Abnormal account identification method and device, computer equipment and storage medium

Abstract

The invention is suitable for the technical field of artificial intelligence, and particularly relates to an abnormal account identification method and device, computer equipment and a storage medium, and the method comprises the steps: constructing a sample feature graph according to the sample information of all sample accounts in a sample account set; determining a sample graph embedding feature and a sample community abnormal feature corresponding to each sample account based on the sample feature graph; obtaining a preset abnormal account identification model, inputting the sample graph embedding feature, the sample community abnormal feature, the user portrait feature and the sample statistical feature which belong to the same sample account into the preset abnormal account identification model, and determining an abnormal account score corresponding to each sample account; and determining an abnormal account identification result corresponding to each sample account according to the abnormal account score and a preset abnormal threshold, thereby remarkably improving the abnormal user identification accuracy of an online platform in the fields of smart finance, smart medical treatment and the like.

Description

Technical Field

[0001] The present invention relates to the field of intelligent decision-making technology, and in particular to a method, device, computer equipment and storage medium for identifying abnormal accounts. Background Art

[0002] With the development of mobile internet, more and more platforms are gradually shifting traditionally cumbersome offline services online. Users no longer need to be physically present; they can simply access relevant interfaces and complete relevant business processes through client apps or mini-programs. For example, in the field of smart finance, users can conduct business online (such as purchasing insurance products) or claim welfare rewards. In the field of smart healthcare, users can obtain appointments and consult doctors online.

[0003] However, online business operations also attract a large number of users involved in illegal activities. These users often forge accounts, devices, and IP addresses to obtain illegal profits, causing significant economic losses to the platforms. Existing technologies primarily rely on expert rules (such as statistical features such as IP access frequency and device activity) to identify abnormal traffic. However, these rules are easily bypassed, feature-rich, and have poor interpretability, resulting in low accuracy in identifying abnormal accounts. Summary of the Invention

[0004] Embodiments of the present invention provide a method, apparatus, computer device, and storage medium for identifying abnormal accounts to address the significant defects of the prior art, such as easy bypass of rules, single features, and poor interpretability, which in turn lead to low accuracy in identifying abnormal accounts.

[0005] A method for identifying abnormal accounts, comprising: Obtain a sample account set; the sample account set includes multiple sample accounts, each of which corresponds to one sample information, sample portrait feature, and sample statistical feature; Constructing a sample feature graph based on the sample information corresponding to all the sample accounts; Determining, based on the sample feature graph, a sample graph embedding feature and a sample community abnormal feature corresponding to each of the sample accounts; Obtain a preset abnormal account identification model, and input the sample graph embedding features, the sample community abnormal features, the user portrait features, and the sample statistical features belonging to the same sample account into the preset abnormal account identification model to determine the abnormal account score corresponding to each sample account; Obtain a preset abnormality threshold, and determine the abnormal account identification result corresponding to each of the sample accounts based on the abnormal account score and the preset abnormality threshold.

[0006] An abnormal account identification device comprises: A sample obtaining module is configured to obtain a sample account set, wherein the sample account set comprises a plurality of sample accounts, and each sample account corresponds to sample information, a sample portrait feature, and a sample statistical feature; A sample feature map constructing module is configured to construct a sample feature map according to the sample information corresponding to all the sample accounts; A feature determining module is configured to determine a sample graph embedding feature and a sample community abnormal feature corresponding to each sample account based on the sample feature map; A model processing module is configured to obtain a preset abnormal account identification model, and input the sample graph embedding feature, the sample community abnormal feature, the user portrait feature, and the sample statistical feature belonging to the same sample account into the preset abnormal account identification model to determine an abnormal account score corresponding to each sample account; An abnormality identification module is configured to obtain a preset abnormal threshold, and determine an abnormal account identification result corresponding to each sample account according to the abnormal account score and the preset abnormal threshold.

[0007] A computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above abnormal account identification method when executing the computer program.

[0008] A computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the above abnormal account identification method.

[0009] The above abnormal account identification method, device, computer device, and storage medium, the method constructs a sample feature map based on sample information of sample accounts, thereby capturing sample graph embedding features related to individual sample accounts and sample community abnormal features related to classification groups to which the sample accounts belong from the sample feature map, and finally combining sample portrait features and sample statistical features for abnormal account identification, which fully considers the topological relationship between sample accounts and the behavior characteristics of sample accounts in multiple dimensions, and effectively improves the accuracy of abnormal account identification. BRIEF DESCRIPTION OF DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0011] Figure 1This is a schematic diagram of an application environment of a method for identifying abnormal accounts in one embodiment of the present invention; Figure 2 is a flow chart of a method for identifying abnormal accounts in one embodiment of the present invention; Figure 3 This is a principle block diagram of an abnormal account identification device according to an embodiment of the present invention; Figure 4 FIG. 1 is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0013] The abnormal account identification method provided by the embodiment of the present invention can be applied as follows: Figure 1 Specifically, the abnormal account identification method is applied in an abnormal account identification system, which includes the following: Figure 1 The client and server shown in the figure communicate over the network, and a service connection is established between the server and the smart cabinet. This addresses significant shortcomings of existing technologies, such as easily bypassed rules, limited features, and poor interpretability, which in turn lead to low accuracy in identifying abnormal accounts. The client, also known as the user end, refers to the program that corresponds to the server and provides local services to clients. The client can be installed on, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented as a standalone server or a server cluster consisting of multiple servers. The server can be a standalone server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0014] In one embodiment, if Figure 2 As shown, a method for identifying abnormal accounts is provided, which is applied in Figure 1 The server in the example is used as an example, and the steps are as follows: S10: Obtain a sample account set; the sample account set includes multiple sample accounts, and each sample account corresponds to a sample information, a sample portrait feature, and a sample statistical feature.

