Abnormal account detection method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal account detection method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining an incidence relation graph corresponding to a to-be-detected target application account; extracting a first association relationship between each element object node and a target node corresponding to the target application account and a second association relationship between different element object nodes based on the association relationship graph, and generating an association relationship feature based on the first association relationship and the second association relationship; constructing an associated feature sequence according to the element content information and the category information corresponding to each element object node; acquiring account content features of the target application account, and generating fusion features according to the account content features and the associated feature sequence; and inputting the preset account detection prompt text, the association relationship feature and the fusion feature into the large language model to obtain an anomaly detection result output by the large language model. According to the embodiment of the invention, the accuracy of abnormal account detection in the application can be improved.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and in particular to a method, apparatus, electronic device, and storage medium for detecting abnormal accounts. Background Technology

[0002] Abnormal accounts refer to application accounts that engage in harmful or abnormal business or dissemination activities in various internet applications, endangering the network environment and security. Currently, it is possible to determine whether an application account is abnormal by analyzing its actions within the application. For example, an application account that publishes a large amount of harmful content in an internet application is identified as an abnormal account. However, with the development of technology, abnormal accounts have gradually become more capable of evading detection, resulting in relatively low accuracy in detecting abnormal accounts in internet applications using current technologies. Summary of the Invention

[0003] This disclosure provides an abnormal account detection method, apparatus, electronic device, and storage medium, which can improve the accuracy of abnormal account detection in applications.

[0004] According to one aspect of this disclosure, an abnormal account detection method is provided, comprising:

[0005] Obtain the association graph corresponding to the target application account to be detected. The association graph includes element object nodes of various categories that are associated with the target application account based on multiple association relationships.

[0006] Based on the association graph, a first association relationship is extracted between each element object node and the target node corresponding to the target application account, and a second association relationship is extracted between different element object nodes. Association relationship features are generated based on the first association relationship and the second association relationship.

[0007] Construct the associated feature sequence corresponding to the target application account based on the element content information and category information corresponding to each element object node;

[0008] Obtain the account content features of the target application account, and generate a fused feature based on the account content features and the associated feature sequence;

[0009] The preset account detection prompt text, the associated relationship features, and the fusion features are input into the large language model to obtain the anomaly detection results output by the large language model.

[0010] According to one aspect of this disclosure, an abnormal account detection device is provided, comprising:

[0011] The acquisition unit is used to acquire the association graph corresponding to the target application account to be detected. The association graph includes element object nodes of various categories that are associated with the target application account based on multiple association relationships.

[0012] The first generation unit is used to extract a first association relationship between each element object node and the target node corresponding to the target application account based on the association relationship graph, and to extract a second association relationship between different element object nodes, and to generate association relationship features based on the first association relationship and the second association relationship;

[0013] The construction unit is used to construct the associated feature sequence corresponding to the target application account based on the element content information and category information corresponding to each element object node;

[0014] The second generation unit is used to obtain the account content features of the target application account and generate fused features based on the account content features and the associated feature sequence.

[0015] The input unit is used to input the preset account detection prompt text, the correlation features and the fusion features into the large language model to obtain the anomaly detection results output by the large language model.

[0016] Optionally, in one implementation, the building unit is specifically used for:

[0017] The multiple element object nodes are sorted based on the category information corresponding to each element object node to obtain the node order;

[0018] Based on the node order and the element content information corresponding to each element object node, construct the associated feature sequence corresponding to the target application account.

[0019] Optionally, in one implementation, the element content information includes multiple element attributes;

[0020] The building unit is specifically used for:

[0021] According to the node order, the multiple element attributes corresponding to each element object node are input into the node encoding network to obtain multiple element attribute features;

[0022] Based on the multiple element attribute features corresponding to each element object node, an element content feature corresponding to each element object node is generated, and based on the element content feature, an associated feature sequence corresponding to the target application account is constructed.

[0023] Optionally, in one implementation, the element attributes include text attributes and image attributes;

[0024] The building unit is specifically used for:

[0025] According to the node order, the multiple element attributes corresponding to each element object node are input into the node encoding network, which includes a text encoding sub-network and an image encoding sub-network.

[0026] When the element attribute is the text attribute, element text attribute features are generated based on the text encoding subnetwork;

[0027] When the element attribute is the image attribute, the element image attribute feature is generated based on the image encoding subnetwork.

[0028] Optionally, in one implementation, the first generating unit is specifically used for:

[0029] Construct a node association matrix based on the first association relationship and the second association relationship;

[0030] The node association matrix is ​​input into the first neural network to generate association relationship features.

[0031] Optionally, in one implementation, the first generating unit is specifically used for:

[0032] Based on the first association relationship and the second association relationship, construct the degree matrix and adjacency matrix corresponding to the association relationship graph;

[0033] Construct a node association matrix based on the degree matrix and the adjacency matrix.

[0034] Optionally, in one implementation, the first generating unit is specifically used for:

[0035] Based on the first association relationship and the second association relationship, obtain the third association relationship between different element object nodes of the same category;

[0036] Generate association relationship features based on the first association relationship, the second association relationship, and the third association relationship.

[0037] Optionally, in one implementation, the first generating unit is specifically used for:

[0038] A node group is determined based on the first association relationship and the second association relationship. The node group includes multiple element object nodes of the same category, and the multiple element object nodes are connected to the same intermediate node in the association relationship graph.

[0039] For each node group, a third association relationship is obtained based on the association relationship category between each element object node and the corresponding intermediate node.

[0040] Optionally, in one implementation, the association graph corresponding to the target application account to be detected is generated through the following process:

[0041] Obtain first elements of various categories that are linked to the target application account based on multiple relationships;

[0042] Obtain second elements of various categories that are related to the first element based on the multiple association relationships;

[0043] Generate a relationship graph based on the target application account, the first element, and the second element.

[0044] Optionally, in one implementation, obtaining a second element of multiple categories that is associated with the first element based on the multiple association relationships includes:

[0045] Obtain multiple candidate elements of various categories that are related to the first element based on the multiple association relationships;

[0046] Determine multiple correlation scores between the multiple candidate elements and the target application account;

[0047] The second element is determined from the plurality of candidate elements based on the plurality of correlation scores.

[0048] Optionally, in one implementation, the input unit is specifically used for:

[0049] Obtain the target preset account detection prompt text corresponding to the target detection scenario;

[0050] The target preset account detection prompt text, the correlation features, and the fusion features are input into the large language model to obtain the anomaly detection results of the target detection scenario.

[0051] The abnormal account detection method in this embodiment obtains a relational graph corresponding to the target application account to be detected. The relational graph includes element object nodes of various categories that are associated with the target application account based on multiple relational relationships. Based on the relational graph, a first relational relationship between each element object node and the target node corresponding to the target application account is extracted, as well as a second relational relationship between different element object nodes. Relationship features are generated based on the first and second relational relationships. A relational feature sequence corresponding to the target application account is constructed according to the element content information and category information corresponding to each element object node. The account content features of the target application account are obtained, and a fusion feature is generated based on the account content features and the relational feature sequence. The preset account detection prompt text, relational features, and fusion features are input into a large language model to obtain the abnormal detection result output by the large language model.

