Abnormal information identification method and device, computer readable medium and electronic equipment

Abstract

The embodiment of the invention provides an abnormal information identification method and device, a computer readable medium and electronic equipment. The method comprises the steps of obtaining feature information of a target information related party; determining feature values corresponding to the plurality of abnormal information identification features according to the feature information; inputting feature values corresponding to the abnormal information identification features into a credit scoring model obtained by training, and predicting a credit score of a target information related party; if it is determined that the target information related party belongs to a specified credit category according to the credit score, target abnormal information is filtered out from information related to the target information related party, and the credit score of the information related party belonging to the specified credit category is lower than the credit score of the information related party belonging to other credit categories; and training according to the target abnormal information to obtain a target abnormal information identification model, and performing abnormal information identification based on the target abnormal information identification model. According to the embodiment of the invention, the timeliness and coverage rate of abnormal information identification can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, computer-readable medium and electronic device for identifying abnormal information. Background Art

[0002] At present, the main way to identify abnormal information is to identify the information itself through algorithms or models. However, this method can only identify information of known abnormal types, and cannot perceive and identify information of unknown abnormal types, resulting in low timeliness and coverage of abnormal information identification. Summary of the invention

[0003] The embodiments of the present application provide a method, device, computer-readable medium and electronic device for identifying abnormal information, which can timely perceive and identify information of unknown abnormal types to at least a certain extent, thereby improving the timeliness and coverage of abnormal information identification.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a method for identifying abnormal information is provided, the method comprising: acquiring feature information of a target information-related party; determining feature values ​​corresponding to a plurality of abnormal information identification features respectively according to the feature information; inputting the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predicting the credit score of the target information-related party through the credit scoring model; if it is determined according to the credit score that the target information-related party belongs to a specified credit category, filtering out target abnormal information from information related to the target information-related party, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories; training a target abnormal information identification model according to the target abnormal information, and performing abnormal information identification based on the target abnormal information identification model.

[0006] According to one aspect of an embodiment of the present application, a device for identifying abnormal information is provided, the device comprising: an acquisition unit, configured to acquire feature information of a target information-related party; a determination unit, configured to determine feature values ​​corresponding to a plurality of abnormal information identification features respectively according to the feature information; an input unit, configured to input the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predict the credit score of the target information-related party through the credit scoring model; a filtering unit, configured to filter out target abnormal information from information related to the target information-related party if it is determined that the target information-related party belongs to a specified credit category according to the credit score, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories; and a training and identification unit, configured to obtain a target abnormal information identification model trained according to the target abnormal information, and identify abnormal information based on the target abnormal information identification model.

[0007] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a target information related party determination unit; before obtaining the characteristic information of the target information related party, the target information related party determination unit is used to: identify at least one abnormal information released within a predetermined time interval based on the original abnormal information recognition model; determine the information related party of each of the abnormal information as the target information related party; the training and recognition unit is configured to: use the target abnormal information as a training sample, train the original abnormal information recognition model based on the training sample, and obtain the target abnormal information recognition model.

[0008] In some embodiments of the present application, based on the aforementioned scheme, the training and identification unit is configured to: identify the abnormal information released within the next predetermined time interval based on the target abnormal information identification model, and re-execute the steps and subsequent steps of determining the information related parties of each abnormal information based on the identified abnormal information.

[0009] In some embodiments of the present application, based on the aforementioned solution, the abnormality type of the target abnormality information is different from the abnormality type of each of the abnormality information.

[0010] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a credit scoring model training unit; before determining the feature values ​​corresponding to the multiple abnormal information identification features respectively according to the feature information, the credit scoring model training unit is configured to: obtain the feature information of multiple information stakeholders and the credit labels of each information stakeholder; for each information stakeholder, determine the feature values ​​corresponding to the multiple features of the information stakeholder according to the feature information of the information stakeholder; filter out the multiple abnormal information identification features from the multiple features according to the feature values ​​and credit labels of each information stakeholder; construct a training sample set according to the feature values ​​corresponding to the abnormal information identification features of each information stakeholder and the credit labels of each information stakeholder; and obtain a credit scoring model by training based on the training sample set.

[0011] In some embodiments of the present application, based on the aforementioned scheme, the filtering unit is configured to: match the information related to the target information-related party with a preset key dictionary respectively; and filter out target abnormal information from the information related to the target information-related party according to the matching results.

[0012] In some embodiments of the present application, based on the aforementioned scheme, the credit scoring model is trained based on an extreme gradient boosting model, and the extreme gradient boosting model splits the tree in the following manner: for each abnormal information identification feature, the gain value of each segmentation point of the abnormal information identification feature is determined based on a training sample set, and the segmentation point with the largest gain value is selected as the optimal segmentation point of the abnormal information identification feature; the tree is split according to the optimal segmentation point of each abnormal information identification feature.

[0013] In some embodiments of the present application, based on the aforementioned solution, the information is an advertisement, and the target information-related party is the publisher of the target advertisement or the producer of the product disseminated by the target advertisement.

[0014] In some embodiments of the present application, based on the aforementioned scheme, the abnormal information identification features belong to one of the following categories: features related to the status recorded in the management department, features related to historical abnormal statistics, and features related to web pages used to guide advertisement clickers to perform specific actions.

[0015] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for identifying abnormal information as described in the above embodiment is implemented.

[0016] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying abnormal information as described in the above embodiments.

[0017] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for identifying abnormal information as described in the above embodiments.

