Group identification method and system and related equipment

Abstract

The invention provides a group identification method, a group identification system and related equipment. The method comprises the following steps: acquiring access information of a group from a first platform; filtering the access information of the group based on a regular expression rule base to obtain the access information of an initial abnormal group; adding the corresponding initial abnormal group through the access information of the initial abnormal group; determining an activeness index of the initial abnormal group; and determining whether the initial abnormal group is an abnormal group based on the activeness index. Wherein the regular expression rule base is constructed based on uniform resource locator format features and group identification modes of known abnormal groups. The method can improve the efficiency of identifying the abnormal group.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a group identification method, system, and related equipment. Background Technology

[0002] With the development of network technology, identifying anomalous groups to ensure network security has become a hot topic. The current process for identifying anomalous groups includes: staff obtaining information on suspected anomalous groups through manual searches or informant reports, joining these suspected groups based on the information, and then the system monitoring these suspected anomalous groups to determine whether they are indeed anomalous.

[0003] However, this method relies on human experience and is limited by the number of personnel and working hours, resulting in low efficiency in identifying anomalous groups. Therefore, improving the efficiency of anomalous group identification is a problem. Summary of the Invention

[0004] This application provides a group identification method, system, and related equipment, which can improve the efficiency of identifying abnormal groups.

[0005] In a first aspect, embodiments of this application provide a group identification method. The method includes: an electronic device obtaining access information of a group from a first platform, and filtering the access information based on a regular expression rule base to obtain access information of an initial abnormal group; the electronic device joining the corresponding initial abnormal group using the access information of the initial abnormal group; the electronic device determining the activity index of the initial abnormal group, and determining whether the initial abnormal group is an abnormal group based on the activity index. The regular expression rule base is constructed based on the known Uniform Resource Locator (URL) format features and group identification patterns of abnormal groups.

[0006] As can be seen, the embodiments of this application can determine whether a group is an abnormal group by obtaining the group's access information, filtering the group's access information, joining the group, and determining the group's activity level. Compared with the manual group identification method, this method does not rely on human experience and is not limited by the number of personnel and working hours, which can improve the efficiency of identifying abnormal groups.

[0007] In one optional implementation, the electronic device joins the corresponding initial abnormal group based on the access information of the initial abnormal group. Specifically, it determines the verification code required to join the corresponding initial abnormal group based on the access information of the initial abnormal group, and joins the corresponding initial abnormal group based on the verification code.

[0008] In this implementation, the electronic device can simulate user behavior: determine the verification code and join the initial abnormal group based on the verification code. This helps to replace manual operation, reduce the time for joining a single group from minutes to seconds, increase the daily processing capacity to thousands of groups, and improve the response speed to newly added initial abnormal groups.

[0009] In one optional implementation, the electronic device calculates the anomaly probability of the corresponding initial anomaly group based on a natural language processing model and the access information of the initial anomaly group; based on the anomaly probability of the initial anomaly group, the electronic device determines whether the initial anomaly group is a high-confidence anomaly group; if the initial anomaly group is a high-confidence anomaly group, the electronic device performs the step of joining the corresponding initial anomaly group through the access information of the initial anomaly group. Here, a high-confidence anomaly group is an initial anomaly group whose anomaly probability is greater than or equal to a first threshold.

[0010] In this embodiment, the electronic device calculates the anomaly probability to filter the initial anomaly group and then determines the high-confidence anomaly group. This is beneficial for the electronic device to join the high-confidence anomaly group with a high anomaly probability, thereby reducing the identification of groups with a low anomaly probability and reducing resource consumption.

[0011] In one alternative implementation, the natural language processing model is trained based on fields in the links of known outlier groups, the basic attributes of known outlier groups, and the classification labels of known outlier groups.

[0012] In one optional implementation, the activity metrics include message frequency, topic concentration, and user interaction rate. The electronic device determines whether an initial abnormal group is an abnormal group based on these activity metrics. Specifically, this involves: determining the feature vector of the initial abnormal group based on message frequency, topic concentration, and user interaction rate; calculating the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center; and determining whether the initial abnormal group is an abnormal group based on the Euclidean distance. The first cluster center is a center obtained based on a clustering model used to classify the activity level of groups.

[0013] In this implementation, electronic devices quantify the abnormal attributes of the initial abnormal group through multi-dimensional activity indicators (such as message frequency, topic concentration, and user interaction rate) to distinguish between abnormal groups and normal groups, thereby helping to reduce resource waste and improve resource utilization.

