Abnormal group processing method and device, equipment and storage medium

Abstract

The invention relates to the technical field of security, and provides an abnormal group processing method and device, equipment and a storage medium. The method comprises the following steps: receiving target abnormal information carrying a group identifier of a target set, and carrying out associated storage on the target abnormal information and a target group node corresponding to the group identifier. And determining a target group structure diagram to which the target group node belongs based on the latest acquired group relationship data. And based on the abnormal behavior represented by each piece of abnormal information included in the target group structure diagram, obtaining a group abnormal evaluation value of the target group node, and when the group abnormal evaluation value satisfies a preset evaluation condition, outputting the target group as an abnormal group. Through the method, the problems of relatively low accuracy and relatively low coverage of an abnormal industry processing scheme in related technologies can be solved. The embodiment of the invention can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic, auxiliary driving and the like.

Description

Background Art

[0002] Due to the ubiquity of instant messaging applications, a large number of abnormal industries perform abnormal operations on ordinary objects in instant messaging applications, causing losses to the interests of ordinary objects. Now the abnormal industries have changed their operation methods from the past of registering new accounts in large quantities. They will use normal objects with no abnormal records to create groups, add normal objects to groups, and use normal objects to help send abnormal advertisements, etc., to avoid the existing processing solutions of instant messaging applications.

[0003] The abnormal industry processing solution in the related technology mainly performs point-to-point identification on abnormal accounts, and processes them after analyzing the abnormal operation mode and abnormal operation records of abnormal accounts. However, in order to prevent accidental injury to normal objects, this processing method will limit the number threshold for judging whether the operation record is an abnormal operation record, so that abnormal industries can avoid being identified as abnormal accounts by testing the number threshold within a certain period of time. It can be seen that this processing method is easy to miss abnormal accounts, that is, there is a problem of low coverage.

[0004] In addition, the overall solution for abnormal groups is usually to use clustering algorithms to group abnormal accounts together for processing. However, this solution often has a high execution delay, and because abnormal groups involve more accounts and groups, it is easy to accidentally hurt some normal objects in the group, and there is a problem of low accuracy.

[0005] This shows that the abnormal industry processing solutions in related technologies have problems of low accuracy and low coverage. Summary of the invention

[0006] The embodiments of the present application provide a method, device, equipment and storage medium for handling abnormal groups to solve the problems of low accuracy and low coverage of abnormal industry handling solutions in related technologies.

[0007] In a first aspect, an embodiment of the present application provides a method for handling an abnormal group, including:

[0008] Receive target abnormality information carrying a group identifier of a target set, and associate and save the target abnormality information with a target group node corresponding to the group identifier; the target abnormality information indicates that an abnormal behavior has occurred in a member of the target set; and the target group node indicates the target set;

[0009] Based on the most recently acquired group relationship data, determine the target group structure diagram to which the target group node belongs; wherein the group relationship data represents: the member inclusion relationship between the sets represented by different group nodes; the target group structure diagram has the target group node representing the target group as the root node, multiple group nodes as child nodes, and each group node is associated with and stored with at least one abnormal information; the set represented by each group node includes the same members who have committed abnormal behaviors as the set represented by at least one other group node;

[0010] Based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, the group abnormality evaluation value of the target group node is obtained, and when the group abnormality evaluation value meets the preset evaluation condition, the target group is output as an abnormal group.

[0011] In a second aspect, the embodiment of the present application further provides an abnormal group processing device, including:

[0012] A receiving unit is used to receive target abnormality information carrying a group identifier of a target set; the target abnormality information indicates that an abnormal behavior occurs in a member of the target set;

[0013] An association storage unit, used to associate and store the target abnormal information with a target group node corresponding to the group identifier; the target group node represents the target set;

[0014] A structure diagram determining unit is used to determine the target group structure diagram to which the target group node belongs based on the most recently acquired group relationship data; wherein the group relationship data represents: the member inclusion relationship between the sets represented by different group nodes; the target group structure diagram has the target group node representing the target group as the root node, multiple group nodes as child nodes, and each group node is associated with and stored with at least one abnormal information; the set represented by each group node includes the same members who have committed abnormal behaviors as the set represented by at least one other group node;

[0015] The abnormal group processing unit is used to obtain the group abnormality evaluation value of the target group node based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, and output the target group as an abnormal group when the group abnormality evaluation value meets the preset evaluation condition.

[0016] In a possible implementation, when the association storage unit associates and stores the target abnormal information with the target group node corresponding to the group identifier, it is used to:

[0017] Based on the latest mapping relationship between each group identifier and each group structure diagram, query whether a reference group structure diagram is associated with the corresponding group identifier; if so, traverse each group node included in the reference group structure diagram, obtain the target group node corresponding to the group identifier, and associate the target exception information with the target group node for storage; otherwise, based on the group identifier, create a new reference group structure diagram, the new reference group structure diagram includes: a new target group node, and a new reference group node representing the group to which the target set belongs; the target exception information is associated with the new target group node for storage.

[0018] In one possible implementation, the associated storage unit queries whether a reference group structure diagram is stored in association with the group identifier based on the latest mapping relationship between each group identifier and each group structure diagram, and is used to: query whether a reference group node is stored in association with the group identifier based on the latest mapping relationship between each group identifier and each group node; if so, determine that a reference group structure diagram is stored in association with the group identifier, and obtain the reference group structure diagram to which the reference group node belongs based on the subordinate relationship between each group node and each group structure diagram; otherwise, determine that there is no reference group structure diagram stored in association with the group identifier.

[0019] In a possible implementation, when the structure diagram determination unit determines the target group structure diagram to which the target group node belongs based on the latest acquired group relationship data, it is used to: obtain at least one associated exception information that has an associated relationship with the target exception information based on the latest acquired group relationship data; the associated relationship at least represents that: the member triggering the associated exception information is the same as the member triggering the target exception information; based on the group identifier carried by each of the at least one associated exception information, and the mapping relationship between the latest group identifier and the group structure diagram, obtain at least one associated group structure diagram to which each of the at least one associated exception information belongs; based on the number of nodes included in each of the at least one associated group structure diagram and the reference group structure diagram, merge the at least one associated group structure diagram with the reference group structure diagram to obtain the target group structure diagram.

[0020] In one possible implementation, the structure diagram determination unit merges the associated group structure diagram with the reference group structure diagram based on the number of nodes each of the at least one associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram, and is used to: determine, based on the number of nodes each of the associated group structure diagram and the reference group structure diagram, that the one with a larger number of nodes is the target group structure diagram, and the remaining group structure diagrams are non-target group structure diagrams; and use each group node included in the non-target group structure diagram as a child node of the target group node, and integrate them into the target group structure diagram.

[0021] In a possible implementation, the structure diagram determining unit merges the associated group structure diagram with the reference group structure diagram based on the number of group nodes each of the associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram, and is further used to:

[0022] Based on the group identifiers corresponding to the respective group nodes included in the target group structure diagram, the mapping relationship between the group identifiers and the group structure diagram is updated.