[0018] In the technical solutions provided in some embodiments of the present application, after acquiring the characteristic information of the target information-related party, the characteristic values ​​corresponding to multiple abnormal information identification features are determined respectively, and then the characteristic values ​​corresponding to the multiple abnormal information identification features are input into the credit scoring model to obtain the credit score output by the credit scoring model, thereby realizing the prediction of the credit score of the target information-related party, and then, by determining that the credit score of the target information-related party is low according to the credit score, the target abnormal information is filtered out from the information related to the target information-related party, and after continuing to train the target abnormal information recognition model using the target abnormal information, the target abnormal information recognition model is used to identify the abnormal information. Therefore, the scheme of the embodiment of the present application cleverly monitors the information corresponding to the target information-related parties with lower credit scores from the perspective of the credit scores of the target information-related parties. Since the target abnormal information is not identified through the traditional abnormal information recognition model but obtained through filtering, it is very likely to be information of unknown abnormal type. Therefore, training samples can be quickly provided for the identification of unknown abnormal types. On this basis, the target abnormal information recognition model is obtained by training according to the target abnormal information. When abnormal information recognition is performed based on the target abnormal information recognition model, the unknown abnormal type information can be perceived and identified in a timely manner, thereby improving the timeliness and coverage of abnormal information recognition.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0021] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;

[0022] Figure 2 A flowchart showing a method for identifying abnormal information according to an embodiment of the present application is shown;

[0023] Figure 3 A schematic diagram of an overall process according to an embodiment of the present application is shown;

[0024] Figure 4 A flowchart showing the steps before determining feature values ​​respectively corresponding to a plurality of abnormal information identification features according to feature information according to an embodiment of the present application;

[0025] Figure 5 A schematic diagram showing an abnormal information identification feature according to an embodiment of the present application is shown;

[0026] Figure 6 An embodiment according to the present application is shown. Figure 2 Detailed flowchart of the steps before step 230 and step 270 in the embodiment;

[0027] Figure 7 An embodiment according to the present application is shown. Figure 2 A flowchart of the details of step 260 in an embodiment;

[0028] Figure 8 An embodiment according to the present application is shown Figure 6 A flowchart of the details of step 270 in an embodiment;

[0029] Fig. 9 A schematic diagram showing an illegal advertisement published by an advertisement publisher with a low credit score according to an embodiment of the present application;

[0030] Fig.10 A schematic diagram of the overall framework according to an embodiment of the present application is shown;

[0031] Fig.11 A block diagram of an abnormal information identification device according to an embodiment of the present application is shown;

[0032] Fig.12A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0034] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0035] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0036] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0037] In related technologies, in order to identify abnormal information, the information to be identified is mainly identified through a detection algorithm or a detection model to determine whether it is abnormal information. Although this method has a certain degree of recognition accuracy and effectiveness, it also has some obvious limitations, as follows:

[0038] 1. In order to identify the information corresponding to the newly discovered anomaly types, a large number of training samples corresponding to the newly discovered anomaly types should be prepared. However, the training samples corresponding to such newly discovered anomaly types require a long time to accumulate, and the updating timeliness is low.

[0039] 2. It can only identify information of known abnormal types, but cannot perceive and identify variants of abnormal information, that is, it cannot detect new abnormal types of information. This leads to low timeliness and coverage of abnormal information identification, making some potential abnormal information unable to be identified.

[0040] To this end, the present application first provides a method for identifying abnormal information, which can be used to identify various abnormal information such as illegal and irregular information. The method for identifying abnormal information provided by the embodiments of the present application can overcome the above-mentioned defects, not only can it quickly perceive new abnormal types of information, thereby accumulating more training samples corresponding to the newly discovered abnormal types, but also can improve the timeliness and coverage of abnormal information identification, and solve the problem of fast changes in abnormal information and low coverage of abnormal information identification.

[0041] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiment of the present application can be applied is shown. Figure 1 As shown, the system architecture 100 may include an advertisement violation detection server 110, a cloud 120, a first database 130, a management server 140 and a user terminal 150. The advertisement violation detection server 110, the cloud 120 and the management server 140, the first database 130 and the management server 140, the management server 140 and the user terminal 150, and the first database 130 and the advertisement violation detection server 110 are all connected via communication links. The cloud 120 specifically includes an advertisement publishing platform server 121 and a second database 122. The advertisement publishing platform server 121 and the second database 122 also establish a communication connection. The advertisement violation detection server 110 is deployed with an original advertisement violation detection model. The advertisement publishing platform server 121 of the cloud 120 stores advertisements published by advertisers. The second database 122 stores feature information of advertisers. The management server 140 is deployed with a pre-trained credit scoring model. The management server 140 is the executor of the embodiment of the present application. When a method for identifying abnormal information provided in the embodiment of the present application is applied to Figure 1In the system architecture shown, a process may be as follows: first, the advertisement violation detection server 110 accesses the advertisement publishing platform server 121, and uses the original advertisement violation detection model to monitor the advertisements published by the advertiser, obtains a number of illegal advertisement data, and stores these illegal advertisement data in the first database 130; then, the management server 140 obtains the identification information of the illegal advertisement data from the illegal advertisement data stored in the first database 130, and sends a feature information query request carrying the identification information of the illegal advertisement data to the cloud 120, and obtains the feature information of the advertiser corresponding to the identification information of the illegal advertisement data returned by the second database 122 of the cloud 120 according to the feature information query request; then, the management server 140 extracts feature values ​​corresponding to multiple abnormal information identification features from the feature information of the advertiser, and inputs these feature values ​​into In the credit scoring model, the credit score output by the credit scoring model is obtained; next, the management server 140 determines that the advertiser is a low-credit advertiser according to the credit score, and monitors the advertisements published by the low-credit advertiser on the advertising publishing platform server 121 after the current time, thereby screening out suspected abnormal advertisements; then, the management server 140 sends the suspected abnormal advertisements to the user terminal 150, which is reviewed by the user of the user terminal 150, and after the review is passed, the label information marked by the user for the suspected abnormal advertisement is obtained; finally, the management server 140 sends the suspected abnormal advertisements and the corresponding label information to the advertising violation detection server 110, thereby training a new advertising violation detection model based on the suspected abnormal advertisements and the corresponding label information, and the advertising violation detection server 110 can use the new advertising violation detection model to continue to monitor illegal advertisements.

[0042] In some embodiments of the present application, the original advertisement violation detection model monitors advertisements published by the advertiser within a predetermined time period before the predetermined time at a predetermined time every day.

[0043] In some embodiments of the present application, the original advertising illegality detection model is a collection of multiple models.

[0044] In some embodiments of the present application, the suspected abnormal advertisements are of a type that cannot be detected by the original advertisement illegality detection model.

[0045] In some embodiments of the present application, the new advertising illegality detection model is trained on the basis of the original advertising illegality detection model.

[0046] In some embodiments of the present application, the new advertisement illegality detection model is a new model independent of the original advertisement illegality detection model.