[0052] Therefore, in the abnormal account detection method of this disclosure, the association relationship feature can characterize the association relationship dimension feature of the target application account in the Internet application. Thus, the association relationship feature can be used to detect anomalies in the target application account from the dimension of association relationships. The association feature sequence can characterize the content features of multiple categories of elements that are associated with the target application account. Therefore, the fusion feature integrates the account content features of the target application account itself with the content features of each element, performing anomaly detection on the target application account from a richer content dimension. By using a large language model and preset account detection prompt text to perform semantic understanding of the association relationship feature and the fusion feature, the anomaly detection result of the target application account is determined from the association relationship dimension and the rich content dimension of the target application account. Therefore, the abnormal account detection method of this disclosure utilizes a more comprehensive account evaluation dimension and improves the accuracy of abnormal account detection by leveraging the powerful semantic recognition and reasoning capabilities of the large language model.

[0053] Other features and advantages of this disclosure will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the disclosure. The objectives and other advantages of this disclosure may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0054] The accompanying drawings are provided to further understand the technical solutions of this disclosure and constitute a part of the specification. They are used together with the embodiments of this disclosure to explain the technical solutions of this disclosure and do not constitute a limitation on the technical solutions of this disclosure.

[0055] Figure 1 This is an architecture diagram of the system used in the abnormal account detection method according to the embodiments of this disclosure;

[0056] Figure 2A This is a schematic diagram of an interface in the scenario of handling account reporting, based on an embodiment of this disclosure;

[0057] Figure 2B This is another schematic diagram of an interface used in the application of this disclosure in the scenario of handling account reporting.

[0058] Figure 2C This is another schematic diagram of an interface used in the application of this disclosure in the scenario of handling account reporting.

[0059] Figure 2D This is another schematic diagram of an interface used in the application of this disclosure in the scenario of handling account reporting.

[0060] Figure 2EThis is another schematic diagram of an interface used in the application of this disclosure in the scenario of handling account reporting.

[0061] Figure 3 This is a flowchart of an abnormal account detection method according to an embodiment of the present disclosure;

[0062] Figure 4 This is a schematic diagram of an association relationship map according to an embodiment of the present disclosure;

[0063] Figure 5 This is a schematic diagram of another association map according to an embodiment of the present disclosure;

[0064] Figure 6 This is a schematic diagram of a degree matrix according to an embodiment of the present disclosure;

[0065] Figure 7 This is a schematic diagram of an adjacency matrix according to an embodiment of the present disclosure;

[0066] Figure 8 This is a schematic diagram of a node association matrix according to an embodiment of the present disclosure;

[0067] Figure 9 This is a schematic diagram of multiple accounts belonging to the same group but not directly associated, according to an embodiment of this disclosure;

[0068] Figure 10 Based on an embodiment of this disclosure Figure 4 A schematic diagram of the node order obtained from the association graph;

[0069] Figure 11 This is a schematic diagram of constructing an associated feature sequence based on a node coding network according to an embodiment of the present disclosure;

[0070] Figure 12 This is a schematic diagram illustrating the encoding of text attributes and image attributes according to an embodiment of the present disclosure;

[0071] Figure 13 This is a schematic diagram illustrating the construction of account content features based on a content coding network according to an embodiment of the present disclosure;

[0072] Figure 14 This is a schematic diagram of generating fusion features based on a second neural network according to an embodiment of the present disclosure;

[0073] Figure 15 This is a schematic diagram illustrating the implementation of multiple scene detection tasks based on preset account detection prompt text, association features and fusion features according to an embodiment of the present disclosure;

[0074] Figure 16 This is another flowchart illustrating an abnormal account detection method according to an embodiment of the present disclosure;

[0075] Figure 17 This is a schematic diagram illustrating risk type identification according to an embodiment of the present disclosure;

[0076] Figure 18 This is a schematic diagram of the structure of an abnormal account detection device according to an embodiment of the present disclosure;

[0077] Figure 19 This is a terminal structure diagram for implementing various methods according to an embodiment of the present disclosure;

[0078] Figure 20 This is a server structure diagram illustrating the implementation of various methods according to an embodiment of the present disclosure. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this disclosure.

[0080] Before providing a further detailed description of the embodiments of this disclosure, the terms and concepts used in these embodiments are explained, and they are subject to the following interpretations:

[0081] Large Language Model (LLM): This refers to a deep learning model trained on a large amount of text data that can generate natural language text or understand the meaning of language text. LLM can handle a variety of natural language tasks, such as text classification, question answering, and dialogue. The core idea of ​​LLM is to learn the patterns and structures of natural language through large-scale unsupervised training, accumulating a large amount of natural language knowledge, and thus better understanding and generating natural text.

[0082] Multilayer Perceptron (MLP): A type of feedforward artificial neural network consisting of an input layer, one or more hidden layers, and an output layer. Each layer comprises several neurons connected by weights and subjected to non-linear transformations through activation functions. MLPs can be used for classification, regression, and feature representation tasks.

[0083] Transformer: A deep learning model based on self-attention mechanism, primarily used in natural language processing. Self-attention allows the model to focus on other elements in a sequence while processing each element. This helps the model capture long-range dependencies within the sequence. Transformer addresses the difficulty of traditional sequence models in capturing long-range dependencies through self-attention and positional encoding, and its applications in natural language processing are widespread, including machine translation, text summarization, question answering systems, and sentiment analysis.

[0084] In related technologies, when detecting abnormal accounts in internet applications, the abnormality of an account is generally determined by acquiring the characteristics of the target application account itself. For example, if a target application account sends harmful content to other accounts, this action is used to identify the account as abnormal. Since the analytical dimensions used for anomaly detection are relatively singular, a simpler model can be chosen to detect the features, such as the XGBoost model. However, with technological advancements, abnormal accounts have become increasingly adept at evading detection. Simply modeling the characteristics of the target application account itself has significant limitations in detection capabilities. For instance, to evade anomaly detection, a target application account might engage in controlled harmful activities while simultaneously creating numerous affiliated accounts to conduct these activities, making the actions of each account insufficient to be considered a risky account. Therefore, the accuracy of application account anomaly detection based solely on modeling the characteristics of the account itself is low. Furthermore, if the feature dimensions for account anomaly detection are expanded, the models used in related technologies for account anomaly detection have significant limitations and cannot accurately identify abnormal accounts. Therefore, this disclosure provides an abnormal account detection method to improve the accuracy of abnormal account detection in internet applications.