[0023] In a possible implementation, when the abnormal group processing unit obtains the group abnormality evaluation value of the target group node based on the abnormal behavior represented by each abnormal information included in the target group structure diagram, it is used to: determine the abnormality evaluation value corresponding to the abnormal behavior represented by each abnormal information included in the target group structure diagram based on the mapping relationship between abnormal behavior and abnormality evaluation value; for the multiple group nodes, perform the following operations respectively: determine the group abnormality evaluation value of the group node based on the abnormality evaluation value corresponding to the abnormal behavior represented by each abnormal information associated with and saved on the group node; obtain the group abnormality evaluation value of the target group node based on the group abnormality evaluation value of each group node included in the target group structure diagram.

[0024] In a possible implementation, when the abnormal group processing unit obtains the group abnormality evaluation value of the target group node based on the group abnormality evaluation value of each group node included in the target group structure diagram, it is used to: determine the scale evaluation value of the target group based on the number of group nodes included in the target group structure diagram; and obtain the group abnormality evaluation value based on the group abnormality evaluation value of each group node included in the target group structure diagram in combination with the scale evaluation value.

[0025] In a third aspect, an embodiment of the present application further provides a computer device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of any one of the above-mentioned abnormal group processing methods.

[0026] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of any one of the above-mentioned abnormal group processing methods.

[0027] In a fifth aspect, an embodiment of the present application further provides a computer program product, including computer instructions, which are executed by a processor to perform the steps of any of the above-mentioned abnormal group processing methods.

[0028] The beneficial effects of this application are as follows:

[0029] The embodiment of the present application provides a method, device, equipment and storage medium for processing abnormal groups. In the method, each abnormal information is associated with the set to which it belongs through a group identifier, and then the sets with associated relationships are combined into a group according to the group relationship data, and the group is evaluated whether it is an abnormal group according to the group abnormality evaluation value.

[0030] Since the preset evaluation conditions are set from the perspective of the group instead of processing a single abnormal account, even if an abnormal industry tests the threshold by creating a new account, the abnormal group to which the new account belongs can be determined based on the group association relationship, thereby solving the problem in related technologies that abnormal industries can avoid being identified as abnormal accounts by testing the threshold, and can also improve the accuracy and coverage of abnormal group output.

[0031] Furthermore, the efficiency from receiving target abnormal information to outputting abnormal groups has been significantly improved. For the current large number of short and fast abnormal cases, the abnormal groups can be effectively handled before normal objects suffer economic losses, thereby maintaining the safety of normal objects to a great extent.

[0032] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 This is an optional schematic diagram of an application scenario in an embodiment of the present application;

[0035] Figure 2A flowchart of a method for handling abnormal groups provided in an embodiment of the present application;

[0036] Figure 3A One of the target abnormal information association storage schematic diagrams provided in the embodiment of the present application;

[0037] Figure 3B One of the target abnormal information association storage schematic diagrams provided in the embodiment of the present application;

[0038] Figure 4 A schematic diagram of a process for determining a target group structure diagram provided in an embodiment of the present application;

[0039] Figure 5 A schematic diagram of a process for obtaining a group abnormality assessment value provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of the overall process of the abnormal group processing method provided in the embodiment of the present application;

[0041] Fig. 7A One of the process diagrams of the abnormal group processing method provided in the embodiment of the present application;

[0042] Figure 7B One of the process diagrams of the abnormal group processing method provided in the embodiment of the present application;

[0043] Figure 7C One of the process diagrams of the abnormal group processing method provided in the embodiment of the present application;

[0044] Figure 8 A schematic diagram of the structure of an abnormal group processing device provided in an embodiment of the present application;

[0045] Fig. 9 A schematic diagram of a hardware structure of a computer device provided in an embodiment of the present application;

[0046] Fig.10 A schematic diagram of the hardware composition structure of another computer device to which the embodiment of the present application is applied. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0048] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0049] 1) Abnormal accounts: instant messaging application accounts that participate in or organize abnormal behaviors. Abnormal behaviors may include illegal behaviors, such as obtaining economic resources of ordinary objects through illegal operations, causing losses to the interests of ordinary objects.

[0050] 2) Normal account: an instant messaging application account that is active for a long time, has regular social activities, and has no abnormal records. Among them, abnormal records may include records of being punished or reminded due to abnormal actions.

[0051] 3) Abnormal set: In instant messaging applications, a group of illegal accounts that perform abnormal behaviors is called an abnormal set. The abnormal set can include abnormal accounts and normal accounts.

[0052] 4) Abnormal groups: In instant messaging applications, abnormal accounts and abnormal collections that have certain associations are grouped together and are called abnormal groups.

[0053] The following is a brief introduction to the design concept of the embodiment of the present application:

[0054] Due to the ubiquity of instant messaging applications, a large number of abnormal industries perform abnormal operations on ordinary objects in instant messaging applications, causing losses to the interests of ordinary objects. Now the abnormal industries have changed their operation methods from the past of registering new accounts in large quantities. They will use normal objects with no abnormal records to create groups, add normal objects to groups, and use normal objects to help send abnormal advertisements, etc., to avoid the existing processing solutions of instant messaging applications.

[0055] The abnormal industry processing solution in the related technology mainly performs point-to-point identification on abnormal accounts, and processes them after analyzing the abnormal operation mode and abnormal operation records of abnormal accounts. However, in order to prevent accidental injury to normal objects, this processing method will limit the number threshold for judging whether the operation record is an abnormal operation record, so that abnormal industries can avoid being identified as abnormal accounts by testing the number threshold within a certain period of time. It can be seen that this processing method is easy to miss abnormal accounts, that is, there is a problem of low coverage.

[0056] In addition, the overall solution for abnormal groups is usually to use clustering algorithms to group abnormal accounts together for processing. However, this solution often has a high execution delay, and because abnormal groups involve more accounts and groups, it is easy to accidentally hurt some normal objects in the group, and there is a problem of low accuracy.

[0057] In addition, the abnormal industry will deliberately prolong the cycle of abnormal behavior, that is, use more tool accounts to assist in the execution of abnormal behavior, making it more difficult to identify abnormal accounts. For example, instead of one abnormal account entering multiple groups, multiple abnormal accounts enter multiple groups, and the abnormal account is used briefly and then abandoned to execute abnormal behavior. In this case, the accuracy of the abnormal industry processing solution in the relevant technology is low.

[0058] This shows that the abnormal industry processing solutions in related technologies have problems of low accuracy and low coverage.

[0059] In view of this, an embodiment of the present application provides an abnormal group processing method, device, equipment and storage medium. The method includes: receiving target abnormal information carrying a group identifier of a target set, and associating and saving the target abnormal information with the target group node corresponding to the group identifier. Based on the latest acquired group relationship data, determine the target group structure diagram to which the target group node belongs. Based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, obtain the group abnormality evaluation value of the target group node, and when the group abnormality evaluation value meets the preset evaluation conditions, output the target group as an abnormal group.