[0047] It should be understood that Figure 1The number of user terminals, advertising illegality detection servers, first databases, management servers, and advertising publishing platform servers and second databases in the cloud are only illustrative. According to the implementation requirements, the number of user terminals, advertising illegality detection servers, first databases, management servers, and advertising publishing platform servers and second databases in the cloud can be arbitrary. For example, there can be multiple user terminals, first databases, and second databases, and the advertising illegality detection servers, management servers, and advertising publishing platform servers can all be server clusters composed of multiple servers.

[0048] It should be noted that Figure 1 The embodiment shown is only one embodiment of the present application. Figure 1 In the embodiment, the credit score of the advertiser is obtained. However, in other embodiments of the present application, the credit score of the producer of the product disseminated by the advertisement, that is, the advertiser, can also be obtained. Figure 1 In the scheme of the embodiment, the abnormal information is illegal advertisements, that is, illegal advertisements are identified, but in other embodiments of the present application, the abnormal information can also be various other types of information such as illegal self-media articles, messages of instant messaging tools, etc.; although in Figure 1 In the embodiment, the characteristic information of all advertisers is stored in a database that can communicate with the advertisement publishing platform server. However, in other embodiments of the present application, different characteristic information of advertisers can be stored in different databases, and some databases can be prevented from communicating with the advertisement publishing platform server. Figure 1 In the embodiment, the credit scoring model and the original advertisement illegal detection model are deployed on different devices, but in other embodiments of the present application, the two can also be deployed on the same device. Figure 1 In the solution of the embodiment, the user terminal is a desktop computer, but in other embodiments of the present application, the user terminal can also be various types of devices such as a smart phone, a tablet computer, a vehicle-mounted terminal, a portable wearable device, a workstation, etc. The embodiment of the present application does not make any limitation to this, and the protection scope of the present application should not be limited in any way.

[0049] It is easy to understand that the abnormal information identification method provided in the embodiment of the present application is generally executed by the server, and accordingly, the abnormal information identification device is generally set in the server. However, in other embodiments of the present application, the terminal device may also have similar functions as the server, so as to execute the abnormal information identification scheme provided in the embodiment of the present application.

[0050] Therefore, the embodiments of the present application can be applied to a terminal or a server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application is not limited here.

[0051] The solution of the embodiment of the present application can be applied to the field of cloud computing. Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called a "cloud". The resources in the "cloud" are infinitely expandable in the eyes of users, and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0052] As a cloud computing basic capability provider, a cloud computing resource pool (referred to as a cloud platform, generally referred to as IaaS (Infrastructure as a Service)) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0053] According to the logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on the PaaS layer. SaaS can also be deployed directly on IaaS. PaaS is a platform for software operation, such as databases, web containers, etc. SaaS is a variety of business software, such as web portals, SMS mass senders, etc. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0054] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0055] Figure 2The flowchart of the abnormal information identification method according to an embodiment of the present application is shown. The abnormal information identification method can be executed by various devices capable of computing and processing, such as user terminals or cloud servers. User terminals include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, smart watches, etc. Please refer to Figure 2 As shown, the method for identifying abnormal information may at least include the following steps:

[0056] Step 230, obtaining characteristic information of the party related to the target information.

[0057] Step 240: Determine feature values ​​corresponding to the plurality of abnormal information identification features respectively according to the feature information.

[0058] Step 250, input the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predict the credit score of the target information related party through the credit scoring model.

[0059] Step 260, if it is determined based on the credit score that the target information-related party belongs to a specified credit category, target abnormal information is filtered out from the information related to the target information-related party, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories.

[0060] Step 270: A target abnormal information recognition model is obtained according to target abnormal information training, and abnormal information recognition is performed based on the target abnormal information recognition model.

[0061] Before introducing the above steps in detail, first, combine Figure 3 The steps before step 230 and step 240 are introduced.

[0062] Figure 3 Schematic diagram of the overall process according to an embodiment of the present application is shown. Figure 3 As shown, two flow charts on the left and right are shown, which will be introduced respectively below.

[0063] Before determining the feature values ​​corresponding to the plurality of abnormal information identification features respectively according to the feature information, it is necessary to obtain a credit scoring model first. Figure 4 A flowchart showing the steps before determining feature values ​​corresponding to multiple abnormal information identification features respectively according to feature information according to an embodiment of the present application is shown. Figure 4 As shown, before determining the feature values ​​corresponding to the plurality of abnormal information identification features respectively according to the feature information, the abnormal information identification method may include the following steps:

[0064] In step 410, characteristic information of multiple information stakeholders and a credit tag of each information stakeholder are obtained.

[0065] The information in the embodiments of the present application may be various types of data such as advertisements, articles, messages, videos, etc.

[0066] The following describes the scheme of the embodiment of the present application by taking the information as an advertisement as an example. The advertisement can be a combination of one or more of the following forms of content: text, picture, audio, video.

[0067] The information stakeholders may be publishers of advertisements or providers or producers of products disseminated by the target advertisements.

[0068] The publisher of an advertisement can be, for example, a company or an individual, who may have a self-media account, a public account, a social platform account, etc. Therefore, he can publish an advertisement by publishing an article on a news platform or a social platform. The article itself or part of the article can be an advertisement, or an advertisement can be embedded in the article. The provider or producer of the product disseminated by the target advertisement is the advertiser. If A needs to sell product B, he requests the publisher of the advertisement C to publish an advertisement for product B. Then, A can be the provider or producer of product B disseminated by the advertisement. A can be a company or an individual, and the product here can be a physical or virtual product.

[0069] For each information stakeholder, corresponding feature information can be obtained. The feature information of the same information stakeholder can include multiple items, and each item of feature information can be obtained from multiple different data sources. The credit label of the information stakeholder can be automatically labeled by the machine learning model for the information stakeholder, or it can be manually labeled for the information stakeholder.

[0070] Each information stakeholder has only one credit label. The credit labels of information stakeholder can be various, for example, the credit label of an information stakeholder can be one of the following: high credit, medium credit and low credit; the credit label of an information stakeholder can also be one of the following: good credit, bad credit.

[0071] See also Figure 3 As shown, the flowchart on the left includes the following steps:

[0072] Step 310, prepare an illegal advertiser information database and corresponding credit labels.

[0073] The illegal advertiser detection information database may include information of multiple illegal advertisers. For example, it may include information of 100,000 illegal advertisers. Each illegal advertiser has a corresponding credit label. The illegal advertiser is the aforementioned information related party.

[0074] Of course, in other embodiments of the present application, information of compliant advertisers and corresponding credit labels may be further prepared for use in training a credit scoring model.

