. In one embodiment, the processor 1401 can control the display brightness of the display screen 1405 according to the ambient light intensity collected by the optical sensor 1413. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1405 is increased; when the ambient light intensity is low, the display brightness of the display screen 1405 is reduced. In another embodiment, the processor 1401 can also dynamically adjust the shooting parameters of the camera assembly 1406 according to the ambient light intensity collected by the optical sensor 1413.

[0271] The proximity sensor 1414, also called a distance sensor, is usually arranged on the front of the computer device 1400. The proximity sensor 1414 is used to collect the distance between the user and the front of the computer device 1400. In one embodiment, when the proximity sensor 1414 detects that the distance between the surrounding objects and the front of the computer device 1400 is gradually decreasing, the processor 1401 controls the external display screen to display the user's eye image; when the proximity sensor 1414 detects that the distance between the user and the front of the computer device 1400 is gradually increasing, the processor 1401 controls the internal display screen to switch from the screen-on state to the screen-off state.

[0272] Those skilled in the art will understand that Fig.14 The structure shown in the figure does not constitute a limitation on the computer device 1400, and the computer device 1400 may include more or less components than shown in the figure, or combine some components, or adopt a different arrangement of components.

[0273] Fig.151 is a schematic diagram of the structure of a computer device according to an exemplary embodiment. The computer device 1500 includes a central processing unit (CPU) 1501, a system memory 1504 including a random access memory (RAM) 1502 and a read-only memory (ROM) 1503, and a system bus 1505 connecting the system memory 1504 and the central processing unit 1501. The computer device 1500 also includes a basic input / output system (I / O system) 1506 for helping to transmit information between various devices in the computer device, and a large-capacity storage device 1507 for storing an operating system 1513, an application program 1514 and other program modules 1515.

[0274] The basic input / output system 1506 includes a display 1508 for displaying information and an input device 1509 such as a mouse and a keyboard for user inputting information. The display 1508 and the input device 1509 are connected to the central processing unit 1501 through an input / output controller 1510 connected to the system bus 1505. The basic input / output system 1506 may also include an input / output controller 1510 for receiving and processing inputs from a plurality of other devices such as a keyboard, a mouse, or an electronic stylus. Similarly, the input / output controller 1515 also provides output to a display screen, a printer, or other types of output devices.

[0275] The mass storage device 1507 is connected to the central processing unit 1501 through a mass storage controller (not shown) connected to the system bus 1505. The mass storage device 1507 and its associated computer device readable medium provide non-volatile storage for the computer device 1500. That is, the mass storage device 1507 may include a computer device readable medium (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0276] Without loss of generality, the computer device readable medium may include computer device storage media and communication media. Computer device storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer device readable instructions, data structures, program modules or other data. Computer device storage media include RAM, ROM, Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), CD-ROM, Digital Video Disc (DVD) or other optical storage, cassette, tape, disk storage or other magnetic storage devices. Of course, those skilled in the art will know that the computer device storage medium is not limited to the above. The above-mentioned system memory 1504 and mass storage device 1507 can be collectively referred to as memory.

[0277] According to various embodiments of the present disclosure, the computer device 1500 can also be connected to a remote computer device on a network through a network such as the Internet. That is, the computer device 1500 can be connected to the network 1511 through the network interface unit 1512 connected to the system bus 1505, or the network interface unit 1512 can be used to connect to other types of networks or remote computer device systems (not shown).

[0278] The memory also includes one or more programs, which are stored in the memory. The central processing unit 1501 implements all or part of the steps of the above-mentioned abnormal subject identification method by executing the one or more programs.

[0279] The present application also provides a computer-readable storage medium, in which at least one instruction, at least one program, a code set or an instruction set is stored. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the method for identifying an abnormal subject provided in the above method embodiment.

[0280] The present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the abnormal subject identification method provided by the above method embodiment.

[0281] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0282] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0283] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for identifying an abnormal subject, characterized in that: The method comprises: The first anomaly identification task is displayed in the task management page; receiving, in a configuration page of the first anomaly identification task, an operation of configuring a subject cluster targeted by the first anomaly identification task as a first subject cluster, the first subject cluster including a plurality of first subjects, and a goal of the first anomaly identification task being to identify an abnormal subject among the plurality of first subjects; Displaying the first N subjects obtained by sorting the multiple first subjects according to feature values ​​on the result page of the first anomaly identification task, the first subject having at least one feature, and the feature value being the value of the feature of the first subject; And, display the characteristic values ​​corresponding to the first N subjects respectively, where N is a positive integer; A sending review operation for at least one of the first N subjects is received, and after the review is completed, a review result of whether the at least one subject is an abnormal subject or a non-abnormal subject is displayed.

2. The method according to claim 1, characterized in that The first anomaly recognition task is an anomaly recognition task performed based on a single feature, and the method further includes: receiving, in a configuration page of the first abnormality identification task, an operation of configuring a feature based on the first abnormality identification task as a target first feature; The first N subjects obtained by sorting the multiple first subjects according to the feature values ​​are displayed in the result page of the first anomaly identification task; and the feature values ​​corresponding to each of the first N subjects are displayed, including: The result page of the first anomaly identification task displays the first N subjects obtained by sorting the multiple first subjects according to the values ​​of the target first feature, and displays the values ​​of the target first feature corresponding to each of the first N subjects.

