Risk user determination method and device, and electronic equipment

Abstract

The invention provides a method for determining a risk user, and relates to the technical field of information processing, in particular to the technical field of network security and risk user mining. According to the specific implementation scheme, high-risk users are determined based on a preset target user and risk application program relation graph; in a preset risk associated user network diagram, determining a target risk associated user corresponding to the high-risk user in the plurality of risk associated users; determining a target risk user based on the target risk associated user; wherein the target user and risk application relation graph is used for representing the behavior relation between each target user and the risk application; the risk associated user network diagram is used for representing the user relationship of each risk associated user. The target risk user is accurately and efficiently determined, the target risk user is prevented from suffering malicious risk behaviors, and the safety of user information and personal property is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of information processing, and particularly to the technical fields of network security and determination of risk users. Background Art

[0002] With the rapid development of network information, online social networks have become an integral part of people's daily lives. People can communicate, share personal information, obtain the latest news, etc. through online social network platforms. However, due to the characteristics of data sharing, dissemination, openness, etc. of online social networks, network users have become the targets of malicious risk behaviors. Among them, malicious risk behaviors include, for example: online fraud behaviors, telephone fraud behaviors, clickbait behaviors, etc.

[0003] Currently, there is a lack of an effective method for determining risk users who are prone to encountering malicious risk behaviors. Summary of the Invention

[0004] The present disclosure provides a method, an apparatus, and an electronic device for determining risk users to solve at least one of the above technical problems.

[0005] According to one aspect of the present disclosure, there is provided a method for determining risk users, wherein the method includes:

[0006] Determining high-risk users based on a preset relationship graph of target users and risk application programs;

[0007] Determining a target risk-associated user corresponding to the high-risk user among multiple risk-associated users in a preset risk-associated user network graph;

[0008] Determining target risk users based on the target risk-associated user;

[0009] Wherein, the relationship graph of target users and risk application programs is used to represent the behavioral relationships between each target user and risk application programs; the risk-associated user network graph is used to represent the user relationships between each risk-associated user.

[0010] According to another aspect of the present disclosure, there is provided a device for determining risk users, wherein the device includes:

[0011] A preliminary determination module, configured to determine high-risk users based on a preset relationship graph of target users and risk application programs;

[0012] A target determination module, configured to determine a target risk-associated user corresponding to the high-risk user among multiple risk-associated users in a preset risk-associated user network graph;

[0013] A final determination module for determining a target risk user based on the target risk associated user;

[0014] Wherein, the target user and risk application relationship diagram is used to represent the behavioral relationships between each target user and the risk application; the risk associated user network diagram is used to represent the user relationships between each risk associated user.

[0015] According to another aspect of the present disclosure, there is provided an electronic device, including:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor is enabled to execute the above method.

[0019] According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the above method.

[0020] According to another aspect of the present disclosure, there is provided a computer program product, including a computer program, where the computer program, when executed by a processor, implements the above method.

[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings are used to better understand the present solution and do not constitute a limitation to the present disclosure. Among them:

[0023] Figure 1 is a flowchart of a method for determining a risk user provided in the first embodiment of the present disclosure;

[0024] Figure 2 is an exemplary target user and risk application relationship diagram of a method for determining a risk user provided in the first embodiment of the present disclosure;

[0025] Figure 3 is an exemplary flowchart of S101 of a method for determining a risk user provided in the first embodiment of the present disclosure;

[0026] Figure 4It is an exemplary risk-associated user network diagram of a method for determining risk users provided by the first embodiment of the present disclosure;

[0027] Figure 5 It is a schematic flowchart of S102 of a method for determining risk users provided by the first embodiment of the present disclosure;

[0028] Figure 6 It is a schematic flowchart of obtaining risk-associated users in a method for determining risk users provided by the first embodiment of the present disclosure;

[0029] Figure 7 It is a schematic structural diagram of a device for determining risk users provided by the second embodiment of the present disclosure;

[0030] Figure 8 It is a block diagram of an electronic device for implementing the method of the embodiments of the present disclosure. Detailed implementation manners

[0031] The following makes an explanation of the exemplary embodiments of the present disclosure in conjunction with the accompanying drawings. Various details of the embodiments of the present disclosure are included to facilitate understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted below.

[0032] Without conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other.

[0033] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0034] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms unless the context clearly indicates otherwise.

[0035] Unless otherwise defined, the meanings of all terms (including technical and scientific terms) used herein are the same as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the relevant art and the context of the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless clearly defined herein.

[0036] The method for determining a risky user according to the present disclosure can be executed by an electronic device such as a terminal device or a server. The terminal device can be an in-vehicle device, a display device (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a Personal Digital Assistant (PDA), a handheld device, a computing device, an in-vehicle device, a wearable device, etc. The method can be implemented by a processor invoking computer-readable program instructions stored in a memory. Alternatively, the server can execute the method for determining a risky user provided by the present disclosure.