[0075] Step 320, obtaining characteristic information of corresponding illegal advertisers.

[0076] Feature information related to a plurality of preset features is obtained from all information of the illegal advertiser.

[0077] Please continue to see Figure 4 In step 420, for each information stakeholder, characteristic values ​​of the information stakeholder corresponding to the multiple characteristics are determined according to the characteristic information of the information stakeholder.

[0078] For each information stakeholder, multiple feature values ​​can be calculated based on its feature information, and these multiple feature values ​​correspond one-to-one to multiple features.

[0079] In step 430, a plurality of abnormal information identification features are screened out from the plurality of features based on the feature values ​​and credit labels of each information stakeholder.

[0080] In one embodiment of the present application, the credit scoring model is trained based on the extreme gradient boosting model.

[0081] The extreme gradient boosting model, namely the XGBoost (eXtreme Gradient Boosting) model, is an ensemble learning algorithm based on decision trees. It improves the accuracy and generalization ability of the model by integrating multiple decision trees.

[0082] The main benefits of XGBoost models include:

[0083] 1. Efficiency: XGBoost uses a variety of optimization techniques, such as cache access and parallel computing, which can quickly train large-scale data sets and high-dimensional feature spaces.

[0084] 2. Accuracy: XGBoost improves the accuracy and generalization ability of the model by integrating multiple decision trees. It also provides a variety of optimization techniques, such as gradient boosting, regularization, missing value processing, etc., which can effectively avoid problems such as overfitting and underfitting.

[0085] 3. Interpretability: XGBoost’s decision tree model has good interpretability, which can help users understand the model’s decision-making process and feature importance.

[0086] In general, XGBoost is an efficient, accurate, and interpretable machine learning algorithm that is suitable for various types of data sets and tasks, such as classification, regression, sorting, recommendation, etc. In practical applications, appropriate parameters and optimization techniques can be selected according to specific data sets and tasks to obtain better model performance.

[0087] Although a credit scoring model based on XGBoost is used in the embodiment of the present application, in other embodiments of the present application, a credit scoring model based on other models can also be used, such as a credit scoring model based on GBDT (GradientBoosting Decision Tree). GBDT is an integrated learning method that improves the performance of the model by continuously adding new decision trees to the existing model and optimizing the objective function. The main idea of ​​GBDT is to combine multiple weak learners (usually using decision trees) to achieve a strong prediction effect. It is mainly used in regression and classification problems, especially in solving overfitting problems, processing data sets with many features, and processing problems with class imbalance. During the training process, the GBDT algorithm will continue to iterate, and each round will train a new decision tree based on the residual of the previous round (the gap between the true value and the predicted value), and this new decision tree will focus on improving the residual of the previous round. In this way, the GBDT algorithm can gradually approach the optimal solution.

[0088] Multiple abnormal information identification features can be screened out from multiple features based on the feature importance. The feature importance of a feature refers to the contribution of the feature to the model performance when training the model.

[0089] Feature importance can be calculated using weight-based, coverage-based, and gain-based methods. Among them, weight-based feature importance refers to the sum of the number of times each feature is used as a split node in all trees. Coverage-based feature importance refers to the sum of the number of times each feature is used as a split node, divided by the number of times the feature is used as a split node plus one. Gain-based feature importance refers to the average gain that each feature can bring when used as a split node. Specifically, to obtain feature importance, you can use the plot_importance() function or get_score() function provided by XGBoost. The plot_importance() function can plot a feature importance chart, while the get_score() function can return a dictionary containing the importance scores of each feature.

[0090] The feature with the highest feature importance can be selected from multiple features as the abnormal information identification feature.

[0091] In one embodiment of the present application, the abnormal information identification feature belongs to one of the following categories: features related to the status recorded in the management department, features related to historical abnormal statistics, and features related to web pages used to guide advertisement clickers to perform specific actions.

[0092] Figure 5 A schematic diagram of abnormal information identification features according to an embodiment of the present application is shown.

[0093] See also Figure 5 As shown, the abnormal information identification features finally obtained can be divided into three categories, namely industrial and commercial characteristics, historical violation characteristics and landing page characteristics. Among them, industrial and commercial characteristics are characteristics related to the status recorded in the management department. These characteristics are all related to the management of the industrial and commercial management department, including industrial and commercial anomalies, regular range anomalies, administrative penalties, persons subject to execution, persons without credibility and other characteristics; historical violation characteristics are characteristics related to historical abnormal statistical data, including the number of violations in the past month, the violation rate in the past month, the distribution of violation levels and other characteristics; landing page characteristics are characteristics related to web pages used to guide ad clickers to perform specific actions. The landing page is the ad landing page, which is a specific web page used to guide ad clickers to perform a specific action, such as purchasing a product, registering for a subscription, downloading an application, etc. When the user clicks on the posted ad, he may enter the ad landing page. Landing page features include URL character features, URL IP location, URL filing time and other features related to the landing page. Although Figure 5 There is no limit on the time corresponding to the landing page features, but in fact, time restrictions can be imposed on it so that the feature values ​​can be accurately determined. For example, the URL character features can be the URL character features of the landing page of the advertisement released in the past month, the URL IP location can be the URL IP location of the landing page of the advertisement released in the past month, and the URL filing time can be the URL filing time of the landing page of the advertisement released in the past month.

[0094] Please continue to see Figure 3 As shown, after step 320, the following steps are also included:

[0095] Step 330: Screening of features of illegal advertisers.

[0096] The abnormal information identification features are obtained through screening.

[0097] Please continue to see Figure 4 As shown, in step 440, a training sample set is constructed based on the feature values ​​corresponding to the abnormal information identification features of each information stakeholder and the credit labels of each information stakeholder.

[0098] The feature value corresponding to the abnormal information identification feature and the corresponding credit label of each information stakeholder are taken as a training sample, and a training sample set is constructed using the training samples of each information stakeholder.

[0099] In step 450, a credit scoring model is trained based on the training sample set.

[0100] In one embodiment of the present application, the extreme gradient boosting model splits the tree in the following manner: for each abnormal information identification feature, the gain value of each segmentation point of the abnormal information identification feature is determined based on the training sample set, and the segmentation point with the largest gain value is selected as the optimal segmentation point of the abnormal information identification feature; the tree is split according to the optimal segmentation point of each abnormal information identification feature.

