Data processing method and device, computer equipment, medium and product

Abstract

The invention discloses a data processing method and device, computer equipment, a medium and a product, and the method comprises the steps: obtaining associated data associated with a to-be-evaluated object, the associated data comprising object feature data of the to-be-evaluated object, target interface calling data and management data; performing clustering processing on the to-be-evaluated object according to the object feature data to obtain an object category of the to-be-evaluated object; determining a target similarity between the target interface calling data and the reference interface calling data, and determining a first anomaly judgment result of the to-be-evaluated object according to the target similarity; performing exception judgment processing on the to-be-evaluated object according to the management data to obtain a second exception judgment result of the to-be-evaluated object; and determining an assessment result of the to-be-assessed object according to the object category of the to-be-assessed object, the first anomaly judgment result and the second anomaly judgment result. According to the method, the to-be-evaluated object is evaluated through the data of the multiple dimensions, and the evaluation accuracy of the to-be-evaluated object can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data processing method, a data processing device, a computer device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] For a business platform, it is necessary to discover abnormal objects in time, which can effectively reduce the loss of the business platform.

[0003] At present, the detection of abnormal objects is usually detected by manual detection, which has high cost and missed detection, so that the abnormal objects in each business scenario cannot be accurately detected. Therefore, how to accurately identify abnormal objects becomes a technical problem to be solved. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, computer device, medium and product, which can evaluate the to-be-evaluated object through multi-dimensional data, and can improve the evaluation accuracy of the to-be-evaluated object.

[0005] The embodiments of the present application disclose a data processing method, which comprises:

[0006] Obtaining associated data associated with the to-be-evaluated object, the associated data comprising object feature data of the to-be-evaluated object, target interface call data and management data; the target interface call data is interface call data of the to-be-evaluated object in the process of business operation through the business platform; the management data is data generated by management of the to-be-evaluated object;

[0007] According to the object feature data, the to-be-evaluated object is clustered to obtain a clustering result of the to-be-evaluated object, and the clustering result is used to indicate the object category of the to-be-evaluated object;

[0008] Determining a target similarity between the target interface call data and reference interface call data, and determining a first abnormality determination result of the to-be-evaluated object according to the target similarity; the reference interface call data is interface call data of an abnormal object in the process of business operation through the business platform;

[0009] According to the management data, the to-be-evaluated object is subjected to abnormality determination processing to obtain a second abnormality determination result of the to-be-evaluated object;

[0010] According to the object category of the to-be-evaluated object, the first abnormality determination result and the second abnormality determination result, an evaluation result of the to-be-evaluated object is determined.

[0011] The embodiment of the application discloses a data processing device, which comprises:

[0012] An acquisition unit is configured to acquire associated data associated with a to-be-evaluated object, the associated data comprising object feature data of the to-be-evaluated object, target interface calling data, and management data; the target interface calling data is interface calling data of the to-be-evaluated object in a business operation process through a business platform; and the management data is data generated by management on the to-be-evaluated object.

[0013] A processing unit is configured to perform clustering processing on the to-be-evaluated object according to the object feature data, to obtain a clustering result of the to-be-evaluated object, the clustering result being used to indicate an object category of the to-be-evaluated object.

[0014] A determination unit is configured to determine a target similarity between the target interface calling data and reference interface calling data, and determine a first abnormality determination result of the to-be-evaluated object according to the target similarity; the reference interface calling data is interface calling data of an abnormal object in a business operation process through the business platform.

[0015] The processing unit is further configured to perform abnormality determination processing on the to-be-evaluated object according to the management data, to obtain a second abnormality determination result of the to-be-evaluated object.

[0016] The determination unit is further configured to determine an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result.

[0017] The embodiment of the application discloses a computer device, which comprises a processor adapted to implement one or more computer programs; and a computer readable storage medium, the computer readable storage medium storing one or more computer programs, the one or more computer programs being adapted to be loaded and executed by the processor to implement the above data processing method.

[0018] The embodiment of the application discloses a computer readable storage medium, the computer readable storage medium storing one or more computer programs, the one or more computer programs being adapted to be loaded and executed by the processor to implement the above data processing method.

[0019] The embodiment of the application discloses a computer program product, which comprises a computer program stored in a computer readable storage medium. The processor of the computer device reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the computer device executes the above data processing method.

[0020] In the embodiments of the present application, the associated data associated with the to-be-evaluated object is obtained, the associated data including object feature data of the to-be-evaluated object, target interface calling data and management data; the target interface calling data is interface calling data of the to-be-evaluated object in the process of business operation through the business platform. In the present application, the data used for judging whether the to-be-evaluated object is abnormal is not only limited to the object feature data, but also additionally includes the interface calling data and the management data, which can evaluate the to-be-evaluated object in multiple dimensions. The to-be-evaluated object is clustered according to the object feature data, and a clustering result of the to-be-evaluated object is obtained, the clustering result being used for indicating an object category of the to-be-evaluated object. The object type of the to-be-evaluated object can be determined according to the object feature data, which is conducive to identifying the business involved by the to-be-evaluated object. The target similarity between the target interface calling data and reference interface calling data is determined, and a first abnormality determination result of the to-be-evaluated object is determined according to the target similarity; the reference interface calling data is interface calling data of an abnormal object in the process of business operation through the business platform. The abnormality of the to-be-evaluated object can be more accurately judged based on the interface object of the abnormal object. The to-be-evaluated object is subjected to abnormality determination processing according to the management data, and a second abnormality determination result of the to-be-evaluated object is obtained. The use of the account of the to-be-evaluated object can be mined in combination with the management data, so as to more deeply determine the abnormality of the to-be-evaluated object. The evaluation result of the to-be-evaluated object is determined according to the object category, the first abnormality determination result and the second abnormality determination result of the to-be-evaluated object. The evaluation result of the to-be-evaluated object can be accurately determined in combination with the object category, the first abnormality determination result and the second abnormality determination result, and the loss brought by the abnormal object to the business platform can be effectively reduced based on the evaluation result. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 is a network architecture schematic diagram of a data processing system disclosed by the embodiments of the present application;

[0023] Figure 2 is a flow schematic diagram of a data processing method disclosed by the embodiments of the present application;

[0024] Figure 3 is a schematic diagram of a multi-dimensional relationship graph disclosed by the embodiments of the present application;

[0025] Figure 4This is a schematic diagram of a multidimensional relationship graph to isomorphic graph disclosed in an embodiment of this application;

[0026] Figure 5 This is a schematic diagram of a clustering result disclosed in an embodiment of this application;

[0027] Figure 6 This is a flowchart of a model-based object data processing method disclosed in an embodiment of this application;

[0028] Figure 7 This is a schematic diagram of the structure of a data processing device disclosed in an embodiment of this application;

[0029] Figure 8 This is a schematic diagram of the structure of a computer device disclosed in an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In order to improve the evaluation accuracy of the to-be-evaluated object, the data processing method provided by the embodiment of the present application is mainly used for abnormality judgment of the to-be-evaluated object, and generally includes the following steps: ①obtaining associated data associated with the to-be-evaluated object, the associated data including object feature data of the to-be-evaluated object, target interface calling data and management data; the target interface calling data is interface calling data of the to-be-evaluated object in the process of business operation through the business platform. In the present application, the data used for judging whether the to-be-evaluated object is abnormal is not limited to the object feature data, but additionally includes the interface calling data and the management data, which can evaluate the to-be-evaluated object in multiple dimensions. ②performing clustering processing on the to-be-evaluated object according to the object feature data to obtain a clustering result of the to-be-evaluated object, the clustering result being used for indicating an object category of the to-be-evaluated object. The object type of the to-be-evaluated object can be determined according to the object feature data, which is conducive to identifying the business involved by the to-be-evaluated object. ③determining a target similarity between the target interface calling data and reference interface calling data, and determining a first abnormality judgment result of the to-be-evaluated object according to the target similarity; the reference interface calling data is interface calling data of an abnormal object in the process of business operation through the business platform. The interface object based on the abnormal object can more accurately judge the abnormality of the to-be-evaluated object. ④performing abnormality judgment processing on the to-be-evaluated object according to the management data to obtain a second abnormality judgment result of the to-be-evaluated object. The use of the account of the to-be-evaluated object can be mined in combination with the management data, so as to more deeply determine the abnormality of the to-be-evaluated object. ⑤determining an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality judgment result and the second abnormality judgment result. The evaluation result of the to-be-evaluated object can be accurately determined in combination with the object category, the first abnormality judgment result and the second abnormality judgment result, and the loss caused by the abnormal object to the business platform can be effectively reduced based on the evaluation result.