[0037] In the technical solution of the present disclosure, the processing of collection, storage, use, processing, transmission, provision, disclosure, and application of the user's personal information involved all comply with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and it does not violate public order and good customs.

[0038] In the first embodiment of the disclosure, refer to Figure 1 , Figure 1 which shows a schematic flowchart of a method for determining a risky user provided by the first embodiment of the present disclosure. The method includes:

[0039] S101. Based on a preset relationship diagram of target users and risky application programs, determine high-risk users.

[0040] Among them, a risky application program: is an application program with malicious risks or network security problems. It is possible to obtain an application program that has been confirmed to have malicious risks or network security problems as a risky application program through a risk platform. If a target user interacts with a risky application program, that is, there is a risky user behavior with the risky application program, then such a target user will be regarded as a high-risk user. High-risk users among the target users are initially screened out through the user behavior relationship between the target user and the risky application program.

[0041] It should be noted that in the link of obtaining user behavior and related user information of the present application, only when the user clearly knows and agrees, necessary information directly related to the core function of the patented technology is collected, and the user knows the subsequent application of user behavior and related user information. The acquisition method complies with the provisions of relevant laws and regulations. Through clear and easy-to-understand user agreements, privacy policies and other documents, key information such as the purpose, method, and scope of information collection is fully explained to the user. The user's consent is voluntarily given on the basis of fully understanding the above content.

[0042] S102. In a preset risk-associated user network diagram, determine the target risk-associated user corresponding to the high-risk user among multiple risk-associated users.

[0043] After determining high-risk users based on the relationship graph between target users and risk applications, map the high-risk users to the risk-associated user network graph, that is: the target risk-associated users in the risk-associated user network graph that are the same as the high-risk users.

[0044] S103. Determine target risk users based on the target risk-associated users.

[0045] Thus, determine the final target risk users through the user relationships between the target risk-associated users and other risk-associated users.

[0046] Among them, risk-associated users: are users who are potentially vulnerable to malicious risk behaviors. Target risk users are users who are determined to be vulnerable to malicious risk behaviors, that is, the probability of target risk users suffering from malicious risk behaviors is higher than that of risk-associated users suffering from malicious risk behaviors. Among them, malicious risk behaviors include, for example: online fraud behaviors, telephone fraud behaviors, etc., which are not limited here. In other words, risk-associated users are potentially easily deceived users, and target risk users are determined easily deceived users.

[0047] Among them, the relationship graph between target users and risk applications: is used to represent the behavioral relationships between each target user and the risk applications; the risk-associated user network graph: is used to represent the user relationships between each risk-associated user. A graph is a data structure, and a graph is composed of some points (vertices) and the connections (edges) between these points; among them, points are usually called "vertices", and the connections between points are called "edges or arcs", usually denoted as, G=(V,E), where G represents the graph. In the present disclosure, a relationship graph between target users and risk applications will be established in advance based on the interaction relationships between each target user and the risk applications; and a risk-associated user network graph will be established based on the relationships between risk-associated users.

[0048] Since the behavioral relationships between each target user and the risk applications, and the user relationships between each risk-associated user are expressed in the form of a graph, the graph expression method can integrate disordered and complex information into an ordered and clear data relationship. Therefore, calculating the vector similarity based on the ordered data relationship can reduce the computational complexity. Moreover, compared with the traditional data storage method, the data storage method of the graph has a faster data retrieval speed. Therefore, it can improve the calculation speed. Furthermore, determining target risk users based on the graph calculation method can reduce the computational complexity and improve the calculation speed. In the case of generating new data, it can be relatively easily updated into the graph through the graph expression method, having good scalability.

[0049] The method provided by the present disclosure determines high-risk users through the relationship graph of target users and risk application programs, then corresponds the high-risk users to the risk-associated user network graph to determine target risk-associated users, and determines the final target risk users based on the user relationships of the target risk-associated users. In this graph-based manner, it is convenient for calculation and screening. Moreover, through the dual-graph linkage screening method, the relationship between users and application programs and the relationship between users and users can be separated, making the construction and calculation of the graph simpler and clearer, thereby achieving accurate and efficient mining of target risk users, avoiding malicious risk behaviors suffered by target risk users, and enhancing the security of user information and personal property. It should be emphasized that the core purpose of the user information collection mechanism involved in this application is to accurately identify the user groups suffering from malicious risk behaviors, rather than preventive monitoring of users. By collecting limited and necessary user information, the possibility of users suffering from malicious risk behaviors is effectively evaluated. This process aims to actively provide protection for users and give early warnings of potential risk threats to users, thus significantly enhancing the protection of users.