[0085] System architecture and scenario description of the embodiments disclosed herein

[0086] Figure 1 This is a system architecture diagram applied to the abnormal account detection method according to embodiments of the present disclosure. It includes a terminal 140, an Internet 130, a gateway 120, a server 110, etc.

[0087] Terminal 140 can take various forms, including desktop computers, laptops, PDAs (personal digital assistants), mobile phones, in-vehicle terminals, home theater terminals, and dedicated terminals. Furthermore, it can be a single device or a collection of multiple devices. For example, multiple devices can be connected via a local area network, sharing a single display device to work collaboratively, forming a single terminal 140. Terminal 140 can also communicate with the Internet 130 via wired or wireless means to exchange data.

[0088] Server 110 refers to a computer system that can provide certain services to terminal 140. Compared to ordinary terminal 140, server 110 has higher requirements in terms of stability, security, and performance. Server 110 can be a single high-performance computer in a network platform, a cluster of multiple high-performance computers, a portion of a single high-performance computer (e.g., a machine), or a combination of portions of multiple high-performance computers (e.g., machines).

[0089] Gateway 120, also known as an internetwork connector or protocol converter, is a computer system or device that acts as a translator between two systems using different communication protocols, data formats, languages, or even completely different architectures. It enables network interconnection at the transport layer. Gateways can also provide filtering and security functions. Messages sent from terminal 140 to server 110 are forwarded to the corresponding server 110 through gateway 120. Messages sent from server 110 to terminal 140 are also forwarded to the corresponding terminal 140 through gateway 120.

[0090] The abnormal account detection method of this disclosure embodiment can be executed by an electronic device, which can be a terminal 140 or a server 110. That is, the abnormal account detection method can be executed by the terminal 140 or the server 110, or it can be executed by both the terminal 140 and the server 110.

[0091] The embodiments disclosed herein can be applied in various scenarios, such as Figures 2A-2E The scenarios shown include handling account reporting matters.

[0092] like Figure 2A As shown, in an internet application, account A1 can interact with other accounts. When account A2 engages in harmful activities that severely impact account A1's use of the application, account A1 wants to report account A2 to the internet application platform. To report account A2, click the option icon corresponding to account A2; a pop-up window will appear on the internet application interface as shown below. Figure 2B The option box shown.

[0093] exist Figure 2B In the app, you can report account A2. A pop-up appears on the internet application interface. Figure 2C The report pop-up window. Figure 2C In the reporting pop-up window, you can fill in the reason for reporting account A2. Specifically, you can describe it as "account A2 is engaged in harmful activities". After filling in the information, you can submit the report.

[0094] After receiving a report request, the internet application can use the abnormal account detection method of this embodiment to perform anomaly detection on account A2. After anomaly detection, account A2 can be determined to be an abnormal account. Therefore, the report processing result is fed back to account A1. Figure 2D As shown, the interface for account A1 displays "After detection, account A2 is an abnormal account and has now been cancelled", and deletes the content related to account A2.

[0095] After determining that account A2 is an abnormal account, you can also inform account A2 of the report results. For example... Figure 2E As shown, all content in account A2 has been deleted, and a notification has been sent to account A2: "Your account has been detected as an abnormal account due to engaging in harmful content. Your account has now been cancelled. Please pay attention to maintaining the security of your online environment."

[0096] General Description of Embodiments in this Disclosure

[0097] According to one embodiment of this disclosure, a method for detecting abnormal accounts is provided. The abnormal account detection method provided in this embodiment can be applied to… Figures 2A-2E The scenarios shown include handling account reporting. Figure 3 The diagram shown is a flowchart of an abnormal account detection method provided in this disclosure. This abnormal account detection method may include:

[0098] Step 310: Obtain the relationship graph corresponding to the target application account to be detected.

[0099] The target application account can be an application account being monitored within an internet application. An internet application can be an application that enables communication and interaction between multiple entities. These entities can interact in various ways. For example, two entities can have instant conversations; multiple entities can have group conversations; and entities can also publish content through content publishing platforms within the internet application, allowing other entities to like, comment on, and share the published content.

[0100] Target application accounts can be accounts within internet applications that require monitoring due to specific events, such as accounts reported by other application accounts. When an application account is reported by other application accounts for certain actions, such as spreading inappropriate content or engaging in illegal activities, this application account can be identified as a target application account for monitoring. Target application accounts can also be application accounts within internet applications that are monitored according to predetermined conditions. For example, if an internet application performs batch anomaly checks on application accounts at predetermined intervals to eliminate cybersecurity risks, the application accounts to be monitored can be identified as target application accounts.

[0101] The relationship graph corresponding to the target application account can contain information about the target application account's relationships within internet applications. Specifically, it can include element object nodes of various categories that are associated with the target application account based on multiple relationships. Therefore, the relationship graph can be used to determine the connections between the target application account and other elements within the internet application.

[0102] Elements can be categorized in various ways, such as account categories, group categories, and content categories. Account category elements can be other accounts associated with the target application account. The association between account category elements and the target application account can include: friends (indicating a friend relationship between the two accounts), same phone number (indicating the two accounts are linked to the same phone number), and same device ID (indicating the two accounts log in using the same device). When the target application account is friends with other accounts, if those other accounts are considered suspicious, the target application account is also highly likely to be suspicious. When the target application account is linked to the same phone number as other accounts, these two accounts may belong to the same entity, which may use both accounts simultaneously to evade anomaly detection. Similarly, when the target account logs in using the same device as other accounts, these two accounts may belong to the same entity or organization, switching between the two accounts to evade anomaly detection. Therefore, other accounts associated with the target application account can provide a reference for anomaly detection of the target application account.

[0103] The elements of a group category can be conversation groups associated with the target application account. The association between these group category elements and the target application account can include: group management (indicating the target application account created the group or has administrative privileges over it) and group members (indicating the target application account belongs to the group but does not have administrative privileges). When a target application account creates a group or has administrative privileges over it, it can use the group to gather members and organize illegal activities. When a target application account is a group member but does not have administrative privileges over it, if the group is used to organize illegal activities, then the target application account as a group member is highly likely to be an abnormal account. Therefore, conversation groups associated with the target application account can also provide a reference for anomaly detection of the target application account.

[0104] Content category elements can be content associated with the target application account. Content can take various forms, including text, images, videos, and audio. The association between content category elements and the target application account can include: published content (indicating that the content was published by the target application account) and interactive content (indicating that the target application account interacted with the content, such as liking, commenting, saving, and sharing). When the content published by the target application account includes anomalous content, the target application account is highly likely to be an anomalous account. When the content interacted with by the target application account includes anomalous content, it suggests that the target application account is interested in this content, and the target application account may also be an anomalous account. Therefore, content associated with the target application account can also provide a reference for anomaly detection of the target application account.

[0105] The relationship graph can also contain relationships between different elements. For example, there may be no direct relationship between account A1 and the target application account, but these two accounts belong to the same group. In this case, account A1 can establish a "group member" relationship with the group in the relationship graph. The group and the target application account also have a "group member" relationship. Thus, account A1 can establish an indirect relationship with the target application account through the group.

