Abnormal subject identification method and device, equipment and storage medium

Abstract

The invention provides an abnormal subject identification method and device, equipment and a storage medium, which can be applied to the technical fields of short videos, artificial intelligence and the like, and comprises the following steps: obtaining at least one of first information of a first subject, second information of the first subject and third information of N second subjects corresponding to the first subject, the N second main bodies are N second main bodies under a first certificate number corresponding to the first main body; and determining whether the first subject is an abnormal subject based on at least one of the first information of the first subject, the second information of the first subject and the account information of the N second subjects. According to the invention, based on at least one of the first information of the first main body, the second information of the first main body and the account information of the N second main bodies, whether the first main body is the abnormal main body or not can be quickly identified in advance.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of computer technologies, and particularly to a method, apparatus, device, and storage medium for identifying abnormal entities. Background Art

[0002] With the rapid development of short-video related technologies, various short-video platforms have emerged. Users can watch various short videos on short-video platforms and can also post short videos on short-video platforms. Since any user can post short videos on the short-video platform, there will be some abnormal short videos.

[0003] To ensure the healthy development of short-video platforms, it is necessary to identify video accounts that post abnormal short videos. Currently, methods based on content clustering are used to identify abnormal entities. However, when using methods based on content clustering to identify abnormal entities, the algorithm can only identify when a large number of accounts post similar or homogeneous content, which inevitably leads to the problem of lagging identification. Summary of the Invention

[0004] The present application provides a method, apparatus, device, and storage medium for identifying abnormal entities. By using at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, it is determined whether the first entity is an abnormal entity, thereby achieving accurate and rapid identification of abnormal entities.

[0005] In a first aspect, the present application provides a method for identifying an abnormal entity, including:

[0006] Obtaining at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, where the N second entities are N second entities under the first ID number corresponding to the first entity, and N is a positive integer;

[0007] Based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities, determining whether the first entity is an abnormal entity.

[0008] In a second aspect, the present application provides an apparatus for identifying an abnormal entity, including:

[0009] An obtaining unit, configured to obtain at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, where the N second entities are N second entities under the first ID number corresponding to the first entity, and N is a positive integer;

[0010] A determination unit, configured to determine whether the first subject is an abnormal subject based on at least one of the first information of the first subject, the second information of the first subject, and the third information of the N second subjects.

[0011] In some embodiments, the abnormal subject includes a video account that rents the login code of a video account, the first subject includes a first video account, the first information includes user basic information, the second information includes login information, and the second subject includes a social account; the determination unit is specifically configured to determine whether the first video account is the video account that rents the login code of the video account based on at least one of the user basic information of the first video account and the login information of the first video account.

[0012] In some embodiments, the determination unit is specifically configured to determine a first suspicious score of the first video account based on the user basic information of the first video account; and determine whether the first video account is the video account that rents the login code of the video account based on the first suspicious score and the login information of the first video account.

[0013] In some embodiments, the determination unit is specifically configured to, if the first suspicious score is greater than a first preset value, determine a second suspicious score of the first video account based on the login information of the first video account; and determine whether the first video account is the video account that rents the login code of the video account based on the second suspicious score.

[0014] In some embodiments, the login information of the first video account includes at least one of a login location, a historical login count at the login location, and a login IP address; the determination unit is specifically configured to determine a suspicious score corresponding to at least one of the login location, the historical login count at the login location, and the login IP address; and determine the second suspicious score based on the suspicious score corresponding to at least one of the login location, the historical login count at the login location, and the login IP address.

[0015] In some embodiments, the determining unit is specifically configured to: if the login location is a different location, determine that the suspicious score corresponding to the login location is a first value; if the login location is not a different location, determine that the suspicious score corresponding to the login location is a second value, where the first value is greater than the second value; if the historical login times of the first video account at the login location is 0, determine that the suspicious score corresponding to the historical login times at the login location is a third value; if the historical login times of the first video account at the login location is greater than 0, determine that the suspicious score corresponding to the historical login times at the login location is a fourth value, where the third value is greater than the fourth value; obtain at least one of the number of abnormal users and the proportion of abnormal users under the login IP address; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than the corresponding preset value, determine that the suspicious score corresponding to the login IP address is a fifth value; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, determine that the suspicious score corresponding to the login IP address is a sixth value, where the fifth value is greater than the sixth value.

[0016] In some embodiments, the determining unit is specifically configured to determine the sum of the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address as the second suspicious score.

[0017] In some embodiments, the determining unit is specifically configured to perform suspicious account prediction on the basic user information of the first video account through a first recognition model to obtain the first suspicious score of the first video account.

[0018] In some embodiments, the determining unit is specifically configured to, when detecting that the first entity logs in by scanning the login code, obtain at least one of the first information of the first entity and the second information of the first entity.

[0019] In some embodiments, the abnormal entity includes a video account that sends abnormal data on behalf of others, the first entity includes a first video account, the second entity includes a social account, and the third information is the account information of the social account; the determining unit is specifically configured to determine whether the first video account is the video account that sends abnormal data on behalf of others based on the account information of the N social accounts.

[0020] In some embodiments, the determining unit is specifically configured to determine, based on the account information of the N social accounts, the identification information of M objects that have a suspicious relationship with the N social accounts, where the suspicious relationship includes at least one of a multimedia data sending relationship, a payment relationship, and a group joining relationship, and M is a positive integer; for the i-th object among the M objects, determine the feature data of the i-th object based on the identification information of the i-th object, and determine whether the i-th object is a suspicious object based on the feature data of the i-th object; and determine whether the first video account is the video account that sends abnormal data based on the number of suspicious objects among the M objects.

[0021] In some embodiments, the determining unit is specifically configured to, based on the identification information of the i-th object, obtain P ID numbers that have the suspicious relationship with the i-th object, where P is a positive integer; obtain the dynamic data of the social accounts under each of the P ID numbers, where the dynamic data includes at least one of the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics; and determine the feature data of the i-th object based on the dynamic data of the social accounts under each of the P ID numbers.

[0022] In some embodiments, the determining unit is specifically configured to perform a suspicious object prediction on the feature data of the i-th object through a second recognition model to obtain the suspicious score of the i-th object; and determine whether the i-th object is the suspicious object based on the suspicious score of the i-th object.

[0023] In some embodiments, when the i-th object is a suspicious object, the determining unit is further configured to, when detecting that a second social account has the suspicious relationship with the i-th object, determine the second social account and each social account under the ID number corresponding to the second social account as abnormal social accounts.

[0024] In some embodiments, the obtaining unit is configured to, when detecting that the first video account publishes video data, obtain the account information of the N social accounts corresponding to the first video account.

[0025] In some embodiments, when the first subject is an abnormal subject, the determining unit is further configured to display an identity authentication interface; receive the identity information input by the user in the identity authentication interface; and if it is determined that the identity authentication of the first subject fails based on the identity information, perform a blocking process on the first subject.

[0026] In some embodiments, when the first subject is an abnormal subject, the determining unit is further configured to perform a blocking process on the first subject and a second subject corresponding to the first subject.

[0027] In a third aspect, an electronic device is provided, which includes a processor and a memory. The memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the methods in the first aspect and its various implementation manners as described above.

[0028] In a fourth aspect, a chip is provided, which is used to implement the methods in any one of the first aspect and its various implementation manners as described above. Specifically, the chip includes: a processor, which is used to call and run a computer program from a memory, so that a device installed with the chip executes the methods in any one of the first aspect and its various implementation manners as described above.

[0029] In a fifth aspect, a computer-readable storage medium is provided, which is used to store a computer program, and the computer program enables a computer to execute the methods in the first aspect and its various implementation manners as described above.

[0030] In a sixth aspect, a computer program product is provided, which includes computer program instructions, and the computer program instructions enable a computer to execute the methods in the first aspect and its various implementation manners as described above.

[0031] In a seventh aspect, a computer program is provided, which when running on a computer, enables the computer to execute the methods in the first aspect and its various implementation manners as described above.