[0050] The user information obtained in this application (including the following user attributes) is only used to implement the specific functions of the technology or product covered by the patent, such as identifying the degree to which users are prone to malicious risk behaviors, and will not be used for other purposes without user permission beyond the authorized scope. At the same time, in the process of information use, security technical measures and management specifications in line with industry standards are adopted to prevent the leakage, tampering, and loss of user personal information, ensure the security of user information, and ensure that the processing activities of user personal information comply with the security protection obligations stipulated by law.

[0051] The risk-associated user network graph and the relationship graph of target users and risk application programs are described in detail below.

[0052] In some examples, refer to Figure 2 , Figure 2 which shows an exemplary relationship graph of target users and risk application programs. The relationship graph of target users and risk application programs in S101 can be in the following form:

[0053] Taking each target user and each risk application program as vertices, and taking the user behaviors generated by each target user in the risk application program as edges, each target user and each risk application program are connected.

[0054] Among them, the edge feature of the edge is the user behavior type, and different user behavior types correspond to different edge weights.

[0055] Continue to refer to Figure 2 , taking Figure 2For example, the relationship graph between target users and risk applications includes three vertices: target user A, target user B, risk application 1, and risk application 2. Among them, target user A includes multiple attributes, such as user attribute A-1 and user attribute A-2; target user B includes multiple attributes, such as user attribute B-1 and user attribute B-2. Among them, user attributes can include various types of user information; risk application 1 also includes multiple attributes, such as application attribute 1-1, application attribute 1-2, and application attribute 1-3; risk application 2 includes multiple attributes, exemplarily including application attribute 2-1. Among them, application attributes can include various types of application information, such as the type of the application, the store where the application is listed, the development company of the application, etc., which are not limited here. When constructing the graph, through the user behaviors of the target user vertices (such as target user A and target user B), the edges between the target user vertices and the risk application vertices (such as risk application 1) are constructed, such as the first edge Ea, the second edge Eb, and the third edge Ec in the graph. The first edge Ea indicates that target user A has a user behavior with risk application 1; the second edge Eb and the third edge Ec respectively indicate that target user B has user behaviors with risk application 1 and risk application 2; among them, each edge carries an edge feature and an edge weight corresponding to the edge feature. It should be noted that Figure 2 This is only an exemplary form of the relationship graph between target users and risk applications. In other implementation manners, it may include more vertex and edge relationships, which are not limited here.

[0056] Specifically, user behavior is used to describe the interaction behavior generated by the target user on the risk application. There are various user behaviors of the target user with respect to the risk application, which can specifically include multiple types of user behavior types, such as including at least one of the following: login behavior type, click behavior type, browsing behavior type, publishing behavior type, search behavior type, etc., which are not limited here. These user behaviors can include historical user behaviors or real-time user behaviors can also be introduced, so as to more dynamically determine the riskiness of user behaviors and increase the timeliness of mining target risk users.

[0057] Moreover, the risk levels are different for different types of user behaviors with the risk application. For example, the risk level of the publishing behavior type is greater than that of the login behavior type. Therefore, the edge features of different user behavior types have different preset edge weights. The specific numerical values of the edge weights can be set according to needs. For example, the edge weight corresponding to the login behavior type is 0.1, and the edge weight corresponding to the click behavior type is 0.2, which are not limited here.

[0058] Before constructing the risk application relationship graph, the obtained user behaviors can be vectorized first, so as to facilitate the construction of the relationship between the target user and the risk application. That is, before S101, before constructing the risk application relationship graph, the method provided by the present disclosure includes:

[0059] For any target user, convert the obtained user behaviors of the target user into user behavior vectors.

[0060] In some examples, converting the obtained user behaviors of the target user into user behavior vectors includes:

[0061] Sub-step one: Convert the target user behaviors into user behavior vectors through graph algorithms or word vector conversion methods.

[0062] After that, based on the user behavior vectors, construct the edges between the target users and the risk applications.

[0063] Among them, the word vector refers to a distributed representation of words, and its basic idea is to map words into vectors of a fixed dimension. In sub-step one, for the example of vectorizing user behaviors through word vector conversion methods, specifically, sub-step one specifically includes: converting user behaviors into user behavior vectors in the form of word vectors through a language model, where the language model includes, for example, at least one of the following: text word vector conversion (word to vector, word2vec) model, Global Vectors for Word Representation (glove) model, Embeddings from Language Models (ELMo) model, Bidirectional Encoder Representation from Transformers (BERT) model, etc., which are not limited here.

[0064] In some examples, Figure 3 It is a schematic flowchart of an exemplary S101. S101 includes:

[0065] S1011: Perform weighted calculation based on the edges between each target user and the risk application and their edge weights.