[0106] Element object nodes can be stored as graph nodes corresponding to the elements in the relationship graph. Relationships between nodes can be stored as edges in the relationship graph. For example... Figure 4 The diagram shown is an example of a relationship graph. Account A1 is linked to the target application account with the same phone number; Account A2 and Account A3 log in using the same device; Account A4 is a friend of the target application account; the target application account is the group administrator for both groups G1 and G2; Accounts A5 and A6 are group members in group G1, and Account A7 is a group member in group G2; Contents C1, C2, and C3 are interactive content from the target application account; Account A3 also interacts with Content C1, and Account A7 interacts with Content C3; Content C4 is published content from the target application account.

[0107] The relationship graph can be pre-generated or generated in real-time during anomaly detection of the target application account. When the relationship graph is pre-generated, it can be updated at predetermined time intervals. Whenever anomaly detection is needed for the target application account, the corresponding relationship graph can be directly accessed. When the relationship graph is generated in real-time, the latest relationship graph for the target application account can be generated when anomaly detection is required.

[0108] To establish features related to the target application accounts, it is necessary to obtain a rich and comprehensive set of relationships among these accounts. A relationship graph can visually represent the complex relationships between target application accounts within internet applications. After generating the relationship graph, direct or indirect connections between various element nodes can be extracted, thereby improving the accuracy of anomaly detection for target application accounts based on these relationships.

[0109] In one implementation, the relationship graph corresponding to the target application account to be detected is generated through the following process:

[0110] Obtain first elements of various categories that are linked to the target application account based on multiple relationships;

[0111] Retrieve second elements of various categories that are related to the first element based on multiple relationships;

[0112] Generate a relationship graph based on the target application account, the first element, and the second element.

[0113] The various categories of the first element have been described in detail above, including account category, group category, and content category. The various relationships between the first element and the target application account have also been described in detail, and will not be repeated here.

[0114] Note that when obtaining the first and second elements associated with the target application account, prior consent must be obtained from the user of the target application account, the owner of the first element, and the owner of the second element. Furthermore, the collection, use, and processing of the first and second elements will comply with relevant laws, regulations, and standards.

[0115] In one implementation, a first element of multiple categories that is associated with the target application account based on multiple relationships can be obtained, and the element can be obtained for multiple preset categories and multiple relationships.

[0116] The element categories used for anomaly detection of target application accounts and their associations with the target application accounts can be pre-defined. When obtaining the first element, multiple pre-defined associations between elements of the pre-defined categories and the target application account can be retrieved. Specifically, for each association, a corresponding retrieval method can be used to obtain the first element.

[0117] For example, the preset element categories can include account categories, group categories, and content categories. For account categories, preset associations can include friends, same phone number, and same device number; for group categories, preset associations can include group management and group members; for content categories, preset associations can include published content and interactive content. For each association under each of the above element categories, the corresponding first element can be obtained using the corresponding retrieval method.

[0118] For example, for account-type first elements with a "friend" relationship, this can be obtained by collecting the friend directory of the target application account in the internet application; for account-type first elements with a "same phone number" relationship, the target phone number bound to the target application account can be identified, and other application accounts bound to the target phone number can be found as first elements; for account-type first elements with a "same device ID" relationship, the target device ID of the device on which the target application account has logged in can be identified, and other application accounts that have logged in on the device corresponding to the target device ID can be found as first elements; for group-type first elements with "group management" and "group member" relationships, this can be obtained by collecting group accounts created, managed, and participated in by the target application account in the internet application; for content-type first elements with a "published content" relationship, this can be obtained by collecting the published content records of the target application account; and for content-type first elements with a "interactive content" relationship, this can be obtained by collecting the interactive content records of the target application account.

[0119] The system can directly collect first elements of multiple categories and multiple relationships according to preset acquisition methods, thereby improving the efficiency of acquiring first elements.

[0120] In another implementation, obtaining a first element of multiple categories that is associated with the target application account based on multiple relationships includes: extracting a first element of multiple categories that is associated with the target application account based on the account logs of the target application account to be detected within a predetermined time period.

[0121] The target application account's account logs can be a database used by internet applications to store all account-related information for the target application account within a predetermined time period. This time period can be directly retrieved after it has been determined. The predetermined time period can be the time frame used for anomaly detection of the target application account. The target application account may not consistently engage in abnormal activity; therefore, the predetermined time period for anomaly detection can be pre-determined. For example, a period of time between the current moment and the current moment can be defined as the predetermined time period to determine if the target application account has recently exhibited abnormal activity. Determining the first element based on the predetermined time period avoids irrelevant account information that is too far removed from the time period in which the target application account exhibited abnormal activity from affecting anomaly detection, thus improving the accuracy of anomaly detection.

[0122] Account-related information for the target application account can include: associated account information, associated group information, and associated content information. Associated account information can include interactive account information, associated account change information, and account identifier detection information. Interactive account information indicates other accounts that have had conversations with the target application account within a predetermined time period. Associated account change information indicates other accounts that have been added to or pinned by the target application account within the predetermined time period. Account identifier detection information indicates information obtained by detecting relevant identifiers of the target application account in internet applications within the predetermined time period, such as phone numbers and device IDs. Associated group information can include group interaction information and associated group change information. Group interaction information indicates the groups in which the target application account participated in conversations within the predetermined time period. Associated group change information indicates groups created, managed, or joined within the predetermined time period. Associated content information indicates content published by the target application account or content that has undergone interactive operations such as liking, commenting, and saving within the predetermined time period. For example, Table 1 shows an example of account-related information recorded in an account log within a predetermined time period.

[0123] time Account-related information 2024.7.1.07:01:20 Likes C1 2024.7.1.07:02:15 Comment content C2 2024.7.1.07:02:45 Having a conversation with account A1 2024.7.1.07:03:36 Log in with account A2, which is linked to the same phone number as account A1. 2024.7.1.07:04:52 Add account A3 2024.7.1.07:06:15 Post content C3 in group G1 2024.7.1.07:08:47 Added administrative privileges to group G2 …… …… 2024.7.5.23:20:15 Log in with account A4, which has the same device ID as account A1.

[0124] Table 1

[0125] Table 1 records account-related information for the target application account between July 1, 2024 and July 5, 2024. Related account information includes: "conversation with account A1", "login of account A2 (with the same phone number as account A1)", "adding account A3", and "login of account A4 (with the same device ID as account A1)". Related group information includes: "posting content C3 in group G1" and "being granted administrative permissions by group G2". Related content information includes: "liking content C1", "commenting content C2", and "posting content C3 in group G1". Therefore, the first element extracted from the above account logs includes: account A1, account A2, account A3, account A4, group G1, group G2, content C1, content C2, and content C3. Among them, accounts A1, A2, and A3 belong to the account category. The association relationship of account A1 is friend, the association relationship of account A2 is same phone number, the association relationship of account A3 is friend, and the association relationship of account A4 is same device number; groups G1 and G2 belong to the group category. The association relationship of group G1 is group member, and the association relationship of group G2 is group administrator; the association relationship of content C1, content C2, and content C3 is the content category. The association relationship of content C1 and content C2 is interactive content, and the association relationship of content C3 is published content.