[0032] In summary, the present application obtains at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, where the N second entities are N second entities under the first ID number corresponding to the first entity, and N is a positive integer; and then determines whether the first entity is an abnormal entity based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities corresponding to the first entity. That is to say, the embodiments of the present application can determine whether the first entity is an abnormal identification account in advance based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities corresponding to the first entity, without waiting for a large amount of abnormal data to be released by the first entity and other entities before identification. Therefore, the method of the embodiments of the present application can achieve rapid and early identification of abnormal entities. Description of the Drawings

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0034] Figure 1 Schematic diagram of an implementation environment related to an embodiment of this application;

[0035] Figure 2 Schematic flowchart of a method for identifying an abnormal entity provided by an embodiment of this application;

[0036] Figure 3 Schematic diagram of the training of the first identification model;

[0037] Figure 4 Schematic diagram of N social accounts corresponding to the first video account and objects having a suspicious relationship with the N social accounts;

[0038] Figure 5 Schematic diagram of the dynamic data of social accounts under P ID numbers having a suspicious relationship with the i-th object;

[0039] Figure 6 Schematic diagram of predicting the suspicious score of the i-th object using the second identification model;

[0040] Figure 7 Schematic diagram of determining the second social account having a suspicious relationship with the i-th object as an abnormal social account;

[0041] Figure 8 Schematic diagram of identity authentication;

[0042] Figure 9 Schematic diagram of blocking the first video account and the social accounts corresponding to the first video account;

[0043] Figure 10 Schematic diagram of a reminder explanation after blocking a social account;

[0044] Figure 11 Schematic flowchart of a method for identifying an abnormal entity provided by an embodiment of this application;

[0045] Figure 12 Schematic flowchart of a method for identifying an abnormal entity provided by an embodiment of this application;

[0046] Figure 13 Schematic block diagram of an abnormal entity identification device provided by an embodiment of this application;

[0047] Figure 14 Schematic block diagram of an electronic device provided by an embodiment of this application. Detailed implementation manners

[0048] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0049] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and do not necessarily need to describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In the embodiments of the present invention, "B corresponding to A" means that B is associated with A. In one implementation, B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B can also be determined according to A and / or other information. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices. In the description of the present application, unless otherwise specified, "a plurality of" means two or more than two.

[0050] The technical solutions proposed in the present application can be applied to technical fields such as short videos and artificial intelligence, etc., to improve the recognition accuracy and recognition speed of abnormal entities (such as abnormal video accounts).

[0051] The following introduces the relevant concepts involved in the embodiments of the present application.

[0052] Short video: That is, a short film video, which is a way of spreading Internet content, generally a video with a duration of less than n minutes spread on Internet new media. With the popularization of mobile terminals and the acceleration of network speed, short, flat and fast large-flow communication content has gradually won the favor of the public. In some embodiments, the short videos in the embodiments of the present application may refer to any short video platform product.

[0053] The full name of the black industry is the black industry, which refers to the industry that makes profits by abnormal means.

[0054] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a way similar to human intelligence. Artificial intelligence also studies the design principles and implementation methods of various intelligent machines to enable machines to have the functions of perception, reasoning and decision-making.

[0055] Artificial intelligence technology is an interdisciplinary subject with a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. The software technologies of artificial intelligence mainly include several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0056] Machine Learning (ML) is an interdisciplinary subject that involves multiple disciplines such as probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve their own performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent, and its applications cover all fields of artificial intelligence. Machine learning and deep learning usually include technologies such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and rote learning.

[0057] With the research and progress of artificial intelligence technology, artificial intelligence technology has been studied and applied in multiple fields. For example, common ones include smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, driverless, autonomous driving, drones, robots, smart healthcare, smart customer service, etc. It is believed that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0058] In the embodiments of this application, artificial intelligence technology is applied to the identification of abnormal entities to identify abnormal video accounts.

[0059] Since any user can post short videos on this short video platform, some abnormal short videos will appear. To ensure the healthy development of the short video platform, it is necessary to identify the video accounts that post abnormal short videos. Currently, the method based on content clustering is used to identify abnormal entities. However, when using the method based on content clustering to identify abnormal entities, the algorithm can only identify when a large number of accounts post similar or homogeneous content, which inevitably has the problem of lagging identification.

[0060] To solve this technical problem, the embodiment of the present application obtains at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity. The N second entities are N second entities under the first identification number corresponding to the first entity, and N is a positive integer. Furthermore, based on at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, it is determined whether the first entity is an abnormal entity. That is to say, the embodiment of the present application can, based on at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, identify in advance whether the first entity is an abnormal entity, without waiting for the first entity and other entities to post a large amount of abnormal data before identification. Therefore, the method of the embodiment of the present application can achieve fast and early identification of abnormal entities.

[0061] The implementation environment of the method for identifying abnormal entities provided by the embodiment of the present application is introduced below.

[0062] Figure 1 This is a schematic diagram of an implementation environment involved in the embodiment of the present application, including a terminal device 101, a server 102, a terminal device 102, and a terminal device 103. In the embodiment of the present application, the front end of the video playback platform is installed on the terminal device 101 and the terminal device 102, and the server 102 can be understood as the back end of the video playback platform. Among them, the terminal device 101 and the terminal device 102 can be understood as the terminal devices of the user side, and the terminal device 103 can be understood as the terminal device of the operation and maintenance side.

[0063] The server 102 in the embodiment of the present application includes a first identification model and a second identification model. The first identification model can predict whether the first entity is a suspicious account based on the first information of the first entity. The second identification model can predict whether the medium is a suspicious medium based on the characteristic data of the medium.

[0064] In some embodiments, such as Figure 1As shown, the user publishes a short video on the terminal device 101. The server 102 receives the short video published by the terminal device 101 and presents the short video to the user corresponding to the terminal device 102 through the video playback platform. At the same time, the operation and maintenance personnel can review the short video published by the user through the terminal device 103.

[0065] In the embodiment of the present application, when the server 101 detects the login of the first entity or the situation that the first entity publishes a video, etc., it obtains at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, where the N second entities are the N second entities under the first ID number corresponding to the first entity. Then, based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities, it is determined whether the first entity is an abnormal entity. For example, based on the first information of the first entity and the second information of the first entity, it is determined whether the first entity is a video account that rents the login code of the video account. For another example, based on the third information of the N second entities corresponding to the first entity, it is determined whether the first entity is a video account that sends abnormal data on behalf of others. It can be seen that in the embodiment of the present application, based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities corresponding to the first entity, it can be identified in advance whether the first entity is an abnormal identification account, without waiting for the first entity and other entities to publish a large amount of abnormal data before identification. Therefore, the method of the embodiment of the present application can realize the rapid and early identification of abnormal entities.

[0066] The embodiment of the present application does not limit the specific type of the terminal device. In some embodiments, the terminal device 101 may include but is not limited to: mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, wearable smart devices, medical devices, etc. The device is often configured with a display device, and the display device may also be a monitor, a display screen, a touch screen, etc. The touch screen may also be a touch panel, a touch screen panel, etc.

[0067] In some embodiments, the server(s) can be one or more. When there are multiple servers, at least two servers are used to provide different services, and / or at least two servers are used to provide the same service, such as providing the same service in a load balancing manner. The embodiments of the present application do not limit this. Among them, the above-mentioned server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server can also become a node of the blockchain.

[0068] In the embodiments of the present application, the terminal device and the electronic device can be directly or indirectly connected through wired communication or wireless communication. The present application does not limit this here.

[0069] It should be noted that the implementation environment of the embodiments of the present application includes but is not limited to Figure 1 as shown.

[0070] The technical solutions of the embodiments of the present application will be described in detail below through some embodiments. These several embodiments below can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0071] Figure 2 It is a schematic flowchart of a method for identifying an abnormal entity provided by an embodiment of the present application. The execution entity of the embodiments of the present application is a device with an identification function, such as an identification device for abnormal entities, simply referred to as an identification device. In some embodiments, the identification device can be Figure 1 the server in Figure 1 or the terminal device in Figure 1 or a system composed of the server and the terminal device in

[0072] As Figure 3 shown, the identification process of the abnormal entity in the embodiments of the present application includes:

[0073] S101. Obtain at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity.

[0074] Among them, the N second entities are N second entities under the first ID number corresponding to the first entity, and N is a positive integer.

[0075] The embodiments of the present application do not limit the specific type of the first entity.

[0076] In some embodiments, the first entity may be understood as any video account registered on a video playback platform.

[0077] In some embodiments, the video playback platform of the embodiments of the present application may be a short video playback platform, and the corresponding first entity may be a short video account. Of course, the video playback platform may also be a medium or long video playback platform, and the corresponding first entity is a medium or long video account. The embodiments of the present application do not limit this.

[0078] When the video playback platform of the embodiments of the present application is a short video playback platform, the embodiments of the present application do not limit the specific type of the short video playback platform. For example, it may include a short video playback platform of a social platform type (i.e., a short video playback platform hosted on a social platform), an independent short video playback platform (i.e., an independent short video playback platform not hosted on other platforms), a live broadcast short video playback platform, and so on.

[0079] In one possible implementation, the video playback platform of the embodiments of the present application is a short video playback platform of a social platform type, and the corresponding first entity may be a video account registered on the short video playback platform of the social platform type.

[0080] In some embodiments, the first information of the first entity may be understood as the first information of the first user corresponding to the first entity. The embodiments of the present application do not limit the specific content of the first information of the first entity.

[0081] In some embodiments, the first information may be the basic user information of the first user.