[0014] In an optional implementation, if the initial abnormal group is an abnormal group, the electronic device further performs the following steps: extracting the member behavior feature vector of the abnormal group, and identifying the group associated with the abnormal group based on the member behavior feature vector, wherein the member behavior feature vector includes one or more of the following: the time distribution of members sending messages, keyword frequency inverse document frequency, and connection strength.

[0015] In this implementation, groups associated with abnormal groups are identified based on the member behavior feature vectors of abnormal groups, which helps to discover groups associated with abnormal groups, thereby expanding the scope of identification and ensuring network security.

[0016] Secondly, embodiments of this application provide a group identification system, the system comprising: The group joining module is used to obtain group access information from the first platform; The group joining module is also used to filter the access information of groups based on the regular expression rule base to obtain the access information of the initial abnormal groups. The regular expression rule base is built based on the Uniform Resource Locator format features of known abnormal groups and group identification patterns. The group joining module is also used to join the corresponding initial abnormal group based on the access information of the initial abnormal group; The activity assessment module is used to determine the activity metrics of the initial abnormal groups; The activity assessment module is also used to determine whether an initial abnormal group is an abnormal group based on activity metrics.

[0017] Optionally, the group joining module can join the corresponding initial abnormal group based on the access information of the initial abnormal group, specifically: Based on the access information of the initial abnormal group, determine the verification code required to join the corresponding initial abnormal group; Based on the verification code, add the user to the corresponding initial abnormal group.

[0018] Optionally, the group joining module is also used to calculate the anomaly probability of the corresponding initial anomaly group based on the access information of the natural language processing model and the initial anomaly group. The group addition module is also used to determine whether the initial abnormal group is a high-confidence abnormal group based on the abnormal probability of the initial abnormal group. A high-confidence abnormal group is an initial abnormal group whose abnormal probability is greater than or equal to a first threshold. If the initial abnormal group is a high-confidence abnormal group, the group joining module is also used to join the corresponding initial abnormal group based on the access information of the initial abnormal group.

[0019] Optionally, the natural language processing model is trained based on the fields in the links of known outlier groups, the basic attributes of known outlier groups, and the classification labels of known outlier groups.

[0020] Optional activity metrics include message frequency, topic concentration, and user interaction rate. The group joining module uses these activity metrics to determine whether an initial abnormal group is indeed an abnormal group. Specifically: Based on message frequency, topic concentration, and user interaction rate, the feature vector of the initial abnormal group is determined. Calculate the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center, which is the center obtained based on the clustering model to divide the activity level of the group; Based on Euclidean distance, determine whether the initial outlier group is an outlier group.

[0021] Optionally, if the initial abnormal group is an abnormal group, the extension module is used to extract the member behavior feature vector of the abnormal group. The member behavior feature vector includes one or more of the following: the time distribution of members sending messages, keyword frequency inverse document frequency, and connection strength. Based on member behavior feature vectors, identify groups associated with abnormal groups.

[0022] Thirdly, embodiments of this application provide an information processing apparatus, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the method described above.

[0023] Fourthly, this application also provides a computer storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above.

[0024] Fifthly, this application also provides a computer program product containing instructions that, when executed on an information processing device, implement the steps of the method described above. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0026] Figure 1 A flowchart illustrating a group identification method provided in an embodiment of this application; Figure 2 A flowchart illustrating another group identification method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a group identification system provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an information processing device provided in an embodiment of this application. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0028] It should be understood that the terms "comprising" or "including" indicate the presence of the said feature, step, operation, element, component, item, type, and / or group, but do not exclude the presence, occurrence, or addition of one or more other features, steps, operations, elements, components, items, types, and / or groups.

[0029] It should be understood that although the steps in the flowcharts of this application's embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0030] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0031] Information about initial abnormal groups can be obtained manually by staff or through informant reports. Based on this information, staff complete the group entry verification and join the initial abnormal group. For example, staff search for keywords such as "part-time job," "brushing," and "investment" on platforms like Telegram and the dark web to obtain information about initial abnormal groups. Based on this information, staff enter a verification code to join the initial abnormal group.

[0032] However, the above method is a "passive discovery" approach, and this manual method of discovering abnormal groups is time-consuming (e.g., it takes about 5-10 minutes for a single group to join), and is limited by the number of staff (e.g., a single team can only handle about 50-100 groups per day). Given that thousands of abnormal groups are added daily on platforms such as Telegram and the dark web, this method cannot cover new groups in a timely manner, resulting in a large number of abnormal groups going undetected and a high rate of missed detections.