[0126] Extracting the first element from the account logs of the target application account within a predetermined time period allows for the flexible acquisition of elements of different categories and with different relationships to the target application account, thus improving the flexibility of extracting the first element and consequently enhancing the accuracy of anomaly detection based on the first element.

[0127] The associations used for anomaly detection of target application accounts can include not only elements directly related to the target application account, but also elements indirectly related to it. For example, accounts in the same group as the target application account, but which have not added each other as friends.

[0128] Therefore, after determining the first element, it is possible to obtain second elements of various categories that are related to the first element based on multiple relationships.

[0129] The category of the second element can be the same as the category of the first element, and can include account category, group category, and content category.

[0130] The relationship between the second element and the first element can be similar to the relationship between the first element and the target application account. The difference is that the first element is an element with multiple relationships derived from the account category; while the first element has multiple categories, therefore, the second element is an element with multiple relationships derived from multiple categories. When the first element is an account category, the relationship between the second element and the first element can be the same as the relationship between the first element and the target application account. When the first element is a group category, if the second element is an account category, then the relationship between the second element and the first element can also include "group member" and "group management"; if the second element is a group category, then the relationship between the second element and the first element can include "created by the same account," for example, group G1 and group G2 were created by the same account; if the second element is a content category, then the relationship between the second element and the first element can include "posting content" and "forwarding content," for example, posting content C1 in group G1 and forwarding content C2 from outside group G1 to group G1. When the first element is a content category, if the second element is an account category, the relationship between the second element and the first element can also include "posted content" and "interactive content"; if the second element is a group category, the relationship between the second element and the first element can include "posted content" and "forwarded content"; if the second element is a content category, the relationship between the second element and the first element can include "posted by the same account", for example, content C1 and content C2 are posted by the same account.

[0131] The process of obtaining the second element can be similar to the process of obtaining the first element described above. In one implementation, the element can be obtained based on its category, targeting multiple preset categories and relationships. Different categories of the first element can have corresponding preset categories and relationships, and the second element is obtained according to these preset categories and relationships. Further details are omitted here.

[0132] In another implementation, a second element of various categories that is related to the first element based on the element-related records of the first element within a predetermined time period can be extracted.

[0133] Element-related records can be databases used in internet applications to store all relevant information about the first element within a predetermined time period, which can be retrieved directly after the predetermined time period is determined.

[0134] When the first element is an account category, the related records can be account logs within a predetermined time period; the process of extracting the second element is not detailed here. When the first element is a group category, the related records can be group logs within a predetermined time period, which may include: associated account information, associated group information, and associated content information. Associated account information can indicate the group's creator account, administrator account, and group member accounts within the predetermined time period; associated group information can indicate other groups created by the same account within the predetermined time period; associated content information can indicate content posted or forwarded within the group within the predetermined time period. When the first element is a content category, the related records can be content records within a predetermined time period, which may include: content posting information and content interaction information. Content posting information can indicate the account or group that posted the content; content interaction information can indicate the account or group that liked, commented, favorited, or forwarded the content.

[0135] The process of extracting the second element from the element-related records of the first element in different categories within a predetermined time period is the same as the process of extracting the first element from the account logs of the target application account in the aforementioned steps, and will not be repeated here.

[0136] The amount of data derived from multiple first elements that are indirectly related to the target application account is quite large, and not every element indirectly related to the target application account can provide a reference for anomaly detection of the target application account. Therefore, in one implementation, obtaining second elements of multiple categories that are related to the first element based on multiple relationships includes:

[0137] Retrieve multiple candidate elements of various categories that are related to the first element based on multiple relationships;

[0138] Determine multiple relevance scores between multiple candidate elements and the target application account;

[0139] The second element is determined from multiple candidate elements based on multiple correlation scores.

[0140] The process of obtaining multiple candidate elements is the same as the process of directly obtaining the second element in the aforementioned implementation, and will not be repeated here.

[0141] After obtaining multiple candidate elements, a correlation score can be determined between each candidate element and the target application account. This correlation score can be used to assess the relevance between the target application account and the candidate elements.

[0142] The target application account and candidate elements are indirectly connected through different first elements. For example, candidate element A1 (account type) belongs to the same group G1 as the target application account; candidate element G2 (group type) forwarded content C1 posted by the target application account; and candidate element C2 (content type) is content posted by account A2, a friend of the target application account. Therefore, the first element between account A1 and the target application account is group G1; the first element between group G2 and the target application account is content C1; and the first element between content C2 and the target application account is account A2. For some candidate elements, there may be more than one first element connected to the target application account. For example, account A1 not only belongs to the same group G1 as the target application account but also liked content C3 posted by the target application account and is a friend of both the target application account and its friend account A3. Therefore, the first elements between account A1 and the target application account include group G1, content C3, and account A3. Compared to candidate elements connected by only one first element, account A1 has a higher correlation with the target application account and is more suitable for anomaly detection of the target application account.

[0143] Therefore, the relevance score of a candidate element can be determined based on the number of first elements that indirectly interact with the target application account. Specifically, in one implementation, the relevance score of a candidate element can be directly equal to the number of first elements that indirectly interact with the target application account. For example, if the number of first elements that indirectly interact with the target application account is 12, then its corresponding relevance score is equal to 12.

[0144] After determining the relevance score between each candidate element and the target application account, a second element can be determined from multiple candidate elements based on multiple relevance scores.

[0145] In one implementation, determining a second element from multiple candidate elements based on multiple correlation scores can be achieved by determining a predetermined threshold and identifying candidate elements with correlation scores greater than the predetermined threshold as the second element. For example, if the correlation scores of candidate elements K1, K2, K3, K4, and K5 are 15, 20, 2, 9, and 5 respectively, and the predetermined threshold is 10, then the second elements determined from these scores are candidate elements K1 and K2.

[0146] Determining the second element from multiple candidate elements according to predetermined filtering criteria can eliminate elements with low relevance from a large number of elements that are indirectly related to the target application account, retaining those with high relevance, reducing the amount of data, improving the efficiency of anomaly detection, and at the same time not sacrificing the accuracy of anomaly detection of the target application account based on the first and second elements.

[0147] After obtaining the first and second elements, a relationship graph can be generated based on the target application account, the first element, and the second element. First, the target application account, the first element, and the second element can be stored as graph nodes, resulting in the target node corresponding to the target application account, and the element object nodes corresponding to the first and second elements. The element object node corresponding to the first element can be directly connected to the target node; the element object node corresponding to the second element can be connected to the element object node corresponding to the first element.