[0060] It can be seen that the present application associates and saves each abnormal information with the set to which it belongs through the group identifier. Then, according to the group relationship data, the sets with association relationships are combined into a group, and the group is evaluated whether it is an abnormal group according to the group abnormal evaluation value. Since the preset evaluation conditions are set from the perspective of the group, rather than processing a single abnormal account, even if the abnormal industry tests the threshold through a new account, the abnormal group to which the new account belongs can be determined according to the group association relationship, thereby solving the problem that the abnormal industry in the related technology can avoid being identified as an abnormal account by testing the threshold, and can also improve the accuracy and coverage of the abnormal group output. And significantly improve the efficiency from receiving the target abnormal information to outputting the abnormal group, for a large number of short, flat and fast abnormal cases now, it can effectively deal with the abnormal group before the normal object suffers economic losses, thereby greatly maintaining the safety of the normal object.

[0061] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0062] Figure 1 One application scenario is shown, including a physical terminal device 110 and a server 120. The physical terminal device 110 establishes a communication connection with the server 120 via a wired network or a wireless network.

[0063] The physical terminal device 110 may generate target abnormality information in response to an abnormal behavior of a member in the target set occurring in the target set, and send the target abnormality information to the server 120 through the communication network.

[0064] After receiving the target abnormal information, the server 120 can associate and save the target abnormal information with the target group node corresponding to the group identifier according to the group identifier of the target set carried in the target abnormal information. Then, based on the latest acquired group relationship data, determine the target group structure diagram to which the target group node belongs. Then, based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, obtain the group abnormal evaluation value of the target group node, and when the group abnormal evaluation value meets the preset evaluation condition, output the target group as an abnormal group.

[0065] The physical terminal device 110 of the embodiment of the present application includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The embodiment of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0066] The server 120 of the embodiment of the present application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. This application does not make any restrictions here.

[0067] See also Figure 2 This is an exemplary flow chart of a method for handling abnormal groups provided in an embodiment of the present application. The method can be applied to Figure 1 In the server 120, the following steps 201 to 203 may be included:

[0068] Step 201: receiving target abnormality information carrying a group identifier of a target set, and associating and storing the target abnormality information with a target group node corresponding to the group identifier.

[0069] The target abnormal information represents: a member of the target set has abnormal behavior. The target group node represents the target set.

[0070] In a possible implementation, the target exception information is one of the exception information. Each piece of exception information can be represented by a triple including an account item, a group item, and a negative feedback item. Among them, the account item can include account-related information, such as an account identifier, etc.; the group item can include set-related information, such as a group identifier, etc.; the negative feedback item can include negative feedback information, the reason for triggering the negative feedback, etc. The negative feedback information is information indicating that the account has triggered due to an abnormal behavior, for example, being reported, being reminded, etc. The reason for triggering the negative feedback represents the abnormal behavior that triggers the negative feedback information.

[0071] For example, the target exception information is (account 123, set a, (being reminded, sending abnormal advertisements)). Among them, "account 123" represents the account item in the triple, "set a" represents the group item in the triple, "being reminded, sending abnormal advertisements" represents the negative feedback item in the triple, "being reminded" is the negative feedback information, and "sending abnormal advertisements" is the reason for triggering the negative feedback. That is to say, the target exception information indicates that account 123 in set a was reminded because of sending abnormal advertisements, thus triggering the target exception information.

[0072] Optionally, the negative feedback information can be represented by the identifier of the category to which the corresponding negative feedback belongs. For example, 0001 represents being reported, 0002 represents being reminded, etc. Similarly, the reason for triggering can also be represented by the identifier of the category to which the abnormal behavior belongs. The present application does not limit the representation form of the negative feedback item.

[0073] In a possible implementation, when associating and saving the target exception information with the target group node corresponding to the group identifier, it is possible to query whether the corresponding group identifier is associated and saved with a reference group structure diagram based on the mapping relationship between the latest group identifiers and the respective group structure diagrams.

[0074] If so, traverse each group node included in the reference group structure diagram to obtain the target group node corresponding to the group identifier, and associate and save the target exception information with the target group node.

[0075] Otherwise, create a new reference group structure diagram based on the group identifier. The new reference group structure diagram includes: a new target group node, and a new reference group node representing the group to which the target set belongs. Associate and save the target exception information with the new target group node.

[0076] Optionally, the target group node corresponding to the group identifier can be a group node whose node identifier is the same as the group identifier. For example, the target group node corresponding to the group identifier a is the group node with the node identifier a.

[0077] Alternatively, the target group node corresponding to the group identifier may be determined based on a pre-stored mapping relationship between the group identifier and the group node. In the mapping relationship, the group identifier and the group node are in one-to-one correspondence. For example, the mapping relationship may include: group identifier a corresponds to a group node with a node identifier of 1, group identifier b corresponds to a group node with a node identifier of 2, and group identifier c corresponds to a group node with a node identifier of 3. Then, when the group identifier carried in the target abnormal information is b, the node identifier of the target group node can be determined to be 2 based on the mapping relationship.

[0078] In one example, when a reference group structure diagram is stored in association with the corresponding group identifier, see Figure 3A One of the target abnormal information association and storage schematic diagrams provided in the embodiment of the present application. Assuming that the group identifier carried in the target abnormal information is b, in the server, based on the latest mapping relationship between each group identifier and each group structure diagram, the identifier of the reference group structure diagram associated with b in the server is queried as group structure diagram 01. Since group structure diagram 01 includes group node A, group node a and group node b, abnormal information 1 is associated and stored on group node a, and abnormal information 2 is associated and stored on group node b. By traversing each group node included in group structure diagram 02, it can be obtained that group node b is the target group node corresponding to group identifier b, and the target abnormal information is associated and stored with group node b.

[0079] In one example, when there is no reference group structure diagram associated with the corresponding group identifier, see Figure 3B One of the target abnormal information association and storage schematic diagrams provided in the embodiment of the present application. Assuming that the group identifier carried in the target abnormal information is g, after querying, it is determined that there is no reference group structure diagram associated and stored with the corresponding group identifier g in the server, then a new reference group structure diagram is created: group structure diagram 07. And in group structure diagram 07, group node G and group node g are included, wherein group node g and group node G are both nodes created when creating group structure diagram 07, and group node g is a child node of group node G. Then the target abnormal information is associated and stored with group node g.

[0080] In some embodiments, the server may store an index between each group identifier and each group structure diagram, which is used to store the mapping relationship between each group identifier and each group structure diagram in the form of a key-value pair, and update the index each time each group structure diagram stored in the server is updated. Each group structure diagram may correspond to at least one group identifier.

[0081] In some other embodiments, based on the latest mapping relationship between each group identifier and each group structure diagram, querying whether the corresponding group identifier is associated with a reference group structure diagram can be performed as follows: based on the latest mapping relationship between each group identifier and each group node, querying whether the corresponding group identifier is associated with a reference group node. If so, it is determined that the corresponding group identifier is associated with a reference group structure diagram, and based on the subordinate relationship between each group node and each group structure diagram, the reference group structure diagram to which the reference group node belongs is obtained. Otherwise, it is determined that the corresponding group identifier is not associated with a reference group structure diagram.

[0082] Specifically, the mapping relationship between each group identifier and each group node can be an index from the group identifier to the group node, and the subordinate relationship between each group node and each group structure diagram can be an index from the group node to the group structure diagram. That is, when the server queries whether the corresponding group identifier is associated with a reference group structure diagram, it can query based on the stored index from the group identifier to the group node and the index from the group node to the group structure diagram. And the index from the group identifier to the group node and the index from the group node to the group structure diagram are updated each time the group structure diagram is updated.