[0033] This application proposes a group identification method that does not rely on human experience and is not limited by the number of personnel or working hours. It can reduce the missed detection rate of groups and improve the efficiency of identifying abnormal groups.

[0034] The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0035] Please see Figure 1 , Figure 1 This is a flowchart illustrating a group identification method provided in an embodiment of this application. The method is illustrated using an application to an electronic device as an example. Figure 1 As shown, the method includes, but is not limited to, the following steps: S101. The electronic device obtains the group access information from the first platform.

[0036] Optionally, S101 includes: the electronic device obtaining the group's access information from the first platform based on a web crawler. Here, a web crawler refers to a program or script used to retrieve the group's access information; for example, a web crawler could be the Scrapy framework.

[0037] Optionally, the first platform can be Telegram or the dark web; this application embodiment does not limit the type of the first platform. The dark web refers to a network platform that provides anonymous communication for users.

[0038] S102. The electronic device filters the access information of the group based on the regular expression rule base to obtain the access information of the initial abnormal group.

[0039] Optionally, the initial abnormal group can be understood as a group suspected of being involved in fraud.

[0040] Optionally, the group access information includes the group's link. Correspondingly, the access information for the initial abnormal group includes the link to the initial abnormal group. Optionally, the group access information also includes one or more of the following: group name, number of group members, message records, or member behavior logs. Correspondingly, the access information for the initial abnormal group also includes one or more of the following: group name, number of group members, message records, or member behavior logs. Message records may include message text and the corresponding timestamp.

[0041] In one optional implementation, S102 includes: the electronic device filtering out access information of normal groups from the access information of the groups based on a regular expression rule base to obtain the access information of the initial abnormal groups. For example, normal groups are industry communication groups or normal social groups. This method can reduce the scope of subsequent abnormal group identification and reduce resource consumption.

[0042] The regular expression rule base is built based on the Uniform Resource Locator (URL) format features and identity document (ID) patterns of known anomalous groups. Known anomalous groups can be understood as historically fraudulent groups or known fraudulent groups.

[0043] In one alternative implementation, before the electronic device executes S102, a regular expression rule base is constructed based on the URL format characteristics and group ID patterns of known abnormal groups.

[0044] Taking the URL format characteristics of known abnormal groups as ^t\.me / [\w_-]+, and the group ID of known abnormal groups containing the keywords "fake" or "scam" as an example, the electronic device constructs a regular expression rule library based on the URL format characteristics and group ID patterns of known abnormal groups to match strings that start with t\.me, contain arbitrary content in the middle, and end with "fake" or "scam".

[0045] Optionally, the electronic device uses a pre-trained natural language processing (NLP) model and named entity recognition (NER) to extract group link keywords, platform identifiers, and risk markers from the access information of known anomalous groups, in order to determine the URL format characteristics and group ID patterns of the known anomalous groups. The pre-trained NLP model can be a qwen model or a bidirectional encoder representations from transformers (BERT) model.

[0046] For example, electronic devices can extract group link keywords such as "join group", "enter group", and "invitation code" from the access information of known abnormal groups through pre-trained natural language processing models and named entity recognition. These group link keywords are used to determine the URL format characteristics and group ID patterns of known abnormal groups.

[0047] For example, electronic devices can extract platform identifiers such as "t.me" and ".onion" from the access information of known abnormal groups using pre-trained natural language processing models and named entity recognition. These platform identifiers are used to determine the URL format characteristics and group ID patterns of known abnormal groups.

[0048] For another example, an electronic device extracts risk identification words such as "advance payment", "cashback", and "earn one thousand yuan a day" from the access information of known abnormal groups through a pre-trained natural language processing model and named entity recognition. These risk identification words are used to determine the URL format features and group ID patterns of the known abnormal groups.

[0049] Optionally, before the electronic device extracts group link keywords, platform identifiers, and risk identification words from the access information of known abnormal groups through a pre-trained natural language processing model and named entity recognition to determine the URL format features and group ID patterns of the known abnormal groups, the electronic device performs noise cleaning on the access information of the known abnormal groups based on a regular expression. For example, the electronic device filters out information related to traffic generation or document handling in the access information of the known abnormal groups based on the regular expression r'generate traffic on behalf of others|handle documents on behalf of others'. This approach helps to reduce the interference of invalid information.