[0082] In the embodiments of the present application, the second information of the first entity is information that is not completely consistent with the first information. The embodiments of the present application do not limit the specific content of the second information.

[0083] In some embodiments, if the first entity is the first video account, the second information may be the login information of the first video account.

[0084] In the embodiments of the present application, the login information of the first video account may be understood as the login behavior information when logging in to the first video account. For example, the login information of the first video account includes at least one of the login method of the first video account, the current login location, the number of logins at this login location, the login IP address of this login to the first video account, and other information.

[0085] In the embodiments of the present application, the N second entities corresponding to the first entity are second entities under the same identification number as the first entity. The embodiments of the present application do not limit the specific type of the second entity.

[0086] In some embodiments, when the first entity is the first video account, the second entity may be the social account corresponding to the first video account. That is to say, the N social accounts corresponding to the first video account are social accounts under the same identification number as the first video account. For example, if the first video account is a video account under the first identification number, then the N social accounts under the first identification number are determined to be the N social accounts corresponding to the first video account.

[0087] The embodiments of the present application do not limit the triggering conditions for obtaining the user basic information of the first video account, the login information of the first video account, and the account information of the N social accounts corresponding to the first video account.

[0088] In a possible implementation, when it is detected that the first video account logs in, at least one of the user basic information of the first video account, the login information of the first video account, and the account information of the N social accounts corresponding to the first video account is obtained.

[0089] In a possible implementation, when it is detected that the first video account publishes a video, at least one of the user basic information of the first video account, the login information of the first video account, and the account information of the N social accounts corresponding to the first video account is obtained.

[0090] In a possible implementation, when it is detected that the first video account logs in by scanning a login code, at least one of the user basic information of the first video account and the login information of the first video account is obtained.

[0091] In a possible implementation, when it is detected that the first video account publishes a video, the account information of the N social accounts corresponding to the first video account is obtained.

[0092] It should be noted that all kinds of data obtained in the embodiments of the present application and the ways to obtain each data comply with relevant laws and regulations.

[0093] In the embodiments of the present application, after the electronic device obtains at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities corresponding to the first entity, the following step S102 is executed.

[0094] S102. Determine whether the first entity is an abnormal entity based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities.

[0095] The embodiments of the present application can identify in advance whether the first entity is an abnormal entity based on at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, without waiting for a large amount of abnormal data to be released by the first entity and other entities before identification. Therefore, the method of the embodiments of the present application can achieve fast and advance identification of abnormal entities.

[0096] The following uses an example where the first entity includes a first video account, the first information includes the user basic information of the first video account, the second information includes the login information of the first video account, the second entity includes the social account corresponding to the first video account, and the third information is the account information of the social account to illustrate this step.

[0097] The embodiments of the present application do not limit the specific types of abnormal entities.

[0098] In some embodiments, the abnormal entities at least include the following two types:

[0099] The first type is: a video account that rents out the login code of the video account. For example, the black production party opens a video account login assistant on the web page and displays the video account login code. Then, the black production party provides the login code to the owner of the video account, such as the second user. The second user scans the login code to complete the login of the video account. At this time, the black production party can operate the video account, such as posting abnormal videos on the video account.

[0100] The second type is: a video account that forwards abnormal data. That is, the black production party sends abnormal video data to the owner of the video account, and the owner of the video account posts the abnormal video data on his own video account.

[0101] The following describes the identification processes for the above two types of abnormal entities separately.

[0102] First, in combination with Case 1, that is, when the abnormal entity includes a video account that rents out the login code of the video account, the process of determining whether the first video account is a video account that rents out the login code of the video account based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts is introduced.

[0103] The embodiments of the present application do not limit the specific manner in which the electronic device determines whether the first video account is a video account that rents out the login code of the video account based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts.

[0104] In some embodiments, the electronic device determines whether the first video account is a video account that rents out video account login codes based on the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts. For example, based on the login information of the first video account, it is determined that the login method of the first video account is to log in by scanning the login code, the login location is a remote login, and the login count is the first login. Based on the user basic information of the first video account, it is determined that the user basic information conforms to the user basic information of a suspicious object. And based on the account information of the N social accounts corresponding to the first video account, it is determined that at least one of the N social accounts is an abnormal social account or at least one of the social accounts has been banned before. Then it is determined that the first video account is a video account that rents out video account login codes.

[0105] In some embodiments, the following steps of S102-A can be used to determine whether the first video account is a video account that rents out video account login codes:

[0106] S102-A: Determine whether the first video account is a video account that rents out video account login codes based on at least one of the user basic information of the first video account and the login information of the first video account.

[0107] In this embodiment, the electronic device can determine whether the first video account is a video account that rents out video account login codes based on at least one of the user basic information of the first video account and the login information of the first video account.

[0108] In a possible implementation manner, the electronic device determines whether the first video account is a video account that rents out video account login codes based on the user basic information of the first video account. For example, the electronic device obtains a first prediction model, which can predict whether the video account is a video account that rents out video account login codes based on the user basic information of the video account. The first prediction model is trained based on the user basic information of different video accounts, and the user basic information of the different video accounts includes positive samples and negative samples. In this way, the electronic device can input the obtained user basic information of the first video account into the first prediction model for prediction to obtain whether the first video account is a video account that rents out video account login codes.

[0109] In a possible implementation, the electronic device determines whether the first video account is a video account renting out video account login codes based on the login information of the first video account. For example, the electronic device obtains a second prediction model, which can predict whether the video account is a video account renting out video account login codes based on the login information of the video account. The second prediction model is trained based on the login information of different video accounts, and the login information of the different video accounts includes positive samples and negative samples. In this way, the electronic device can input the obtained login information of the first video account into the second prediction model for prediction to obtain whether the first video account is a video account renting out video account login codes.

[0110] In a possible implementation, the electronic device determines whether the first video account is a video account renting out video account login codes based on the user basic information and login information of the first video account. At this time, the above S102-A includes the following steps of S102-A1 and S102-A2:

[0111] S102-A1: Determine the first suspicious score of the first video account based on the user basic information of the first video account;

[0112] S102-A2: Determine whether the first video account is a video account renting out video account login codes based on the first suspicious score and the login information of the first video account.

[0113] In this implementation, it is determined whether the first video account is a video account renting out video account login codes based on the user basic information of the first video account and the login information of the first video account. Specifically, first, the first suspicious score of the first video account is determined based on the user basic information of the first video account.

[0114] The embodiments of the present application do not limit the specific manner of determining the first suspicious score of the first video account based on the user basic information of the first video account.

[0115] In a possible implementation, the user basic information may include information A of the user, information B of the user, and other information. Different suspicious scores are set for different information A and different information B. For example, the suspicious score of a user with a smaller information A is less than the suspicious score of a user with a larger information A. In this way, the first suspicious score of the first video account can be determined based on the user basic information of the first video account. For example, based on the user basic information of the first video account, the suspicious score corresponding to the information A of the user and the suspicious score corresponding to the information B of the user are determined respectively from the preset different information A and different information B corresponding to different suspicious scores, and then the sum of the suspicious score corresponding to the information A of the user and the suspicious score corresponding to the information B of the user is determined as the first suspicious score of the first video account.

[0116] In a possible implementation, as Figure 3 shown, an embodiment of the present application can train a first recognition model. This first recognition model can predict a suspicious score of a video account based on the basic user information of the video account. The first recognition model is obtained through offline training on the (T + 1)-th day. The training samples during training include positive samples and negative samples. Among them, the positive samples are the randomly selected basic user information of video accounts, and the negative samples are the basic user information of abnormal video accounts. Optionally, the positive-negative sample ratio is controlled at 1:20. In this way, the electronic device can perform suspicious account prediction on the basic user information of the first video account through the first recognition model to obtain the first suspicious score of the first video account. For example, input the basic user information of the first video account into the first recognition model for suspicious account prediction to obtain the suspicious score of the first video account being a suspicious video account. For the convenience of description, this suspicious score is denoted as the first suspicious score.

[0117] After the electronic device determines the first suspicious score of the first video account based on the basic user information of the first video account, it executes the steps of S102-A2 described above.

[0118] The embodiment of the present application does not limit the specific manner of determining whether the first video account is a video account renting the login code of the video account based on the first suspicious score and the login information of the first video account.

[0119] In some embodiments, the electronic device can determine a second suspicious score of the first video account based on the login information of the first video account, and then determine the total suspicious score of the first video account based on the first suspicious score and the second suspicious score of the first video account. Then, based on the total suspicious score of the first video account, it is determined whether the first video account is a video account renting the login code of the video account. For example, if the total suspicious score of the first video account is greater than a preset value, it is determined that the first video account is a video account renting the login code of the video account. If the total suspicious score of the first video account is less than or equal to the preset value, it is determined that the first video account is not a video account renting the login code of the video account.