[0015] As can be understood, online platforms exist in various fields, hosting a number of registered accounts within these platforms. These accounts are referred to as sample accounts. For example, in a smart healthcare platform for smart medical guidance, sample accounts can be patients registered on the platform. In a financial product recommendation platform for smart finance, sample accounts can be users registered on the platform. Each sample account corresponds to a sample of information, which includes, but is not limited to, user personal information, basic account information, login device information, IP address, network information, access history, purchase history, or transaction history. Sample profile features are constructed based on user attribute characteristics, such as basic user information (e.g., age and gender) and platform-related information (e.g., policyholders on the financial product recommendation platform). Sample statistical features are constructed based on user behavior data (e.g., access frequency, device diversity, IP address diversity, etc.) or business data (e.g., financial product purchase history on the financial product recommendation platform, or patient registration, medical consultation, and medication records on the smart guidance platform).

[0016] S20: Construct a sample feature graph based on the sample information corresponding to all the sample accounts.

[0017] It can be understood that in the sample feature graph, each sample account is regarded as an account node, and the account nodes with corresponding account relationships will be connected through node relationship edges. For example, suppose there are multiple users on a financial product recommendation platform in the field of smart finance, and each user is regarded as an account node. Suppose the platform launches an activity that requires users to publish evaluations of a certain financial product, and give prizes based on the number of likes or comments from other users on the published evaluations. At this time, some users will invite other users to comment on or like the evaluations they posted, so the account relationship between these users includes likes, evaluations, invitations or assistance, etc. Therefore, these users rely on the account relationships of likes, evaluations, invitations or assistance in the sample feature graph to construct node relationship edges to connect the corresponding account nodes of these users in the sample feature graph.

[0018] S30: Determine the sample graph embedding features and sample community abnormal features corresponding to each of the sample accounts based on the sample feature graph.

[0019] It can be understood that the sample graph embedding feature is a low-dimensional vector representation of the homogeneity and structural equivalence between each sample account and other sample accounts in the sample feature graph. In other words, the sample graph embedding feature reflects the characteristics of the sample account itself. The sample community anomaly feature is a vector representation of the classification of each sample account in the sample feature graph. In other words, the sample community anomaly feature reflects the characteristics of the community cluster to which the sample account belongs.

[0020] S40: Obtain a preset abnormal account identification model, and input the sample graph embedding features, the sample community abnormal features, the user portrait features and the sample statistical features belonging to the same sample account into the preset abnormal account identification model to determine the abnormal account score corresponding to each sample account.

[0021] It can be understood that the preset abnormal account identification model is used to evaluate whether a sample account is an abnormal account, thereby outputting an abnormal account score indicating that the sample account is an abnormal account. In other words, the higher the abnormal account score output by the preset abnormal account identification model, the higher the probability that the sample account is an abnormal account. Conversely, the lower the abnormal account score output by the preset abnormal account identification model, the lower the probability that the sample account is an abnormal account.

[0022] S50: Obtain a preset abnormality threshold, and determine an abnormal account identification result corresponding to each of the sample accounts according to the abnormal account score and the preset abnormality threshold.

[0023] It is understood that the preset abnormality threshold can be set as needed. For example, the preset abnormality threshold can be set to 0.9, 0.95, or 0.98. Furthermore, after obtaining the preset abnormality threshold, the abnormal account score is compared with the preset abnormality threshold. If the abnormal account score is greater than or equal to the preset abnormality threshold, the sample account is determined to be an abnormal account. Conversely, if the abnormal account score is less than the preset abnormality threshold, the sample account is determined to be a normal account.

[0024] In this embodiment, a sample feature graph is constructed based on the sample information of the sample accounts, so that the sample graph embedding features related to the individual sample accounts and the abnormal features of the sample community related to the classification group to which the sample accounts belong can be captured from the sample feature graph as a supplement. Finally, the sample portrait features and sample statistical features are combined for abnormal account identification. This method fully considers dimensions such as the topological relationship between sample accounts and the behavioral characteristics of the sample accounts themselves, effectively improving the accuracy of abnormal account identification.

[0025] In one specific embodiment, the abnormal account identification method proposed in this application is applied to a smart medical guidance platform in the field of smart healthcare. By continuously collecting patient-related information on this platform on a daily basis, sample information for each patient can be constructed. This sample information can then be used to construct a sample feature graph, and the sample feature graph can be used to construct abnormal features of the sample community and sample graph embedding features. Ultimately, a preset abnormal account identification model is used to monitor patients based on these features, identifying high-risk patient groups or individual patients, thereby improving the accuracy of disease monitoring or post-treatment health monitoring of patients.

[0026] In another specific embodiment, the abnormal account identification method proposed in this application is applied to a financial product recommendation platform in the field of smart finance. Sample information of each user can be constructed by analyzing the transaction information of users purchasing financial products on the financial product recommendation platform, information related to participation in activities organized by the sponsor, or comments posted on the platform. In this way, the sample information can be used to construct a sample feature graph, and the sample feature graph can be used to construct abnormal features of the sample community and sample graph embedding features. Finally, a preset abnormal account identification model is used to monitor users based on the above features to determine whether the online user's behavior is normal, more accurately identify users involved in illegal and gray market activities, and reduce the economic losses caused by the platform.

[0027] In one embodiment, step S20, i.e., constructing a sample feature graph based on the sample information corresponding to all the sample accounts, includes: Each of the sample accounts is determined as an account node, and an account node is selected from all the account nodes as a sample vertex.

[0028] It can be understood that there are multiple sample accounts in the sample account set, and each sample account can be regarded as an account node, so that an account node is arbitrarily selected from all account nodes and the selected account node is used as the sample vertex.

[0029] Based on the sample information corresponding to the sample vertex and the sample information corresponding to other unselected account nodes, it is determined whether there is an account relationship between the sample vertex and all unselected account nodes.