[0032] In a possible implementation, the data processing method provided by the embodiment of the present application can be implemented based on cloud technology. In the embodiment of the present application, one or more of cloud storage, cloud database and big data in cloud technology can be involved. For example, data generated by executing the data processing method (for example, the evaluation result of the evaluation object) is stored in the cloud database; or data required for executing the data processing method (for example, the associated data associated with the to-be-evaluated object, including the object feature data of the to-be-evaluated object, the target interface calling data and the management data, and the reference interface calling data) is obtained from the cloud database.

[0033] Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, network, etc. in a wide area network or a local area network to realize data calculation, storage, processing and sharing. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on cloud computing business model application, which can form a resource pool, and be used on demand, flexibly and conveniently. Cloud computing technology will become an important support. Cloud storage is a new concept extended and developed on the basis of the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that cooperatively works together to provide data storage and business access functions by applying cluster applications, grid technology and distributed storage file systems, etc. to collect a large number of various types of storage devices (storage nodes) in the network through application software or application interface. Database (Database), in short, can be regarded as an electronic file cabinet - a place to store electronic files. Users can add, query, update, delete, etc. data in the file. A "database" is a collection of data stored together in a certain way, shared by multiple users, with as little redundancy as possible, and independent of application programs.

[0034] The data processing method provided by the embodiments of the present application can also be implemented based on artificial intelligence (AI) technology. Specifically, the clustering processing, similarity calculation and abnormality determination processing involved in the data processing method provided by the embodiments of the present application can be implemented by an artificial intelligence model, which is obtained by training a deep neural network.

[0035] Among them, artificial intelligence is to use digital computers or digital computer controlled machines to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which tries to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making. Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, both hardware and software technologies. Artificial intelligence basic technologies generally include sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, pre-training model technology, operation / interaction system, mechatronics, etc. Among them, the pre-training model is also called large model, basic model, which can be widely applied to downstream tasks in various directions of artificial intelligence after fine tuning. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology and machine learning / deep learning, etc. several directions.

[0036] Please refer to Figure 1 , a network architecture diagram of a data processing system disclosed in an embodiment of the present application. The evaluation system can include a terminal device 101, a server 102, and a database 103. The terminal device 101 is a device used by an object for business operation. Different terminal devices correspond to different objects. The object can also be understood as a user. The object and the user in the present embodiment can be replaced with each other. The terminal device 101 is mainly used to send associated data to the server 102 and receive notification information returned by the server 102. The notification information is mainly prompt information output to the to-be-evaluated object when the to-be-evaluated object is an abnormal object. The server 102 is mainly used to obtain associated data (including object feature data, target interface call data, and management data) related to the to-be-evaluated object from the terminal device 101, obtain reference interface call data from the database 103, determine the evaluation result of the to-be-evaluated object based on the associated data and the reference interface call data, and determine the evaluation result of the to-be-evaluated object, including: determining the object category of the to-be-evaluated object according to the object feature data; determining the first abnormality determination result of the to-be-evaluated object according to the target interface call data and the reference interface call data; determining the second abnormality determination result of the to-be-evaluated object according to the management data; and determining the evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result. The database 103 is mainly used to store related data, such as reference interface call data, or can also store the evaluation result of the to-be-evaluated object.

[0037] In an embodiment, the terminal device 101 includes, but is not limited to, a smart phone, a tablet computer, a smart wearable device, a smart voice interaction device, a smart home appliance, a personal computer, a vehicle-mounted terminal, a smart camera, a virtual reality device (such as an AR (Augmented Reality) device), and the like. The present application does not limit this. The server 102 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs (Content Delivery Networks), and big data and artificial intelligence platforms, and the like. The present embodiment does not limit this. Figure 1 The network architecture diagram of the data processing system is only exemplary and is not limited thereto. For example, Figure 1The server 102 in the application can be deployed as a node in the blockchain network, or the server 102 can also be connected to the blockchain network, so that the server 102 uploads the associated data associated with the to-be-evaluated object and the evaluation result of the to-be-evaluated object to the blockchain network for storage, to prevent internal data from being tampered with, thereby ensuring data security. The terminal device 101 and the server 102 can establish a direct communication connection through wired communication, or can establish an indirect communication connection through wireless communication, which is not limited in the embodiments of the application.

[0038] In the embodiments of the application, in combination with the data processing system, the data processing method can include: the server 102 obtains, from the terminal device 101, associated data associated with a to-be-evaluated object, the associated data including object feature data of the to-be-evaluated object, target interface call data, and management data; the target interface call data is interface call data of the to-be-evaluated object in a business operation process through a business platform. The server 102 performs clustering processing on the to-be-evaluated object according to the object feature data, to obtain a clustering result of the to-be-evaluated object, the clustering result being used to indicate an object category of the to-be-evaluated object. The server 102 obtains, from the database 103, reference interface call data, the reference interface call data being interface call data of an abnormal object in a business operation process through the business platform, determines a target similarity between the target interface call data and the reference interface call data, and determines a first abnormality determination result of the to-be-evaluated object according to the target similarity; the server 102 performs abnormality determination processing on the to-be-evaluated object according to the management data, to obtain a second abnormality determination result of the to-be-evaluated object; and the server 102 determines an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result. Optionally, the server 102 can send the evaluation result of the to-be-evaluated object to the database 103 for storage, which can effectively prevent the result from being changed. Alternatively, when the to-be-evaluated object is abnormal, the server 102 can return notification information to the terminal device 101 to prompt that the related business of the to-be-evaluated object cannot be used. Based on the method, the evaluation result of the to-be-evaluated object can be accurately determined through multi-dimensional data, and the loss of the business platform caused by abnormal objects can be effectively reduced based on the evaluation result.

[0039] The benefits brought by the data processing method will be described below in combination with specific business scenarios. For example, if it is detected that a to-be-evaluated object is an abnormal object when the to-be-evaluated object sells irregular goods on a target business platform, the object can be prohibited from selling on the target business platform, and if the abnormality is not detected in time, the platform can be limited for use. For another example, if some objects can be found in time after purchasing marketing activity product resources through batch account registration to resell, the loss of the platform can be effectively reduced.

[0040] It should be particularly pointed out that the relevant data collection and processing in the application should be strictly in accordance with the requirements of relevant laws and regulations, and the informed consent or separate consent of the personal information subject should be obtained, and the subsequent data use and processing behavior should be carried out within the scope of authorization of laws and regulations and personal information subject.

[0041] The data processing method proposed by the embodiment of the application will be described in detail below.

[0042] Please refer to Figure 2 The flowchart of the data processing method disclosed by the embodiment of the application, which can be executed by a computer device, can be a server 102 shown in the figure, and the data processing method can specifically include but not limited to the following steps: Figure 1 The server 102 shown in the figure, and the data processing method can specifically include but not limited to the following steps:

[0043] S201: Obtain the associated data associated with the to-be-evaluated object, the associated data including object feature data of the to-be-evaluated object, target interface calling data and management data; the target interface calling data being the interface calling data of the to-be-evaluated object in the process of business operation through the business platform; the management data being the data generated in the management of the to-be-evaluated object.

[0044] In the process of operation of the business platform, in order to timely find abnormal objects and reduce the loss of the corresponding business platform, each business platform server can detect whether there is an abnormal object at regular intervals or in real time, and limit the business ability of the abnormal object. Therefore, before evaluation, the data for evaluating the to-be-evaluated object, i.e. the associated data associated with the to-be-evaluated object, needs to be obtained.