[0083] Step 202: Based on the most recently acquired group relationship data, determine the target group structure diagram to which the target group node belongs.

[0084] The group relationship data may be updated in real time according to the changes in the members in each set. The group relationship data indicates: the member inclusion relationship between the sets represented by different group nodes. The member inclusion relationship may be the inclusion relationship of any member. For example, group relationship data 1 may indicate: set a and set b include 3 identical members: account 111, account 222, account 333. Alternatively, the member inclusion relationship may also be the inclusion relationship of members who have committed abnormal behaviors. For example, group relationship data 2 may indicate: set a and set b include 1 identical member who has committed abnormal behaviors: account 111.

[0085] In some embodiments, the group relationship data may be a type of relationship data, which may include set-related information of each set, and account-related information of each member in the set. In this scenario, the set features of each set may also be calculated based on the group relationship data, such as the number of members in the set, the time when the set was established, whether there is negative feedback in the set, etc. The account features of each member in each set may also be calculated based on the group relationship data, such as the registration time of the account, the number of times the account has entered the set, etc. After the set features and account features are obtained, they may be stored in a database. In addition, the set features and account features may be recalculated each time the group relationship data is updated.

[0086] The server may include a graph database, which may include one or more group structure diagrams, each group structure diagram representing the architecture of a group, and each group structure diagram may include a group node and at least one group node. The target group structure diagram is a group structure diagram in the graph database. The target group structure diagram has a target group node representing the target group as the root node, multiple group nodes as child nodes of the target group node, and at least one abnormal information is associated and stored on each group node. The set represented by each group node includes the same members who have experienced abnormal behavior as the set represented by at least one other group node.

[0087] It should be noted that when there is no associated abnormal information associated with the target abnormal information in the graph database, the target group structure graph may also include a group node.

[0088] For a possible implementation, see Figure 4 A schematic diagram of a process for determining a target group structure diagram provided in an embodiment of the present application. If there is at least one associated abnormal information associated with the target abnormal information in the graph database, the server may perform the following steps 2021-2023 when executing step 202:

[0089] Step 2021: Based on the most recently acquired group relationship data, obtain at least one associated abnormal information that has an associated relationship with the target abnormal information.

[0090] The association relationship at least represents that the member that triggers the associated abnormal information is the same as the member that triggers the target abnormal information.

[0091] Optionally, the association relationship may further be characterized in that: the set of triggering associated abnormal information includes members that trigger target abnormal information, or may further be characterized in that the set of triggering target abnormal information includes members that trigger associated abnormal information.

[0092] Specifically, the server may use a graph operator query method to search in the stored group relationship data for at least one associated exception information that is associated with the target exception information according to the account-related information, collection-related information, and negative feedback information included in the target exception information.

[0093] In some embodiments, it is also possible to obtain associated accounts and associated sets associated with members who trigger target abnormal information within a preset period based on the latest acquired group relationship data and preset association conditions, and then obtain associated abnormal information based on the associated accounts and associated sets.

[0094] In one example, based on the latest acquired group relationship data, other members in the target set that have had abnormal behaviors within a week can be determined: account 111, account 222, and account 333. It can also be determined that account 111 also belongs to set a and set c, account 222 also belongs to set b and set d, and account 333 also belongs to set b and set e. In set ae, the sets that have had abnormal behaviors are: set b and set d. Then account 111, account 222, and account 333 are associated accounts, and set b and set d are associated sets. Based on the associated accounts and associated sets, the abnormal information triggered by the abnormal behavior of any one of account 111, account 222, and account 333, as well as the abnormal information associated and saved on the group nodes of set b and set d, can be used as associated abnormal information.

[0095] Optionally, in order to ensure the consistency of constituting groups, abnormal groups are distinguished from normal groups, and only adjacent sets and members in the adjacent sets may be considered when determining associated sets, that is, other sets to which members in the adjacent sets belong are no longer considered.

[0096] In some embodiments, in order to further ensure the consistency of the group composition, after obtaining the associated accounts and associated sets associated with the members who triggered the target abnormal information within a preset period based on the latest acquired group relationship data, filtering conditions can be added, and the set characteristics and account characteristics can be used to determine the associated accounts and associated sets in the obtained associated accounts and associated sets that meet the filtering conditions, and then the associated abnormal information is obtained based on the filtered associated accounts and associated sets.

[0097] Taking the scenario in the above example as an example, after determining that account 111, account 222, and account 333 are associated accounts, the associated accounts can be filtered according to filtering condition 1: the account registration time is within one week, so as to obtain the filtered associated accounts: account 222 and account 333. Then, from the associated sets: set b and set d, according to filtering condition 2: filtering the sets that account 222 and account 333 joined within one week, the filtered associated set: set b is determined. Then, based on the filtered associated accounts and associated sets, the abnormal information triggered by the abnormal behavior of any one of account 222 and account 333, as well as the abnormal information associated and saved on the group node of set b, are all used as the associated abnormal information.

[0098] It should be noted that the above-mentioned preset period can be set according to actual conditions or experience, and can be one week, ten days, one month, etc. The above-mentioned preset association conditions and screening conditions can be iteratively optimized according to the business to which the abnormal behavior belongs, and this application does not limit this.

[0099] In a possible implementation, in a graph database, it can be considered that there is an associated edge between the target abnormal information and the associated abnormal information, and there is an associated edge between the group nodes of the associated set and the target group nodes.

[0100] Step 2022: Based on the group identifier carried by each of the at least one associated exception information and the mapping relationship between the latest group identifier and the group structure diagram, obtain at least one associated group structure diagram to which each of the at least one associated exception information belongs.

[0101] For example, assume that at least one associated abnormal information includes abnormal information 4 and abnormal information 5, and abnormal information 4 is associated and stored in cluster node c, and abnormal information 5 is stored in cluster node d. If cluster node c and cluster node d belong to the same group structure diagram: group structure diagram 02, then group structure diagram 02 is determined to be an associated group structure diagram. If cluster node c and cluster node d belong to different group structure diagrams, cluster node c belongs to group structure diagram 02, and cluster node d belongs to group structure diagram 03, then group structure diagram 02 and group structure diagram 03 are both determined to be associated group structure diagrams.

[0102] Step 2023: Based on the number of nodes included in at least one associated group structure diagram and the reference group structure diagram, at least one associated group structure diagram and the reference group structure diagram are merged to obtain a target group structure diagram.

[0103] Among them, the obtained target group structure diagram is the target group structure diagram to which the target group node belongs.

[0104] In some embodiments, when executing step 2023, the server can determine that the group structure diagram with more nodes is the target group structure diagram based on the number of nodes included in the associated group structure diagram and the reference group structure diagram, and the remaining group structure diagrams are non-target group structure diagrams. Each group node included in the non-target group structure diagram is used as a child node of the target group node and merged into the target group structure diagram.

[0105] Specifically, when each group node included in the non-target group structure diagram is taken as a child node of the target group node and integrated into the target group structure diagram, the abnormal information associated and stored on each group node can be copied to the target group structure diagram by traversing each group node included in the non-target group structure diagram.