[0066] S1012: Determine high-risk users from each target user according to the results of the weighted calculation.

[0067] Among them, for each target user, the edges between the target user and each risk application are weighted by the user behavior types as edges and the weights of the edges in the figure, and the weighted calculation results of each target user are obtained. The weighted calculation results can identify the risk levels between the target user and each risk application. Thus, the N target users with the largest numerical values of the weighted calculation results are selected as high-risk users, where N is an integer greater than 1. In this way, the risk levels between the target user and each risk application can be known based on the interaction degree reflected by user behaviors between the target user and each risk application, and typical high-risk users can be screened from the dimension of the target user and the risk application. Then, in the risk-associated user network graph, target risk users with a wider coverage can be screened from the relationships between users.

[0068] As a specific example, taking target user B as an example, there is a second edge Eb between target user B and risk application 1, and there is a third edge Ec between target user B and risk application 2. For the weighted calculation of target user B and risk applications 1 and 2, the weighted calculation is performed by the edge weights of the second edge Eb and the third edge Ec, and the weighted calculation result represents the risk level of target user B.

[0069] In some examples, refer to Figure 4 , Figure 4 which shows an exemplary risk-associated user network graph. The risk-associated user network graph in S102 can be constructed in the following way:

[0070] Step 1: Use risk-associated users as user nodes and the risk-associated information of risk-associated users as vertex attribute nodes, and connect the user nodes to the corresponding attribute nodes through edges.

[0071] Step 2: Determine the attribute similarities between the attribute nodes connected by each user node, and connect the attribute nodes with attribute similarities greater than a preset attribute similarity threshold among different user nodes through edges to construct a risk-associated user network graph.

[0072] Among them, the attribute similarity threshold is used to judge the similarity of risk-associated users for the same type of risk-associated attribute, and the specific value can be set as needed and is not limited here.

[0073] Continue to refer to Figure 4 , to Figure 4For example, the risk-associated user network diagram includes three user nodes: Risk-associated User 1, Risk-associated User 2, and Risk-associated User 3. Among them, Risk-associated User 1 includes multiple attribute nodes, such as Risk-associated Information 1-1, Risk-associated Information 1-2, and Risk-associated Information 1-3. The three attribute nodes are connected to Risk-associated User 1, which is the user node, by edges; Risk-associated User 2 includes multiple attribute nodes, such as Risk-associated Information 2-1, Risk-associated Information 2-2, and Risk-associated Information 2-3. The three attribute nodes are connected to Risk-associated User 2, which is the user node, by edges; Risk-associated User 3 includes multiple attribute nodes, such as Risk-associated Information 3-1, Risk-associated Information 3-2, and Risk-associated Information 3-3. The three attribute nodes are connected to Risk-associated User 3, which is the user node, by edges. When constructing the diagram, the attribute nodes (i.e., risk-associated information) are connected to their corresponding user nodes (i.e., risk-associated users) by edges. For example, Risk-associated Information 3-1 is connected to Risk-associated User 3 by edge E3-1, Risk-associated Information 3-2 is connected to Risk-associated User 3 by edge E3-2, and Risk-associated Information 3-3 is connected to Risk-associated User 3 by edge E3-3.

[0074] After that, by calculating the attribute similarity between the attribute nodes connected to each user node, if the attribute similarity of a certain attribute node of two different user nodes is greater than the preset attribute similarity threshold, it is considered that the two different user nodes have a high correlation, and then the two similar attribute nodes of the two different user nodes are connected by an edge. For example, Figure 4 in this case, the attribute similarity between the attribute node Risk-associated Information 3-2 connected to the user node Risk-associated User 3 and the attribute node Risk-associated Information 1-2 connected to the user node Risk-associated User 1 is greater than the preset attribute similarity threshold, so the attribute node Risk-associated Information 3-2 and the connected attribute node Risk-associated Information 1-2 are connected by edge E1; the attribute similarity between the attribute node Risk-associated Information 3-3 connected to the user node Risk-associated User 3 and the attribute node Risk-associated Information 1-3 connected to the user node Risk-associated User 1 is greater than the preset attribute similarity threshold, so the attribute node Risk-associated Information 3-3 and the attribute node Risk-associated Information 1-3 are connected by edge E2. If the user node Risk-associated User 1 is the target risk-associated user, that is, a high-risk user, then other risk-associated users (such as Risk-associated User 2 and Risk-associated User 3) with attribute similarity to it are determined through Risk-associated User 1 and may be target risk users. It should be noted that Figure 4 This is only an exemplary form of the risk-associated user network diagram. In other implementation manners, it may include more vertex and edge relationships, which are not limited here.