[0045] In a possible implementation manner, the associated data associated with the to-be-evaluated object is obtained, and the associated data includes object feature data of the to-be-evaluated object, target interface calling data and management data. The object feature data is the basic data information of the to-be-evaluated object, including but not limited to the binding information, registration information, device information, identity information, login information and configuration information of the to-be-evaluated object. The target interface calling data is the interface calling data of the to-be-evaluated object in the process of business operation through the business platform. The business operation includes purchase business operation, sale business operation, etc. The management data is the data generated in the management of the account corresponding to the to-be-evaluated object, including management data of multiple dimensions, such as the limited use times of the account, the abnormal reminding times of the account, the de-abnormal reminding times of the account, the de-limited use times of the account, whether the account is involved in abnormal business, etc. Specifically, the associated data can refer to Table 1:

[0046] Table 1

[0047] Data type Key data Binding information Communication identifier, mailbox identifier Registration information Account registration address Login information Account login address Device information Device characteristics Identity information Authentication information, organization information Payment information Resource account identifier, payment method Configuration information Outbound, inbound IP rules Interface call data Interface type, interface call time Management data Management data in multiple dimensions

[0048] Referring to Table 1, the binding information can refer to a communication identifier, a mailbox identifier, such as a mobile phone number and a mailbox number, used by a user (i.e., an object to be evaluated), and the obtained mobile phone number and mailbox are encrypted; the registration information refers to an account registration address corresponding to the object to be evaluated; the login information refers to an account login address corresponding to the object to be evaluated; the device information refers to device characteristics, including device active time, device model, and the like; the identity information refers to authentication information and organization information to which the object to be evaluated belongs; the payment information refers to a resource account identifier and a payment method corresponding to the object to be evaluated. The configuration information mainly refers to resource security group configuration information, mainly including outbound and inbound IP rules of the object to be evaluated, the outbound refers to setting which application programs and services are allowed to access the Internet, and the inbound IP rule refers to setting which IP can access the object to be evaluated. The interface calling data refers to the interface type and the interface calling time of the object to be evaluated. The management data is data generated when the account corresponding to the object to be evaluated is managed, including multiple dimensions of management data, which can specifically include the limited use times of the account, the abnormal reminding times of the account, the abnormal reminding release times of the account, the limited use release times of the account, and whether the account is involved in abnormal business.

[0049] In order to accurately evaluate the object to be evaluated, more data should be obtained as much as possible, so that the initial data of the object to be evaluated can be obtained from different data sources, and after the initial data is obtained, the initial data can be preprocessed to obtain preprocessed data. The preprocessing includes cleaning the integrated data to eliminate noise, outliers and inconsistencies; it also includes data standardization processing, normalization processing, discretization processing, etc. The preprocessing here refers to filtering of abnormal data and garbled data, and data preprocessing can help eliminate bias in the data. For example, garbled data when a large amount of data is reported, abnormal data caused by inconsistent expression codes included in the object name (i.e., the object name includes expressions, which are easily encoded, leading to encoding errors), etc. After filtering these abnormal data, hash codes with consistent lengths can be generated. The preprocessed data is associated with the identification information of the object to be evaluated to obtain associated data associated with the object to be evaluated. The association processing can be performed by the IdMapping method, which is a technology for mapping object identification information of different sources or formats to a unified identification, used to associate data of the same object on multiple platforms or channels. For example, the binding information, registration information, login information, device information, and other dimensional information are discrete and separated when first extracted and stored, but they can all be matched to the corresponding object ID and device ID level. This step of processing generates a unique identification of the data: user ID + device ID, and matches the feature information of each dimension with the unique identification, thereby realizing the association of data and objects.

[0050] S202: Cluster the to-be-evaluated object according to the object feature data to obtain a clustering result of the to-be-evaluated object, the clustering result being used to indicate an object category of the to-be-evaluated object.

[0051] In a possible implementation, the purpose of clustering the to-be-evaluated object according to the object feature data is to determine the object category of the to-be-evaluated object. Therefore, before clustering, the object feature data of a plurality of reference objects can be obtained first, and a multi-dimensional relationship graph can be constructed according to the object feature data of the to-be-evaluated object and the object feature data of the plurality of reference objects. Before constructing the multi-dimensional relationship graph, the object feature data of the to-be-evaluated object can be integrated first, and the purpose of the integration is to solve problems such as data inconsistency, duplication, and missing, so as to ensure the integrity and accuracy of the data. When constructing the multi-dimensional relationship graph, the object feature data of the to-be-evaluated object can be re-constructed according to the obtained object feature data of the to-be-evaluated object and the object feature data of the plurality of reference objects; or the object feature data of the to-be-evaluated object can be directly added to an existing multi-dimensional relationship graph, and the existing multi-dimensional relationship graph is constructed according to the object feature data of the plurality of reference objects. If there is no reference object, the to-be-evaluated object can be directly clustered according to the object feature data of the to-be-evaluated object.

[0052] The application can be constructed based on Neo4j when constructing the multi-dimensional relationship graph, and Neo4j is a high-performance NOSQL graph database that stores structured data on a network. In the multi-dimensional relationship graph, a node represents a dimensional data, and the node type can be, for example, user identification information, mobile phone information, email information, device information, identity information, and the like, and the attributes of the node represent the characteristics of the corresponding dimension, such as age, gender, registration time, binding time, and the like. Correspondingly, the node type can be as shown in Table 2:

[0053] Table 2

[0054] Node type Attribute User identification information Username, registration time, age, gender, user type, user region, etc. Mobile phone information Mobile phone prefix and suffix, mobile phone region, etc. Email information Email suffix, email type, etc. Device information Device active time, device information, etc. Identity information IP region, organization information

[0055] In actual application, the multi-dimensional relationship graph can be constructed based on the object feature data of the to-be-evaluated object and the object feature data of the plurality of reference objects, and the multi-dimensional relationship graph can be updated according to time T+1h. In the multi-dimensional relationship graph, each edge represents the closeness between two nodes, and the closeness can be represented by a weight. After the multi-dimensional relationship graph is constructed, the connection relationship between each object is determined according to the multi-dimensional relationship graph, and a homomorphic graph can be constructed based on the connection relationship. The homomorphic graph is determined according to the connection relationship between each object and the weight table corresponding to the node type. As shown in FIG. 1, it is a schematic diagram of a multi-dimensional relationship graph, Figure 3 Figure 3 ​User A, user B, user C and user D are shown in the figure, wherein user A and user B have the same mobile phone and mailbox; user A and user C have the same login IP; user B and user D have the same device IP; user D and user C have the same mailbox. Based on the figure, the connection relationship between the users can be determined.

[0056] Based on the connection relationship between the objects, a corresponding isomorphic graph can be constructed, and the weight between the objects can be directly displayed in the isomorphic graph. The object is the user, and the user is the object, which are equivalent. As shown in Figure 4 It is a schematic diagram of isomorphic transformation of a multi-dimensional relationship graph. 401 is a multi-dimensional relationship graph of user A and user B. According to 401, it is determined that user A and user B have the same mailbox and mobile phone. Then, the weights corresponding to the mailbox and mobile phone are obtained from table 402, the weight between user A and user B is calculated, and the attribute information corresponding to user A and user B is determined based on the mailbox and mobile phone, as shown in 403, that is, an isomorphic graph. The weight between user A and user B is indicated in the isomorphic graph.

[0057] Finally, the multiple reference objects and the to-be-evaluated objects are clustered based on the weight between the objects, and the clustering results of the multiple reference objects and the to-be-evaluated objects are obtained. In the clustering process, a clustering algorithm is used to cluster the nodes represented by the objects. Because each node has corresponding attribute information, the similarity between the objects can be calculated by combining the attribute information and the weight, and then the objects can be divided into different categories, that is, multiple clustering results. Each clustering result includes at least one object, and the feature data (including attribute information) of the objects included in each clustering result are similar. One clustering result corresponds to one object category. Each object category is distinguished by a category identifier. As shown in Figure 5 It is a schematic diagram of a clustering result. As can be seen from Figure 5 In the figure, multiple objects are clustered in different categories, which are the first category, the second category, the third category and the fourth category. Different categories represent different classifications, such as the first category can be a group selling high-profit goods, and the second category can be a group publishing illegal advertisements.