[0148] In this embodiment, a relationship graph is constructed by acquiring the first and second elements that have a second-order or lower association with the target application account. Similarly, elements with a third-order or lower association with the target application account can also be acquired to construct a relationship graph. However, as the distance between the elements and the target application account increases, the influence of the elements on the anomaly detection of the target application account decreases, which may lead to over-guidance and inaccurate anomaly detection results. After experimental verification, this embodiment shows that using a second-order or lower association relationship to detect anomalies in the target application account can obtain more accurate anomaly detection results.

[0149] By generating a relationship graph based on the first element that has a direct relationship with the target application account and the second element that has an indirect relationship, the comprehensiveness of obtaining the relationship between the target application account and the Internet application can be improved, and the accuracy of anomaly detection of the target application account based on the relationship can be improved.

[0150] Step 320: Extract the first association relationship between each element object node and the target node corresponding to the target application account based on the association relationship graph, and extract the second association relationship between different element object nodes, and generate association relationship features based on the first association relationship and the second association relationship.

[0151] The relationship graph visually displays the complex relationships between target application accounts in internet applications. Anomaly detection of target application accounts based on the relationships shown in the relationship graph is highly accurate in terms of relationship dimension. However, the anomaly detection method in this embodiment of the disclosure uses the powerful recognition and understanding capabilities of a large language model for anomaly detection, and large language models cannot directly process graph data. Therefore, the relationships between target application accounts can be extracted from the relationship graph so that the large language model can understand these relationships. The use of the large language model for anomaly detection is described in detail in subsequent step 340, and will not be repeated here.

[0152] Extracting the association relationships of a target application account from the association relationship graph can include: extracting the first association relationship between each element object node and the target node corresponding to the target application account; and extracting the second association relationship between different element object nodes.

[0153] When an element object node is connected to a target node in the relationship graph, a first relationship can be established between the element object node and the target node, and this relationship can be extracted. Similarly, when two element object nodes are connected, a second relationship can be established between them. For example, from... Figure 4 The relationship graph shown can be used to extract the following first relationships: target node and account A1, target node and account A2, target node and account A3, target node and account A4, target node and group G1, target node and group G2, target node and content C1, target node and content C2, target node and content C3, and target node and content C4. The relationship graph can be used to extract the following second relationships: group G1 and account A5, group G1 and account A6, content C3 and account A7, group G2 and account A7, and account A3 and content C1.

[0154] After extracting the first and second relationships from the relationship graph, relationship features can be generated based on these relationships. These relationship features can characterize the relationships of a target application account within internet applications.

[0155] In one implementation, generating association relationship features based on a first association relationship and a second association relationship includes:

[0156] Construct a node association matrix based on the first and second association relationships;

[0157] The node association matrix is ​​input into the first neural network to generate association relationship features.

[0158] A node association matrix can be a matrix used to characterize the detailed associations in an association graph. In one implementation, constructing a node association matrix based on a first association and a second association includes:

[0159] Construct the degree matrix and adjacency matrix corresponding to the association graph based on the first association relationship and the second association relationship;

[0160] Construct a node association matrix based on the degree matrix and the adjacency matrix.

[0161] A degree matrix can be used to represent the number of relationships between a target node and each element node. The degree matrix is ​​a diagonal matrix where the number of rows and columns represents the number of nodes in the relationship graph, with each row and column representing a node. The diagonal elements are the degree of each node, which is the number of relationships between that node and other nodes; the off-diagonal elements are all 0.

[0162] Based on the first and second association relationships, a degree matrix is ​​constructed. The degree of the target node in the association relationship graph can be determined by the number of first association relationships. The degree of each element object node in the association relationship graph can be determined by the first and second association relationships. Specifically, the degree of an element object node is equal to the number of that element object nodes contained in each first association relationship and each second association relationship.

[0163] For example Figure 5 The relationship graph shown extracts the following first relationships: target node and account A1, target node and account A2, target account and group G1, target account and group G2, and target account and content C1. Therefore, the degree of the target node in the relationship graph is determined to be 5. The second relationship extracted includes: group G1 and account A3, group G1 and content C2, and content C1 and account A2. Therefore, the degree of each element object node is as follows: account A1 is 1 (target node and account A1), account A2 is 2 (target node and account A2 and content C1 and account A2), account A3 is 1 (group G1 and account A3), group G1 is 3 (target account and group G1, group G1 and account A3, and group G1 and content C2), group G2 is 1 (target account and group G2), content C1 is 2 (target account and content C1 and content C1 and account A2), and content C2 is 1 (group G1 and content C2). Therefore, the degree matrix constructed based on the first and second association relationships described above is as follows: Figure 6 As shown, the rows and columns in the degree matrix are arranged in the following order: target node, account A1, account A2, account A3, group G1, group G2, content C1 and content C2, and the diagonal represents the degree of each node.

[0164] An adjacency matrix represents whether there are edges between target nodes and element nodes in an association graph. Its number of rows and columns equals the number of nodes in the association graph, with each row and column representing a node. If an edge exists between the node in the first row and the node in the third column, the value of the matrix in the first row and third column is 1; otherwise, the value is 0.

[0165] Therefore, when constructing the adjacency matrix based on the first and second association relationships, if there is a first or second association relationship between two nodes, the corresponding matrix value is 1; otherwise, if there is no first or second association relationship between two nodes, the corresponding matrix value is 0.

[0166] For example, based on from Figure 5 The adjacency matrix constructed from the first and second associations extracted from the association graph shown is as follows: Figure 7 As shown, the rows and columns in the degree matrix are arranged in the following order: target node, account A1, account A2, account A3, group G1, group G2, content C1 and content C2. The matrix values ​​on the diagonal are 0, and the remaining matrix values ​​reflect whether there are any relationships between the nodes.

[0167] After constructing the degree matrix and adjacency matrix, a node affinity matrix can be constructed based on these matrices. In one implementation, the node affinity matrix is ​​equal to the difference between the degree matrix and the adjacency matrix. For example, the degree matrix is... Figure 6 The matrix shown has the following adjacency matrix: Figure 7 Given the matrix shown, the node association matrix can be represented as: Figure 8 .

[0168] By constructing a node association matrix using degree and adjacency matrices, the node association matrix can represent both the relationships between individual element objects and the number of such relationships, thus improving the comprehensiveness of the node association matrix in representing the relationships shown in the association graph.

[0169] After constructing the node association matrix, the node association matrix can be input into the first neural network to generate association relationship features.

[0170] The first neural network can encode the node association matrix, thereby mapping the node association matrix to a semantic space that the large language model can understand. The semantic space that the large language model can understand is a multi-dimensional space, which maps each feature in the node association matrix to a vector, enabling the large language model to understand each feature and thus understand the overall association relationships of the target application account. The first neural network can be a multilayer perceptron or a converter network. The first neural network can be pre-trained based on a predetermined neural network for the application scenario of this disclosure embodiment.