[0075] In some examples, refer to Figure 5 , Figure 5It is a schematic flowchart of an exemplary S102. In S102, target risk users are determined based on target risk-associated users, including:

[0076] S1021. Based on the risk-associated user network graph and through graph algorithms, calculate the vector similarity between the risk association information of the target risk-associated user and the risk association information of other risk-associated users associated with the target risk-associated user.

[0077] S1022. Screen out target risk users from other risk-associated users according to the vector similarity.

[0078] Among them, the graph algorithms adopted can be various graph algorithms, for example, including at least one of the following: Dijkstra algorithm, Bellman-Ford algorithm, Prim algorithm, Hungarian algorithm, etc., which are not limited here. Exemplarily, in S1021, the edges of the attributes between risk-associated users can also include attribute values, calculate the vector distance, and use the vector distance as the calculation result of the vector similarity. The vector distance includes, for example, at least one of the following: Euclidean distance, cosine distance, Hamming distance, Manhattan distance, etc., which are not limited here.

[0079] As an example, the graph algorithm can also be an algorithm based on a neural network. For example, in S1021, after constructing the risk-associated user network graph, the node feature matrix X, the sparse format adjacency matrix A, and the vector Y of risk association information can be obtained from the risk-associated user network graph as input data, where the number of nodes in the risk-associated user network graph is n, the number of edges is e, and the feature dimension is m; the output classification result is obtained through the activation function, that is, the target risk users are obtained.

[0080] Based on the above method, among the risk-associated users included in the risk-associated user network graph, determine the target risk-associated users consistent with the high-risk users, so as to calculate the vector similarity between other risk-associated users whose attributes have edge relationships with the target risk-associated users and the target risk-associated users, and determine the M other risk-associated users with the largest vector similarity as the target risk users, where M is an integer greater than or equal to 1. In this way, other risk-associated users with strong associations (i.e., high vector similarities) with high-risk users can be screened out as the finally mined target risk users according to the relationship between users, so as to achieve accurate and efficient mining of target risk users, avoid malicious risk behaviors on target risk users, and improve the security of user information and personal property.

[0081] Among them, the risk-related information: is information related to determining the degree to which a risk-related user is vulnerable to malicious risk behaviors, and can specifically include various types of information, such as including at least one of the following: interest tags, basic information, information acquisition level tags, user-specific feature information, etc. Of course, the risk-related information can also include any other information related to risk security, which is not limited here. It should be emphasized that in the acquisition process of risk-related information (including interest tags, basic information, information acquisition level tags, user-specific feature information, etc.) in this application, only the necessary information directly related to implementing the core functions of the patented technology is collected under the condition that the user clearly knows and consents, and the user is aware of the subsequent application of the risk-related information.

[0082] Among them, the interest tags. The user's interest tags are used to represent the interest fields involved by the user. The interest tags include, for example, at least one of the following: interest tags in the shopping field, interest tags in the investment and financial management field, etc., which are not limited here.

[0083] Basic information. The user's basic information can include various information, such as including at least one of the following: permanent residence information, age information, gender information, etc., which are not limited here.

[0084] Among them, the information acquisition level tag is used to represent the user's information acquisition ability. The stronger the user's information acquisition ability, the weaker the degree of being deceived; vice versa. In some examples, when the risk-related information includes the information acquisition level tag, the information acquisition level tag is determined according to the following method:

[0085] Based on the historical search-related behavior information of the risk-related user, determine the information acquisition level tag of the risk-related user.

[0086] Among them, the historical search-related behavior information is the user behavior related to search in the user's historical behavior. The types of historical search-related behavior information can include at least one of the following: historical search behavior information, historical click behavior information, historical speed information for obtaining search results, historical type information of search results, etc. Of course, it can also include any behavior information related to search, which is not limited here.

[0087] Specifically, multiple methods can be used to determine the information acquisition level tag of the risk-related user according to the historical search-related behavior information. For example, weights can be set in advance for different types of historical search-related behavior information; weighted calculation is performed on the historical search-related behavior information to obtain an information acquisition level evaluation value; the preset value range to which the information acquisition level evaluation value belongs is determined, and the information acquisition level tag corresponding to the preset value range to which it belongs is determined as the information acquisition level tag of the risk-related user.

[0088] Among them, multiple information acquisition level tags of different levels can be preset to represent different information acquisition capabilities. Each information acquisition level tag corresponds to a value range of an information acquisition level evaluation value, so as to obtain an information acquisition level evaluation value, and its corresponding information acquisition level tag can be determined according to the value range it belongs to. Exemplarily, four information acquisition level tags representing the information acquisition capabilities from high to low are preset: the first information acquisition level tag, the second information acquisition level tag, the third information acquisition level tag, and the fourth information acquisition level tag.