[0101] The above method implements the tree splitting in a greedy way. However, when the amount of data is very large and it is impossible to load all the data into the memory at the same time, the above method will be very time-consuming. Therefore, the tree can also be split based on an approximate algorithm. The approximate algorithm first proposes candidate splitting points based on the percentiles of the feature distribution, maps the continuous features to the buckets divided by these candidate points, summarizes and counts the information, and finds the best solution in the proposal based on the summarized information. For a certain feature k, the algorithm first finds a candidate set of feature cutting points based on the quantiles of the feature distribution, then divides the value of feature k into buckets according to the set, then accumulates the sample statistics G and H in each bucket, and finally finds the best splitting point based on these accumulated statistics.

[0102] In the process of model training to generate decision trees, XGBoost also uses some optimization techniques, such as sparse value processing, feature column sorting, cache access, etc., to make training faster.

[0103] Sparsity-aware Split Finding. In actual projects, input values ​​are usually sparse. For example, missing data and one-hot encoding will cause input data to be sparse. Therefore, XGBoost also provides a sparse value processing method, specifically: for missing data, let the model automatically learn the default split direction. In each split, the missing values ​​are split into the left node and the right node respectively. By calculating the score value to compare which of the two split methods is better, an optimal default split direction will be learned for the missing values ​​of each feature.

[0104] Column Block for Parallel Learning. In the process of tree generation, a lot of time is spent on feature selection and split point selection, and most of this time is spent on sorting feature values. In order to reduce the sorting time overhead, XGBoost divides and sorts the blocks by features, saves the sorted feature values ​​and references to the corresponding samples in the blocks, so as to obtain the first-order and second-order derivative values ​​of the samples.

[0105] Cache-aware Access. In order to reduce the problem of low cache hit rate caused by non-continuous memory access, XGBoost uses a cache access optimization mechanism. The solution is: since the problem is caused by non-continuous memory access, it can be solved by removing non-continuous memory access. Access to non-continuous memory space can be removed by converting non-continuous to continuous cache prefetch. That is, the gradient statistics (first-order and second-order derivatives) in the non-continuous memory space to be accessed are picked up and placed in the continuous memory space. The specific operation is to allocate a continuous buffer cache area in the memory space for each thread, and store the required gradient statistics in the buffer. This method is very useful when the amount of data is large, because when the amount of data is large, not all samples can be added to the memory, so the relevant information can be dynamically added to the memory.

[0106] In addition, when training the model, you can also use regularization techniques such as L1 and L2 regularization and subsampling to effectively avoid overfitting.

[0107] In addition, you can also monitor the performance indicators of the model on the validation set during the model training process, such as error or validation accuracy. As the model is trained on the training data, the performance indicators of the model on the validation set will usually improve first, then reach the optimal point, and then begin to decline. When the model performance does not improve after several consecutive iterations of training, it can be considered that the model has overfit the training data, and continued training may lead to overfitting. At this time, the training can be automatically stopped to prevent overfitting.

[0108] Please continue to see Figure 3 As shown, after step 330, the following steps are also included:

[0109] Step 340: generate a decision tree using an approximate algorithm.

[0110] In this process, several optimization techniques are involved, including the following steps:

[0111] Step 341, sparse value processing.

[0112] Step 342, block parallelism.

[0113] Step 343, cache access.

[0114] Step 344, regularization to prevent overfitting.

[0115] Step 350: training the XGBoost advertiser credit scoring model.

[0116] Through the above process, an advertiser credit score model based on the XGBoost model can be trained. After the model is trained, the model parameters can be saved for predicting the advertiser's credit score.

[0117] Next, the steps before step 230 will be described.

[0118] Figure 6 An embodiment according to the present application is shown Figure 2 Detailed flowchart of the steps before step 230 and step 270 in the embodiment. Please refer to Figure 6 As shown, before obtaining the characteristic information of the target information related party, the method for identifying abnormal information may include the following steps:

[0119] In step 210, at least one abnormal information released within a predetermined time interval is identified based on the original abnormal information identification model.

[0120] The original abnormal information recognition model can be a single model or a collection of multiple models. When the original abnormal information recognition model is a collection of multiple models, as long as one model in the collection recognizes a certain information as abnormal information, then the information is abnormal information.

[0121] Information can be published on social platforms, news platforms and other information publishing platforms.

[0122] Taking the information as an advertisement as an example, the original abnormal information recognition model may include a picture detection model and a text detection model, so that it is possible to detect whether the advertisement including pictures and / or text is in violation of the rules. The picture detection model and the text detection model may be models established based on a neural network algorithm. Of course, the original abnormal information recognition model may also be a multimodal large model, which can detect data of both picture and text modes at the same time. The original abnormal information recognition model may be a model that can detect abnormal information of multiple abnormal types; the original abnormal information recognition model may also include multiple abnormal information recognition models corresponding to multiple abnormal types, and each abnormal information recognition model can only be used to detect abnormal information of the corresponding abnormal type. When the information is an advertisement, the abnormal type is the violation type of the advertisement, and the violation type of the advertisement may be an extreme term violation (for example, the best product in the country), or a medical term mixed violation (for example, the slimming tea can prolong life and protect cardiovascular system), or a profit guarantee violation (for example, guaranteeing double profits), etc.

[0123] The predetermined time interval may be any time interval, such as a randomly selected time interval or a periodic time interval. For example, information released between 0:00 and 24:00 on the same day may be obtained at 24:00 every day, and the information may be identified using the original abnormal information identification model to obtain corresponding abnormal labels (when the information is an advertisement, it is an illegal label for indicating the type of illegality), thereby obtaining at least one abnormal information.

[0124] When the information is advertising, millions of advertising data can be obtained every day, and illegal advertising detection models can be used to identify illegal advertisements.

[0125] In step 220, the information stakeholders of each abnormal information are determined as target information stakeholders.

[0126] In one embodiment of the present application, the abnormal information is a target advertisement, and the target information-related party is the publisher of the target advertisement or the producer of the product disseminated by the target advertisement.

[0127] The information stakeholders of each abnormal information can be queried by calling the interface provided by the information publishing platform. The target information stakeholders can be one or more.

[0128] In step 230, characteristic information of the party related to the target information is obtained.

[0129] After obtaining the target information related party, corresponding feature information related to the abnormal information identification feature can be extracted from the information of the target information related party.