[0050] Among them, the access information of the known abnormal groups can be obtained by the electronic device based on a web crawler from the first platform.

[0051] S103. The electronic device joins the corresponding initial abnormal group through the access information of the initial abnormal group.

[0052] Optionally, S103 includes: the electronic device determines the verification code required to join the corresponding initial abnormal group based on the access information of the initial abnormal group; the electronic device joins the corresponding initial abnormal group based on the verification code.

[0053] When the access information of the initial abnormal group includes the link of the initial abnormal group, the electronic device determines the verification code required to join the corresponding initial abnormal group based on the access information of the initial abnormal group, including: the electronic device opens the link of the initial abnormal group based on a driven browser or an application programming interface (API); the electronic device calls an identification verification code model to determine the verification code required to join the corresponding initial abnormal group. For example, the driven browser can be a selenium-driven browser, and the identification verification code model can be an optical character recognition (OCR) model.

[0054] In one optional implementation, the electronic device calculates the anomaly probability of the corresponding initial anomaly group based on a natural language processing model and the access information of the initial anomaly group; the electronic device determines whether the initial anomaly group is a high-confidence anomaly group based on the anomaly probability of the initial anomaly group; and the electronic device executes the operation described in S103 if the initial anomaly group is a high-confidence anomaly group. In this method, the electronic device determines whether the initial anomaly group is a high-confidence anomaly group based on the anomaly probability, so the electronic device only executes the operation in S103 if the initial anomaly group is a high-confidence anomaly group, which can reduce resource waste.

[0055] Optionally, the electronic device calculates the anomalous probability of the corresponding initial anomalous group based on the access information of the natural language processing model and the initial anomalous group, including: the electronic device uses the access information of the initial anomalous group as input to the natural language processing model to obtain the anomalous probability of the initial anomalous group.

[0056] A high-confidence anomaly group is an initial anomaly group whose anomaly probability is greater than or equal to a first threshold. For example, the first threshold can be set to 0.8, and this application does not limit the range of the first threshold. Here, the anomaly probability can be understood as the probability of fraud, and the high-confidence anomaly group can be understood as a group with a relatively high probability of fraud.

[0057] The natural language processing model is trained based on fields in the links of known abnormal groups, the basic attributes of known abnormal groups, and the classification labels of known abnormal groups. Optionally, the basic attributes of known abnormal groups include one or more of the following: number of group members, average daily number of messages. Optionally, the classification labels of known abnormal groups include any of the following: fraudulent order group, investment group.

[0058] S104. Electronic devices determine the activity index of the initial abnormal group.

[0059] The activity metrics include message frequency, topic concentration, and user interaction rate.

[0060] Message frequency refers to the number of group messages per unit of time. Electronic devices can determine the message frequency of initial abnormal groups using the following formula (1): (1) The message frequency is represented by F. The number of messages within a time window T constructed for an electronic device; for example, the time window T can be 1 hour.

[0061] Topic concentration refers to the degree of concentration of group topics based on information entropy. Electronic devices can determine the topic concentration of initial anomalous groups using the following formula (2): (2) The degree of topic concentration is represented by H. For the first The probability of occurrence of each keyword This represents the total number of keywords.

[0062] User interaction rate refers to the level of activity in the interactions among members of the initial abnormal group. Electronic devices can determine the user interaction rate of the initial abnormal group using the following formula (3): (3) In this context, user interaction rate is represented by I. Number of replies For the number of reposts, The number of messages within a time window T constructed for an electronic device.

[0063] S105. Electronic devices determine whether the initial abnormal group is an abnormal group based on activity indicators.

[0064] In one optional implementation, S105 includes: the electronic device determining the feature vector of the initial abnormal group based on message frequency, topic concentration and user interaction rate; calculating the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center; and determining whether the initial abnormal group is an abnormal group based on the Euclidean distance.

[0065] Optionally, the electronic device determines the feature vector of the initial abnormal group based on message frequency, topic concentration, and user interaction rate, including: the electronic device constructs a feature vector (F, H, I) based on message frequency F, topic concentration H, and user interaction rate I.

[0066] The first cluster center is the center used to classify the activity level of groups based on the clustering model. In other words, before the electronic device executes S105, it needs to determine the first cluster center used to classify the activity level of groups based on the clustering model.