[0030] Understandably, the sample information records user behavior data for each sample account, which includes the account relationships between the sample account and other sample accounts. However, it should be noted that not every two sample accounts will have an account relationship. For example, in an activity on a financial product recommendation platform, if sample account A receives likes from sample accounts C and D, then only sample accounts C and D will have an account relationship with sample account A; the other sample accounts will not have an account relationship with sample account A.

[0031] In this way, after randomly selecting a sample vertex, we can use the user behavior data in the sample information to determine whether there is an account relationship between the sample account corresponding to the sample vertex and other sample accounts. If there is an account relationship, then it is determined that there is an account relationship between the sample vertex and the account node, and a node relationship edge needs to be constructed. If there is no account relationship, then it is determined that there is no account relationship between the sample vertex and the account node, and no node relationship edge needs to be constructed.

[0032] The account node that has an account relationship with the sample vertex is used as the account connection node corresponding to the sample vertex, and the sample vertex is connected to the account connection node corresponding to the sample vertex through a relationship edge according to the account relationship to obtain a node relationship edge.

[0033] Specifically, after determining whether there is an account relationship between the sample vertex and all unselected account nodes, the account node that has an account relationship with the sample vertex is used as the account connection node corresponding to the sample vertex, and the sample vertex is connected to the account connection node corresponding to the sample vertex based on the account relationship to obtain a node relationship edge, which represents the account relationship between the two account nodes.

[0034] Furthermore, if a sample vertex has many account-connected nodes, to reduce redundancy in the constructed sample feature graph and speed up subsequent processing of the sample feature graph, the number of account-connected nodes connected to the sample vertex is reduced. For example, if a sample vertex has 100 account-connected nodes, a correlation value is determined based on the account relationship between each account-connected node and the sample vertex (for example, if the account relationship indicates 12 likes and 10 comments between the two nodes, the correlation value is 22; if the account relationship indicates 2 likes between the two nodes, the correlation value is 2). The account nodes with the highest correlation value above the connection threshold that have an account relationship are then used as the account-connected nodes for the sample vertex. This reduces the number of node relationship edges constructed between account nodes with incidental account relationships, increases the closeness between account nodes in the sample feature graph, reduces the impact of incidental account relationships on the sample feature graph, and improves the accuracy of abnormal account identification.

[0035] An account node is reselected from all account nodes as a new sample vertex, where the new sample vertex is an account node that has not been selected from all account nodes.

[0036] Continue to determine the node relationship edges corresponding to the new sample vertices until all account nodes are selected.

[0037] Specifically, after connecting the sample vertex with the account-connected node corresponding to the sample vertex through an edge relationship based on the account relationship and obtaining the node relationship edge, a new account node can be selected from all account nodes as a new sample vertex (this new sample vertex is different from the previously selected sample vertex), and the node relationship edge corresponding to the new sample vertex is determined through the above steps. Then, another account node is selected (different from the previously selected sample nodes). In this way, after all account nodes have been selected, that is, each account node has established a node relationship edge with the account node with which it has an account relationship, all sample accounts in the sample account set have been selected.

[0038] Based on all the obtained node relationship edges, the sample feature graph is generated.

[0039] Specifically, when all account nodes construct node relationship edges between them and the account nodes having account relationships, a sample feature graph including all account nodes and the node relationship edges corresponding to each account node can be constructed based on all the obtained node relationship edges.

[0040] In one embodiment, step S30, i.e., determining the abnormal characteristics of the sample community corresponding to each of the sample accounts based on the sample characteristic graph, includes: Each account node in the sample feature graph is recorded as an account community.

[0041] An account community is selected from all the account communities as a target community, and a first modularity of the target community is determined.

[0042] As you can understand, the sample feature graph described above is constructed from the account nodes corresponding to the sample accounts and the node relationship edges between the account nodes. Therefore, in order to distinguish the communities of the account nodes in the sample feature graph and determine the abnormal characteristics of the sample communities of account nodes in the same community, modularity is used to measure the quality of the target community segmentation. A good segmentation result is manifested in: high similarity between account nodes within the target community and low similarity with account nodes outside the community.

[0043] Furthermore, after constructing the sample feature graph, each account node can be initially considered an account community, meaning that each account community currently has one and only one account node. One account community is selected from all account communities as the target community, and the first modularity of the target community is determined. The modularity calculation formula is as follows: in, Represents an account node i and account nodesj The weights corresponding to the node relationship edges between them, Refers to the account node in the sample feature graph i The sum of the weights of the node relationship edges between directly connected other account nodes. Refers to the account node in the sample feature graph j The sum of the weights of the node relationship edges between directly connected other account nodes. is the total number of all node relationship edges in the sample feature graph. is the indicator function.

[0044] Furthermore, the weights associated with node relationship edges mentioned above can be determined based on the account relationship between the account nodes connected by the node relationship edge. For example, if the account relationship indicates that there are 12 likes and 10 comments between two nodes, a weight can be calculated based on the number of likes and comments, or the total number of likes and comments can be directly used as the weight of the node relationship edge connecting the two account nodes.

[0045] Detect whether there is a neighbor node for the end node in the target community; the end node refers to the account node last added to the target community; the neighbor node refers to the account node adjacent to the end node and connected through a node relationship edge.

[0046] Understandably, there are multiple account nodes in the sample feature graph. Account nodes are connected to other account nodes via node-relationship edges, but not all account nodes are connected via node-relationship edges. Consequently, each account node has a different number of other account nodes connected by node-relationship edges. For example, account node A is connected to account node B via a node-relationship edge, while account node C and account node B, and account node D and account node E, are connected via different node-relationship edges. In this case, account node A is connected to only one neighboring account node via a node-relationship edge, while account node C is connected to three neighboring account nodes via node-relationship edges.