[0130] Please continue to see Figure 3As shown, the flowchart on the right includes the following steps:

[0131] Step 360, obtaining a daily advertisement violation detection information database.

[0132] The daily advertisement violation detection information database stores the latest published violation advertisements detected every day.

[0133] Step 370: Obtain characteristic information of corresponding illegal advertisers.

[0134] According to the illegal advertisements obtained in step 360, the corresponding illegal advertisers are determined, and then the corresponding illegal advertiser feature information is obtained.

[0135] Please continue to see Figure 2 In step 240, feature values ​​corresponding to the plurality of abnormal information identification features are determined according to the feature information.

[0136] The abnormal information identification features here are consistent with the abnormal information identification features used to train the credit scoring model mentioned above.

[0137] In step 250, the feature values ​​corresponding to each abnormal information identification feature are input into a pre-trained credit scoring model, and the credit score of the target information related party is predicted by the credit scoring model.

[0138] The credit scoring model is a pre-trained model that can output a credit score for the information stakeholders. The output credit score can be 40, 70, 80, etc. The higher the credit score of the information stakeholder, the less likely the information stakeholder is to publish abnormal information, that is, the lower the risk of the information stakeholder.

[0139] Please continue to see Figure 3 As shown, after step 370, the following steps are also included:

[0140] Step 380: Call the XGBoost advertiser credit scoring model.

[0141] The XGBoost advertiser credit scoring model trained in step 350 is called.

[0142] Step 390: Output the advertiser's credit score.

[0143] According to the characteristic information of the illegal advertiser, the characteristic value of the illegal advertiser is obtained; the characteristic value of the illegal advertiser is input into the XGBoost advertiser credit scoring model to obtain the advertiser credit score output by the model.

[0144] Please continue to see Figure 2In step 260, if it is determined that the target information-related party belongs to a specified credit category based on the credit score, the target abnormal information is filtered out from the information related to the target information-related party, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories.

[0145] The credit score can be divided into three credit score intervals of 0-40, 41-80, and 81-100, which correspond to the three credit categories of low credit, medium credit, and high credit respectively. According to the credit score interval to which the credit score belongs, the credit category of the corresponding information stakeholder can be determined. The credit score can be in the range of 0-40, and the designated credit category can be low credit, that is, the target information stakeholder can be determined as an information stakeholder with low credit.

[0146] When the information related party is an advertiser, the target information related party belonging to the specified credit category may be an advertiser with a low credit score.

[0147] Figure 7 An embodiment according to the present application is shown Figure 2 Flow chart of details of step 260 in the embodiment. Figure 7 As shown, filtering out target abnormal information from information related to a target information-related party may specifically include the following steps:

[0148] In step 261, information related to the target information related party is matched with preset key dictionaries respectively.

[0149] The information related to the target information stakeholder may be any one or more information released by the target information stakeholder, may be all information released by the target information stakeholder, may be part of the information released by the target information stakeholder, and may be information released by the target information stakeholder from the moment it is determined that the target information stakeholder belongs to a specified credit category.

[0150] Matching can be performed by determining whether the information related to the target information related party contains the keywords in the key dictionary.

[0151] Matching through the key dictionary is equivalent to constructing a weak model.

[0152] In step 262, target abnormal information is filtered out from information related to the target information related party according to the matching result.

[0153] If a matching result corresponding to a piece of information is that the information related to the party related to the target information contains the keywords in the key dictionary, then it can be determined that the information is the target abnormal information.

[0154] Of course, other methods can also be used to filter out target abnormal information.

[0155] In one embodiment of the present application, target abnormal information is filtered out from information related to target information stakeholders, including: filtering out candidate abnormal information from information related to target information stakeholders; submitting the candidate abnormal information to a reviewer; receiving the review result fed back by the reviewer; if the review result is passed, marking the candidate abnormal information as target abnormal information.

[0156] The method of filtering out candidate abnormal information can adopt the dictionary matching method in the above-mentioned embodiment. Since the information related to the target information related party is filtered, there may be inaccurate filtering. After filtering out the candidate abnormal information, the embodiment of the present application guarantees the accuracy of the obtained target abnormal information by submitting it to the auditor for secondary review.

[0157] In one embodiment of the present application, the exception type of the target exception information is different from the exception type of each exception information.

[0158] That is, the target abnormal information may be a new type of abnormal information, that is, a new type of illegal advertisement, that is, a variant of illegal advertisement. The auditor may approve the audit only when it is determined that the target abnormal information is a new type of abnormal information.

[0159] While providing feedback on the audit results, auditors can also provide further feedback on corresponding new exception types.

[0160] Please continue to see Figure 3 As shown, after step 390, the following steps are also included:

[0161] Step 3100: monitor low-credit advertisers.

[0162] Monitor advertisements of low-credit advertisers.

[0163] Step 3110, weak model filtering and manual review of advertising leads.

[0164] Illegal advertisements are filtered out through weak models such as rules or keyword matching, and the filtered illegal advertisement clues are sent to the user end for manual review.

[0165] In step 270, a target abnormal information recognition model is obtained according to target abnormal information training, and abnormal information recognition is performed based on the target abnormal information recognition model.

[0166] The target anomaly information recognition model can be trained based on the target anomaly information and the corresponding new anomaly type label. Of course, if the auditor does not feedback the new anomaly type, the target anomaly information can be directly labeled as an unknown anomaly type label, and then the model training can be performed based on the label.

[0167] Please continue to see Figure 6 As shown, the target abnormal information recognition model obtained by training the target abnormal information may include:

[0168] In step 271, the target abnormal information is used as a training sample, and the original abnormal information recognition model is trained based on the training sample to obtain a target abnormal information recognition model.

[0169] Since the target abnormal information may belong to a new abnormal type, the target abnormal information recognition model may recognize the abnormal information belonging to the new abnormal type.

[0170] In the embodiment of the present application, the target abnormal information recognition model is trained on the basis of the original abnormal information recognition model. Of course, in other embodiments of the present application, the target abnormal information recognition model can also be a completely new model, that is, the target abnormal information recognition model can be trained on the basis of the original abnormal information recognition model, and the target abnormal information recognition model and the original abnormal information recognition model are different models.