[0058] In the embodiments of the present application, the clustering algorithm includes a distance-based clustering algorithm (such as K-means, DBSCAN, etc.), a graph-based clustering algorithm (such as Louvain, Girvan-Newman, etc.). The distance-based clustering algorithm is an algorithm that measures the similarity between data points by distance, and thus classifies points with high similarity into one category. The graph-based clustering algorithm is an algorithm that creates data point groups using the similarity or relationship between data points. This kind of algorithm usually regards data as a graph, where data points are nodes, and the similarity or distance between points is an edge.

[0059] S203: Determine the target similarity between the target interface call data and the reference interface call data, and determine the first abnormality determination result of the to-be-evaluated object according to the target similarity; the reference interface call data is the interface call data of the abnormal object in the process of business operation through the business platform.

[0060] The target interface call data is the interface call data of the to-be-evaluated object in the process of business operation through the business platform, and the reference interface call data is the interface call data of the abnormal object in the process of business operation through the business platform. The reference interface call data is used to determine whether the target interface call data of the to-be-evaluated object is abnormal. Since the interface call data is objective data and difficult to change, using this dimension of interface call data to determine whether the to-be-evaluated object is abnormal can improve the accuracy of evaluation.

[0061] In a possible implementation, the interface call data includes an interface type of a called interface and an interface call time, and the reference interface call data is included in an interface call data set, and the interface call data set includes a plurality of reference interface call data. Correspondingly, the process of determining the target similarity between the target interface call data and the reference interface call data can include: obtaining the target interface call data of the to-be-evaluated object in a set time window, and obtaining the reference interface call data of the reference object in the corresponding time window. According to the interface type of the called interface and the interface call time included in the interface call data, the similarity between the target interface call data and each reference interface call data in the interface call data set is determined; first, the interface type of the called interface and the interface call time included in the target interface call data are determined, and then the interface type of the called interface and the interface call time included in each reference interface call data are determined, the similarity between the target interface call data and the reference interface call data is calculated in time sequence according to the interface type of the called interface, and finally the similarities corresponding to all interface types are weighted to obtain a plurality of similarities between the target interface call data and each reference interface call data; then, the maximum similarity is selected from the plurality of similarities determined, and the maximum similarity is determined as the target similarity between the target interface call data and the reference interface call data. Optionally, the average value of the similarities between the target interface call data and each reference interface call data can also be determined, and the average value is taken as the target similarity.

[0062] For example, the set time window can be one day, one week, one month; taking user 1 and user 2 as an example, taking one hour as a time window, the determined interface call data of user 1 and user 2 are as follows: user 1: ("interface 1", "2021-10-01 10:00:00"), ("interface 2", "2021-10-01 10:05:00"), ("interface 3", "2021-10-01 10:10:00"), ("interface 1", "2021-10-01 10:15:00"), ("interface 2", "2021-10-01 10:20:00"); user 2: ("interface 1", "2021-10-01 11:00:00"), ("interface 4", "2021-10-01 11:05:00"), ("interface 5", "2021-10-01 11:10:00"), ("interface 1", "2021-10-01 11:15:00"). The data of user 1 and user 2 are aggregated, user 1 is aggregated together, and user 2 is aggregated together, and the similarity between user 1 and user 2 can be calculated by using a similarity calculation model.

[0063] Further, the target similarity can be compared with the similarity threshold to obtain a comparison result; if the comparison result indicates that the target similarity is greater than the similarity threshold, it is determined that the first abnormality determination result of the to-be-evaluated object is an object abnormality determination result, and the object abnormality determination result is used to indicate that the to-be-evaluated object is an object with abnormal interface call; if the comparison result indicates that the target similarity is less than or equal to the similarity threshold, it is determined that the first abnormality determination result of the to-be-evaluated object is an object normality determination result, and the object normality determination result is used to indicate that the to-be-evaluated object is an object with normal interface call. If the to-be-evaluated object is an object with abnormal interface call, the to-be-evaluated object can be marked with an abnormality label, and if the to-be-evaluated object is an object with normal interface call, the to-be-evaluated object can not be marked.

[0064] S204: performing abnormality determination processing on the to-be-evaluated object according to the management data to obtain a second abnormality determination result of the to-be-evaluated object.

[0065] In a possible implementation, the management data is data generated when the account corresponding to the to-be-evaluated object is managed, and includes management data of multiple dimensions, for example, the limited use times of the account, the abnormal reminding times of the account, the un-abnormal reminding times of the account, the un-limited use times of the account, whether the account is involved in abnormal business, and the like. The process of performing abnormality determination processing on the to-be-evaluated object according to the management data to obtain the second abnormality determination result of the to-be-evaluated object can be as follows: first, obtaining the weight data of each data dimension in the multiple data dimensions; performing weighted processing on the management data under each data dimension by using the weight data of each data dimension, to obtain the management data after weighted processing under each data dimension; and determining the second abnormality determination result of the to-be-evaluated object according to the management data after weighted processing under each data dimension. Specifically, the score of the to-be-evaluated object can be determined according to the management data after weighted processing under each data dimension, and then the second abnormality determination result of the to-be-evaluated object is determined according to the score and a score threshold. If the absolute value of the score of the to-be-evaluated object is greater than the score threshold, it is determined that the second abnormality determination result of the to-be-evaluated object is the first object abnormality determination result, and the first object abnormality determination result is used to indicate that the to-be-evaluated object is an object with abnormal account information. If the absolute value of the score of the to-be-evaluated object is less than or equal to the score threshold, it is determined that the second abnormality determination result of the to-be-evaluated object is the second object abnormality determination result, and the second object abnormality determination result is used to indicate that the to-be-evaluated object is an object without abnormal account information. Based on the management data, the management situation of the account corresponding to the to-be-evaluated object is determined, the problems of the account can be found in time, the abnormal object can be found in time, and the related business can be prevented in time, thereby reducing the business loss.

[0066] For example, the management data of the to-be-evaluated object includes management data of three data dimensions, which are management data 1, management data 2, and management data 3. First, the weight corresponding to the management data under each dimension is determined from the management data and the weight mapping table, the weight corresponding to the management data 1 is weight 1, the weight corresponding to the management data 2 is weight 2, and the weight corresponding to the management data 3 is weight 3. Then, the number of times of occurrence of the management data under each dimension is determined, the number of times of occurrence of the management data 1 is 1, the number of times of occurrence of the management data 2 is 3, and the number of times of occurrence of the management data 3 is 5. Then, the management data 1 after weighted processing is weight 1*1, the management data 2 after weighted processing is weight 2*3, and the management data 3 after weighted processing is weight 3*5. Then, the score of the to-be-evaluated object is determined based on each management data after weighted processing, which is weight 1*1+weight 2*3+weight 3*5. Finally, the second abnormality determination result of the to-be-evaluated object is determined based on the score. If the absolute value of the score is greater than the score threshold, it is determined that the to-be-evaluated object is an account abnormal object. If the absolute value of the score is less than or equal to the score threshold, it is determined that the to-be-evaluated object is an account normal object.

[0067] The weight data of each data dimension in the plurality of data dimensions is obtained from management data and a weight mapping table, and how to construct the management data and the weight mapping table is described as follows:

[0068] 1. Obtain a weight determination matrix, and the size of the weight determination matrix is MxM. The element value of the Kth row and the Lth column in the weight determination matrix is used to indicate the importance of the Kth data dimension relative to the Lth data dimension. The Kth data dimension is the data dimension ranked in the Kth position in a data dimension sequence, the Lth data dimension is the data dimension ranked in the Lth position in the data dimension sequence, the data dimension sequence includes M data dimensions, K and L are any positive integers less than or equal to M, and M is a positive integer greater than 1.