[0047] Furthermore, in the initial phase, if there is only one account node in the target community, this account node is the end node. If new accounts are added to the target community in subsequent phases, the end node is continuously updated, and the end node is the last account node added to the target community. Furthermore, a neighbor node is an account node directly connected to the end node via a node relationship edge. For example, account nodes A and B are directly connected, account node A is directly connected to account node D, and account node D is directly connected to account node F. In this case, account nodes B and D can serve as neighbor nodes of account node A, while account node F is not a neighbor node of account node A.

[0048] When the tail node in the target community has a neighboring node, the neighboring node is added to the target community to generate a fusion community; one neighboring node corresponds to one fusion community.

[0049] Specifically, after checking whether the last node in the target community has any neighboring nodes, if so, the neighboring node is added to the target community to create a fused community. It is understood that the last node may have multiple neighboring nodes, because each neighboring node added separately to the target community will generate multiple fused communities.

[0050] A second modularity of each of the fused communities is determined, and a modularity gain corresponding to each of the fused communities is determined based on the first modularity and the second modularity.

[0051] Specifically, after adding neighbor nodes to the target community to form a converged community, the second modularity of the converged community is determined using the above-described method, and the difference between the second modularity and the first modularity is determined as the modularity gain. Each different neighbor node added to the target community brings a different gain to the target community, which can be positive or negative.

[0052] When the modularity gain is greater than zero, the fusion community with the largest modularity gain is used as a new target community, and the tail node is removed from other fusion communities except the new target community.

[0053] Specifically, after determining the modularity gain corresponding to each fused community based on the first and second modularities, the fused community with the greatest modularity gain is selected as the new target community, and the neighboring nodes are removed from all other fused communities except the new target community. For example, assume that the last node (A) of the target community has three neighboring nodes (B, C, and D). After adding these three neighboring nodes to the target community to form three fused communities, only the fused community with the greatest modularity gain is retained as the new target community (A+B). This new target community contains the account node (A) originally selected as part of the target community, as well as the newly added neighbor node (B). The other fused communities are restored. Specifically, the last nodes are removed from the other two fused communities, and these two communities remain the original account communities (containing only C or D). In this case, in the sample feature graph, there are no account communities containing only account node A or only account node B. Instead, there are the other original account communities and an account community containing both account nodes A and B.

[0054] Continue to determine whether the end node in the new target community has a neighboring node. When the end node in the new target community has no neighboring nodes, record the new target community as a classification community, and select an account community from the remaining account communities as the new target community. Continue to determine the classification community corresponding to the new target community until all account nodes have corresponding classification communities. Then, determine the abnormal characteristics of the sample community corresponding to the account node in each classification community.

[0055] Specifically, when the fused community with the greatest modularity gain is selected as the new target community, the terminal node in the new target community is also updated. That is, the terminal node is the new account node most recently added to the target community (e.g., account node B in the above example). At this point, it is further determined whether account node B has neighbor nodes, and the above steps of adding neighbor nodes to the target community, generating fused communities, determining the second modularity of each fused community, and determining the modularity gain corresponding to each fused community based on the first and second modularities are repeated. If the modularity gain is greater than zero, the fused community with the greatest modularity gain is selected as the new target community, and the terminal node is removed from all fused communities other than the new target community. It should be noted that each time a target community is updated, in addition to the account nodes included in the target community being updated, the modularity corresponding to the target community is also updated. Therefore, the above-mentioned first and second modularities merely represent different modularity values. The specific modularity is calculated based on the account nodes included in the current target community or fused community.

[0056] In one embodiment, before obtaining the preset abnormal account identification model, the method further includes: Obtain a training account set; the training account set includes multiple training accounts, and each training account corresponds to one training information, training portrait feature, and training statistical feature.

[0057] Similarly, similar to the sample accounts in the sample account set, training accounts can also be online platforms in different fields, with multiple registered accounts on the platforms. This is not detailed here. Training information includes but is not limited to user personal information, basic account information, login device information, IP address, network information, access history, purchase history, or transaction history. Training profile features are constructed based on user attribute features such as basic user information corresponding to the sample accounts and information related to the corresponding platform. Training statistical features are constructed based on user behavior data or business data corresponding to the sample accounts.

[0058] A training feature graph is constructed according to the training information corresponding to all the training accounts, and a training graph embedding feature and a training community abnormal feature corresponding to each of the training accounts are determined based on the training feature graph.

[0059] It can be understood that in the training feature graph, each training account is regarded as a training node, and the training nodes corresponding to the account relationship are connected through the node relationship edge. The account relationship is the same as the account relationship between the above-mentioned sample account. The training graph embedding feature is a low-dimensional vector representation of the homogeneity and structural equivalence of each training account and other training accounts in the training feature graph, that is, the training graph embedding feature reflects the features of the training account itself. The training community anomaly feature is a vector representation of the classification of each training account in the training feature graph, that is, the training community anomaly feature reflects the features of the community cluster to which the training account belongs.

[0060] The training portrait feature, the training statistical feature, the training graph embedding feature and the training community anomaly feature belonging to the same training account are fused to obtain a training fusion feature corresponding to the training account.

[0061] Specifically, after determining the training portrait feature, the training statistical feature, the training graph embedding feature and the training community anomaly feature corresponding to each training account, the training portrait feature, the training statistical feature, the training graph embedding feature and the training community anomaly feature can be fused to obtain the training fusion feature, and at this time, the training fusion feature represents the training account from four dimensions.

[0062] The training fusion feature is subjected to feature binning to obtain a plurality of feature regions; each feature region includes at least one training fusion feature.