[0120] In some embodiments, the above S102-A2 includes the following steps of S102-A21 and S102-A22:

[0121] S102-A21: If the first suspicious score is greater than the first preset value, then based on the login information of the first video account, determine the second suspicious score of the first video account;

[0122] S102-A22: Based on the second suspicious score, determine whether the first video account is a video account renting the login code of the video account.

[0123] In this implementation, the electronic device first determines the first suspicious score of the first video account based on the user's basic information of the first video account. When the first suspicious score is greater than the first preset value, the electronic device then determines the second suspicious score of the first video account based on the login information of the first video account. This can reduce the amount of data processing for determining whether the first video account is a video account renting the login code of a video account, and improve the speed of determining whether the first video account is a video account renting the login code of a video account.

[0124] The following introduces the specific process of the electronic device determining the second suspicious score of the first video account based on the login information of the first video account.

[0125] In a possible implementation, the embodiments of the present application can train a third recognition model. This third recognition model can predict the suspicious score of a video account based on the login information of the video account. The training samples during the training of this third recognition model include positive samples and negative samples. Among them, the positive samples are randomly selected login information of video accounts, and the negative samples are the login information of abnormal video accounts. In this way, the electronic device can predict the suspicious account of the login information of the first video account through the third recognition model to obtain the second suspicious score of the first video account. For example, input the login information of the first video account into the third recognition model for suspicious account prediction to obtain the second suspicious score of the first video account.

[0126] In a possible implementation, the video account renting the login code of a video account is usually logged in from a different location and logged in for the first time at the different location. Based on this, the login information of the first video account in the embodiments of the present application includes at least one of the login location, the historical login times at the login location, and the login IP address. The login location can be understood as the current login location of the first video account. The historical login times at the login location can be understood as the historical login times of the first video account at the current login location. The login IP address can be understood as the current login IP address of the first video account. At this time, determining the second suspicious score of the first video account based on the login information of the first video account in step S102-A21 above includes the following steps of S102-A211 and S102-A212:

[0127] S102-A211: Determine the suspicious score corresponding to at least one of the login location, the historical login times at the login location, and the login IP address;

[0128] S102-A212: Determine the second suspicious score based on the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address.

[0129] In this implementation, when the login information of the first video account includes at least one of the login location, the historical login times at the login location, and the login IP address, the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address can be determined. For example, if the login information of the first video account includes the login location, the historical login times at the login location, and the login IP address, then the suspicious scores corresponding to the login location, the historical login times at the login location, and the login IP address are determined, and then based on these three suspicious scores, the second suspicious score of the first video account is determined.

[0130] The following introduces the specific process of determining the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address.

[0131] The embodiments of the present application do not limit the specific manner in which the electronic device determines the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address.

[0132] In some embodiments, the login location, the historical login times at the login location, and the login IP address respectively correspond to a suspicious score prediction model. Exemplarily, based on the account information of the first video account, the electronic device obtains the login location of the first video account during registration, and then inputs the current login location of the first video account and the login location of the first video account during registration into the suspicious score prediction model corresponding to the login location for prediction, and obtains the suspicious score corresponding to the current login location. Exemplarily, based on the account information and the current login location of the first video account, the electronic device obtains the historical login times of the first video account at the current login location, and then inputs the historical login times into the suspicious score prediction model corresponding to the historical login times for prediction, and obtains the suspicious score corresponding to the historical login times of the first video account at the current login location. Exemplarily, based on the login IP address, the electronic device obtains the number of black production users corresponding to the login IP address, and then inputs the number of black production users corresponding to the login IP address into the suspicious score prediction model corresponding to the login IP address for prediction, and obtains the suspicious score corresponding to the login IP address.

[0133] In some embodiments, the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address can be determined through preset rules.

[0134] Exemplarily, assuming that the login information of the first video account includes the login location, if the login location is in a different place, then determine that the suspicious score corresponding to the login location is the first value; if the login location is not in a different place, then determine that the suspicious score corresponding to the login location is the second value, where the first value is greater than the second value. The embodiments of the present application do not limit the specific values of the first value and the second value. For example, the first value is 1 and the second value is 0, that is, if the login location is in a different place, then determine that the suspicious score corresponding to the login location is 1; if the login location is not in a different place, then determine that the suspicious score corresponding to the login location is 0.

[0135] Exemplarily, assuming that the login information of the first video account includes the historical login times at the login location, if the historical login times of the first video account at the login location is 0, then determine that the suspicious score corresponding to the historical login times at the login location is the third value; if the historical login times of the first video account at the login location is greater than 0, then determine that the suspicious score corresponding to the historical login times at the login location is the fourth value, where the third value is greater than the fourth value. The embodiments of the present application do not limit the specific values of the third value and the fourth value. For example, the third value is 1 and the fourth value is 0, that is, if the historical login times of the first video account at the current login location is 0 (i.e., the first login), then determine that the suspicious score corresponding to the historical login times at the login location is 1; if the historical login times of the first video account at the current login location is greater than 0, then determine that the suspicious score corresponding to the historical login times at the login location is 0.

[0136] Exemplarily, assuming that the login information of the first video account includes the login IP address, first, based on the current login IP address of the first video account, at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is obtained, that is, the black production aggregation degree under the IP address is determined. Furthermore, based on at least one of the number of abnormal users and the proportion of abnormal users under the login IP address, the suspicious score corresponding to the login IP address is determined. For example, if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than the corresponding preset value, it is determined that the suspicious score corresponding to the login IP address is the fifth value; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, it is determined that the suspicious score corresponding to the login IP address is the sixth value, where the fifth value is greater than the sixth value. The specific values of the fifth value and the sixth value in the embodiments of the present application are not limited. For example, the fifth value is 1 and the sixth value is 0. That is to say, if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than the corresponding preset value, it is determined that the suspicious score corresponding to the login IP address is 1; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, it is determined that the suspicious score corresponding to the login IP address is 0. Optionally, the preset values corresponding to the number of abnormal users and the proportion of abnormal users are different.

[0137] Based on the above steps, after determining the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address, based on the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address, the second suspicious score of the first video account is determined.

[0138] For example, the sum of the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address is determined as the second suspicious score.

[0139] For another example, the average value of the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address is determined as the second suspicious score.

[0140] Based on the above steps, the second suspicious score of the first video account is determined, and then the above S102-A22 is executed. Based on this second suspicious score, it is determined whether the first video account is a video account that rents the login code of the video account.

[0141] Exemplarily, if the second suspicious score of the first video account is greater than a preset value, it is determined that the first video account is a video account renting out the video account login code. For example, assume that the login location of the first video account is in a different place, the number of logins of the first video account in the different place is the first login, and the login IP address of the first video account is a gathering place for black production. Based on the above steps, it can be determined that the second suspicious score of the first video account is the sum of the first value, the third value, and the fifth value (for example, 1 + 1 + 1). At this time, the second suspicious score of the first video account (for example, 3) is greater than the preset value (for example, 1), and then it is determined that the first video account is a video account renting out the video account login code.

[0142] The above describes the process of determining whether the first video account is a video account renting out the video account login code based on at least one of the user basic information of the first video account and the login information of the first video account in Case 1.

[0143] Next, in combination with Case 2, that is, when the abnormal entity includes a video account for sending abnormal data on behalf of others, the process of determining whether the first video account is a video account for sending abnormal data on behalf of others based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts is introduced.

[0144] The embodiments of the present application do not limit the specific manner in which the electronic device determines whether the first video account is a video account for sending abnormal data on behalf of others based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts.

[0145] In some embodiments, the electronic device determines whether the first video account is a video account for sending abnormal data on behalf of others based on the user basic information of the first video account, the login information of the first video account, and the account information of N social accounts. For example, if it is determined that the user basic information conforms to the user basic information of a suspicious object based on the user basic information of the first video account (for example, Information A conforms to Information A of the suspicious object), and it is determined that there is video data transmission and payment relationship between the N social accounts corresponding to the first video account and other abnormal social accounts, then it is determined that the first video account is a video account for sending abnormal data on behalf of others.

[0146] In some embodiments, the following steps of S102-B can be used to determine whether the first video account is a video account for sending abnormal data on behalf of others:

[0147] S102-B: Determine whether the first video account is a video account for sending abnormal data on behalf of others based on the account information of N social accounts corresponding to the first video account.

[0148] In this embodiment, the electronic device may determine the abnormal behaviors of the N social accounts corresponding to the first video account based on the account information of the N social accounts, and then determine whether the first video account is a video account that forwards abnormal data based on the abnormal behaviors.

[0149] The embodiments of the present application do not limit the specific manner of determining whether the first video account is a video account that forwards abnormal data based on the account information of the N social accounts corresponding to the first video account.