[0069] The construction process of the weight determination matrix is as follows. It is assumed that there are five dimensions of management data, which are the abnormal prompt times of the account, the limited use times of the account, whether the account is involved in abnormal business, the account exception prompt release times, and the account limited use release times, which are denoted as A1, A2, A3, A4, and A5 respectively. The importance of each dimension can be determined based on historical experience, and the relative numerical value can be determined.

[0070] For example, it is considered that the A2 element is slightly more important than the A1 element, and the relative numerical value A1A2 (indicating the element position in the weight determination matrix) is 0.5. It is considered that A1 is much less important than A3, and the relative numerical value A1A3 is 0.1 (that is, A3 is much more important than A1). It is considered that A1 is more important than A4, and the relative numerical value A1A4 is 3. It is considered that A1 is more important than A5, and the relative numerical value A1A5 is 4.

[0071] Among them, if it is determined that A1 is much less important than A3, that is, A3 is much more important than A1, if A1A3 is 0.1, then A3A1 = 1 / A1A3 = 10. The data in Table 3 all satisfy AiAj = 1 / AjAi.

[0072] Further, after the weight determination matrix is determined, the weight determination matrix can be subjected to outlier detection to detect whether there is an outlier in the elements included in the weight determination matrix. If there is no outlier, the management data and the weight mapping table are determined based on the weight determination matrix. If there is an outlier, the outlier is adjusted, and it is detected whether there is an outlier in the adjusted weight determination matrix. The outlier detection is to judge the rationality of the weight determination matrix.

[0073] In one possible implementation, the weight determination matrix can be subjected to consistency test. The consistency test refers to determining the allowable range of inconsistency of the weight determination matrix. A specific consistency index is calculated by CI. The smaller the CI, the greater the consistency. CI = 0, there is complete consistency; CI close to 0, there is satisfactory consistency; the larger the CI, the more serious the inconsistency.

[0074] The specific detection process is as follows: if the importance of i to j is a, and the importance of j to k is b, then the importance of i to k should be a × b.

[0075] In other words, when constructing the weight determination matrix, there may be some conflicts or contradictions that need to be checked and modified. For example, we might assume that A is more important than B, and B is more important than C, and theoretically A should also be more important than C. However, when comparing A and C, for some reason, we might write that C is more important than A. In this case, the consistency check will fail. If it fails, we need to change the values ​​to make it pass.

[0076] The constructed weight determination matrix can be shown in Table 3:

[0077] Table 3

[0078]

[0079] It should be noted that the multiple data dimensions corresponding to the above-mentioned objects to be evaluated are contained in the data dimension sequence. In other words, the data dimensions included in each object to be evaluated are some or all of the M data dimensions.

[0080] 2. Add the values ​​of each column in the weight determination matrix, and generate a first matrix based on the sum of the column sums. The size of the first matrix is ​​1×M. Add the values ​​of each row in the weight determination matrix, and generate a second matrix based on the sum of the row sums. The size of the second matrix is ​​M×1. For example, adding the M rows of data corresponding to the i-th column yields A1i+A2i+A3i+…+AMi. Another example is adding the M columns of data corresponding to the i-th row, yielding Ai1+Ai2+Ai3+…+AiM.

[0081] Specifically, as shown in Table 3, the element values ​​of each column are added together to obtain the first matrix (163 / 12, 11 / 10, 19 / 10, 58 / 3, 23); the element values ​​of each row are added together to obtain the second matrix (8.6, 13.2, 36, 4.63, 1.88). T .

[0082] 3. According to the first matrix and the second matrix, determine the weight data of each data dimension in the M data dimensions. First, normalize the first matrix and the second matrix to obtain a feature vector. Then, normalize the feature vector to obtain initial management data and a weight mapping table. Standardize the initial management data and the weight mapping table to obtain management data and a weight mapping table. The management data and the weight mapping table include the management data of each dimension and the weight data corresponding to the management data of each dimension. Therefore, based on the management data and the weight mapping table, the weight data of the management data of each dimension included in any to-be-evaluated object can be determined.

[0083] For example, after normalizing the first matrix and the second matrix, the initial management data and the weight mapping table obtained can be as shown in Table 4:

[0084] Table 4

[0085] Management data Weight A1 - number of abnormal reminders for the account 0.1035878788778 A2 - number of limited uses for the account 0.1818265235233 A3 - whether the account is involved in abnormal business 0.6301911725624 A4 - number of abnormal reminder removals for the account 0.0566565416546 A5 - number of limited use removals for the account 0.0319154556915

[0086] Considering that the values in Table 4 are all decimals, if subsequently used for score calculation of the to-be-evaluated object, the data processing amount is large, therefore, the weights in Table 4 can be standardized, and the standardization can be the same amplification multiple.

[0087] For example, the weights in Table 4 can be enlarged by 50 times in equal ratio, and rounded to obtain the management data and the weight mapping table, which can be as shown in Table 5. It can be seen that the weight values of the data management data under each data dimension shown in Table 5 are all integers, therefore, when the score calculation is performed according to the number of management data, it can be more efficient. Among them, unrestricting represents tending to normal, and restricting use represents tending to abnormal, so positive and negative numbers are used to distinguish unrestricting and restricting use.

[0088] Table 5

[0089] Management data Weight A1 - number of abnormal reminders for the account 5 A2 - number of limited uses for the account 9 A3 - whether the account is involved in abnormal business 32 A4 - number of abnormal reminder removals for the account -3 A5 - number of limited use removals for the account -2

[0090] S205: According to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result, determine the evaluation result of the to-be-evaluated object.

[0091] In a possible implementation, the first weight data corresponding to the object category of the to-be-evaluated object, the second weight data corresponding to the first abnormality determination result, and the third weight data corresponding to the second abnormality determination result are determined respectively. In the specific implementation process, a weight table can be agreed in advance, and the weight table defines the weight data corresponding to different object categories, the weight data corresponding to whether the interface data is abnormal, and the weight data corresponding to whether the account is abnormal. Therefore, after the object category, the first abnormality determination result, and the second abnormality determination result of the to-be-evaluated object are determined, the corresponding weight data can be directly obtained from the weight table. The evaluation result of the to-be-evaluated object is determined according to the first weight data, the second weight data, and the third weight data. The first weight data, the second weight data, and the third weight data can be added to obtain the evaluation result of the to-be-evaluated object, or the first weight data, the second weight data, and the third weight data can be added and then averaged, and the average is taken as the evaluation result of the to-be-evaluated object. In this application, the evaluation result of the to-be-evaluated object is determined according to multiple dimensions, and the accuracy is higher than that of evaluation from a single dimension.

[0092] If the direct addition method is used, three weight data can be determined, for example, S A , S B , and S C . Finally, the score of the to-be-evaluated object is S=S A +S B +S C . According to the score of the to-be-evaluated object, the evaluation level of the to-be-evaluated object can be determined. The evaluation level can be determined according to the following formula:

[0093]

[0094] wherein, L1 and L2 are self-defined values, and the higher the level, the greater the possibility that the to-be-evaluated object is an abnormal object. For example, if the evaluation result of the to-be-evaluated object indicates that the to-be-evaluated object is in the fourth level, it can be directly determined that the to-be-evaluated object is an abnormal object.

[0095] In a possible implementation, the related business of the to-be-evaluated object can be managed according to the evaluation result of the to-be-evaluated object. Specifically, if the evaluation result of the to-be-evaluated object indicates that the abnormal level of the to-be-evaluated object is higher than or equal to the set abnormal level, the to-be-evaluated object is prohibited from performing business operations on the business platform, that is, the interface is closed, so that the user cannot normally call the interface.

[0096] For example, after identifying a user (or object) that may involve abnormal business, the user is limited to participate in marketing activities if the abnormal level of the user is high; or in the post-paid credit limit scenario, the credit limit of the user is reduced if the abnormal level of the user is high. In this way, the business can limit abnormal users and effectively reduce the loss of each platform.