[0067] Optionally, the electronic device determines the first cluster center for classifying group activity levels based on a clustering model. This includes: the electronic device constructs a feature vector (F, H, I) from the message frequency F, topic concentration H, and user interaction rate I of known abnormal groups as input to the clustering model, and sets the number of clusters in the clustering model to 3, resulting in the first, second, and third cluster centers. The first cluster center corresponds to high-value groups, the second cluster center to medium-value groups, and the third cluster center to low-value groups. High-value groups can be understood as groups that can provide key clues or breakthroughs for solving cases and recovering losses for the public, and are the focus of investigation and monitoring.

[0068] In the execution of S105 by the electronic device, the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center can be calculated using the following formula (4): (4) Wherein, the Euclidean distance between the feature vector of the initial outlier group and the first cluster center is used express, The feature vector of the initial abnormal group. The feature vector of the first cluster center.

[0069] Optionally, the electronic device determines whether the initial abnormal group is an abnormal group based on Euclidean distance, including: the electronic device determines the initial abnormal group as an abnormal group if the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center is less than or equal to a second threshold.

[0070] In addition, electronic devices can also use formula (5) to calculate the error rate: (5) Among them, the false addition rate refers to the proportion of the number of normal groups joined by electronic devices to the total number of groups joined by electronic devices. The number of normal groups is the number of groups that electronic devices initially joined based on activity indicators, which were not abnormal groups. The total number of groups joined is the number of groups that electronic devices initially joined from abnormal groups.

[0071] Electronic devices can also use formula (6) to calculate the success rate of joining a group: (6) Among them, the group joining success rate refers to the proportion of the number of groups that the electronic device successfully joins to the number of groups that the electronic device attempts to join, the number of successful group joining is the number of initial abnormal groups that the electronic device successfully joins, and the number of attempts to join is the total number of initial abnormal groups that the electronic device actively initiates.

[0072] Optionally, electronic devices can adjust the keyword weights of the pre-trained natural language model based on the false addition rate and adjust the regular expression rule base based on the daily group joining success rate, thereby improving the accuracy of identifying abnormal groups. For example, electronic devices can reduce the weight of "industry communication" in the pre-trained natural language model based on the false addition rate. Another example is that, in response to a low daily group joining success rate, electronic devices can add URL patterns for new platforms.

[0073] Optionally, electronic devices can also optimize clustering models based on reinforcement learning. For example, electronic devices can adjust the weights of message frequencies in the clustering model based on the proximal policy optimization (PPO) algorithm to optimize the results of the clustering model and thus improve the accuracy of identifying anomalous groups.

[0074] As can be seen, the embodiments of this application can determine whether a group is an abnormal group by obtaining the group's access information, filtering the group's access information, joining the group, and determining the group's activity level. Compared with the manual group identification method, this method does not rely on human experience and is not limited by the number of personnel and working hours, which can improve the efficiency of abnormal group identification.

[0075] Furthermore, in this embodiment, the electronic device constructs a feature vector based on the message frequency, topic concentration, and user interaction rate of the initial abnormal group to determine whether the initial abnormal group is an abnormal group. Compared to the method by which the electronic device determines group activity based on the relationship between basic group indicators (such as the number of group messages, the average number of group messages per day, and the member growth rate) and a threshold, this application can distinguish between "truly high-activity abnormal groups" and "normal groups temporarily added to increase the number of members." For example, in the method by which the electronic device determines group activity based on the relationship between basic group indicators and a threshold, if the electronic device determines that the group is a truly high-activity abnormal group when the average number of group messages per day is greater than 100, this may lead to normal social groups being misjudged as "high-activity abnormal groups" due to high-frequency messages, while high-value abnormal groups (such as abnormal groups with hidden members and obscure language) are not marked due to the small number of messages. As a result, staff need to spend a lot of time verifying invalid targets, resulting in a waste of resources.

[0076] Furthermore, in this embodiment, the electronic device determines whether an initial abnormal group is an abnormal group by calculating the Euclidean distance between the feature vector of the initial abnormal group and the feature vector of the first cluster center. Compared to the method of using a keyword library to perform text matching on messages of the initial abnormal group, this application can reduce the probability of normal social groups (such as industry exchange groups) being mislabeled and abnormal groups being missed. For example, the method of using a keyword library to perform text matching on messages of the initial abnormal group can only identify content that is completely consistent with known abnormal phrases (such as "advance payment", "cashback", "earn thousands of yuan a day"), lacking in-depth analysis of the abnormal attributes of the group (such as member interaction patterns and the correlation of phrase content), resulting in a high probability of abnormal groups being missed.