[0150] In a possible implementation manner, the electronic device obtains the data processing behavior data of the N social accounts in the most recent preset time period based on the account information of the N social accounts corresponding to the first video account, such as data sending and receiving behavior data, asset interaction behavior data, etc. Then, the data processing behavior data is input into a prediction model, and the prediction model can predict whether the first video account is a video account that forwards abnormal data based on the data processing behavior data of the N social accounts in the most recent preset time period.

[0151] In a possible implementation manner, the above S102-B includes the following steps of S102-B1 to S102-B3:

[0152] S102-B1: Determine the identification information of M objects that have a suspicious relationship with the N social accounts based on the account information of the N social accounts, where the suspicious relationship includes at least one of a multimedia data sending relationship, a payment relationship, and a group joining relationship, and M is a positive integer;

[0153] S102-B2: For the i-th object among the M objects, determine the feature data of the i-th object based on the identification information of the i-th object, and determine whether the i-th object is a suspicious object based on the feature data of the i-th object;

[0154] S102-B3: Determine whether the first video account is a video account that forwards abnormal data based on the number of suspicious objects among the M objects.

[0155] In the embodiments of the present application, the objects include social accounts, payment accounts, group IDs, group pullers, group administrators, etc. In the embodiments of the present application, in order to accurately and pre-judge whether the first video account is a video account that forwards abnormal data, the N social accounts corresponding to the first video account are obtained, and then based on the abnormal behavior data of the N social accounts, the pre-judgment of whether the first video account is a video account that forwards abnormal data is realized.

[0156] In an embodiment of the present application, the process of determining the abnormal behavior data of the N social accounts is specifically as follows: Based on the account information of the N social accounts, the identification information of M objects having a suspicious relationship with the N social accounts is determined. For example, the identification information of M objects having at least one suspicious relationship such as a multimedia data sending relationship, a payment relationship, and a group entry relationship with the N social accounts is determined.

[0157] For example, as Figure 4 shown, the N social accounts associated with the first video account and the certificate are social account 1, social account 2, and social account 3 respectively, that is, N = 3. In the recent preset time period, for example, within the preset time period before and after the first video account publishes video data, the object having a multimedia data sending relationship with at least one of the 3 social accounts is social account a, the object having a payment relationship with at least one of the 3 social accounts is payment account b, and the objects having a group entry relationship with at least one of the 3 social accounts include group ID1, group inviter c, and group administrator d.

[0158] After the electronic device obtains the identification information of M objects having a suspicious relationship with the N social accounts based on the above steps, it executes the steps of S102-B2 above to determine whether each of the M objects is a suspicious object. In an embodiment of the present application, the specific methods for determining whether each of the M objects is a suspicious object are basically the same. For the convenience of description, here, taking the determination of whether the i-th object among the M objects is a suspicious object as an example for illustration.

[0159] First, based on the identification information of the i-th object, the characteristic data of the i-th object is determined. Among them, the characteristic data of the i-th object can be understood as the dynamic data of each social account having a specific suspicious relationship with the i-th object. Here, the dynamic data can be understood as the social media dynamic data of the social account, such as dynamic data of publishing a certain media data, canceling a certain media data, forwarding a certain media data, liking a certain media data, and following a certain media data on the social account.

[0160] The following introduces the specific process of determining the characteristic data of the i-th object based on the identification information of the i-th object.

[0161] In a possible implementation manner, a topological relationship network is maintained for each object, and the topological relationship network is updated periodically and stores at least one social account having a specific suspicious relationship with the object in the current preset time period. In this way, for the i-th object, the electronic device obtains the topological relationship network of the i-th object based on the identification information of the i-th object, and then obtains the dynamic data of these social accounts based on the account information of each social account in the topological relationship network, and then determines these dynamic data as the characteristic data of the i-th object.

[0162] In a possible implementation, the electronic device obtains P ID numbers that have a suspicious relationship with the i-th object based on the identification information of the i-th object, where P is a positive integer. Then, it obtains the dynamic data of the social accounts under each of the P ID numbers. In this way, the characteristic data of the i-th object can be determined based on the dynamic data of the social accounts under each of the P ID numbers.

[0163] In the embodiments of the present application, the dynamic data of the social account includes at least one of the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics.

[0164] For example, as Figure 5 shown, for the i-th object, the P ID numbers that have a specific suspicious relationship with the i-th object within the current preset time period include ID number 1 that has a payment relationship with the i-th object, ID number 2 and ID number 3 that have a group entry relationship with the i-th object, and ID number 4 that has a specific multimedia data sending relationship with the i-th object. Then, it obtains the dynamic data of the social accounts under each of these 4 ID numbers. For example, there is 1 social account under ID number 1, and it obtains the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics of this social account. For another example, there are 2 social accounts under ID number 2, and it obtains the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics of these 2 social accounts. For another example, there is 1 social account under ID number 3, and it obtains the number of punished dynamics and the number of self-deleted dynamics of this social account. For another example, there is 1 social account under ID number 4, and it obtains the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics of this social account. Then, based on the dynamic data of the social accounts under each of these 4 ID numbers, the characteristic data of the i-th object is determined. For example, the dynamic data of the social accounts under all of these 4 ID numbers is determined as the characteristic data of the i-th object.

[0165] After the electronic device determines the characteristic data of the i-th object based on the above steps, it determines whether the i-th object is a suspicious object based on the characteristic data of the i-th object.

[0166] The embodiments of the present application do not limit the specific manner of determining whether the i-th object is a suspicious object based on the characteristic data of the i-th object.

[0167] In some embodiments, as described above, the feature data of the i-th object includes the dynamic data of each social account under P ID numbers that have a suspicious relationship with the i-th object. Then, based on the dynamic data of these social accounts, it is determined whether the i-th object is a suspicious object. For example, if the abnormal dynamic data among the dynamic data of these social accounts is greater than a preset value, such as the number of punished dynamic data is greater than a certain preset value, and / or the number of self-deleted dynamic data is greater than a certain preset value, then it is determined that the i-th object is a suspicious object.

[0168] In some embodiments, a second recognition model is trained in the embodiments of the present application. This first recognition model can predict the suspicious score of an object based on the feature data of the object. The second recognition model is obtained through offline training on the (T + 1)-th day. The training samples during training include positive samples and negative samples. Among them, the positive samples are the feature data of randomly selected different objects, and the negative samples are the feature data of suspicious objects. Optionally, the positive-negative sample ratio is controlled at 1:20. In this way, the electronic device can predict whether the i-th object is a suspicious object through the second recognition model, and obtain the suspicious score of the i-th object. Figure 6 As shown, the feature data of the i-th object is input into the second recognition model for suspicious object prediction, and the suspicious score of the i-th object is obtained. Then, based on the suspicious score of the i-th object, it is determined whether the i-th object is a suspicious object. For example, if the suspicious score of the i-th object is greater than the preset value, then it is determined that the i-th object is a suspicious object. For another example, if the suspicious score of the i-th object is less than or equal to the preset value, then it is determined that the i-th object is not a suspicious object.

[0169] Based on the above specific process of determining whether the i-th object is a suspicious object, the electronic device can determine whether each of the M objects is a suspicious object.

[0170] Then, the electronic device executes the above S102-B3, and determines whether the first video account is a video account that posts abnormal data on behalf of others based on the number of suspicious objects among the M objects. For example, if the number of suspicious objects among the M objects is greater than or equal to the threshold A, then it is determined that the first video account is a video account that posts abnormal data on behalf of others. For another example, if the number of suspicious objects among the M objects is less than the threshold A, then it is determined that the first video account is not a video account that posts abnormal data on behalf of others. The embodiments of the present application do not limit the specific value of the threshold A. Optionally, the threshold A is 1, that is, if there is 1 suspicious object among the M objects, then it is determined that the first video account is a video account that posts abnormal data on behalf of others.

[0171] In some embodiments, before the electronic device executes the above steps S102-B1 to S102-B3, it first obtains the dynamic data of the social account corresponding to the first video account, and then based on this dynamic data, determines whether the social account is a suspicious object. If it is a suspicious object, then the above steps S102-B1 to S102-B3 are executed.

[0172] The above specifically introduces the process of determining whether the first video account is a video account that posts abnormal data on behalf of others based on the account information of the N social accounts corresponding to the first video account.

[0173] In some embodiments, in addition to determining whether the first video account is a video account that posts abnormal data on behalf of others, the embodiments of the present application can also determine whether the relevant social accounts are abnormal social accounts through real-time association. Specifically, taking the i-th object as an example, if it is determined that the i-th object is a suspicious object based on the above steps, then when it is detected that the second social account has a suspicious relationship with the i-th object, the second social account and each social account under the ID number corresponding to the second social account are determined as abnormal social accounts. Exemplarily, as Figure 7 shown, if it is determined that the i-th object is a suspicious object, then when a real-time suspicious relationship occurs, that is, when it is detected that there is a suspicious relationship between the second social account and the i-th object, the second social account and other social accounts (such as social account 1, social account 2, and social account 3) under the same ID number as the second social account are determined as abnormal social accounts, for example, determined as participants in posting abnormal data on behalf of others.