[0171] Figure 8 An embodiment according to the present application is shown Figure 6 Flow chart of details of step 270 in the embodiment. Figure 8 As shown, performing abnormal information recognition based on the target abnormal information recognition model may include the following steps:

[0172] In step 272, abnormal information released within the next predetermined time interval is identified based on the target abnormal information identification model.

[0173] The next scheduled time interval may be 0:00-24:00 of the next day.

[0174] After executing step 272, the step of determining the information related parties of each abnormal information and subsequent steps will be re-executed based on the abnormal information identified in the next predetermined time interval, thereby realizing normalized monitoring of new types of abnormal information.

[0175] Please continue to see Figure 3 As shown, after step 3110, the following steps are also included:

[0176] Step 3120, customized model training.

[0177] The customized model here can be the model used to detect illegal advertisements in step 360. This step can be based on the illegal advertisements that have been manually reviewed in step 3110 to train the model used in step 360.

[0178] Since information stakeholders with low credit are more likely to publish some new types of abnormal information in order to avoid abnormal information detection, in the embodiment of the present application, after detecting the target information stakeholders who publish abnormal information, their credit scores are judged. If they are determined to be information stakeholders with low credit according to their credit scores, abnormal information filtering is directly performed on the information related to them, so that new types of target abnormal information are more likely to be obtained. Then, these target abnormal information are used as training samples corresponding to new abnormal types for model training, so that abnormal information belonging to new abnormal types can be detected in a timely and accurate manner.

[0179] Fig. 9 A schematic diagram showing an illegal advertisement published by an advertisement publisher with a low credit score according to an embodiment of the present application. Fig. 9 As shown, advertisers can publish advertisements through self-media or public accounts, many of which may be illegal advertisements.

[0180] Fig.10 Schematic diagram of the overall framework according to an embodiment of the present application is shown. Fig.10 As shown, first, the information of illegal advertisers is obtained from the illegal advertisers information database; then, the feature values ​​of illegal advertisers are obtained through the illegal advertisers feature extraction module; then, the credit score of the advertiser is obtained through the XGBoost advertiser credit score module; next, the illegal advertisers with low credit scores are monitored to obtain new types of illegal advertisements; then, the new type of illegal advertisements are used to train a new violation model; finally, the new violation model is used to detect the latest new type of illegal advertisements corresponding to the advertiser, and the new type of illegal advertisements are used to update the violation labels of the advertisements corresponding to the illegal advertisers information database, so that advertisers who publish new types of illegal advertisements can be monitored.

[0181] In summary, the method for identifying abnormal information provided by the embodiment of the present application can at least achieve the following beneficial effects:

[0182] 1. By introducing the XGBoost advertiser credit rating model, instead of relying solely on customized illegal models for identification, the algorithm can quickly and effectively perceive new types of illegal advertising samples, thereby improving the update timeliness of new types of illegal advertising samples.

[0183] 2. Technically, by combining actively perceived samples with weak model filtering to replace manually prepared training samples, the new illegal advertising model is continuously iterated, and the accuracy of illegal advertising identification is increased from 80% to 95%, and the timeliness of the model in detecting new variants of illegal advertising is greatly improved.

[0184] 3. The solution of the embodiment of the present application is applied in national advertising projects, monitoring more than 100,000 illegal advertisers every day, and associating more than 1,000 new illegal advertising samples, with an accuracy rate of more than 95% and a coverage rate of more than 80%.

[0185] The following describes an embodiment of the device of the present application, which can be used to execute the method for identifying abnormal information in the above embodiment of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method for identifying abnormal information in the above embodiment of the present application.

[0186] Fig.11 A block diagram of an abnormal information identification device according to an embodiment of the present application is shown.

[0187] Reference Fig.11 As shown, according to an embodiment of the present application, an abnormal information identification device 1100 includes: an acquisition unit 1100, a determination unit 1120, an input unit 1130, a filtering unit 1140 and a training and identification unit 1150, wherein the acquisition unit 1100 is used to acquire feature information of a target information-related party; the determination unit 1120 is used to determine feature values ​​corresponding to multiple abnormal information identification features according to the feature information; the input unit 1130 is used to input the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predict the credit score of the target information-related party through the credit scoring model; the filtering unit 1140 is used to filter out target abnormal information from information related to the target information-related party if it is determined that the target information-related party belongs to a specified credit category according to the credit score, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories; the training and identification unit 1150 is used to obtain a target abnormal information identification model according to the target abnormal information training, and perform abnormal information identification based on the target abnormal information identification model.

[0188] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a target information related party determination unit; before obtaining the characteristic information of the target information related party, the target information related party determination unit is used to: identify at least one abnormal information released within a predetermined time interval based on the original abnormal information recognition model; determine the information related party of each of the abnormal information as the target information related party; the training and recognition unit 1150 is configured to: use the target abnormal information as a training sample, train the original abnormal information recognition model based on the training sample, and obtain the target abnormal information recognition model.

[0189] In some embodiments of the present application, based on the aforementioned scheme, the training and identification unit 1150 is configured to: identify the abnormal information released within the next predetermined time interval based on the target abnormal information identification model, and re-execute the steps and subsequent steps of determining the information related parties of each abnormal information based on the identified abnormal information.

[0190] In some embodiments of the present application, based on the aforementioned solution, the abnormality type of the target abnormality information is different from the abnormality type of each of the abnormality information.

[0191] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a credit scoring model training unit; before determining the feature values ​​corresponding to the multiple abnormal information identification features respectively according to the feature information, the credit scoring model training unit is configured to: obtain the feature information of multiple information stakeholders and the credit labels of each information stakeholder; for each information stakeholder, determine the feature values ​​corresponding to the multiple features of the information stakeholder according to the feature information of the information stakeholder; filter out the multiple abnormal information identification features from the multiple features according to the feature values ​​and credit labels of each information stakeholder; construct a training sample set according to the feature values ​​corresponding to the abnormal information identification features of each information stakeholder and the credit labels of each information stakeholder; and obtain a credit scoring model by training based on the training sample set.

[0192] In some embodiments of the present application, based on the aforementioned scheme, the filtering unit 1140 is configured to: match the information related to the target information-related party with a preset key dictionary respectively; and filter out target abnormal information from the information related to the target information-related party according to the matching results.