[0063] It can be understood that feature binning is mainly to reduce the complexity of variables and reduce the influence of variable noise on model inference, discretize continuous variables, and combine multi-state discrete variables into few states. This embodiment adopts chi-square binning, a bottom-up data discretization method, and the basic idea is that two adjacent intervals have similar class distributions, then the two intervals are combined, otherwise they should be kept separate, thereby forming a plurality of feature regions, and the training accounts in each feature region have similar class distributions, that is, belong to the same category.

[0064] A region weight value corresponding to each feature region is determined, and the training fusion feature in the feature region corresponding to the region weight value is converted based on the region weight value to obtain a weight conversion feature.

[0065] It can be understood that the purpose of the region weight value is to map the training fusion feature after binning from a non-linear separable space to an approximately linear separable space, so that the preset identification model can identify and process the input weight conversion feature, and improve the accuracy of model inference.

[0066] Obtain a preset recognition model including initial parameters, and input the weight conversion features into the preset recognition model to train the preset recognition model through all the weight conversion features, and determine the preset recognition model after training as the preset abnormal account recognition model.

[0067] It can be understood that after the weight conversion feature is input into the preset recognition model, the weight conversion feature is recognized by the preset recognition model, and the predicted account label of the training account corresponding to the weight conversion feature is output; the training account label corresponding to the training account is determined from the training information corresponding to each training account; based on the predicted account label and the training account label, the predicted loss value corresponding to the preset recognition model is determined; when the predicted loss value does not reach the pre-training convergence condition, the initial parameters of the preset recognition model are iteratively updated until the predicted loss value reaches the pre-training convergence condition, and the preset recognition model after convergence is recorded as the preset abnormal account recognition model.

[0068] Furthermore, the pre-training convergence condition can be the condition that the predicted loss value is very small and will not decrease after 3000 calculations, that is, when the predicted loss value is very small and will not decrease after 3000 calculations, the training is stopped, and the preset recognition model after convergence is recorded as the preset abnormal account recognition model; the pre-training convergence condition can also be the condition that the predicted loss value is less than a set threshold, that is, when the predicted loss value is less than the set threshold, the training is stopped, and the preset recognition model after convergence is recorded as the preset abnormal account recognition model. In this way, when the predicted loss value does not reach the pre-training convergence condition, the initial parameters of the preset recognition model are continuously adjusted, and the accurate result can be continuously approached, so that the recognition accuracy rate is increasingly higher. In this way, the accuracy of the model in predicting abnormal accounts can be improved, and the efficiency of abnormal account recognition can be improved.

[0069] Furthermore, the training account label mentioned above is used to characterize whether the preset recognition model predicts that the training account is an abnormal account based on the weight conversion features. The preset recognition model actually outputs the probability that the training account is an abnormal account. Based on this probability, it is compared with the threshold. If the threshold is exceeded, the training account label is used to characterize the prediction that the training account is an abnormal account. If the threshold is not exceeded, the training account label is used to characterize the prediction that the training account is not an abnormal account. The training account label is manually labeled and determined based on the training information of the training account. The training account label is used to characterize the true label of whether the training account is an abnormal account. The prediction loss value can be determined by a loss function such as cross entropy. The prediction loss value is used to characterize the degree of distinction between the predicted account label output by the preset recognition model and the true labeled training account label.

[0070] In one embodiment, the training fusion features are binned to obtain multiple feature regions, including: Determine the feature score corresponding to each of the training fusion features, and sort all the training fusion features from small to large according to the feature scores to obtain a fusion feature sequence.

[0071] Understandably, the feature score is used to indicate the likelihood that a training fusion feature belongs to an abnormal account. Essentially, it represents the account attributes of the training account corresponding to the training fusion feature. After determining the feature score for each training fusion feature, all training fusion features are sorted from smallest to largest by feature score to obtain a fusion feature sequence.

[0072] Starting from the first training fusion feature in the fusion feature sequence, two adjacent training fusion features are combined into a fusion feature group.

[0073] It can be understood that for the training fusion features in the fusion feature sequence, starting from the training fusion feature ranked first in the fusion feature sequence, two adjacent training fusion features are combined into a fusion feature group. For example, the training fusion features ranked first and second are combined into a fusion feature group, the training fusion features ranked third and fourth are combined into a fusion feature group, and so on, ultimately forming multiple fusion feature groups.

[0074] Determine the feature binning value between the two training fusion features in each fusion feature group, take the fusion feature group with the smallest feature binning value as the target feature group, split all fusion feature groups except the target feature group, and update the fusion feature sequence.

[0075] As you can understand, the feature binning value is used to characterize the distribution similarity between two training fusion features in the same fusion feature group, that is, to determine whether two training fusion features belong to the same class. A smaller feature binning value indicates a more similar class distribution between the two training fusion features in that fusion feature group. Conversely, a smaller feature binning value indicates a significant difference in the class distribution between the two training fusion features in that fusion feature group.

[0076] Furthermore, after determining the feature binning value between the two training fusion features in each fusion feature group, the fusion feature group with the smallest feature binning value is retained, and the other fusion feature groups are split into individual training fusion features. However, the retention or splitting operations do not affect the order of the training fusion features. For example, assuming that the fusion feature group with the smallest feature binning value contains the third and fourth ranked training fusion features, then after the retention or splitting operation is performed, the fusion feature sequence will be the first ranked training fusion feature, the second ranked training fusion feature, the target feature group, and so on.

[0077] Continue to determine new target feature groups until the feature bin values ​​corresponding to all target feature groups in the fused feature sequence are greater than or equal to the preset bin threshold, or the number of feature groups corresponding to the included target feature groups is greater than or equal to the preset combination threshold, and then determine one target feature group as one feature region.