[0174] The above introduces the process of determining whether the first video account is a video account that posts abnormal data on behalf of others based on the account information of the N social accounts corresponding to the first video account in case 2.

[0175] In some embodiments, when the electronic device determines that the first video account is an abnormal video account based on the above steps, it can block the first video account.

[0176] In some embodiments, to further improve the accuracy and reliability of the account suspension process, when the electronic device determines that the first video account is an abnormal video account based on the above steps, it displays the identity authentication interface and receives the identity information entered by the user in this identity authentication interface. If it is determined that the identity authentication of the first video account fails based on this identity information, the first video account will be suspended. If it is determined that the identity authentication of the first video account passes based on this identity authentication information, the first video account will not be suspended. For example, if the first video account is an abnormal video account, for example, based on the above steps, it is determined that the first video account is a video account renting out the video account login code, or it is determined that the first video account is a video account for sending abnormal data, then it will display as Figure 8 the identity authentication interface shown. Exemplarily, this identity authentication interface includes explanatory information and identity authentication options. The identity authentication options include a cancel option and a go-ahead authentication option. If the user triggers the cancel option, the user cannot log in to the first video account normally. If the user triggers the go-ahead authentication option, an identity authentication information input interface will be displayed, and the user enters the identity information (such as face authentication or fingerprint authentication, etc.) in this input interface. Then, the electronic device compares the identity information entered by the user with the identity information at the time of registration of the first video account. If the identity information entered by the user is consistent with the identity information at the time of registration of the first video account, it is determined that the identity authentication of the first video account passes, and the first video account will not be suspended. If the identity information entered by the user is inconsistent with the identity information at the time of registration of the first video account, it is determined that the identity authentication of the first video account fails, and the first video account will be suspended.

[0177] In some embodiments, if it is determined that the first video account is an abnormal video account, the first video account and the social account corresponding to the first video account will be suspended. In one example, to improve the accuracy of the account suspension process for the first video account, as Figure 9 shown, if it is determined that the first video account is an abnormal video account based on the above steps, the first video account will be manually reviewed once. If the first video account is determined to be an abnormal video account after manual review, the first video account and the social accounts under the same ID number as the first video account will be suspended.

[0178] In some embodiments, if the social account corresponding to the first video account is also suspended, when the user logs in to this social account next time, it will display Figure 10 the account suspension reminder interface shown.

[0179] The method for identifying an abnormal entity provided by the embodiment of the present application obtains at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity. The N social accounts are N social accounts under the first ID number corresponding to the first video account, and N is a positive integer. Then, based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of the N social accounts, it is determined whether the first video account is an abnormal video account. That is to say, the embodiment of the present application can identify in advance whether the first video account is an abnormal identification account based on at least one of the user basic information of the first video account, the login information of the first video account, and the account information of the N social accounts corresponding to the first video account, without waiting for a large amount of abnormal video data to be released by the first video account and other video accounts before identification. Therefore, the method of the embodiment of the present application can achieve rapid and early identification of abnormal identification accounts, and can ensure the reliability of the video playback platform.

[0180] The above provides an overall introduction to the identification process of the abnormal entity in the embodiment of the present application. The following combines Figure 11 to introduce the specific process of determining whether the first entity is a video account that rents the login code of the video account.

[0181] Figure 11 It is a schematic flowchart of the method for identifying an abnormal entity provided by an embodiment of the present application. In this embodiment, taking the first entity including the first video account, the first information including the user basic information of the first video account, the second information including the login information of the first video account, and the second entity including the social account corresponding to the first video account as an example, the method for identifying an abnormal entity provided by the embodiment of the present application is introduced.

[0182] As Figure 11 shown, the method of the embodiment of the present application includes the following steps:

[0183] S201. When it is detected that the first video account logs in by scanning the login code, obtain the user basic information of the first video account and the login information of the first video account.

[0184] It should be noted that the above S201 is not a necessary condition for determining whether the first video account is a video account that rents the login code of the video account. That is to say, if it is detected that the first video account logs in by scanning the login code, obtain the user basic information of the first video account and the login information of the first video account, and execute the following steps S202 to S204. If the first video account does not log in by scanning the login code, the user basic information of the first video account and the login information of the first video account can also be obtained, and the following steps S202 to S204 are executed.

[0185] S202. Determine a first suspicious score of the first video account based on the basic user information of the first video account.

[0186] For example, use a first recognition model to predict suspicious accounts for the basic user information of the first video account to obtain the first suspicious score of the first video account.

[0187] For the specific implementation process of the above S202, reference can be made to the relevant description of the above S102, which will not be elaborated here.

[0188] S203. If the first suspicious score is greater than the first preset value, then determine a second suspicious score of the first video account based on the login information of the first video account.

[0189] In some embodiments, if the login information of the first video account includes at least one of the login location, the historical login times at the login location, and the login IP address, and the first suspicious score is greater than the first preset value, then determine the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address. Based on the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address, determine the second suspicious score.

[0190] For example, if the login location is in a different place, then determine the suspicious score corresponding to the login location as a first value; if the login location is not in a different place, then determine the suspicious score corresponding to the login location as a second value, where the first value is greater than the second value. If the historical login times of the first video account at the login location is 0, then determine the suspicious score corresponding to the historical login times at the login location as a third value; if the historical login times of the first video account at the login location is greater than 0, then determine the suspicious score corresponding to the historical login times at the login location as a fourth value, where the third value is greater than the fourth value. Obtain at least one of the number of abnormal users and the proportion of abnormal users under the login IP address; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than the corresponding preset value, then determine the suspicious score corresponding to the login IP address as a fifth value; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, then determine the suspicious score corresponding to the login IP address as a sixth value, where the fifth value is greater than the sixth value.

[0191] Next, sum up the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address, and determine it as the second suspicious score.

[0192] For the specific implementation process of the above S203, reference can be made to the relevant description of the above S102, which will not be elaborated here.

[0193] S204. Determine whether the first video account is the video account that rents the login code of the video account based on the second suspicious score.

[0194] For example, if the second suspicious score is greater than the preset value, it is determined that the first video account is the video account that rents the login code of the video account.

[0195] For another example, if the second suspicious score is less than or equal to the preset value, it is determined that the first video account is not the video account that rents the login code of the video account.

[0196] In this embodiment, when it is detected that the first video account logs in by scanning the login code, the user basic information of the first video account and the login information of the first video account are obtained, and based on the user basic information of the first video account and the login information of the first video account, it is determined whether the first video account is the video account that rents the login code of the video account. In this way, it can be predicted in advance whether the first video account is the video account that rents the login code of the video account when the first video account logs in.

[0197] Next, in combination with Figure 12 , the specific process of determining whether the first video account is the video account that posts abnormal data is introduced.

[0198] Figure 12 FIG. is a flowchart of a method for identifying an abnormal object provided by an embodiment of the present application. In this embodiment, taking the first subject including the first video account, the first information including the user basic information of the first video account, the second information including the login information of the first video account, and the second subject including the social account corresponding to the first video account, and the third information being the account information of the social account as an example, the method for identifying an abnormal subject provided by the embodiment of the present application is introduced.

[0199] As Figure 12 shown, the method of the embodiment of the present application includes the following steps:

[0200] S301. When it is detected that the first video account publishes video data, obtain the account information of N social accounts corresponding to the first video account.

[0201] It should be noted that in the above S301, when detecting that the first video account publishes video data, obtaining the account information of N social accounts corresponding to the first video account is not a necessary condition for determining whether the first video account is a video account that forwards abnormal data. That is to say, if when detecting that the first video account publishes video data, obtain the account information of N social accounts corresponding to the first video account, and perform the following steps S302 to S304. If it is detected that the first video account does not publish video data, it is also possible to obtain the account information of N social accounts corresponding to the first video account, and perform the following steps S302 to S304.

[0202] S302. Based on the account information of N social accounts, determine the identification information of M objects that have a suspicious relationship with the N social accounts.

[0203] Among them, the suspicious relationship includes at least one of a multimedia data sending relationship, a payment relationship, and a group joining relationship, and M is a positive integer.

[0204] For the specific implementation process of the above S302, reference can be made to the relevant description of the above S102, and details will not be elaborated here.

[0205] S303. For the i-th object among the M objects, based on the identification information of the i-th object, determine the characteristic data of the i-th object, and based on the characteristic data of the i-th object, determine whether the i-th object is a suspicious object.