[0193] In some embodiments of the present application, based on the aforementioned scheme, the credit scoring model is trained based on an extreme gradient boosting model, and the extreme gradient boosting model splits the tree in the following manner: for each abnormal information identification feature, the gain value of each segmentation point of the abnormal information identification feature is determined based on a training sample set, and the segmentation point with the largest gain value is selected as the optimal segmentation point of the abnormal information identification feature; the tree is split according to the optimal segmentation point of each abnormal information identification feature.

[0194] In some embodiments of the present application, based on the aforementioned solution, the information is an advertisement, and the target information-related party is the publisher of the target advertisement or the producer of the product disseminated by the target advertisement.

[0195] In some embodiments of the present application, based on the aforementioned scheme, the abnormal information identification features belong to one of the following categories: features related to the status recorded in the management department, features related to historical abnormal statistics, and features related to web pages used to guide advertisement clickers to perform specific actions.

[0196] Fig.12 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0197] It should be noted that Fig.12 The computer system 1200 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0198] like Fig.12 As shown, the computer system 1200 includes a central processing unit (CPU) 1201, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1202 or the program loaded from the storage part 1208 to the random access memory (RAM) 1203, such as executing the method described in the above embodiment. In the RAM 1203, various programs and data required for system operation are also stored. The CPU 1201, the ROM 1202 and the RAM 1203 are connected to each other through the bus 1204. The input / output (I / O) interface 1205 is also connected to the bus 1204.

[0199] The following components are connected to the I / O interface 1205: an input section 1206 including a keyboard, a mouse, etc.; an output section 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1210 as needed so that a computer program read therefrom is installed into the storage section 1208 as needed.

[0200] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1209, and / or installed from a removable medium 1211. When the computer program is executed by a central processing unit (CPU) 1201, various functions defined in the system of the present application are executed.

[0201] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0202] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0203] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0204] As one aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0205] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0206] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0207] It can be understood that in the specific implementation of this application, it involves the acquisition of characteristic information of information stakeholders. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0208] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0209] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for identifying abnormal information, characterized in that: The method comprises: Obtain characteristic information of parties related to target information; Determining feature values ​​corresponding to a plurality of abnormal information identification features respectively according to the feature information; Inputting the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predicting the credit score of the target information related party through the credit scoring model; If it is determined according to the credit score that the target information-related party belongs to a specified credit category, filtering out target abnormal information from information related to the target information-related party, wherein the credit score of the information-related party belonging to the specified credit category is lower than the credit score of the information-related party belonging to other credit categories; A target abnormal information recognition model is obtained according to the target abnormal information training, and abnormal information recognition is performed based on the target abnormal information recognition model.

2. The method for identifying abnormal information according to claim 1, characterized in that: Before acquiring the characteristic information of the party related to the target information, the method further includes: Identifying at least one abnormal information released within a predetermined time interval based on the original abnormal information identification model; Determining information stakeholders of each of the abnormal information as the target information stakeholders; The training of obtaining a target abnormal information recognition model according to the target abnormal information includes: The target abnormal information is used as a training sample, and the original abnormal information recognition model is trained based on the training sample to obtain the target abnormal information recognition model.

3. The method for identifying abnormal information according to claim 2, characterized in that: The performing abnormal information identification based on the target abnormal information identification model includes: Based on the target abnormal information identification model, the abnormal information released within the next predetermined time interval is identified, and based on the identified abnormal information, the step of determining the information related parties of each abnormal information and subsequent steps are re-executed.

4. The method for identifying abnormal information according to claim 2, characterized in that: The abnormality type of the target abnormality information is different from the abnormality type of each of the abnormality information.

5. The method for identifying abnormal information according to claim 1, characterized in that: Before determining the feature values ​​corresponding to the plurality of abnormal information identification features respectively according to the feature information, the method further includes: Obtaining characteristic information of multiple information stakeholders and credit labels of each information stakeholder; For each information stakeholder, determining feature values ​​of the information stakeholder corresponding to the plurality of features respectively according to the feature information of the information stakeholder; Filtering the plurality of abnormal information identification features from the plurality of features according to the feature values ​​and credit labels of each information stakeholder; Constructing a training sample set according to the feature values ​​corresponding to the abnormal information identification features of each information stakeholder and the credit labels of each information stakeholder; A credit scoring model is obtained by training based on the training sample set.

6. The method for identifying abnormal information according to claim 1, characterized in that: The filtering out target abnormal information from the information related to the target information related party includes: Matching the information related to the target information related party with the preset key dictionary respectively; Filter out target abnormal information from information related to the target information related party according to the matching result.

7. The method for identifying abnormal information according to claim 1, characterized in that: The credit scoring model is trained based on the extreme gradient boosting model, which splits the tree in the following way: For each abnormal information identification feature, determine the gain value of each segmentation point of the abnormal information identification feature based on the training sample set, and select the segmentation point with the largest gain value as the optimal segmentation point of the abnormal information identification feature; The tree is split according to the best segmentation point of each abnormal information recognition feature.

8. The method for identifying abnormal information according to any one of claims 1 to 7, characterized in that: The information is an advertisement, and the target information related party is the publisher of the target advertisement or the producer of the product disseminated by the target advertisement.

9. The method for identifying abnormal information according to claim 8, characterized in that: The abnormal information identification feature belongs to one of the following categories: a feature related to a status recorded in an administrative department, a feature related to historical abnormal statistical data, and a feature related to a web page used to guide an advertisement clicker to perform a specific action.

10. A device for identifying abnormal information, characterized in that: The device comprises: An acquisition unit, used to acquire characteristic information of a party related to target information; a determining unit, configured to determine, according to the feature information, feature values ​​corresponding to the plurality of abnormal information identification features; An input unit, used to input the feature values ​​corresponding to each abnormal information identification feature into a pre-trained credit scoring model, and predict the credit score of the target information related party through the credit scoring model; a filtering unit, configured to filter out target abnormal information from information related to the target information related party if it is determined according to the credit score that the target information related party belongs to a specified credit category, wherein the credit score of the information related party belonging to the specified credit category is lower than the credit score of the information related party belonging to other credit categories; The training and identification unit is used to obtain a target abnormal information identification model according to the target abnormal information training, and perform abnormal information identification based on the target abnormal information identification model.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying abnormal information according to any one of claims 1 to 9 is implemented.

12. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the method for identifying abnormal information as described in any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for identifying abnormal information as described in any one of claims 1 to 9.

Images