3. The method according to claim 1, characterized in that The first anomaly recognition task is an anomaly recognition task performed based on multiple features, and the method further includes: Acquire the plurality of first entities; For any one of the multiple first subjects, based on the values ​​of the multiple features of the first subject and according to the anomaly detection algorithm, calculate an anomaly score of the first subject; The first N subjects obtained by sorting the multiple first subjects according to the feature values ​​are displayed in the result page of the first anomaly identification task; and the feature values ​​corresponding to each of the first N subjects include: The result page of the first anomaly identification task displays the first N subjects obtained by sorting the multiple first subjects in descending order of the anomaly scores, and displays the comprehensive feature values ​​corresponding to each of the first N subjects. For any first subject among the first N subjects, the anomaly score of the first subject has a positive correlation with the comprehensive feature value.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises at least one of the following steps: Displaying the abnormal reasons corresponding to the first N subjects; Displaying the abnormal history corresponding to each of the first N subjects, wherein the abnormal history includes at least one of the historical abnormal characteristics of the first subject and the abnormal times of the historical abnormal characteristics; Displaying multiple query entrances, each of which is used to jump to a corresponding information query system to query information of a first subject among the first N subjects, the multiple query entrances correspond one to one with the multiple information query systems, and different information query systems are used to query different information of the first subject; Displaying an audit entry, the audit entry is used to jump to the audit station to audit whether the first subject is an abnormal subject or a non-abnormal subject; The first abnormality identification task is executed again every preset period in the background program.

5. The method according to claim 4, characterized in that The first anomaly recognition task is an anomaly recognition task performed based on multiple features; The display of the abnormal reasons corresponding to the first N subjects respectively includes: For a first subject among the first N subjects, an abnormal reason showing an abnormal feature of the first subject is a higher probability of a left tail or a higher probability of a right tail.

6. The method according to claim 2, characterized in that The configuration page of the first anomaly identification task also supports executing at least one of the following: Receiving a configuration operation of N; Receive a configuration operation for configuring the sorting mode to ascending or descending; A configuration operation of receiving a filtering condition for the feature value is performed.

7. The method according to claim 3, characterized in that The configuration page of the first anomaly identification task also supports executing at least one of the following: Receiving a configuration operation of N; receiving a configuration operation for a maximum number of features used by the anomaly detection algorithm; A configuration operation for an algorithm that complements the anomaly detection algorithm is received.

8. The method according to claim 3, characterized in that The calculating, based on the values ​​of the multiple features of the first subject and according to the anomaly detection algorithm, an anomaly score of the first subject includes: For any one of the multiple features, based on the value of the first subject in the feature, combined with the left cumulative distribution function corresponding to the feature, a left tail probability is obtained; multiple left tail probabilities corresponding to the multiple features of the first subject are determined, wherein the input of the left cumulative distribution function is the feature value, and the output is the probability that the feature value is greater than multiple historical feature values; Based on the value of the first subject in the feature, combined with the right cumulative distribution function corresponding to the feature, a right tail probability is obtained; a plurality of right tail probabilities corresponding to the first subject in the plurality of features are determined, wherein the input of the right cumulative distribution function is the feature value, and the output is the probability that the feature value is less than the plurality of historical feature values; Concatenate the multiple left tail probabilities and the multiple right tail probabilities to obtain an embedding vector; The embedding vector is input into a neural network model to predict an anomaly score of the first subject.

9. The method according to claim 8, characterized in that The step of inputting the embedding vector into a neural network model to predict an abnormality score of the first subject includes: Inputting the embedding vector into an input layer, a first hidden layer of a fully connected neural network, a second hidden layer of the fully connected neural network, and an output layer having a cascade relationship, and predicting an abnormality score of the first subject; The number of neural units included in the first hidden layer is the same as the dimension of the multiple features, and the number of neural units included in the second hidden layer is a preset value.

10. The method according to claim 8, characterized in that The method further comprises: For any one of the multiple features, based on the multiple historical feature values ​​of the feature taken by multiple historical normal subjects, the left and right cumulative distribution functions corresponding to the feature are fitted, and the multiple historical normal subjects correspond one-to-one to the multiple historical feature values.

11. The method according to claim 8, characterized in that The method further comprises: For any one of the multiple features, calculate the skewness coefficient corresponding to the feature; When the skewness coefficient is less than zero, the first subject is included in the accumulation of the left-tail probability corresponding to the feature; when the skewness coefficient is greater than or equal to zero, the first subject is included in the accumulation of the right-tail probability corresponding to the feature; Repeat the above steps for the multiple features to accumulate and obtain an adaptive tail probability; The step of concatenating the plurality of left tail probabilities and the plurality of right tail probabilities to obtain an embedding vector includes: The multiple left tail probabilities, the multiple right tail probabilities and the adaptive tail probability are concatenated to obtain the embedding vector.

12. A device for identifying an abnormal subject, characterized in that: The device comprises: A display module, used to display the first abnormality identification task in the task management page; a receiving module, configured to receive, in a configuration page of the first abnormality identification task, an operation of configuring a subject cluster targeted by the first abnormality identification task as a first subject cluster, wherein the first subject cluster includes a plurality of first subjects, and a goal of the first abnormality identification task is to identify an abnormal subject among the plurality of first subjects; The display module is further configured to display, in a result page of the first abnormality identification task, the first N subjects obtained by sorting the multiple first subjects according to feature values, wherein the first subject has at least one feature, and the feature value is a value of the feature of the first subject; The display module is further used to display the feature values ​​corresponding to the first N subjects in the result page of the first anomaly identification task, where N is a positive integer; The receiving module is further used to receive a sending review operation for at least one of the first N subjects; The display module is further used to display the audit result of whether the at least one subject is an abnormal subject or a non-abnormal subject after the audit is completed.

13. A computer device, characterized in that: The computer device comprises: a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the abnormal subject identification method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the method for identifying an abnormal subject as described in any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product stores a computer program, and the computer program is loaded and executed by a processor to implement the method for identifying an abnormal subject as described in any one of claims 1 to 11.

Images