[0089] The first information acquisition level tag indicates that the risk-associated user has a high information acquisition ability. The content related to the historical search behavior information, historical click behavior information, and the type information of the historical search results is risk-free content. The speed information of the historical obtained search results is greater than a preset speed threshold and less than a preset abnormal threshold, and high-quality results can be found quickly and accurately. Among them, the speed threshold can be set as needed, for example, it is 2 minutes; the abnormal threshold is used to indicate that the user's speed is too high, and the user may be an abnormal user such as a machine user or a cheating user, and can be set as needed, for example, it is 5s, which is not limited here.

[0090] The second information acquisition level tag indicates that the risk-associated user has an ordinary information acquisition ability. The content related to the historical search behavior information, historical click behavior information, and the type information of the historical search results is risk-free content. The speed information of the historical obtained search results is less than or equal to the preset speed threshold, and the user needs to screen for a certain time to obtain the required information.

[0091] The third information acquisition level tag indicates that the risk-associated user has a low information acquisition ability. The content related to the historical search behavior information, historical click behavior information, and the type information of the historical search results is risky content, and / or the speed information of the historical obtained search results is less than or equal to the preset speed threshold. The user's behavior involves risky content, or the judgment ability of the search results is low, so the information acquisition ability is low.

[0092] The third information acquisition level tag indicates that the risk-associated user is an abnormal machine user. The content related to the historical search behavior information, historical click behavior information, and the type information of the historical search results is abnormal content, and / or the speed information of the historical obtained search results is greater than the preset abnormal threshold. The user may be an abnormal user such as a machine user or a cheating user.

[0093] Through the above method, the user's interest tags, basic information, and information acquisition level tags representing the user's information acquisition ability can be combined multi-dimensionally, and the user portrait of the risk-associated user can be comprehensively represented by the risk-associated information, making the obtained user portrait more accurate and comprehensive, and having a strong association with the riskiness.

[0094] In some examples, the risk association information may further include user-specific feature information. In this case, the user-specific feature information can be determined in the following manner:

[0095] Obtain the vectorized user-specific feature information from the risk information database.

[0096] Among them, the user-specific feature information is a preset specific feature, and the specific feature represents a feature strongly associated with the vulnerable population, which can be set as needed and is not limited here.

[0097] In the present disclosure, feature extraction can be performed on historical data for the determined target risk users, and the extracted features can be used as user-specific feature information and stored in the risk information database. Thus, the user-specific feature information is the user feature existing in the determined historical target risk users. For example, the user-specific feature information includes, but is not limited to, the age range, interest tags, etc. of the determined historical target risk users.

[0098] In this way, the target risk users can be determined based on the strong association features between the target risk users and the historical target risk users. Relevant personnel can flexibly set the rules for screening target risk users by setting the user-specific feature information that needs special attention, so as to be applicable to various application scenarios.

[0099] In some examples, before constructing the risk association user network diagram, it is necessary to first determine the risk association users from each user. Refer to Figure 6 , Figure 6 which shows the process schematic diagram for obtaining risk association users. The risk association users are determined in the following manner:

[0100] S001. Extract risk object description information from the security log;

[0101] S002. Through the rule engine, based on the risk object description information, screen out multiple risk association users from each user.

[0102] Among them, the security log: is a file generated by recording system, application, and security events, containing detailed information about system activities, such as login attempts, system errors, application crashes, etc. The structure of the entries in the security log can include, for example: log name, specifying the type to which the event belongs; source, referring to the application or component that generated the event; event number, serving as a number for identifying a specific event; level, indicating the severity of the event, such as including categories like information, warning, error, etc.; user, recording the user account when the event occurred; operation code (OpCode), recording the operation executed when triggering the event; recording time, accurately marking the specific time when the event occurred; task category, providing a classification for more details of the event; keyword, a keyword used to classify the event; computer, recording the computer name where the event occurred.

[0103] Specifically, the security log can originate from multiple platforms. For example, anti-fraud platforms, e-commerce platforms, game platforms, financial security detection platforms, etc., which are not limited here.

[0104] Among them, the risk object description information is information used to describe the object related to malicious risk behavior. The risk object includes, for example, at least one of the following: risk website, risk application, risk account, risk area, etc., which are not limited here; correspondingly, the risk object description information includes, for example, at least one of the following: risk website information, risk application program information, risk account information, risk area information, etc., which are not limited here. It should be emphasized that in the acquisition process of the risk object description information (including risk website information, risk application program information, risk account information, risk area information, etc.) in this application, only the necessary information directly related to realizing the core functions of the patented technology is collected when the user clearly knows and agrees, and the user is aware of the subsequent application of the risk object description information.