[0097] In the embodiment of the present application, the server obtains the object feature data of the to-be-evaluated object, the target interface calling data and the management data, and can determine the object category of the to-be-evaluated object according to the object feature data; can determine whether the interface calling is abnormal according to the target interface calling data, and can determine whether the account is abnormal according to the management data. Based on the evaluation results of multiple aspects, the overall evaluation result of the to-be-evaluated object can be obtained. Since multiple dimensions are combined for evaluation in the embodiment of the present application, more accurate evaluation results can be obtained.

[0098] In order to more clearly describe the data processing method of the embodiment of the present application, the data processing method of the embodiment of the present application is described in combination with multiple data processing modules, and the data processing modules include a clustering analysis module based on graph computing, an interface calling data analysis module and a management data analysis module. Correspondingly, the clustering analysis module based on graph computing can be called to perform clustering processing on the to-be-evaluated object according to the object feature data, and the clustering result of the to-be-evaluated object is obtained; the interface calling data analysis module can be called to determine the target similarity between the target interface calling data and the reference interface calling data, and the first abnormality determination result of the to-be-evaluated object is determined according to the target similarity; the management data analysis module can be called to perform abnormality determination processing on the to-be-evaluated object according to the management data, and the second abnormality determination result of the to-be-evaluated object is obtained.

[0099] The clustering analysis module based on graph computing, the interface calling data analysis module and the management data analysis module described above can be replaced by machine learning models respectively, that is, only the input of the model needs to be determined, and the corresponding output can be obtained through the model. Based on the output data of each model, a judgment model can be used to output the result of whether abnormal or not.

[0100] If the clustering analysis module based on graph computing, the interface calling data analysis module and the management data analysis module are multiple models, please refer to Figure 6 The data processing method provided by the embodiment of the present application can be summarized as the following four parts:

[0101] The first part is data preparation, that is, obtaining the associated data associated with the to-be-evaluated object, pre-processing the data, mapping the data and the object identifier, and obtaining the data input into the model.

[0102] The second part: model processing. The input model data is classified according to rules to obtain object feature data, target interface calling data and management data. Each data is input into different models to obtain corresponding outputs. For example, the object feature data is input into a clustering analysis model based on graph calculation to obtain the object category of the to-be-evaluated object; the target interface calling data is input into an interface calling data analysis model to obtain the first abnormality determination result of the to-be-evaluated object; and the management data is input into a management data analysis model to obtain the second abnormality determination result of the to-be-evaluated object.

[0103] The third part: abnormality determination. The object category, the first abnormality determination result and the second abnormality determination result of the to-be-evaluated object are input into an abnormality determination model, and the evaluation result of the to-be-evaluated object can be output.

[0104] The fourth part: real-time service. According to the evaluation result of the to-be-evaluated object, a crowd can be selected, and the crowd can be selected and marked. At the same time, the to-be-evaluated object can be queried, and operations such as limiting can be performed.

[0105] The embodiment of the application can combine the model to describe the data processing method of the embodiment, and the model can be combined to realize more accurate evaluation of the to-be-evaluated object.

[0106] Based on the method embodiment, the embodiment of the application further provides a structural diagram of a data processing device. Referring to Figure 7 , the embodiment of the application provides a structural diagram of a data processing device. Figure 7 The data processing device 700 shown can run the following units:

[0107] The acquisition unit 701 is configured to acquire associated data associated with a to-be-evaluated object, the associated data including object feature data of the to-be-evaluated object, target interface calling data and management data; the target interface calling data is interface calling data of the to-be-evaluated object in a business operation process through a business platform; and the management data is data generated by management of the to-be-evaluated object;

[0108] The processing unit 702 is configured to perform clustering processing on the to-be-evaluated object according to the object feature data to obtain a clustering result of the to-be-evaluated object, and the clustering result is used to indicate the object category of the to-be-evaluated object;

[0109] The determination unit 703 is configured to determine a target similarity between the target interface calling data and reference interface calling data, and determine a first abnormality determination result of the to-be-evaluated object according to the target similarity; and the reference interface calling data is interface calling data of an abnormal object in a business operation process through the business platform;

[0110] The processing unit 702 is further configured to perform abnormality determination processing on the to-be-evaluated object according to the management data, to obtain a second abnormality determination result of the to-be-evaluated object.

[0111] The determination unit 703 is further configured to determine an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result.

[0112] In a possible implementation, when the processing unit 702 performs clustering processing on the to-be-evaluated object according to the object feature data of the to-be-evaluated object to obtain a clustering result of the to-be-evaluated object, the processing unit 702 is specifically configured to perform the following steps:

[0113] Obtain object feature data of a plurality of reference objects;

[0114] Construct a multi-dimensional relationship graph according to the object feature data of the to-be-evaluated object and the object feature data of the plurality of reference objects;

[0115] Determine a weight between any two objects in the to-be-evaluated object and the plurality of reference objects according to the multi-dimensional relationship graph;

[0116] Perform clustering processing on the plurality of reference objects and the to-be-evaluated object according to the weight between any two objects in the to-be-evaluated object and the plurality of reference objects, to obtain a respective clustering result of the plurality of reference objects and the to-be-evaluated object.

[0117] In a possible implementation, the interface calling data includes an interface type of a calling interface and an interface calling time, the reference interface calling data is included in an interface calling data set, the interface calling data set includes a plurality of reference interface calling data, and when the determination unit 703 determines the target similarity between the target interface calling data and the reference interface calling data, the determination unit 703 is specifically configured to perform the following steps:

[0118] Determine the similarity between the target interface calling data and each reference interface calling data in the interface calling data set according to the interface type of the calling interface and the interface calling time included in the interface calling data;

[0119] Select a maximum similarity from the plurality of determined similarities, and determine the maximum similarity as the target similarity between the target interface calling data and the reference interface calling data.

[0120] In a possible implementation, when the determination unit 703 determines the first abnormality determination result of the to-be-evaluated object according to the target similarity, the determination unit 703 is specifically configured to perform the following steps:

[0121] compare the target similarity with a similarity threshold to obtain a comparison result;

[0122] if the comparison result indicates that the target similarity is greater than the similarity threshold, determine the first abnormality determination result of the to-be-evaluated object as an object abnormality determination result, the object abnormality determination result being used to indicate that the to-be-evaluated object is an object with an abnormal interface call;

[0123] if the comparison result indicates that the target similarity is less than or equal to the similarity threshold, determine the first abnormality determination result of the to-be-evaluated object as an object normality determination result, the object normality determination result being used to indicate that the to-be-evaluated object is an object with a normal interface call.

[0124] In a possible implementation, the management data includes management data in a plurality of data dimensions, and when the processing unit 702 performs abnormality determination processing on the to-be-evaluated object according to the management data to obtain a second abnormality determination result of the to-be-evaluated object, the processing unit 702 is specifically configured to perform the following steps:

[0125] obtain weight data of each data dimension in the plurality of data dimensions;

[0126] perform weighted processing on the management data in each data dimension by using the weight data of the data dimension, to obtain weighted management data in each data dimension;

[0127] determine the second abnormality determination result of the to-be-evaluated object according to the weighted management data in each data dimension.

[0128] In a possible implementation, the obtaining unit 701 is further configured to obtain a weight determination matrix, an element value in the Kth row and the Lth column of the weight determination matrix being used to indicate an importance of a Kth data dimension relative to an Lth data dimension, the Kth data dimension being a data dimension ranked in the Kth position in a data dimension sequence, the Lth data dimension being a data dimension ranked in the Lth position in the data dimension sequence, the data dimension sequence including M data dimensions, K and L being any positive integer less than or equal to M, the plurality of data dimensions being included in the data dimension sequence, and M being a positive integer greater than 1.

[0129] The determining unit 703 is further configured to determine the weight data of each data dimension in the M data dimensions according to the weight determination matrix.

[0130] In a possible implementation, when the determining unit 703 determines the weight data of each data dimension in the M data dimensions according to the weight determination matrix, the determining unit 703 is specifically configured to perform the following steps:

[0131] Add the element values of each column in the weight determination matrix respectively, and generate a first matrix according to the addition results of each column;

[0132] Add the element values of each row in the weight determination matrix respectively, and generate a second matrix according to the addition results of each row;

[0133] Determine the weight data of each data dimension in the M data dimensions according to the first matrix and the second matrix.