[0106] For example, suppose the associated group structure diagram is group structure diagram 02, the reference group structure diagram is group structure diagram 04, and group structure diagram 02 includes 4 nodes: group node B, group node a, group node b, and group node c, and group structure diagram 04 includes 2 nodes: group node D and group node d. Since the number of nodes in group structure diagram 02 is greater, it can be determined that group structure diagram 02 is the target group structure diagram, and group structure diagram 04 is the non-target group structure diagram. Therefore, group node d in group structure diagram 04 is taken as a child node of group node B and merged into group structure diagram 02.

[0107] Optionally, since each group structure diagram includes a group node, based on the number of group nodes included in the associated group structure diagram and the reference group structure diagram, the one with more group nodes can be determined as the target group structure diagram.

[0108] In one possible implementation, after merging at least one associated group structure diagram with a reference group structure diagram to obtain a target group structure diagram, the mapping relationship between the group identifiers stored in the server and the group structure diagram can be updated based on the group identifiers corresponding to each group node included in the target group structure diagram.

[0109] Optionally, stored in the server is the mapping relationship between each group identifier and each group node, as well as the subordinate relationship between each group node and each group structure diagram. The mapping relationship between each group identifier and each group node, as well as the subordinate relationship between each group node and each group structure diagram can be updated by each group node and each group node included in the target group structure diagram.

[0110] Step 203: Based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, the group abnormality evaluation value of the target group node is obtained, and when the group abnormality evaluation value meets the preset evaluation condition, the target group is output as an abnormal group.

[0111] The preset evaluation condition may be set according to actual conditions. For example, when the full score of the abnormal evaluation value is 10 points, the preset evaluation condition may be that the group abnormal evaluation value is greater than or equal to 5 points. This application does not limit this.

[0112] For a possible implementation, see Figure 5 The following is a flow chart of obtaining a group abnormality evaluation value provided by an embodiment of the present application. When the server executes step 203, it can be performed as follows: Figure 5 Steps 2031-2033 shown are performed:

[0113] Step 2031: Based on the mapping relationship between abnormal behaviors and abnormal evaluation values, the abnormal evaluation values ​​corresponding to the abnormal behaviors represented by each abnormal information included in the target community structure diagram are determined respectively.

[0114] In a possible implementation, the mapping relationship between abnormal behavior and abnormal evaluation value can be pre-configured in the server. Optionally, in this mapping relationship, the abnormal degree of abnormal behavior can be positively correlated with the abnormal evaluation value. For example, the total score of the abnormal evaluation value can be set to 10 points, and the higher the abnormal degree of abnormal behavior, the higher the abnormal evaluation value corresponding to the abnormal behavior. For example, the abnormal evaluation value corresponding to "sending abnormal advertisements" can be 5 points, the abnormal evaluation value corresponding to "causing losses to the interests of normal objects through abnormal links" can be 10 points, and the abnormal evaluation value corresponding to sending bad messages can be 2 points, etc.

[0115] It should be noted that the mapping relationship between abnormal behavior and abnormal evaluation value can be set according to experience or actual situation, and this application does not limit this.

[0116] Step 2032: for multiple group nodes, perform the following operations respectively: determine a group anomaly assessment value of a group node based on an anomaly assessment value corresponding to an abnormal behavior represented by at least one abnormal information associated and stored on the group node.

[0117] In a possible implementation, when determining the group anomaly evaluation value of a group node, it can be determined according to an average value of anomaly evaluation values ​​corresponding to abnormal behaviors represented by at least one abnormal information associated and stored on the group node.

[0118] For example, cluster node c includes abnormal information 3 and abnormal information 4. Assuming that the server can determine in step 2031 that the abnormal behavior represented by abnormal information 3 corresponds to an abnormal evaluation value of 5, and the abnormal behavior represented by abnormal information 4 corresponds to an abnormal evaluation value of 8, then the group abnormal evaluation value of cluster node c is (5+8) / 2=6.5. Among them, 2 is the number of abnormal information associated and saved on cluster node c.

[0119] In a possible implementation, the server may also pre-configure a mapping relationship between negative feedback information and anomaly assessment values, and when executing step 2032, the information anomaly assessment value corresponding to each abnormal information may be first determined. The information anomaly assessment value may be determined in combination with the anomaly assessment value corresponding to the abnormal behavior represented by the abnormal information and the anomaly assessment value corresponding to the negative feedback information included in the abnormal information.

[0120] Optionally, the information anomaly assessment value can be calculated by weighted summation. For example, the weight of the anomaly assessment value corresponding to the negative feedback information can be set to 0.4, and the weight of the anomaly assessment value corresponding to the abnormal behavior can be set to 0.6. Assuming that the anomaly assessment value corresponding to the negative feedback information in abnormal information 3 is 6, and the anomaly assessment value corresponding to the abnormal behavior represented by abnormal information 3 is 5, then it can be determined that the anomaly assessment value corresponding to abnormal information 3 is 0.4*6+0.6*5=5.4.

[0121] It should be noted that the weight of the abnormality assessment value corresponding to the negative feedback information and the weight of the abnormality assessment value corresponding to the abnormal behavior can be set according to experience or actual conditions, and this application does not limit this.

[0122] In some embodiments, after determining the information anomaly evaluation value corresponding to each abnormal information, when determining the group anomaly evaluation value of a group node, it can be determined according to the average value of the information anomaly evaluation value corresponding to each of the at least one abnormal information associated and stored on the group node. The specific method is similar to the above-mentioned method of determining the group anomaly evaluation value according to the average value of the abnormal evaluation value corresponding to the abnormal behavior represented by each of the at least one abnormal information associated and stored on the group node. Please refer to the relevant description of the above-mentioned method embodiment, which will not be repeated here.

[0123] Step 2033: Based on the group anomaly evaluation values ​​of each group node included in the group structure graph, obtain the group anomaly evaluation value of the target group node.

[0124] In a possible implementation, step 2033 may be specifically performed as follows: determining the size evaluation value of the target group based on the number of group nodes included in the target group structure, and obtaining the group anomaly evaluation value based on the group anomaly evaluation value of each group node included in the target group structure diagram and the size evaluation value.

[0125] In some embodiments, the scale assessment value of the target group is determined based on the number of group nodes included in the target group structure and a preset scale assessment condition. For example, the preset scale assessment condition may be that when the number of group nodes included in the target group structure is greater than 10, the scale assessment value of the target group is 10, when the number of group nodes included in the target group structure is between 5 and 10, the scale assessment value of the target group is 6, and when the number of group nodes included in the target group structure is less than 5, the scale assessment value of the target group is 2.

[0126] It should be noted that the preset scale assessment conditions are preset based on actual conditions or experience, and this application does not limit this.