[0206] For example, based on the identification information of the i-th object, obtain P ID numbers that have a suspicious relationship with the i-th object, where P is a positive integer; obtain the dynamic data of the social accounts under each of the P ID numbers, and the dynamic data includes at least one of the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics; based on the dynamic data of the social accounts under each of the P ID numbers, determine the characteristic data of the i-th object. Use the second recognition model to predict the suspicious object for the characteristic data of the i-th object to obtain the suspicious score of the i-th object. Then, based on the suspicious score of the i-th object, determine whether the i-th object is a suspicious object.

[0207] For the specific implementation process of the above S303, reference can be made to the relevant description of the above S102, and details will not be elaborated here.

[0208] S304. Based on the number of suspicious objects among the M objects, determine whether the first video account is a video account that forwards abnormal data.

[0209] For example, if there is one suspicious object among the M objects, determine that the first video account is a video account that forwards abnormal data.

[0210] For another example, if none of the M objects is a suspicious object, it is determined that the first video account is not a video account that posts abnormal data on behalf of others.

[0211] In this embodiment, when it is detected that the first video account posts video data, the account information of the N social accounts corresponding to the first video account is obtained, and based on the account information of the N social accounts, it is determined whether the first video account is a video account that posts abnormal data on behalf of others. In this way, it can be predicted in advance whether the first video account is a video account that posts abnormal data on behalf of others when the first video account posts video data.

[0212] As described above in conjunction with Figures 2 to 12 , the method embodiments of the present application have been described in detail. Below, in conjunction with Figure 10 and Figure 11 , the apparatus embodiments of the present application will be described in detail.

[0213] Figure 13 FIG. is a schematic block diagram of an abnormal subject identification apparatus provided by an embodiment of the present application. The apparatus 10 can be applied to an electronic device.

[0214] As Figure 13 shown, the abnormal subject identification apparatus 10 includes:

[0215] An obtaining unit 11, configured to obtain at least one of the first information of the first subject, the second information of the first subject, and the third information of the N second subjects corresponding to the first subject, where the N second subjects are N second subjects under the first identification number corresponding to the first subject, and N is a positive integer;

[0216] A determining unit 12, configured to determine whether the first subject is an abnormal subject based on at least one of the first information of the first subject, the second information of the first subject, and the third information of the N second subjects.

[0217] In some embodiments, the abnormal subject includes a video account that rents the login code of the video account, the first subject includes a first video account, the first information includes user basic information, the second information includes login information, and the second subject includes a social account; the determining unit 12 is specifically configured to determine whether the first video account is a video account that rents the login code of the video account based on at least one of the user basic information of the first video account and the login information of the first video account.

[0218] In some embodiments, the determining unit 12 is specifically configured to determine the first suspicious score of the first video account based on the user basic information of the first video account; and determine whether the first video account is a video account that rents the login code of the video account based on the first suspicious score and the login information of the first video account.

[0219] In some embodiments, the determining unit 12 is specifically configured to, when the first suspicious score is greater than a first preset value, determine a second suspicious score of the first video account based on the login information of the first video account; and determine whether the first video account is the video account of the rented video account login code based on the second suspicious score.

[0220] In some embodiments, the login information of the first video account includes at least one of a login location, a historical login count at the login location, and a login IP address; the determining unit 12 is specifically configured to determine a suspicious score corresponding to at least one of the login location, the historical login count at the login location, and the login IP address; and determine the second suspicious score based on the suspicious scores corresponding to at least one of the login location, the historical login count at the login location, and the login IP address.

[0221] In some embodiments, the determining unit 12 is specifically configured to, when the login location is a different location, determine that the suspicious score corresponding to the login location is a first value; when the login location is not a different location, determine that the suspicious score corresponding to the login location is a second value, where the first value is greater than the second value; when the historical login count of the first video account at the login location is 0, determine that the suspicious score corresponding to the historical login count at the login location is a third value; when the historical login count of the first video account at the login location is greater than 0, determine that the suspicious score corresponding to the historical login count at the login location is a fourth value, where the third value is greater than the fourth value; obtain at least one of the number of abnormal users and the proportion of abnormal users under the login IP address; when at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than a corresponding preset value, determine that the suspicious score corresponding to the login IP address is a fifth value; when at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, determine that the suspicious score corresponding to the login IP address is a sixth value, where the fifth value is greater than the sixth value.

[0222] In some embodiments, the determining unit 12 is specifically configured to determine the sum of the suspicious scores corresponding to at least one of the login location, the historical login count at the login location, and the login IP address as the second suspicious score.

[0223] In some embodiments, the determining unit 12 is specifically configured to perform suspicious account prediction on the user basic information of the first video account through a first recognition model to obtain a first suspicious score of the first video account.

[0224] In some embodiments, the determining unit 12 is specifically configured to, when detecting that the first video account logs in by scanning a login code, obtain at least one of the basic user information of the first video account and the login information of the first video account.

[0225] In some embodiments, the abnormal entity includes a video account that issues abnormal data on behalf, the first entity includes the first video account, the second entity includes a social account, and the third information is the account information of the social account; the determining unit 12 is specifically configured to determine whether the first video account is the video account that issues abnormal data on behalf based on the account information of the N social accounts.

[0226] In some embodiments, the determining unit 12 is specifically configured to determine the identification information of M objects having a suspicious relationship with the N social accounts based on the account information of the N social accounts, where the suspicious relationship includes at least one of a multimedia data sending relationship, a payment relationship, and a group joining relationship, and M is a positive integer; for the i-th object among the M objects, determine the characteristic data of the i-th object based on the identification information of the i-th object, and determine whether the i-th object is a suspicious object based on the characteristic data of the i-th object; determine whether the first video account is the video account that issues abnormal data on behalf based on the number of suspicious objects among the M objects.

[0227] In some embodiments, the determining unit 12 is specifically configured to obtain P ID numbers having the suspicious relationship with the i-th object based on the identification information of the i-th object, where P is a positive integer; obtain the dynamic data of the social accounts under each of the P ID numbers, and the dynamic data includes at least one of the dynamic quantity of being punished, the dynamic quantity of self-deleted, and the normal dynamic quantity; determine the characteristic data of the i-th object based on the dynamic data of the social accounts under each of the P ID numbers.

[0228] In some embodiments, the determining unit 12 is specifically configured to perform a suspicious object prediction on the characteristic data of the i-th object through a second recognition model to obtain the suspicious score of the i-th object; determine whether the i-th object is the suspicious object based on the suspicious score of the i-th object.

[0229] In some embodiments, when the i-th object is a suspicious object, the determining unit 12 is further configured to, when detecting that a second social account has the suspicious relationship with the i-th object, determine the second social account and each social account under the ID number corresponding to the second social account as abnormal social accounts.

[0230] In some embodiments, an obtaining unit 11 is configured to obtain the account information of the N social accounts corresponding to the first video account when detecting that the first video account publishes video data.

[0231] In some embodiments, when the first entity is an abnormal entity, a determining unit 12 is further configured to display an identity authentication interface; receive identity information input by a user in the identity authentication interface; and if it is determined based on the identity information that the identity authentication of the first entity fails, perform a blocking operation on the first entity.

[0232] In some embodiments, when the first entity is an abnormal entity, a determining unit 12 is further configured to perform a blocking operation on the first entity and a second entity corresponding to the first entity.

[0233] It should be understood that the apparatus embodiments and the method embodiments can correspond to each other, and similar descriptions can refer to the method embodiments. To avoid repetition, details are not described herein again. Specifically, Figure 13 The illustrated apparatus can execute the embodiments of the above-mentioned method for identifying abnormal entities, and the foregoing and other operations and / or functions of each module in the apparatus respectively implement the corresponding method embodiments of the electronic device. For the sake of brevity, details are not described herein again.

[0234] In the foregoing, the apparatus of the embodiments of the present application has been described from the perspective of functional modules. It should be understood that the functional modules can be implemented in hardware, or in the form of instructions in software, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in the present application can be completed by the integrated logic circuit in the hardware of the processor and / or instructions in software form. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory, and the processor reads the information in the memory and combines its hardware to complete the steps in the above method embodiments.

[0235] Figure 14 is a schematic block diagram of an electronic device provided by an embodiment of the present application, Figure 14 The electronic device can be used to execute the above method embodiments.

[0236] As Figure 14 shown, the electronic device 30 may include:

[0237] A memory 31 and a processor 32, where the memory 31 is used to store a computer program 33 and transmit the program code 33 to the processor 32. In other words, the processor 32 can call and run the computer program 33 from the memory 31 to implement the method in the embodiments of the present application.

[0238] For example, the processor 32 can be used to execute the steps in the above method according to the instructions in the computer program 33.

[0239] In some embodiments of the present application, the processor 32 may include but is not limited to:

[0240] A general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0241] In some embodiments of the present application, the memory 31 includes but is not limited to:

[0242] A volatile memory and / or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synch link dynamic random access memory (SLDRAM), and direct rambus random access memory (DR RAM).