[0077] Please see Figure 2 , Figure 2 This is a flowchart illustrating another group identification method provided in an embodiment of this application. Figure 2 The illustrated embodiment is compared to Figure 1 In the illustrated embodiment, after executing S105, the electronic device may also execute S106 and S107, thus enabling the electronic device to identify groups associated with the abnormal groups even when the initial abnormal group is an abnormal group. Figure 2 As shown, the method also includes the following steps: S106. Extract the member behavior feature vector of the abnormal group from the electronic device.

[0078] In one optional implementation, the member behavior feature vector includes one or more of the following: the time distribution of messages sent by members, the term frequency-inverse document frequency (TF-IDF) of keywords, and the strength of connection. For example, electronic devices extract the proportion of messages sent by members of abnormal groups between 8 PM and midnight. Another example is that electronic devices extract a TF-IDF of 0.8 for "brushing orders" and 0.6 for "part-time job" in abnormal groups. Yet another example is the number of private messages exchanged between members of abnormal groups and other members within the group.

[0079] In one optional implementation, the electronic device analyzes the behavioral feature vectors of members of the abnormal group based on the apriori algorithm and generates association rules. For example, based on the apriori algorithm, the electronic device determines that the support of the itemset {nighttime activity, keywords for fraudulent orders} is 0.35 and the confidence is 0.8, then generates a rule with an anomaly probability of 0.8 for nighttime activity and the inclusion of keywords for fraudulent orders.

[0080] S107. Electronic devices identify groups associated with abnormal groups based on member behavior feature vectors.

[0081] Among them, the groups associated with the abnormal group can be different branch groups of the abnormal group.

[0082] In one optional implementation, S107 includes: the electronic device extracting the member behavior feature vectors of the unidentified group, calculating the cosine similarity between the member behavior feature vectors of the unidentified group and the member behavior feature vectors of the abnormal group, and determining that the unidentified group is associated with the abnormal group if the cosine similarity is greater than or equal to a fourth threshold. The fourth threshold can be set to 0.8, and the range of values ​​for the fourth threshold is not limited in this embodiment.

[0083] Optionally, the electronic device performs operations S102-S105 if it determines that the unidentified group is associated with the abnormal group. This method helps the electronic device determine whether the unidentified group is an abnormal group, so as to achieve full-chain coverage of the abnormal network.

[0084] Among them, the cosine similarity between the member behavior feature vector of the unidentified group and the member behavior feature vector of the abnormal group can be calculated by the following formula (7): (7) Cosine similarity is used express, This represents the behavioral feature vector of members of the abnormal group. This represents the behavioral feature vector of members of an unidentified group.

[0085] As can be seen, in this embodiment of the application, the electronic device can identify groups associated with abnormal groups based on the member behavior feature vectors of abnormal groups. Compared with the method of discovering new groups associated with known abnormal groups based on known abnormal groups and manual expansion, this embodiment of the application can expand the scope of abnormal group identification, improve the efficiency of abnormal group identification, and ensure network security.

[0086] Please see Figure 3 , Figure 3 This is a schematic diagram of a group identification system provided in an embodiment of this application. The group identification system includes at least a group joining module 301, an activity assessment module 302, and an extension module 303, wherein: The group joining module 301 is used to obtain group access information from the first platform.

[0087] The group joining module 301 includes a regular expression matching filter. The regular expression matching filter is used to filter the access information of the group based on the regular expression rule base to obtain the access information of the initial abnormal group. The regular expression rule base is built based on the Uniform Resource Locator format features of known abnormal groups and the group identification pattern.

[0088] The group joining module 301 also includes a group joining executor, which is used to join the corresponding initial abnormal group based on the access information of the initial abnormal group.

[0089] The activity assessment module 302 includes a multi-dimensional indicator calculation submodule, which is used to determine the activity indicators of the initial abnormal group.

[0090] The activity assessment module 302 also includes a clustering submodule, which is used to determine whether the initial abnormal group is an abnormal group based on the activity index.

[0091] Optionally, the group joining executor is used to join the corresponding initial exception group based on the access information of the initial exception group, specifically: Based on the access information of the initial abnormal group, determine the verification code required to join the corresponding initial abnormal group; Based on the verification code, join the corresponding initial abnormal group.