[0134] In a possible implementation, when the determining unit 703 determines the evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result, the determining unit 703 is specifically configured to perform the following steps:

[0135] Determine the first weight data corresponding to the object category of the to-be-evaluated object, the second weight data corresponding to the first abnormality determination result, and the third weight data corresponding to the second abnormality determination result, respectively.

[0136] Determine the evaluation result of the to-be-evaluated object according to the first weight data, the second weight data, and the third weight data.

[0137] It can be understood that the functions of the functional units of the data processing apparatus provided in the embodiments of the present application can be specifically implemented according to the methods in the above method embodiments, and the specific implementation process can refer to the related description in the above method embodiments, which will not be described here.

[0138] In a possible implementation, the data processing apparatus provided in the embodiments of the present application can be implemented in a software manner. The data processing apparatus can be stored in a memory, which can be a program and a plug-in in the form of software, and include a series of units, including an obtaining unit, a processing unit, and a determining unit. The obtaining unit, the processing unit, and the determining unit are used to implement the data processing method provided in the embodiments of the present application.

[0139] In other possible embodiments, the data processing apparatus provided by the embodiments of the present application can also be implemented in a combination of software and hardware, for example, the data processing apparatus provided by the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to implement the data processing method provided by the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can use one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic elements.

[0140] In the embodiments of the present application, the method comprises the following steps: the acquisition unit acquires associated data associated with the to-be-evaluated object, the associated data comprising object feature data of the to-be-evaluated object, target interface call data, and management data; the processing unit performs clustering processing on the to-be-evaluated object according to the object feature data, to obtain a clustering result of the to-be-evaluated object; the determination unit determines a target similarity between the target interface call data and the reference interface call data, and determines a first abnormality determination result of the to-be-evaluated object according to the target similarity; the processing unit performs abnormality determination processing on the to-be-evaluated object according to the management data, to obtain a second abnormality determination result of the to-be-evaluated object; and the determination unit determines an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result. The to-be-evaluated object can be evaluated through multiple dimensions of data, and the evaluation accuracy of the to-be-evaluated object can be improved.

[0141] Please refer to Figure 8 , Figure 8 A structural schematic diagram of a computer device provided by the embodiments of the present application is shown. The computer device described in the embodiments of the present application comprises a processor 801, a communication interface 802, and a memory 803. The processor 801, the communication interface 802, and the memory 803 can be connected through a bus or other means, and the embodiments of the present application take the connection through the bus as an example. The computer device can be a server, a personal computer, a mobile phone, a tablet computer, or other electronic devices. Figure 1 The server 102 is shown.

[0142] The processor 801 (or CPU (Central Processing Unit)) is the computing core and control core of the computer device, which can parse various instructions in the computer device and process various data of the computer device. For example, the CPU can be used to parse the on-off instructions sent by the user to the computer device and control the computer device to perform on-off operation; for another example, the CPU can transmit various interactive data between the internal structures of the computer device, and the like. The communication interface 802 can optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi, mobile communication interfaces, etc.), and is controlled by the processor 801 to receive and send data. The memory 803 is a memory device in the computer device, used to store programs and data. It can be understood that the memory 803 herein can include the built-in memory of the computer device, and of course can also include the expansion memory supported by the computer device. The memory 803 provides a storage space that stores the operating system of the computer device, which can include but is not limited to: Android system, iOS system, Windows Phone system, etc., and the present application does not make any limitation thereto.

[0143] In the embodiment of the present application, the processor 801 executes the following operations by running the executable program code in the memory 803:

[0144] Obtain associated data associated with the to-be-evaluated object, the associated data including object feature data of the to-be-evaluated object, target interface call data, and management data; the target interface call data is interface call data of the to-be-evaluated object in the process of business operation through the business platform; the management data is data generated by management of the to-be-evaluated object;

[0145] According to the object feature data, the to-be-evaluated object is clustered to obtain a clustering result of the to-be-evaluated object, the clustering result being used to indicate an object category of the to-be-evaluated object;

[0146] Determine a target similarity between the target interface call data and reference interface call data, and determine a first abnormality determination result of the to-be-evaluated object according to the target similarity; the reference interface call data is interface call data of an abnormal object in the process of business operation through the business platform;

[0147] According to the management data, the to-be-evaluated object is subjected to abnormality determination processing to obtain a second abnormality determination result of the to-be-evaluated object;

[0148] According to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result, an evaluation result of the to-be-evaluated object is determined.

[0149] In a possible implementation, when the processor 801 determines the clustering result of the to-be-evaluated object according to the object feature data of the to-be-evaluated object by running the executable program code in the memory 803, the processor 801 specifically performs the following steps:

[0150] obtain object feature data of a plurality of reference objects;

[0151] construct a multi-dimensional relationship graph according to the object feature data of the to-be-evaluated object and the object feature data of the plurality of reference objects;

[0152] determine a weight between any two objects of the to-be-evaluated object and the plurality of reference objects according to the multi-dimensional relationship graph;

[0153] perform clustering processing on the plurality of reference objects and the to-be-evaluated object according to the weight between any two objects of the to-be-evaluated object and the plurality of reference objects, to obtain a clustering result of each of the plurality of reference objects and the to-be-evaluated object.

[0154] In a possible implementation, the interface calling data includes an interface type of a called interface and an interface calling time, the reference interface calling data is included in an interface calling data set, the interface calling data set includes a plurality of reference interface calling data, and when the processor 801 determines the target similarity between the target interface calling data and the reference interface calling data by running the executable program code in the memory 803, the processor 801 specifically performs the following steps:

[0155] determine the similarity between the target interface calling data and each reference interface calling data in the interface calling data set according to the interface type of the called interface and the interface calling time included in the interface calling data;

[0156] select a maximum similarity from the plurality of determined similarities, and determine the maximum similarity as the target similarity between the target interface calling data and the reference interface calling data.

[0157] In a possible implementation, when the processor 801 determines the first abnormality determination result of the to-be-evaluated object according to the target similarity by running the executable program code in the memory 803, the processor 801 specifically performs the following steps:

[0158] compare the target similarity with a similarity threshold to obtain a comparison result;

[0159] If the comparison result indicates that the target similarity is greater than a similarity threshold, a first abnormality determination result of the to-be-evaluated object is determined as an object abnormality determination result, and the object abnormality determination result is used to indicate that the to-be-evaluated object is an object with an abnormal interface call.

[0160] If the comparison result indicates that the target similarity is less than or equal to the similarity threshold, the first abnormality determination result of the to-be-evaluated object is determined as an object normality determination result, and the object normality determination result is used to indicate that the to-be-evaluated object is an object with a normal interface call.

[0161] In a possible implementation, the management data includes management data in a plurality of data dimensions, and when the processor 801 determines a second abnormality determination result of the to-be-evaluated object by running the executable program code in the memory 803 according to the management data, the processor 801 is specifically configured to perform the following steps:

[0162] obtain weight data of each data dimension in the plurality of data dimensions;

[0163] perform weighted processing on the management data in each data dimension by using the weight data of the data dimension, to obtain weighted management data in each data dimension;

[0164] determine the second abnormality determination result of the to-be-evaluated object according to the weighted management data in each data dimension.

[0165] In a possible implementation, the processor 801 is further configured to perform the following steps by running the executable program code in the memory 803:

[0166] obtain a weight determination matrix, an element value in the Kth row and the Lth column of the weight determination matrix being used to indicate an importance of a Kth data dimension relative to an Lth data dimension, the Kth data dimension being a data dimension ranked in the Kth position in a data dimension sequence, the Lth data dimension being a data dimension ranked in the Lth position in the data dimension sequence, the data dimension sequence including M data dimensions, K and L being any positive integer less than or equal to M, the plurality of data dimensions being included in the data dimension sequence, and M being a positive integer greater than 1;

[0167] determine weight data of each data dimension in the M data dimensions according to the weight determination matrix.