[0243] In some embodiments of the present application, the computer program 33 may be divided into one or more modules, which are stored in the memory 31 and executed by the processor 32 to complete the method for recording a page provided in the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 33 in the electronic device.

[0244] As Figure 14 shown, the electronic device 30 may further include:

[0245] A transceiver 34, which may be connected to the processor 32 or the memory 31.

[0246] Among them, the processor 32 may control the transceiver 34 to communicate with other devices. Specifically, it may send information or data to other devices, or receive information or data sent by other devices. The transceiver 34 may include a transmitter and a receiver. The transceiver 34 may further include an antenna, and the number of antennas may be one or more.

[0247] It should be understood that the various components in the electronic device 30 are connected through a bus system. Among them, the bus system includes, in addition to a data bus, a power bus, a control bus, and a status signal bus.

[0248] According to one aspect of the present application, there is provided a computer storage medium, on which a computer program is stored, and when the computer program is executed by the computer, the computer can execute the method in the above method embodiments. Or, the embodiments of the present application further provide a computer program product including instructions, and when the instructions are executed by the computer, the computer executes the method in the above method embodiments.

[0249] According to another aspect of the present application, there is provided a computer program product or a computer program, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method in the above method embodiments.

[0250] In other words, when implemented using software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of this application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wirelessly (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a digital video disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0251] Those of ordinary skill in the art can realize that the modules and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0252] In several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division, and there can be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces, and the indirect couplings or communication connections of devices or modules can be in an electrical, mechanical, or other form.

[0253] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network elements. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. For example, in each embodiment of the present application, the functional modules can be integrated into one processing module, or each module can exist physically alone, or two or more modules can be integrated into one module.

[0254] The above content is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for identifying an abnormal subject, characterized in that, Including: Obtaining at least one of the first information of the first entity, the second information of the first entity, and the third information of N second entities corresponding to the first entity, where the N second entities are N second entities under the first ID number corresponding to the first entity, and N is a positive integer; Based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities, determining whether the first entity is an abnormal entity.

2. The method according to claim 1, wherein The abnormal entity includes a video account that rents a video account login code. The first entity includes a first video account. The first information includes user basic information. The second information includes login information. The second entity includes a social account; The determining whether the first entity is an abnormal entity based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities includes: Based on at least one of the user basic information of the first video account and the login information of the first video account, determining whether the first video account is the video account that rents a video account login code.

3. The method according to claim 2, wherein The determining whether the first video account is the video account that rents a video account login code based on at least one of the user basic information of the first video account and the login information of the first video account includes: Based on the user basic information of the first video account, determining a first suspicious score of the first video account; Based on the first suspicious score and the login information of the first video account, determining whether the first video account is the video account that rents a video account login code.

4. The method according to claim 3, wherein The determining whether the first video account is the video account that rents a video account login code based on the first suspicious score and the login information of the first video account includes: If the first suspicious score is greater than a first preset value, then based on the login information of the first video account, determining a second suspicious score of the first video account; Based on the second suspicious score, determining whether the first video account is the video account that rents a video account login code.

5. The method according to claim 4, wherein The login information of the first video account includes at least one of a login location, a historical login count at the login location, and a login IP address; The determining the second suspicious score of the first video account based on the login information of the first video account includes: Determining a suspicious score corresponding to at least one of the login location, the historical login count at the login location, and the login IP address; Based on the suspicious score corresponding to at least one of the login location, the historical login count at the login location, and the login IP address, determining the second suspicious score.

6. The method according to claim 5, wherein Determine the suspicious score corresponding to the login location, including: if the login location is a different place, determine that the suspicious score corresponding to the login location is the first value; if the login location is not a different place, determine that the suspicious score corresponding to the login location is the second value, where the first value is greater than the second value; Determine the suspicious score corresponding to the historical login times at the login location, including: if the historical login times of the first video account at the login location is 0, determine that the suspicious score corresponding to the historical login times at the login location is the third value; if the historical login times of the first video account at the login location is greater than 0, determine that the suspicious score corresponding to the historical login times at the login location is the fourth value, where the third value is greater than the fourth value; Determine the suspicious score corresponding to the login IP address, including: obtain at least one of the number of abnormal users and the proportion of abnormal users under the login IP address; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is greater than the corresponding preset value, determine that the suspicious score corresponding to the login IP address is the fifth value; if at least one of the number of abnormal users and the proportion of abnormal users under the login IP address is less than or equal to the corresponding preset value, determine that the suspicious score corresponding to the login IP address is the sixth value, where the fifth value is greater than the sixth value.

7. The method according to claim 5, wherein The determining of the second suspicious score based on at least one of the suspicious scores corresponding to the login location, the historical login times at the login location, and the login IP address includes: Determine the sum of the suspicious scores corresponding to at least one of the login location, the historical login times at the login location, and the login IP address as the second suspicious score.

8. The method according to claim 3, wherein The determining of the first suspicious score of the first video account based on the user basic information of the first video account includes: Perform suspicious account prediction on the user basic information of the first video account through the first recognition model to obtain the first suspicious score of the first video account.

9. The method according to claim 2, wherein Obtain at least one of the user basic information of the first video account and the login information of the first video account, including: When it is detected that the first video account logs in by scanning the login code, obtain at least one of the user basic information of the first video account and the login information of the first video account.

10. The method according to any one of claims 1-9, characterized in that, The abnormal entity includes a video account that posts abnormal data on behalf of others, the first entity includes the first video account, the second entity includes a social account, and the third information is the account information of the social account; The determining of whether the first entity is an abnormal entity based on at least one of the first information of the first entity, the second information of the first entity, and the third information of the N second entities includes: Based on the account information of the N social accounts, determine whether the first video account is the video account that posts abnormal data on behalf of others.

11. The method according to claim 10, wherein The determining of whether the first video account is the video account that posts abnormal data on behalf of others based on the account information of the N social accounts includes: Based on the account information of the N social accounts, determine the identification information of M objects that have a suspicious relationship with the N social accounts, where the suspicious relationship includes at least one of a multimedia data sending relationship, a payment relationship, and a group entry relationship, and M is a positive integer; For the i-th object among the M objects, based on the identification information of the i-th object, determine the characteristic data of the i-th object, and based on the characteristic data of the i-th object, determine whether the i-th object is a suspicious object; Based on the number of suspicious objects among the M objects, determine whether the first video account is the video account that sends abnormal data on behalf of others.

12. The method according to claim 11, wherein The determining the characteristic data of the i-th object based on the identification information of the i-th object includes: Based on the identification information of the i-th object, obtain P ID numbers that have the suspicious relationship with the i-th object, where P is a positive integer; Obtain the dynamic data of the social accounts under each of the P ID numbers, where the dynamic data includes at least one of the number of punished dynamics, the number of self-deleted dynamics, and the number of normal dynamics; Based on the dynamic data of the social accounts under each of the P ID numbers, determine the characteristic data of the i-th object.

13. The method according to claim 11, wherein The determining whether the i-th object is a suspicious object based on the characteristic data of the i-th object includes: Use a second recognition model to predict whether the i-th object is a suspicious object based on the characteristic data of the i-th object, and obtain the suspicious score of the i-th object; Based on the suspicious score of the i-th object, determine whether the i-th object is the suspicious object.

14. The method according to claim 11, wherein If the i-th object is a suspicious object, the method further includes: When it is detected that a second social account has the suspicious relationship with the i-th object, determine the second social account and each social account under the ID number corresponding to the second social account as abnormal social accounts.

15. The method according to claim 10, wherein Obtaining the account information of the N social accounts includes: When it is detected that the first video account publishes video data, obtain the account information of the N social accounts corresponding to the first video account.

16. The method according to claim 1, wherein If the first subject is an abnormal subject, the method further includes: Display an identity authentication interface; Receive the identity information input by the user in the identity authentication interface; If it is determined based on the identity information that the identity authentication of the first subject fails, then block the first subject.

17. The method according to claim 1, wherein If the first subject is an abnormal subject, the method further includes: Block the first subject and a second subject corresponding to the first subject.

18. An abnormal subject recognition device, characterized in that, Includes: An obtaining unit, configured to obtain at least one of the first information of the first subject, the second information of the first subject, and the third information of N second subjects corresponding to the first subject, where the N second subjects are N second subjects under the first ID number corresponding to the first subject, and N is a positive integer; A determination unit, configured to determine whether the first entity is an abnormal entity based on at least one of first information of the first entity, second information of the first entity, and third information of the N second entities.

19. A computer device, comprising a processor and a memory; The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 17 above.

20. A computer-readable storage medium, characterized in that, For storing a computer program; The computer program causes the computer to execute the method according to any one of claims 1 to 17 above.

Images