[0105] The purpose of step S001 is to extract from the security log the risk objects that may be involved in and / or have been involved in malicious risk behavior. Thus, in step S002, the users associated with these risk objects can be screened as risk-associated users. Among them, being associated with a risk object includes, for example, at least one of the following: having visited a risk website, having downloaded a risk application program, having an interactive behavior with a risk account, being involved in a risk area, etc. The risk area includes, for example: financial field, live broadcast field, shopping field, etc., which are not limited here.

[0106] Based on this, a user screening rule can be preset and placed in the rule engine. Thus, the risk object description information and each user to be screened are input into the rule engine, and the rule engine screens out multiple risk-associated users from the users to be screened through the preset user screening rule.

[0107] Among them, the user screening rules may include multiple rules, such as including at least one of the following:

[0108] The risk website corresponding to the risk website information visited by the user;

[0109] The risk application program corresponding to the risk application information downloaded by the user;

[0110] The user has an interaction behavior with the risk account corresponding to the risk account information;

[0111] There is an interest association or a professional association with the risk area.

[0112] Of course, the user screening rules may also include other rules, which can be specifically set according to needs and are not limited here.

[0113] In the disclosed second embodiment, based on the same Figure 1 principle, Figure 7 A determining device 70 for risk users provided by the second embodiment of the present disclosure is shown. The device includes:

[0114] A preliminary determination module 701, configured to determine high-risk users based on a preset relationship graph of target users and risk application programs;

[0115] A target determination module 702, configured to determine a target risk-associated user corresponding to the high-risk user among multiple risk-associated users in a preset risk-associated user network graph;

[0116] A final determination module 703, configured to determine target risk users based on the target risk-associated users;

[0117] Among them, the relationship graph of target users and risk application programs is used to represent the behavioral relationship between each target user and the risk application program; the risk-associated user network graph is used to represent the user relationship between each risk-associated user.

[0118] In some examples, the final determination module 703 is specifically configured to:

[0119] Based on the risk-associated user network graph, and through a graph algorithm, calculate the vector similarity between the risk association information of the target risk-associated user and the risk association information of other risk-associated users associated with the target risk-associated user;

[0120] According to the vector similarity, screen out target risk users from other risk-associated users.

[0121] In some examples, the preset risk-associated user network graph is constructed in the following manner:

[0122] Using risk-associated users as user nodes and the risk-associated information of risk-associated users as attribute nodes, connect the user nodes to the corresponding attribute nodes through edges;

[0123] Determine the attribute similarity between the attribute nodes connected by each user node, and connect the attribute nodes with an attribute similarity greater than the preset attribute similarity threshold in different user nodes through edges to construct a risk-associated user network graph.

[0124] In some examples, the graph algorithms include at least one of the following: Dijkstra's algorithm, Bellman-Ford algorithm, Prim's algorithm, Hungarian algorithm.

[0125] In some examples, the user-risk application relationship graph uses each target user and each risk application as vertices, and uses the user behaviors generated by each target user in the risk application as edges to connect each target user and each risk application;

[0126] Among them, the edge feature of the edge is the user behavior type, and different user behavior types correspond to different edge weights.

[0127] In some examples, the preliminary determination module 701 is specifically used for:

[0128] Perform weighted calculation based on the edges between each target user and the risk application and their edge weights;

[0129] Determine high-risk users from each target user according to the results of the weighted calculation.

[0130] In some examples, the risk-associated information includes at least one of the following: interest tags of risk-associated users, basic information, information acquisition level tags.

[0131] In some examples, the information acquisition level tag is determined according to the following method:

[0132] Based on the historical search association behavior information of risk-associated users, determine the information acquisition level tag of risk-associated users;

[0133] Among them, the historical search association behavior information includes at least one of the following: historical search behavior information, historical click behavior information, historical speed information for obtaining search results, historical search result type information.

[0134] In some examples, the risk-associated information further includes: user-specific feature information;

[0135] The user-specific feature information is determined according to the following method:

[0136] Obtain the vectorized user-specific feature information from the risk information database.

[0137] In some examples, risk-associated users are determined in the following manner:

[0138] Extract risk object description information from security logs;

[0139] Through a rules engine, based on the risk object description information, filter out multiple risk-associated users from each user.

[0140] In the technical solution of the present disclosure, before obtaining or collecting user personal information, the authorization or consent of the user is obtained.

[0141] According to the embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0142] As Figure 8 shown, the device 800 includes a computing unit 801, which can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 802 or the computer program loaded from the storage unit 802 into the random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. The input / output (I / O) interface 805 is also connected to the bus 804.

[0143] Multiple components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disc, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0144] The computing unit 801 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 executes the various methods and processes described above, such as the method for determining risk users. For example, in some embodiments, the method for determining risk users can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the method for determining risk users described above can be executed. Alternatively, in other embodiments, the computing unit 801 can be configured with the method for determining risk users in any other suitable manner (e.g., by means of firmware).