[0078] Specifically, continue to determine new target feature groups. The new target feature group may be obtained by combining two other training fusion features, or by combining a training fusion feature and the above-mentioned combined target feature group. Until the feature bin values ​​corresponding to all target feature groups in the fusion feature sequence are greater than or equal to the preset bin threshold, that is, the more similar the class distribution between the training fusion features in each target feature group at this time is, the more similar adding other training fusion features into the target feature group will destroy its class distribution; or, when the number of feature groups corresponding to the included target feature group is greater than or equal to the preset combination threshold, that is, the target feature groups obtained by classification should not be too many, which will reduce the granularity and accuracy of the classification. Finally, each target feature group can be determined as a feature region.

[0079] In one embodiment, determining the region weight value corresponding to each of the feature regions includes: A training account label corresponding to each training account is determined from the training information corresponding to the training account; the training account label indicates whether the training account is normal or abnormal.

[0080] A training account whose training account label indicates that the training account is normal is determined as a normal training account, and a training account whose training account label indicates that the training account is abnormal is determined as an abnormal training account.

[0081] As can be understood, the training account label is manually annotated based on the training account's training information and serves as a true label to indicate whether the training account is an abnormal account. In this way, a training account whose training account label indicates a normal training account is considered a normal training account, while a training account whose training account label indicates an abnormal training account is considered an abnormal training account.

[0082] The number of normal training accounts included in the training account set is determined and recorded as the total number of normal accounts, and the number of abnormal training accounts included in the training account set is determined and recorded as the total number of abnormal accounts.

[0083] The number of normal training accounts contained in each of the characteristic regions is determined and recorded as the regional normal total number, and the number of abnormal training accounts contained in each of the characteristic regions is determined and recorded as the regional abnormal total number.

[0084] It can be understood that the total number of normal accounts is the total number of normal training accounts included in the training account set. The total number of abnormal accounts is the total number of abnormal training accounts included in the training account set. The regional normal total is the number of normal training accounts included in each feature region, that is, one feature region corresponds to one regional normal total. The regional abnormal total is the number of abnormal training accounts included in each feature region, that is, one feature region corresponds to one regional abnormal total.

[0085] The regional weight value corresponding to the feature area is determined according to the total number of normal accounts, the total number of abnormal accounts, and the total number of normal accounts and the total number of abnormal accounts corresponding to the same feature area.

[0086] Specifically, the regional weight value is determined according to the following formula: in, is the regional weight value of the i-th feature region. is the total number of regional anomalies in the i-th feature area. is the total number of abnormal accounts. is the normal total number of regions of the i-th feature region. The total number of normal accounts.

[0087] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0088] In one embodiment, an abnormal account identification device is provided, which corresponds to the abnormal account identification method in the above embodiment. Figure 3 As shown, the abnormal account identification device includes a sample acquisition module 10, a sample feature map construction module 20, a feature determination module 30, a model processing module 40 and an abnormality identification module 50. The functional modules are described in detail as follows: The sample acquisition module 10 is used to acquire a sample account set; the sample account set includes multiple sample accounts, and each sample account corresponds to a sample information, a sample portrait feature, and a sample statistical feature; A sample feature graph construction module 20 is configured to construct a sample feature graph based on the sample information corresponding to all the sample accounts; A feature determination module 30 is configured to determine, based on the sample feature graph, a sample graph embedding feature and a sample community abnormality feature corresponding to each of the sample accounts; The model processing module 40 is configured to acquire a preset abnormal account identification model, and input the sample graph embedding features, the sample community abnormal features, the user portrait features and the sample statistical features belonging to the same sample account into the preset abnormal account identification model to determine an abnormal account score corresponding to each sample account. The abnormality identification module 50 is configured to acquire a preset abnormal threshold, and determine an abnormal account identification result corresponding to each sample account according to the abnormal account score and the preset abnormal threshold.

[0089] Further, the sample feature graph construction module 20 comprises: The first node selection unit is configured to determine each sample account as an account node, and select one account node from all account nodes as a sample vertex. The account relationship detection unit is configured to determine whether there is an account relationship between the sample vertex and all unselected account nodes based on the sample information corresponding to the sample vertex and the sample information corresponding to the unselected account nodes. The first relationship edge connection unit is configured to connect the account nodes having an account relationship with the sample vertex as account connection nodes corresponding to the sample vertex, and connect the sample vertex and the account connection nodes corresponding to the sample vertex with relationship edges according to the account relationship to obtain node relationship edges. The second node selection unit is configured to select one account node from all account nodes as a new sample vertex, and the new sample vertex is an unselected account node in all account nodes. The second relationship edge connection unit is configured to continue to determine the node relationship edges corresponding to the new sample vertex until all account nodes are selected. The feature graph generation unit is configured to generate the sample feature graph based on all obtained node relationship edges.

[0090] Further, the feature determination module 30 further comprises: The community generation unit is configured to record each account node in the sample feature graph as an account community. The first module degree determination unit is configured to select one account community as a target community from all account communities, and determine a first module degree of the target community. The neighbor node detection unit is configured to detect whether there is a neighbor node in a tail node in the target community; the tail node refers to an account node added to the target community last; and the neighbor node refers to an account node adjacent to the tail node. a node fusion unit, configured to, when a neighbor node exists at the end node in the target community, add the neighbor node to the target community to generate a fused community; one neighbor node corresponds to one fused community; a gain calculation unit, configured to determine a second modularity of each of the fused communities, and determine a modularity gain corresponding to each of the fused communities based on the first modularity and the second modularity; a community processing unit, configured to, when the modularity gain is greater than zero, take the fused community with the largest modularity gain as a new target community, and remove the tail node from other fused communities except the new target community; The community abnormality feature determination unit is configured to continue determining whether the end node in the new target community has a neighboring node, until the end node in the new target community has no neighboring nodes, record the new target community as a classification community, select an account community from the remaining account communities as the new target community, continue determining the classification community corresponding to the new target community, until all account nodes have corresponding classification communities, and determine the sample community abnormality feature corresponding to the account node in the classification community based on each of the classification communities.