[0168] In a possible implementation, when the processor 801 determines the weight data of each data dimension in the M data dimensions according to the weight determination matrix by running the executable program code in the memory 803, the processor 801 is specifically configured to perform the following steps:

[0169] adding the element values of each column in the weight determination matrix respectively, and generating a first matrix according to the addition results of the columns;

[0170] adding the element values of each row in the weight determination matrix respectively, and generating a second matrix according to the addition results of the rows;

[0171] determining the weight data of each data dimension in the M data dimensions according to the first matrix and the second matrix.

[0172] In a possible implementation, when the processor 801 determines the evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result by running the executable program code in the memory 803, the processor 801 is specifically configured to perform the following steps:

[0173] determining first weight data corresponding to the object category of the to-be-evaluated object, second weight data corresponding to the first abnormality determination result, and third weight data corresponding to the second abnormality determination result respectively;

[0174] determining the evaluation result of the to-be-evaluated object according to the first weight data, the second weight data, and the third weight data.

[0175] According to an aspect of the present application, a computer program product is provided, which includes a computer program stored in a computer readable storage medium. A processor of a computer device reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the computer device performs the data processing method provided in the various optional manners described above.

[0176] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited to the action sequence described, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions and modules involved are not necessarily necessary for the present application.

[0177] In several embodiments provided in the present application, it should be understood that the disclosed apparatus can be implemented in other manners. For example, the division of the above-described apparatus embodiments is merely a logical function division, and there can be another division manner for the actual implementation, for example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In this way, the actual implementation can be divided into other forms.

[0178] The above descriptions are merely specific embodiments of the present application, but the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data processing method, characterized by, The method comprises: obtaining association data associated with an object to be evaluated, the association data comprising object feature data of the object to be evaluated, target interface call data and management data; the target interface call data is interface call data of the object to be evaluated in a business operation process through a business platform; the management data is data generated by management of the object to be evaluated; performing clustering processing on the object to be evaluated according to the object feature data to obtain a clustering result of the object to be evaluated, the clustering result being used to indicate an object category of the object to be evaluated; determining a target similarity between the target interface call data and reference interface call data, and determining a first abnormality determination result of the object to be evaluated according to the target similarity; the reference interface call data is interface call data of an abnormal object in a business operation process through the business platform; performing abnormality determination processing on the object to be evaluated according to the management data to obtain a second abnormality determination result of the object to be evaluated; determining an evaluation result of the object to be evaluated according to the object category of the object to be evaluated, the first abnormality determination result and the second abnormality determination result.

2. The method of claim 1, wherein, The clustering processing on the object to be evaluated according to the object feature data comprises: obtaining object feature data of a plurality of reference objects; constructing a multi-dimensional relationship graph according to the object feature data of the object to be evaluated and the object feature data of the plurality of reference objects; determining a weight between any two objects of the object to be evaluated and the plurality of reference objects according to the multi-dimensional relationship graph; performing clustering processing on the plurality of reference objects and the object to be evaluated according to the weight between any two objects of the object to be evaluated and the plurality of reference objects to obtain respective clustering results of the plurality of reference objects and the object to be evaluated.

3. The method of claim 1, wherein, The interface call data comprises an interface type and an interface call time of a called interface, the reference interface call data is contained in an interface call data set, the interface call data set comprises a plurality of reference interface call data; the determination of the target similarity between the target interface call data and the reference interface call data comprises: determining a similarity between the target interface call data and each reference interface call data in the interface call data set according to the interface type and the interface call time of the called interface included in the interface call data; selecting a maximum similarity from the determined plurality of similarities, and determining the maximum similarity as the target similarity between the target interface call data and the reference interface call data.

4. The method of claim 3, wherein, The determination of the first abnormality determination result of the object to be evaluated according to the target similarity comprises: comparing the target similarity with a similarity threshold to obtain a comparison result; If the comparison result indicates that the target similarity is greater than a similarity threshold, a first abnormality determination result of the to-be-evaluated object is determined as an object abnormality determination result, which is used to indicate that the to-be-evaluated object is an object with an abnormal interface call; If the comparison result indicates that the target similarity is less than or equal to the similarity threshold, the first abnormality determination result of the to-be-evaluated object is determined as an object normality determination result, which is used to indicate that the to-be-evaluated object is an object with a normal interface call.

5. The method of claim 1, wherein, The management data includes management data in multiple data dimensions, and the abnormality determination processing of the to-be-evaluated object based on the management data obtains a second abnormality determination result of the to-be-evaluated object, including: obtaining weight data of each data dimension in the multiple data dimensions; performing weighted processing on the management data in each data dimension by using the weight data of the data dimension, to obtain weighted management data in each data dimension; determining the second abnormality determination result of the to-be-evaluated object based on the weighted management data in each data dimension.

6. The method of claim 5, wherein, The method further includes: obtaining a weight determination matrix, an element value in the Kth row and the Lth column of the weight determination matrix being used to indicate the importance of the Kth data dimension relative to the Lth data dimension, the Kth data dimension being a data dimension ranked in the Kth position in a data dimension sequence, the Lth data dimension being a data dimension ranked in the Lth position in the data dimension sequence, the data dimension sequence including M data dimensions, K and L being any positive integer less than or equal to M, the multiple data dimensions being included in the data dimension sequence, and M being a positive integer greater than 1; determining the weight data of each data dimension in the M data dimensions based on the weight determination matrix.

7. The method of claim 6, wherein, The determination of the weight data of each data dimension in the M data dimensions based on the weight determination matrix includes: adding element values in each column of the weight determination matrix respectively, and generating a first matrix based on the addition results of the columns; adding element values in each row of the weight determination matrix respectively, and generating a second matrix based on the addition results of the rows; determining the weight data of each data dimension in the M data dimensions based on the first matrix and the second matrix.

8. The method according to any one of claims 1 to 7, characterized in that, The determination of the evaluation result of the to-be-evaluated object based on the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result includes: determining first weight data corresponding to the object category of the to-be-evaluated object, second weight data corresponding to the first abnormality determination result, and third weight data corresponding to the second abnormality determination result respectively; determining the evaluation result of the to-be-evaluated object based on the first weight data, the second weight data, and the third weight data.

9. A data processing apparatus, characterized by, The apparatus includes: An acquisition unit is configured to acquire association data associated with a to-be-evaluated object, the association data including object feature data of the to-be-evaluated object, target interface call data, and management data; the target interface call data is interface call data of the to-be-evaluated object in a process of performing a business operation through a business platform; and the management data is data generated by management of the to-be-evaluated object. A processing unit is configured to perform clustering processing on the to-be-evaluated object according to the object feature data, to obtain a clustering result of the to-be-evaluated object, the clustering result being used to indicate an object category of the to-be-evaluated object. A determination unit is configured to determine a target similarity between the target interface call data and reference interface call data, and determine a first abnormality determination result of the to-be-evaluated object according to the target similarity; the reference interface call data is interface call data of an abnormal object in a process of performing a business operation through the business platform. The processing unit is further configured to perform abnormality determination processing on the to-be-evaluated object according to the management data, to obtain a second abnormality determination result of the to-be-evaluated object. The determination unit is further configured to determine an evaluation result of the to-be-evaluated object according to the object category of the to-be-evaluated object, the first abnormality determination result, and the second abnormality determination result.

10. A computer device, comprising: The computer device includes: a processor adapted to implement one or more computer programs; and a computer-readable storage medium storing one or more computer programs, the one or more computer programs being adapted to be loaded and executed by the processor to perform the data processing method according to any one of claims 1-8.

11. A computer readable storage medium, characterized in that, The computer-readable storage medium stores one or more computer programs, the one or more computer programs being adapted to be loaded and executed by the processor to perform the data processing method according to any one of claims 1-8.

12. A computer program product, characterised in that, The computer program product includes a computer program stored in a computer-readable storage medium, and a processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the data processing method according to any one of claims 1-8.

Images