[0127] After determining the size evaluation value of the target group based on the above method, the average value of the group anomaly evaluation value of each group node included in the target group structure diagram can be weighted and summed with the size evaluation value to obtain the group anomaly evaluation value. Among them, the method for determining the average value of the group anomaly evaluation value of each group node included in the target group structure diagram is similar to the method for determining the average value of the anomaly evaluation value described above, and the weighted summation method is similar to the method for determining the information anomaly evaluation value described above, and both can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0128] In one possible implementation, the server can output the target group as an abnormal group to the physical terminal device of the relevant staff. The relevant staff can traverse the various sets included in the abnormal group, as well as the various accounts included in each set, and check the account characteristics of each account and the set characteristics of each set to determine the degree of abnormality of each account and each set. Then, the accounts and sets in the abnormal group can be processed based on the business characteristics of the currently executed group processing business and the processing strategy corresponding to the corresponding degree of abnormality. For example, a processing strategy of blocking accounts with a higher degree of abnormality can be adopted, and a processing strategy of sending security reminders can be adopted for accounts with a lower degree of abnormality.

[0129] In a possible implementation, in order to avoid misprocessing normal objects and collections, a protection strategy can also be set. For example, the protection strategy can be set to a number of members in a collection that is greater than 200, and then the collection with more than 200 members in the abnormal group can be not processed. It should be understood that the protection strategy can be set according to actual conditions or experience, and this application does not limit this.

[0130] Based on the above scheme, since the entire process of steps 201-203 can be completed within a linear time complexity, the real-time performance of the abnormal group processing method can be ensured, and the processing efficiency of the abnormal group can be improved.

[0131] Below, in order to more clearly understand the solution proposed in the embodiment of the present application, an abnormal group processing method provided by the present application will be introduced in combination with a specific embodiment.

[0132] See also Figure 6 This is a schematic diagram of the overall process of the abnormal group processing method provided in the embodiment of the present application. The process includes steps 601 to 607:

[0133] Step 601: Update group relationship data.

[0134] The server can update group relationship data in real time by collecting account-related information and collection-related information in real time.

[0135] Step 602: Calculate associated edges.

[0136] The server can determine the group nodes with associated edges and the abnormal information of associated edges based on the group relationship data. For specific methods, please refer to Figure 2 The relevant description in the method embodiment shown will not be repeated here.

[0137] Step 603: Receive abnormal information.

[0138] Step 604: associate the abnormal information with the corresponding group node and save it.

[0139] After receiving the abnormal information, the abnormal information can be associated with the corresponding group node and saved based on the group identifier carried in the abnormal information.

[0140] Step 605: Group merging.

[0141] If a new group structure graph is created in the graph database, or in response to an instruction to check whether there are group structure graphs that need to be merged in the graph database, multiple group structure graphs with associated relationships can be merged based on the group relationship data and the calculated associated edges. For specific merging methods, see Figure 2 The relevant description in the method embodiment shown will not be repeated here.

[0142] Step 606: Obtain a group abnormality assessment value.

[0143] The server can determine the group abnormality evaluation value for the group node in the merged group structure diagram. For specific methods, see Figure 2 The relevant description in the method embodiment shown will not be repeated here.

[0144] Step 607: Output abnormal groups.

[0145] The server may output the group as an abnormal group when the abnormal evaluation value of the group meets a preset evaluation condition.

[0146] It should be noted that Figure 6 This is only an exemplary flow chart. Since updating group relationship data and calculating associated edges can be performed in real time, the order of the steps in the overall process of the abnormal group processing method provided in the embodiment of the present application is not limited to Figure 6 The order shown, for example, receiving exception information can be performed before calculating associated edges.

[0147] based on Figure 6 The overall process diagram shown is as follows: Figure 7A-7C This is a schematic diagram of the process of the abnormal group processing method provided in the embodiment of the present application. Fig. 7AAs shown, the graph database includes a group structure graph 01, in which group node A is the root node, and group node a and group node b are child nodes of group node A. Group node a is associated with abnormal information 1 and stored, and group node b is associated with abnormal information 2 and stored, and the group identifier carried in abnormal information 1 is a, and the group identifier carried in abnormal information 2 is b.

[0148] At a certain moment, abnormal information 3 carrying group identifier b is received. Since group structure diagram 01 includes group node b, abnormal information 3 can be associated with group node b and saved to obtain the associated and saved group structure diagram 01.

[0149] like Figure 7B As shown, at a certain moment, an abnormal information 4 carrying a group identifier c is received. Since there is no group node corresponding to the group identifier c in the graph database, a group structure graph 02 can be created. The group structure graph 02 includes: group node C and group node c, wherein both group node c and group node C are nodes created when the group structure graph 02 is created, and group node c is a child node of group node C. Then the abnormal information 4 is associated with the group node c and saved.

[0150] Since a new group structure diagram has been created, it is possible to determine whether the new group structure diagram can be merged with other group structure diagrams. Figure 7C As shown, assuming that the preset period is one week, the associated abnormal information of abnormal information 4 within one week can be obtained based on the latest group relationship data: abnormal information 3. At this time, the root node of the group structure diagram to which abnormal information 3 and abnormal information 4 belong respectively, as well as the group node to which they belong respectively, can be obtained. Since group structure diagram 01 includes 2 group nodes, group structure diagram 02 includes 1 group node. Therefore, group structure diagram 01 can be used as the target group structure diagram, group node c and abnormal information 4 associated and saved on group node c are copied to group structure diagram 01, and node c is used as a child node of group node A, thereby obtaining the merged group structure diagram 01. In addition, since group node b is the group node to which the associated abnormal information of abnormal information 4 belongs, it can be determined that there is an associated edge between group node b and group node c.

[0151] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides an abnormal group processing device. Figure 8 The abnormal group processing device 800 may include:

[0152] The receiving unit 801 is configured to receive target abnormality information carrying a group identifier of a target set; the target abnormality information indicates that an abnormal behavior occurs in a member of the target set;

[0153] The associated storage unit 802 is used to associate and store the target abnormal information with the target group node corresponding to the group identifier; the target group node represents the target set;

[0154] The structure diagram determining unit 803 is used to determine the target group structure diagram to which the target group node belongs based on the latest acquired group relationship data; wherein the group relationship data represents: the member inclusion relationship between the sets represented by different group nodes; the target group structure diagram has the target group node representing the target group as the root node, multiple group nodes as child nodes, and each group node is associated with and stored with at least one abnormal information; the set represented by each group node includes the same members who have had abnormal behavior as the set represented by at least one other group node;

[0155] The abnormal group processing unit 804 is used to obtain the group abnormality evaluation value of the target group node based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, and output the target group as an abnormal group when the group abnormality evaluation value meets the preset evaluation condition.

[0156] In one possible implementation, when the associative storage unit 802 associates and saves the target exception information with the target group node corresponding to the group identifier, it is used to: based on the latest mapping relationship between each group identifier and each group structure diagram, query whether a reference group structure diagram is associated and saved corresponding to the group identifier; if so, traverse each group node included in the reference group structure diagram, obtain the target group node corresponding to the group identifier, and associate and save the target exception information with the target group node; otherwise, based on the group identifier, create a new reference group structure diagram, the new reference group structure diagram includes: a new target group node, and a new reference group node representing the group to which the target set belongs; and associate and save the target exception information with the new target group node.

[0157] In one possible implementation, the associated storage unit 802 queries whether a reference group structure diagram is stored in association with the group identifier based on the latest mapping relationship between each group identifier and each group structure diagram, and is used to: query whether a reference group node is stored in association with the group identifier based on the latest mapping relationship between each group identifier and each group node; if so, determine that a reference group structure diagram is stored in association with the group identifier, and based on the subordinate relationship between each group node and each group structure diagram, obtain the reference group structure diagram to which the reference group node belongs; otherwise, determine that there is no reference group structure diagram stored in association with the group identifier.