[0092] Optionally, the group joining module 301 is also used for: Based on the natural language processing model and the access information of the initial abnormal group, the abnormal probability of the corresponding initial abnormal group is calculated. Based on the anomaly probability of the initial anomaly group, determine whether the initial anomaly group is a high-confidence anomaly group, wherein a high-confidence anomaly group is an initial anomaly group whose anomaly probability is greater than or equal to a first threshold. If the initial abnormal group is a high-confidence abnormal group, the step of joining the corresponding initial abnormal group is executed using the access information of the initial abnormal group.

[0093] Optionally, the clustering submodule is used to determine whether an initial abnormal group is an abnormal group based on an activity metric, specifically: Based on message frequency, topic concentration, and user interaction rate, the feature vector of the initial abnormal group is determined. Calculate the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center, which is the center obtained based on the clustering model to divide the activity level of the group; Based on Euclidean distance, determine whether the initial outlier group is an outlier group.

[0094] Extension module 303 includes a member behavior feature extraction submodule. This submodule is used to extract member behavior feature vectors from an initial abnormal group, and to identify groups associated with the abnormal group based on these vectors. The member behavior feature vectors include one or more of the following: the time distribution of messages sent by members, keyword frequency inverse document frequency, and connection strength.

[0095] The embodiments of this application and the method embodiments shown above are based on the same concept and have the same technical effects. For the specific principles, please refer to the description of the embodiments shown above, which will not be repeated here.

[0096] Please see Figure 4 , Figure 4 This is a schematic diagram of an information processing device provided in an embodiment of this application. The information processing device includes at least a processor 401 and a memory 402, wherein the memory 402 is used to store computer programs, and the processor 401 is used to execute the computer programs stored in the memory 402.

[0097] Memory 402 may include volatile memory, such as random-access memory (RAM); memory 402 may also include non-volatile memory, such as flash memory, solid-state drive (SSD), etc.; memory 402 may also include a combination of the above types of memory.

[0098] Processor 401 may be a central processing unit (CPU). Processor 401 may further include hardware chips. The aforementioned hardware chips may be application-specific integrated circuits (ASICs), programmable logic devices (PLDs), etc. The aforementioned PLDs may be field-programmable gate arrays (FPGAs), generic array logic (GALs), etc.

[0099] Processor 401 is used to perform the following steps: Obtain group access information from the first platform; Based on the regular expression rule base, the access information of the group is filtered to obtain the access information of the initial abnormal group. The regular expression rule base is built based on the Uniform Resource Locator format features and group identification patterns of known abnormal groups. Join the corresponding initial abnormal group based on the access information of the initial abnormal group; Determine the activity metrics for the initial abnormal groups; Based on activity metrics, determine whether the initial abnormal group is an abnormal group.

[0100] Optionally, processor 401 is also used to perform the following steps: Based on the natural language processing model and the access information of the initial abnormal group, the abnormal probability of the corresponding initial abnormal group is calculated. Based on the anomaly probability of the initial anomaly group, determine whether the initial anomaly group is a high-confidence anomaly group. A high-confidence anomaly group is an initial anomaly group whose anomaly probability is greater than or equal to the first threshold. If the initial anomaly group is a high-confidence anomaly group, the steps are to join the corresponding initial anomaly group based on the access information of the initial anomaly group.

[0101] Optionally, the natural language processing model is trained based on the fields in the links of known outlier groups, the basic attributes of known outlier groups, and the classification labels of known outlier groups.

[0102] Optional activity metrics include message frequency, topic concentration, and user interaction rate. Processor 401 uses these activity metrics to determine whether the initial abnormal group is indeed an abnormal group, specifically: Based on message frequency, topic concentration, and user interaction rate, the feature vector of the initial abnormal group is determined. Calculate the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center, which is the center obtained based on the clustering model to divide the activity level of the group; Based on Euclidean distance, determine whether the initial outlier group is an outlier group.

[0103] Optionally, if the initial exception group is an exception group, the processor 401 is also configured to perform the following steps: Extract the member behavior feature vector of the abnormal group. The member behavior feature vector includes one or more of the following: the time distribution of members sending messages, keyword frequency and inverse document frequency, and the strength of connection. Based on member behavior feature vectors, identify groups associated with abnormal groups.

[0104] The embodiments of this application and the method embodiments shown above are based on the same concept and have the same technical effects. For the specific principles, please refer to the description of the embodiments shown above, which will not be repeated here.

[0105] This application also provides a computer-readable storage medium storing a detection program, which, when executed by a processor, implements the steps of a group identification method in any of the above embodiments.