[0171] The node association matrix can clearly and accurately express the first and second association relationships. Then, the first neural network is used to map the node association matrix into a semantic space that the large language model can understand, which helps to improve the accuracy of semantic feature conversion of the association relationships of the target application account.

[0172] To evade anomaly detection, criminals can control multiple unrelated elements of the same type as a team, distributing abnormal behavior among each element. For example, they might create multiple accounts using different phone numbers; these accounts may not be directly linked, but they can belong to the same group for easier management. Figure 9 As shown, accounts A1, A2, A3, and the target application account belong to the same group, and there is no direct connection between them. Judging whether the target application account is abnormal based solely on the connections between account A1, account A2, and account A3 may not be accurate enough. However, by treating accounts A1, A2, and A3 as a group and analyzing the connections between this group and the target application account, the target application account can be identified as an abnormal account.

[0173] Therefore, in one implementation, generating association relationship features based on the first association relationship and the second association relationship includes:

[0174] Based on the first and second association relationships, obtain the third association relationship between different element object nodes of the same category;

[0175] Generate association features based on the first association, the second association, and the third association.

[0176] The third type of association can be the implicit association between nodes of the same category that are not connected by edges, obtained from the association graph.

[0177] In one implementation, based on the first association relationship and the second association relationship, a third association relationship is obtained between different element object nodes of the same category, including:

[0178] Node groups are determined based on the first and second association relationships;

[0179] For each node group, obtain the third association relationship based on the association relationship category between each element object node and its corresponding intermediate node.

[0180] A node group can include multiple element object nodes of the same category, and these multiple element object nodes are connected to the same intermediate node in the relationship graph. The intermediate node can be any node in the relationship graph. Figure 4Taking the relationship graph shown as an example, based on the first relationship, multiple node groups can be divided, namely: {Account A1, Account A2, Account A3, Account A4}, {Content C1, Content C2, Content C3, Content C4}, and {Group G1, Group G2}. Each node group contains nodes of the same category that are directly connected to the target node. Based on the second relationship, the node group obtained is {Account A5, Account A6}, in which the two nodes are account nodes with group G1 as the intermediate node.

[0181] After determining the node groups, for each node group, a third association can be obtained based on the association category between each element object node and its corresponding intermediate node. Specifically, when two nodes in a node group have the same association category with their corresponding intermediate nodes, it can be determined that a third association exists between these two nodes.

[0182] Based on the above example, in the node group {Account A1, Account A2, Account A3, Account A4}, Account A2 and Account A3 are also associated with the target application account through the "same device ID" relationship. Therefore, it can be determined that there is a third association relationship between Account A2 and Account A3. In the node group {Content C1, Content C2, Content C3, Content C4}, Content C1, Content C2, and Content C3 are all associated with the target application account through the "interactive content" relationship. Therefore, it can be determined that there is a third association relationship between each pair of these three element object nodes. In the node group {Group G1, Group G2}, two of the nodes are associated with the target application account through the "group management" relationship. Therefore, it can be determined that there is a third association relationship between Group G1 and Group G2. In the node group {Account A5, Account A6}, two of the nodes are associated with Group G1 through the "group member" relationship. Therefore, it can be determined that there is a third association relationship between object A5 and object A6.

[0183] Elements of the same category that are connected to the same intermediate node using the same association relationship are more likely to have implicit associations. Therefore, dividing multiple element object nodes of the same category into node groups based on the first and second association relationships, and obtaining the third association relationship from the node groups based on the association relationship category, can improve the accuracy of mining implicit associations between element object nodes of the same category from the association relationship graph.

[0184] The process of generating association relationship features based on the first association relationship, the second association relationship, and the third association relationship can be the same as the process of generating association relationship features based on the first association relationship and the second association relationship in the aforementioned embodiments, and will not be repeated here.

[0185] In addition to the first and second association relationships, the third association relationship between different element object nodes of the same category can be used to generate association relationship features. This can uncover the implicit associations between element object nodes of the same type in the association relationship graph, so as to perform anomaly detection on the target application account based on the implicit associations. This further expands the association relationship dimension features of the target application account and improves the accuracy of anomaly detection on the target application account.

[0186] Step 330: Construct the associated feature sequence corresponding to the target application account based on the element content information and category information corresponding to each element object node.

[0187] The content information corresponding to an element object node can include multiple pieces of content for that element. The content information can differ depending on the category of the element object node. For example, for an account-type element object node, the content information can include the account avatar, nickname, introduction, and description; for a group-type element object node, the content information can include the group avatar, nickname, introduction, and announcement; and for a content-type element object node, the content information can include a cover image, title, body text, and tags.

[0188] Note that prior consent from the element's owner must be obtained before acquiring the element content information corresponding to each element object node. Furthermore, the collection, use, and processing of element content information will comply with relevant laws, regulations, and standards.

[0189] Category information can indicate the category corresponding to an element object node, such as account category, group category, and content category.

[0190] The associated feature sequence corresponding to the target application account contains multiple element content features. Each element content feature can represent the element content information of an element that is associated with the target application account.

[0191] In one implementation, a sequence of associated features corresponding to the target application account is constructed based on the element content information and category information corresponding to each element object node, including:

[0192] The node order is obtained by sorting multiple element object nodes based on the category information corresponding to each element object node.

[0193] Construct a sequence of associated features for the target application account based on the node order and the element content information corresponding to each element object node.

[0194] The node order can determine the sorting of the element content features corresponding to each element object node in the associated feature sequence.

[0195] In one implementation, multiple element object nodes are sorted based on the category information corresponding to each element object node to obtain the node order, including:

[0196] Group multiple element object nodes based on the category information corresponding to each element object node;

[0197] The node order is obtained by sorting multiple element object nodes according to a predetermined grouping order.

[0198] First, multiple element object nodes can be grouped according to category information. For example, if multiple element object nodes include account A1, group G1, content C1, group G2, account A2, and content C2, these element object nodes can be divided into three groups: {account A1, account A2}, {group G1, group G2}, and {content C1, content C2}.

[0199] The predetermined grouping order can be a pre-defined category sorting. For example, when the grouping order is Account, Group, Content, then arranging the above three groups in this order will result in the following node order: Account A1, Account A2, Group G1, Group G2, Content C1, Content C2. When the grouping order is Group, Account, Content, then arranging the above three groups in this order will result in the following node order: Group G1, Group G2, Account A1, Account A2, Content C1, Content C2.

[0200] In summary, element object nodes of the same category are arranged together, and element object nodes of different categories are sorted according to category. It should be noted that multiple element object nodes within a group corresponding to a category can be arranged in any order. For example, when the grouping order is Account, Group, Content, the node order can be Account A1, Account A2, Group G1, Group G2, Content C1, Content C2, or it can be Account A2, Account A1, Group G1, Group G2, Content C2, Content C1.