[0158] In a possible implementation, when the structure diagram determination unit 803 determines the target group structure diagram to which the target group node belongs based on the latest acquired group relationship data, it is used to: obtain at least one associated exception information that has an associated relationship with the target exception information based on the latest acquired group relationship data; the associated relationship at least represents that: the member triggering the associated exception information is the same as the member triggering the target exception information; based on the group identifier carried by each of the at least one associated exception information, and the mapping relationship between the latest group identifier and the group structure diagram, obtain at least one associated group structure diagram to which each of the at least one associated exception information belongs; based on the number of nodes included in each of the at least one associated group structure diagram and the reference group structure diagram, merge the at least one associated group structure diagram with the reference group structure diagram to obtain the target group structure diagram.

[0159] In one possible implementation, the structure diagram determination unit 803 merges the associated group structure diagram with the reference group structure diagram based on the number of nodes each of the at least one associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram, and is used to: determine, based on the number of nodes each of the associated group structure diagram and the reference group structure diagram, that the one with a larger number of nodes is the target group structure diagram, and the remaining group structure diagrams are non-target group structure diagrams; and use each group node included in the non-target group structure diagram as a child node of the target group node, and integrate them into the target group structure diagram.

[0160] In a possible implementation, the structure diagram determining unit 803 combines the associated group structure diagram with the reference group structure diagram based on the number of group nodes each of the associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram, and is further used to:

[0161] Based on the group identifiers corresponding to the respective group nodes included in the target group structure diagram, the mapping relationship between the group identifiers and the group structure diagram is updated.

[0162] In a possible implementation, when the abnormal group processing unit 804 obtains the group abnormality evaluation value of the target group node based on the abnormal behavior represented by each abnormal information included in the target group structure diagram, it is used to: determine the abnormality evaluation value corresponding to the abnormal behavior represented by each abnormal information included in the target group structure diagram based on the mapping relationship between abnormal behavior and abnormality evaluation value; for the multiple group nodes, perform the following operations respectively: determine the group abnormality evaluation value of the group node based on the abnormality evaluation value corresponding to the abnormal behavior represented by each abnormal information associated with and saved on the group node; obtain the group abnormality evaluation value of the target group node based on the group abnormality evaluation value of each group node included in the target group structure diagram.

[0163] In one possible implementation, when the abnormal group processing unit 804 obtains the group abnormality evaluation value of the target group node based on the group abnormality evaluation value of each group node included in the target group structure diagram, it is used to: determine the scale evaluation value of the target group based on the number of group nodes included in the target group structure diagram; and obtain the group abnormality evaluation value based on the group abnormality evaluation value of each group node included in the target group structure diagram in combination with the scale evaluation value.

[0164] For the convenience of description, the above parts are divided into each module (or unit) according to the function and described separately. In the embodiment of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuit or memory) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the module or unit function.

[0165] After introducing the abnormal group processing method and apparatus according to an exemplary embodiment of the present application, next, a computer device according to another exemplary embodiment of the present application is introduced.

[0166] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0167] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides a computer device. In one embodiment, the computer device may be a server, such as Figure 1 In this embodiment, the structure of the computer device 900 is as follows: Fig. 9 As shown, it may include at least a memory 901 , a communication module 903 , and at least one processor 902 .

[0168] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0169] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0170] The processor 902 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 902 is used to implement the above-mentioned abnormal group processing method when calling the computer program stored in the memory 901.

[0171] The communication module 903 is used to communicate with terminal devices and other servers.

[0172] The specific connection medium between the memory 901, the communication module 903 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 904. The bus 904 is connected to the processor 902 via a bus 904. Fig. 9 The connections between the other components are only for illustration and are not intended to be limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig. 9 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0173] The memory 901 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the abnormal group processing method of the embodiment of the present application. The processor 902 is used to execute the above-mentioned abnormal group processing method, such as Figure 2 shown.

[0174] In another embodiment, the computer device may also be other computer devices, such as Figure 1 The physical terminal device 110 shown in FIG. 1 is a physical terminal device 110 shown in FIG. 1 . In this embodiment, the structure of the computer device can be as follows: Fig.10 As shown, it includes: a communication component 1010, a memory 1020, a display unit 1030, a camera 1040, a sensor 1050, an audio circuit 1060, a Bluetooth module 1070, a processor 1080 and other components.

[0175] The communication component 1010 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the object to send and receive information through the WiFi module.

[0176] The memory 1020 can be used to store software programs and data. The processor 1080 executes various functions and data processing of the physical terminal device 110 by running the software programs or data stored in the memory 1020. The memory 1020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 1020 stores an operating system that enables the physical terminal device 110 to run. In the present application, the memory 1020 can store an operating system and various application programs, and can also store a computer program for executing the abnormal group processing method of the embodiment of the present application.

[0177] The display unit 1030 may also be used to display information input by the object or information provided to the object and a graphical user interface (GUI) of various menus of the physical terminal device 110. Specifically, the display unit 1030 may include a display screen 1032 disposed on the front of the terminal device 110. The display screen 1032 may be configured in the form of a liquid crystal display, a light emitting diode, or the like.

[0178] The display unit 1030 can also be used to receive input digital or character information and generate signal input related to the object setting and function control of the physical terminal device 110. Specifically, the display unit 1030 may include a touch screen 1031 set on the front of the physical terminal device 110, which can collect touch operations of objects on or near it, such as clicking a button, dragging a scroll box, etc.

[0179] The touch screen 1031 can be covered on the display screen 1032, or the touch screen 1031 and the display screen 1032 can be integrated to realize the input and output functions of the physical terminal device 110, and the integrated display screen can be referred to as a touch display screen. In this application, the display unit 1030 can display the application and the corresponding operation steps.

[0180] The camera 1040 can be used to capture static images, and the object can publish the image taken by the camera 1040 through the application. The camera 1040 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the processor 10100 to convert it into a digital image signal.

[0181] The physical terminal device may also include at least one sensor 1050, such as an acceleration sensor 1051, a distance sensor 1052, a fingerprint sensor 1053, and a temperature sensor 1054. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0182] The audio circuit 1060, the speaker 1061, and the microphone 1062 can provide an audio interface between the object and the terminal device 110. The audio circuit 1060 can transmit the electrical signal converted from the received audio data to the speaker 1061, which is converted into a sound signal for output. The physical terminal device 110 can also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 1062 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1060 and converted into audio data, and then the audio data is output to the communication component 1010 to be sent to, for example, another physical terminal device 110, or the audio data is output to the memory 1020 for further processing.

[0183] The Bluetooth module 1070 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the physical terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 1070 to exchange data.

[0184] The processor 1080 is the control center of the physical terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the memory 1020 and calling data stored in the memory 1020. In some embodiments, the processor 1080 may include one or more processing units; the processor 1080 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 1080. In the present application, the processor 1080 can run the operating system, application programs, user interface display and touch response, as well as the abnormal group processing method of the embodiment of the present application. In addition, the processor 1080 is coupled to the display unit 1030.