[0091] Furthermore, the device further comprises: A training account acquisition module is used to acquire a training account set; the training account set includes multiple training accounts, and each training account corresponds to one training information, training portrait feature, and training statistical feature; A feature generation module is configured to construct a training feature graph based on the training information corresponding to all the training accounts, and determine, based on the training feature graph, a training graph embedding feature and a training community anomaly feature corresponding to each of the training accounts; A feature fusion module is used to fuse the training portrait features, training statistical features, training graph embedding features and training community anomaly features belonging to the same training account to obtain the training fusion features corresponding to the training account; A feature binning module is used to bin the training fusion features to obtain multiple feature regions; each feature region includes at least one training fusion feature; A weight value determination module is used to determine a regional weight value corresponding to each of the feature regions, and based on the regional weight value, transform the training fusion features in the feature region corresponding to the regional weight value to obtain a weight conversion feature; A model training module is used to obtain a preset recognition model containing initial parameters, and input the weight conversion features into the preset recognition model to train the preset recognition model through all the weight conversion features, and determine the preset recognition model after training as the preset abnormal account recognition model.

[0092] Further, the feature binning module comprises: a feature score determination unit, configured to determine a feature score corresponding to each of the training fusion features, and sort all the training fusion features in ascending order of the feature scores to obtain a fusion feature sequence; a feature grouping unit, configured to combine two adjacent training fusion features as a fusion feature group, starting from the training fusion feature ranked first in the fusion feature sequence; a feature binning value determination unit, configured to determine a feature binning value between the two training fusion features in each of the fusion feature groups, and take the fusion feature group with the smallest feature binning value as a target feature group, and split all the fusion feature groups except the target feature group to update the fusion feature sequence; a feature region generation unit, configured to continue to determine a new target feature group until the feature binning value corresponding to all the target feature groups in the fusion feature sequence is greater than or equal to a preset binning threshold, or the number of target feature groups corresponding to the target feature group is greater than or equal to a preset combination threshold, and determine one of the target feature groups as one of the feature regions.

[0093] Further, the weight value determination module comprises: a training account label determination unit, configured to determine a training account label corresponding to each of the training accounts from the training information corresponding to the training account; the training account label represents that the training account is normal or abnormal; an account classification unit, configured to determine a training account as a normal training account if the training account label represents that the training account is normal, and determine a training account as an abnormal training account if the training account label represents that the training account is abnormal; a first quantity determination unit, configured to determine the number of normal training accounts included in the training account set and record the number as a total number of normal accounts, and determine the number of abnormal training accounts included in the training account set and record the number as a total number of abnormal accounts; a second quantity determination unit, configured to determine the number of normal training accounts included in each of the feature regions and record the number as a total number of normal accounts in the region, and determine the number of abnormal training accounts included in each of the feature regions and record the number as a total number of abnormal accounts in the region; a weight value calculation unit, configured to determine a region weight value corresponding to each of the feature regions according to the total number of normal accounts, the total number of abnormal accounts, and the total number of normal accounts in the region and the total number of abnormal accounts in the region corresponding to the same feature region.

[0094] Further, the model training module comprises: a model prediction unit, configured to identify the weight conversion feature using the preset recognition model and output a predicted account label of the training account corresponding to the weight conversion feature; a label determination unit, configured to determine a training account label corresponding to each training account from the training information corresponding to the training account; a loss value determining unit, configured to determine a predicted loss value corresponding to the preset recognition model based on the predicted account label and the training account label; A parameter updating unit is used to iteratively update the initial parameters of the preset recognition model when the predicted loss value does not reach the pre-training convergence condition, until the predicted loss value reaches the pre-training convergence condition, and record the preset recognition model after convergence as the preset abnormal account recognition model.

[0095] For the specific definition of the abnormal account identification device, please refer to the definition of the abnormal account identification method above and will not be repeated here. The various modules in the above-mentioned abnormal account identification device can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0096] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data used in the abnormal account identification method in the above embodiment. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an abnormal account identification method is implemented.

[0097] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the abnormal account identification method in the above embodiment is implemented.

[0098] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal account identification method in the above embodiment is implemented.

[0099] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0100] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0101] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A method for identifying abnormal accounts, characterized in that: include: Get a sample account set; The sample account set includes multiple sample accounts, and each sample account corresponds to one sample information, sample portrait feature, and sample statistical feature; Constructing a sample feature graph based on the sample information corresponding to all the sample accounts; Determining, based on the sample feature graph, a sample graph embedding feature and a sample community abnormal feature corresponding to each of the sample accounts; Obtain a preset abnormal account identification model, and input the sample graph embedding features, the sample community abnormal features, the user portrait features, and the sample statistical features belonging to the same sample account into the preset abnormal account identification model to determine the abnormal account score corresponding to each sample account; Obtain a preset abnormality threshold, and determine the abnormal account identification result corresponding to each of the sample accounts based on the abnormal account score and the preset abnormality threshold.

2. The abnormal account identification method according to claim 1, characterized in that: The step of constructing a sample feature graph based on the sample information corresponding to all the sample accounts includes: Determine each of the sample accounts as an account node, and select one account node from all the account nodes as a sample vertex; Determining whether an account relationship exists between the sample vertex and all unselected account nodes based on the sample information corresponding to the sample vertex and the sample information corresponding to other unselected account nodes; The account node that has an account relationship with the sample vertex is used as the account connection node corresponding to the sample vertex, and the sample vertex is connected to the account connection node corresponding to the sample vertex with a relationship edge according to the account relationship to obtain a node relationship edge; Reselect an account node from all account nodes as a new sample vertex, where the new sample vertex is an account node that has not been selected from all account nodes; Continue to determine the node relationship edges corresponding to the new sample vertices until all account nodes are selected; Based on all the obtained node relationship edges, the sample feature graph is generated.