[0106] The embodiments of the electronic device and computer-readable storage medium provided in this application include all the technical features of the above-described group identification method embodiments. The extended and explanatory content of the specification is basically the same as the embodiments of the above method, and will not be repeated here.

[0107] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0108] The steps in the method of this application embodiment can be adjusted, combined, or deleted according to actual needs.

[0109] The units in the device of this application embodiment can be merged, divided, and deleted according to actual needs.

[0110] In this application, the same or similar terms, concepts, technical solutions and / or application scenario descriptions are generally described in detail only when they appear for the first time. When they appear again, they are generally not repeated for the sake of brevity. When understanding the technical solutions and other contents of this application, the same or similar terms, concepts, technical solutions and / or application scenario descriptions that are not described in detail later can be referred to their previous relevant detailed descriptions.

[0111] In this application, the descriptions of the various embodiments have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] The technical features of the present application can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of the present application.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, controlled terminal, or network device, etc.) to execute the methods of each embodiment of this application.

[0114] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, storage disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., SSD), etc.

[0115] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A group identification method, characterized in that, The method includes: Obtain group access information from the first platform; Based on a regular expression rule base, the access information of the group is filtered to obtain the access information of the initial abnormal group. The regular expression rule base is constructed based on the Uniform Resource Locator (URL) format features and group identifier patterns of known abnormal groups. Join the corresponding initial abnormal group based on the access information of the initial abnormal group; Determine the activity index of the initial abnormal group; Based on the activity index, determine whether the initial abnormal group is an abnormal group.

2. The method according to claim 1, characterized in that, The step of joining the corresponding initial anomaly group using the access information of the initial anomaly group includes: Based on the access information of the initial abnormal group, determine the verification code required to join the corresponding initial abnormal group; Based on the verification code, join the corresponding initial abnormal group.

3. The method according to claim 1, characterized in that, The method further includes: Based on the natural language processing model and the access information of the initial abnormal group, the abnormal probability of the corresponding initial abnormal group is calculated. Based on the anomaly probability of the initial anomaly group, it is determined whether the initial anomaly group is a high-confidence anomaly group, wherein the high-confidence anomaly group is an initial anomaly group whose anomaly probability is greater than or equal to a first threshold. If the initial anomaly group is the high-confidence anomaly group, the step of joining the corresponding initial anomaly group using the access information of the initial anomaly group is executed.

4. The method according to claim 3, characterized in that, The natural language processing model is trained based on the fields in the links of the known anomaly groups, the basic attributes of the known anomaly groups, and the classification labels labeled on the known anomaly groups.

5. The method according to any one of claims 1 to 4, characterized in that, The activity metrics include message frequency, topic concentration, and user interaction rate. Determining whether the initial abnormal group is an abnormal group based on the activity metrics includes: Based on the message frequency, the topic concentration, and the user interaction rate, the feature vector of the initial abnormal group is determined; Calculate the Euclidean distance between the feature vector of the initial abnormal group and the first cluster center, where the first cluster center is a center obtained based on the clustering model to divide the activity level of the group; Based on the Euclidean distance, it is determined whether the initial abnormal group is an abnormal group.

6. The method according to claim 5, characterized in that, If the initial anomaly group is the anomaly group, the method further includes: Extract the member behavior feature vector of the abnormal group, which includes one or more of the following: the time distribution of members sending messages, keyword frequency inverse document frequency, and connection strength; Based on the member behavior feature vector, groups associated with the abnormal groups are identified.

7. A group identification system, characterized in that, The system includes: The group joining module is used to obtain group access information from the first platform; The group joining module is also used to filter the access information of the group based on a regular expression rule base to obtain the access information of the initial abnormal group. The regular expression rule base is constructed based on the Uniform Resource Locator format features and group identification patterns of known abnormal groups. The group joining module is also used to join the corresponding initial abnormal group based on the access information of the initial abnormal group; An activity assessment module is used to determine the activity index of the initial abnormal group; The activity assessment module is also used to determine whether the initial abnormal group is an abnormal group based on the activity index.

8. The system according to claim 7, characterized in that, The group joining module joins the corresponding initial abnormal group based on the access information of the initial abnormal group, specifically as follows: Based on the access information of the initial abnormal group, determine the verification code required to join the corresponding initial abnormal group; Based on the verification code, join the corresponding initial abnormal group.

9. An information processing device, characterized in that, The information processing apparatus includes a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to cause the information processing apparatus to perform the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-readable instructions that, when executed on an electronic device, cause the electronic device to perform the method according to any one of claims 1 to 6.

Images