[0185] In addition, it should be noted that in the specific implementation of this application, object data related to abnormal group processing is involved. When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0186] In some possible implementations, various aspects of the abnormal group processing method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on a computer device, the computer program is used to enable the computer device to execute the steps of the abnormal group processing method according to various exemplary embodiments of the present application described above in this specification. For example, the computer device may execute the following steps: Figure 2 Follow the steps shown in .

[0187] The program product may employ any combination of one or more readable media. The readable media may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0188] The program product of the embodiments of the present application may employ a portable compact disk read-only memory (CD-ROM) and include a computer program, and may be run on an electronic device. However, the program product of the present application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0189] The readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable computer program. Such a propagated data signal may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.

[0190] The computer program contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0191] The computer program for performing the operations of the present application may be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The computer program may be executed entirely on the user's computer device, partially on the user's computer device, executed as a stand-alone software package, partially on the user's computer device and partially on a remote computer device, or entirely on the remote computer device. In the case of a remote computer device, the remote computer device may be connected to the user's computer device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer device (e.g., through the Internet using an Internet service provider).

[0192] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0193] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0194] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0195] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0196] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0197] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0198] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0199] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for handling abnormal groups, It is characterized in that include: Receive target abnormality information carrying a group identifier of a target set, and associate and save the target abnormality information with a target group node corresponding to the group identifier; the target abnormality information indicates that an abnormal behavior occurs in a member of the target set; The target group node represents the target set; Based on the most recently acquired group relationship data, determine the target group structure diagram to which the target group node belongs; wherein the group relationship data represents: the member inclusion relationship between the sets represented by different group nodes; the target group structure diagram has the target group node representing the target group as the root node, multiple group nodes as child nodes, and each group node is associated with and stored with at least one abnormal information; the set represented by each group node includes the same members who have committed abnormal behaviors as the set represented by at least one other group node; Based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, the group abnormality evaluation value of the target group node is obtained, and when the group abnormality evaluation value meets the preset evaluation condition, the target group is output as an abnormal group.

2. The method according to claim 1, It is characterized in that The associating and saving the target abnormal information with the target group node corresponding to the group identifier includes: Based on the latest mapping relationship between each group identifier and each group structure diagram, query whether a reference group structure diagram is associated and stored corresponding to the group identifier; If yes, traverse each group node included in the reference group structure diagram, obtain the target group node corresponding to the group identifier, and associate the target abnormal information with the target group node for storage; Otherwise, based on the group identifier, a new reference group structure diagram is created, the new reference group structure diagram including: a new target group node and a new reference group node representing the group to which the target set belongs; the target anomaly information is associated with the new target group node and saved.

3. The method according to claim 2, It is characterized in that The querying, based on the latest mapping relationship between each group identifier and each group structure diagram, whether a reference group structure diagram is associated and stored corresponding to the group identifier includes: Based on the latest mapping relationship between each group identifier and each group node, query whether a reference group node is associated and stored corresponding to the group identifier; If yes, it is determined that a reference group structure diagram is stored in association with the group identifier, and based on the subordinate relationship between each group node and each group structure diagram, the reference group structure diagram to which the reference group node belongs is obtained; Otherwise, it is determined that there is no reference group structure diagram associated with the group identifier.

4. The method according to claim 1, It is characterized in that The step of determining the target group structure diagram to which the target group node belongs based on the most recently acquired group relationship data includes: Based on the most recently acquired group relationship data, at least one associated abnormal information that is associated with the target abnormal information is obtained; the associated relationship at least represents that: the member that triggers the associated abnormal information is the same as the member that triggers the target abnormal information; Based on the group identifier carried by each of the at least one association exception information and the mapping relationship between the latest group identifier and the group structure diagram, obtaining at least one association group structure diagram to which each of the at least one association exception information belongs; Based on the number of nodes each of the at least one associated group structure graph and the reference group structure graph includes, the at least one associated group structure graph and the reference group structure graph are merged to obtain a target group structure graph.

5. The method according to claim 4, It is characterized in that The step of merging the associated group structure diagram with the reference group structure diagram based on the number of nodes each of the at least one associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram includes: Based on the number of nodes respectively included in the associated group structure diagram and the reference group structure diagram, determining that the group structure diagram with more nodes is the target group structure diagram, and the remaining group structure diagrams are non-target group structure diagrams; Each group node included in the non-target group structure diagram is taken as a child node of the target group node and integrated into the target group structure diagram.

6. The method according to claim 4 or 5, It is characterized in that After merging the associated group structure diagram with the reference group structure diagram based on the number of group nodes each of the associated group structure diagram and the reference group structure diagram to obtain a target group structure diagram, the method further includes: Based on the group identifiers corresponding to the respective group nodes included in the target group structure diagram, the mapping relationship between the group identifiers and the group structure diagram is updated.

7. The method according to any one of claims 1 to 5, It is characterized in that The step of obtaining the group anomaly evaluation value of the target group node based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram includes: Based on the mapping relationship between abnormal behaviors and abnormal evaluation values, respectively determine the abnormal evaluation values ​​corresponding to the abnormal behaviors represented by each abnormal information included in the target group structure diagram; For the plurality of group nodes, the following operations are respectively performed: based on the abnormality assessment value corresponding to the abnormal behavior represented by each of at least one abnormal information associated and stored on the group node, a group abnormality assessment value of the group node is determined; Based on the group anomaly evaluation values ​​of the respective group nodes included in the target group structure graph, the group anomaly evaluation value of the target group node is obtained.

8. The method according to claim 7, It is characterized in that The step of obtaining the group anomaly evaluation value of the target group node based on the group anomaly evaluation value of each group node included in the target group structure diagram comprises: Determining a size assessment value of the target group based on the number of group nodes included in the target group structure diagram; The group anomaly evaluation value is obtained based on the group anomaly evaluation value of each group node included in the target group structure diagram in combination with the scale evaluation value.

9. An abnormal group processing device, It is characterized in that include: A receiving unit, configured to receive target anomaly information carrying a group identifier of a target set; The target abnormal information indicates that: a member of the target set has abnormal behavior; An association storage unit, used to associate and store the target abnormal information with a target group node corresponding to the group identifier; the target group node represents the target set; A structure diagram determining unit is used to determine the target group structure diagram to which the target group node belongs based on the most recently acquired group relationship data; wherein the group relationship data represents: the member inclusion relationship between the sets represented by different group nodes; the target group structure diagram has the target group node representing the target group as the root node, multiple group nodes as child nodes, and each group node is associated with and stored with at least one abnormal information; the set represented by each group node includes the same members who have committed abnormal behaviors as the set represented by at least one other group node; The abnormal group processing unit is used to obtain the group abnormality evaluation value of the target group node based on the abnormal behaviors represented by each abnormal information included in the target group structure diagram, and output the target group as an abnormal group when the group abnormality evaluation value meets the preset evaluation condition.

10. A computer device, It is characterized in that It comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, It is characterized in that It includes program codes. When the program codes are run on a computer device, the program codes are used to make the computer device execute the steps of the method according to any one of claims 1 to 8.

12. A computer program product, It is characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Images