3. The abnormal account identification method according to claim 2, characterized in that: The determining, based on the sample feature graph, the abnormal features of the sample community corresponding to each of the sample accounts includes: Recording each account node in the sample feature graph as an account community; selecting an account community from all the account communities as a target community, and determining a first modularity of the target community; Detecting whether a terminal node in the target community has a neighboring node; the terminal node refers to the account node last added to the target community; the neighboring node refers to the account node adjacent to the terminal node and connected to it via a node relationship edge; When the tail node in the target community has a neighboring node, the neighboring node is added to the target community to generate a fusion community; one neighboring node corresponds to one fusion community; determining a second modularity of each of the fused communities, and determining a modularity gain corresponding to each of the fused communities based on the first modularity and the second modularity; When the modularity gain is greater than zero, the fusion community with the largest modularity gain is used as a new target community, and the tail node is removed from other fusion communities except the new target community; Continue to determine whether the end node in the new target community has a neighboring node. When the end node in the new target community has no neighboring nodes, record the new target community as a classification community, and select an account community from the remaining account communities as the new target community. Continue to determine the classification community corresponding to the new target community until all account nodes have corresponding classification communities. Then, determine the abnormal characteristics of the sample community corresponding to the account node in each classification community.

4. The abnormal account identification method according to claim 1, characterized in that: Before obtaining the preset abnormal account identification model, the method further includes: Obtaining a training account set; the training account set includes multiple training accounts, each of which corresponds to one piece of training information, one training profile feature, and one training statistical feature; Constructing a training feature graph based on the training information corresponding to all the training accounts, and determining a training graph embedding feature and a training community abnormality feature corresponding to each of the training accounts based on the training feature graph; Fusing the training portrait features, training statistical features, training graph embedding features, and training community anomaly features belonging to the same training account to obtain the training fusion features corresponding to the training account; Performing feature binning on the training fusion feature to obtain a plurality of feature regions; one of the feature regions includes at least one of the training fusion features; Determining a regional weight value corresponding to each of the feature regions, and converting the training fusion features in the feature regions corresponding to the regional weight value based on the regional weight value to obtain weight conversion features; Obtain a preset recognition model, and input the weight conversion feature into the preset recognition model to train the preset recognition model through all the weight conversion features, and determine the preset recognition model after training as the preset abnormal account recognition model.

5. The abnormal account identification method according to claim 4, characterized in that: The training fusion features are binned to obtain multiple feature regions, including: Determine a feature score corresponding to each of the training fusion features, and sort all the training fusion features from small to large according to the feature scores to obtain a fusion feature sequence; Starting from the first training fusion feature in the fusion feature sequence, the two adjacent training fusion features are combined into a fusion feature group; Determine the feature bin value between the two training fusion features in each of the fusion feature groups, and use the fusion feature group with the smallest feature bin value as the target feature group, and split all fusion feature groups except the target feature group to update the fusion feature sequence; Continue to determine new target feature groups until the feature bin values ​​corresponding to all target feature groups in the fused feature sequence are greater than or equal to the preset bin threshold, or the number of feature groups corresponding to the included target feature groups is greater than or equal to the preset combination threshold, and then determine one target feature group as one feature region.

6. The abnormal account identification method according to claim 4, characterized in that: Determining the area weight value corresponding to each of the feature areas includes: Determining a training account label corresponding to each training account from the training information corresponding to the training account; the training account label indicates whether the training account is normal or abnormal; A training account whose training account label indicates that the training account is normal is determined as a normal training account, and a training account whose training account label indicates that the training account is abnormal is determined as an abnormal training account; Determine the number of normal training accounts included in the training account set and record it as the total number of normal accounts, determine the number of abnormal training accounts included in the training account set and record it as the total number of abnormal accounts; Determine the number of normal training accounts contained in each of the characteristic regions and record it as the regional normal total number, determine the number of abnormal training accounts contained in each of the characteristic regions and record it as the regional abnormal total number; The regional weight value corresponding to the feature area is determined according to the total number of normal accounts, the total number of abnormal accounts, and the total number of normal accounts and the total number of abnormal accounts corresponding to the same feature area.

7. The abnormal account identification method according to claim 4, characterized in that: The step of training the preset recognition model using all the weight conversion features and determining the trained preset recognition model as the preset abnormal account recognition model includes: Identify the weight conversion feature using the preset recognition model, and output a predicted account label of the training account corresponding to the weight conversion feature; Determining a training account tag corresponding to each training account from the training information corresponding to the training account; Determining a predicted loss value corresponding to the preset recognition model based on the predicted account label and the training account label; When the predicted loss value does not reach the pre-training convergence condition, the initial parameters of the preset recognition model are iteratively updated until the predicted loss value reaches the pre-training convergence condition, and the preset recognition model after convergence is recorded as the preset abnormal account recognition model.

8. An abnormal account identification device, characterized in that: include: Sample acquisition module, used to obtain sample account sets; The sample account set includes multiple sample accounts, and each sample account corresponds to one sample information, sample portrait feature, and sample statistical feature; A sample feature graph construction module, configured to construct a sample feature graph based on the sample information corresponding to all the sample accounts; A feature determination module, configured to determine, based on the sample feature graph, a sample graph embedding feature and a sample community abnormality feature corresponding to each of the sample accounts; a model processing module, configured to obtain a preset abnormal account identification model, and input the sample graph embedding features, the sample community abnormality features, the user profile features, and the sample statistical features belonging to the same sample account into the preset abnormal account identification model, to determine an abnormal account score corresponding to each sample account; The abnormality identification module is used to obtain a preset abnormality threshold and determine the abnormal account identification result corresponding to each of the sample accounts based on the abnormal account score and the preset abnormality threshold.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormal account identification method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal account identification method according to any one of claims 1 to 7 is implemented.

Images