[0145] The various embodiments of the systems and techniques described above in this document can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGA), application-specific integrated circuits (ASIC), application-specific standard products (ASSP), system-on-a-chip systems (SOC), complex programmable logic devices (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a dedicated or general-purpose programmable processor, and can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program codes can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0147] In the context of this disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] In order to provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein can be implemented in a computing system including backend components (e.g., as a data server), or a computing system including middleware components (e.g., an application server), or a computing system including frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system including any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0150] A computer system can include a client and a server. The client and the server are generally far apart from each other and typically interact through a communication network. The relationship between the client and the server is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, can also be a server of a distributed system, or a server incorporating a blockchain.

[0151] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and no limitations are imposed herein.

[0152] The above specific embodiments do not constitute a limitation on the protection scope of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub - combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the protection scope of this disclosure.

Claims

1. A method for determining risk users, wherein, The method includes: Determining high-risk users based on a preset relationship graph of target users and risk applications; In a preset network graph of risk-associated users, determining target risk-associated users corresponding to the high-risk users among multiple risk-associated users; Determining target risk users based on the target risk-associated users; Wherein, the relationship graph of target users and risk applications is used to represent the behavioral relationships between each target user and risk applications; the network graph of risk-associated users is used to represent the user relationships between each risk-associated user.

2. The method according to claim 1, wherein, The determining of target risk users based on the target risk-associated users includes: Based on the network graph of risk-associated users and through a graph algorithm, calculating the vector similarity between the risk-associated information of the target risk-associated users and the risk-associated information of other risk-associated users associated with the target risk-associated users; According to the vector similarity, screening out the target risk users from the other risk-associated users.

3. The method according to claim 2, wherein, The preset network graph of risk-associated users is constructed by the following method: Taking the risk-associated users as user nodes and the risk-associated information of the risk-associated users as attribute nodes, connecting the user nodes to the corresponding attribute nodes through edges; Determining the attribute similarity between the attribute nodes connected by each user node, and connecting the attribute nodes with an attribute similarity greater than a preset attribute similarity threshold among different user nodes through edges to construct the network graph of risk-associated users.

4. The method according to claim 2 or 3, wherein The graph algorithm includes at least one of the following: Dijkstra's algorithm, Bellman-Ford algorithm, Prim's algorithm, Hungarian algorithm.

5. The method according to any one of claims 1-4, wherein, The relationship graph of users and risk applications takes each target user and each risk application as vertices, and takes the user behaviors generated by each target user in the risk application as edges to connect each target user and each risk application; Wherein, the edge feature of the edge is the user behavior type, and different user behavior types correspond to different edge weights.

6. The method according to claim 5, wherein, The determining of high-risk users based on a preset relationship graph of target users and risk applications includes: Performing weighted calculation based on the edges and their edge weights between each target user and the risk application; According to the result of the weighted calculation, determining the high-risk users from each target user.

7. The method according to any one of claims 2-4, wherein The risk-associated information includes at least one of the following: interest tags of the risk-associated users, basic information, information acquisition level tags.

8. The method according to claim 7, wherein, The information acquisition level tags are determined according to the following method: Based on the historical search association behavior information of the risk-associated users, determining the information acquisition level tags of the risk-associated users; Wherein, the historical search association behavior information includes at least one of the following: historical search behavior information, historical click behavior information, historical speed information of obtaining search results, historical type information of search results.

9. The method according to claim 7 or 8, wherein, The risk-associated information further includes: user specific feature information; The user specific feature information is determined according to the following method: Obtaining vectorized user specific feature information from a risk information database.

10. The method according to any one of claims 1-9, wherein, The risk-associated users are determined by the following method: Extract risk object description information according to the security log; Through a rule engine, based on the risk object description information, screen out the multiple risk-associated users from each user.

11. An apparatus for determining a risk user, wherein, The device includes: A preliminary determination module, configured to determine high-risk users based on a preset relationship graph of target users and risk applications; A target determination module, configured to determine target risk-associated users corresponding to the high-risk users among the multiple risk-associated users in a preset risk-associated user network graph; A final determination module, configured to determine target risk users based on the target risk-associated users; Wherein, the relationship graph of target users and risk applications is used to represent the behavioral relationships between each target user and risk applications; the risk-associated user network graph is used to represent the user relationships between each risk-associated user.

12. An electronic device, including: At least one processor; And A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1-10.

13. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to execute the method according to any one of claims 1-10.

14. A computer program product, including a computer program, where the computer program implements the method according to any one of claims 1-10 when executed by a processor.

Images