[0201] by Figure 4 For example, when the predetermined grouping order is account, group, content, the node order obtained by sorting multiple element object nodes can be as follows: Figure 10 As shown, they are, in order: Account A1, Account A2, Account A3, Account A4, Account A5, Account A6, Account A7, Group G1, Group G2, Content C1, Content C2, Content C3, Content C4.

[0202] After determining the node order, a sequence of associated features corresponding to the target application account can be constructed based on the node order and the element content information corresponding to each element object node. The element content information corresponding to each element object node can be sorted according to the corresponding node order, and element content features are constructed sequentially according to the node order, ultimately resulting in the associated feature sequence. For the element content information of each element object node, a node encoding network can be used to construct its corresponding element content features. The node encoding network can be used to encode content information, thereby constructing a machine-recognizable feature vector.

[0203] For example Figure 11 As shown, a node encoding network is used to encode the element content information corresponding to each sorted element object node, obtaining the corresponding element content feature. In this way, the element content features corresponding to all element object nodes are used to construct an associated feature sequence according to the node order.

[0204] In one implementation, the element content information includes multiple element attributes. These multiple element attributes can be multiple pieces of content corresponding to the element. As described above, the element content information corresponding to element object nodes of different categories can be different, specifically reflected in the differences in element attributes. For example, for an element object node of the account category, multiple element attributes may include account avatar, account nickname, account introduction, and account description, etc.; for an element object node of the group category, multiple element attributes may include group avatar, group nickname, group introduction, and group announcement, etc.; for an element object node of the content category, multiple element attributes may include content cover, content title, content body, and content tags, etc.

[0205] Based on this, a sequence of associated features corresponding to the target application account is constructed according to the node order and the element content information corresponding to each element object node, including:

[0206] In the order of nodes, input the multiple element attributes corresponding to each element object node into the node encoding network to obtain multiple element attribute features.

[0207] Based on the multiple element attribute features corresponding to each element object node, the element content features corresponding to each element object node are generated, and based on the element content features, the associated feature sequence corresponding to the target application account is constructed.

[0208] For each element attribute corresponding to each element object node, a node encoding network is used to obtain the corresponding element attribute features. Concatenating multiple element attribute features generates the element content features corresponding to the element object node. For example, the element attributes corresponding to account A1 include account avatar, account nickname, account introduction, and account description. Using a node encoding network, avatar features, nickname features, introduction features, and description features can be obtained sequentially. Concatenating these four features yields the element content features corresponding to account A1.

[0209] After constructing the associated feature sequence corresponding to each element object node in the order of nodes, the associated feature sequence corresponding to the target application account can be obtained.

[0210] In one implementation, element attributes include text attributes and image attributes. Text attributes can be element attributes where the content is displayed in text form, such as account nickname, account introduction, group nickname, and content body. Image attributes can be element attributes where the content is displayed in image form, such as account avatar, group avatar, and content cover.

[0211] Based on this, multiple element attributes corresponding to each element object node are input into the node encoding network according to the node order to obtain multiple element attribute features, including:

[0212] According to the node order, the multiple element attributes corresponding to each element object node are input into the node encoding network, which includes a text encoding sub-network and an image encoding sub-network.

[0213] When the element attribute is a text attribute, the element text attribute feature is generated based on the text encoding sub-network;

[0214] When an element attribute is an image attribute, the element's image attribute features are generated based on the image encoding subnetwork.

[0215] like Figure 12 As shown, for each element attribute 1210 corresponding to each element object node, it is determined whether it is a text attribute or an image attribute. For text attributes, the text encoding subnetwork 1221 in the node encoding network 1220 is used to generate element text attribute features 1230; for image attributes, the image encoding subnetwork 1222 is used to generate element image attribute features 1240.

[0216] The text encoding subnetwork 1221 can be the part of the node encoding network 1220 that encodes text-like content. For example, it could be a word embedding encoding network or a converter-type encoding network. The image encoding subnetwork 1222 can be the part of the node encoding network 1220 that encodes image-like content. For example, it could be a convolutional neural network or a residual network.

[0217] By constructing corresponding attribute features using separate encoding subnetworks for text and image attributes, feature construction can be made more targeted, thus improving the accuracy of generated element attribute features.

[0218] Constructing an associated feature sequence based on multiple element attributes corresponding to each element object node ensures that each detail of the element object node can be used to construct corresponding element attribute features, thus improving the accuracy of constructing element content features for element object nodes.

[0219] Constructing a sequence of associated features for a target application account based on node order allows for the arrangement of multiple element content features according to the category information of multiple element object nodes. This enables the large language model to not only understand the content features of a single element, but also to understand the context of feature sequences composed of elements of the same type, thereby improving the accuracy of anomaly detection for target application accounts using the large language model.

[0220] Step 340: Obtain the account content features of the target application account, and generate fused features based on the account content features and associated feature sequences.

[0221] The account content characteristics of a target application account can characterize the target account content corresponding to that target application account. In one implementation, obtaining the account content characteristics of a target application account includes:

[0222] Obtain target account content information for the target application account;

[0223] Construct account content features for the target application account based on the target account content information.

[0224] The target account content information can include both static and dynamic content information of the target application account. Static content information is information that generally does not change unless modified by the target. Examples include the account nickname, avatar, and description. The static content information of the target application account can be obtained from an account database within the internet application, which can store all the static settings for each application account. The static content information of the target application account can then be retrieved from this database.

[0225] Action content information can be actions that occur around the target application account. For example, the target application account creates a chat group, the target application account is blocked, the target application account sends chat details, the target application account posts an update, etc.

[0226] In the preceding steps, elements associated with the target application account can be obtained based on the actions performed by the target account. For example, the action of establishing a chat group based on the target application account can be used as an element associated with the target application account, and anomaly detection of the target application account can be performed based on the association with the chat group and the content characteristics of the chat group. In this embodiment, the focus of obtaining the action content information of the target application account is on the action of "establishing a chat group". If the target application account establishes a large number of chat groups in a short period of time, then the target application account may be abnormal. Therefore, it can be seen that the process of obtaining the action content information of the target application account is closely related to the process of obtaining the first element with multiple associations with the target application account in the aforementioned embodiment.

[0227] In the aforementioned implementation of obtaining the first element of a target application account with multiple relationships, this can be done based on the target application account's account logs. The account logs store all account-related information for the target application account, including the target application account's actions in internet applications. Therefore, obtaining the target application account's action content information can also be based on the account logs. Further details will not be elaborated here.

[0228] Note that when obtaining the static and action content characteristics of a target application account, the consent of the users of that application account must be obtained beforehand. Furthermore, the collection, use, and processing of these static and action content characteristics will comply with relevant laws, regulations, and standards.

[0229] After obtaining the target account content information, account content features of the target application account can be constructed based on the target account content. In one implementation, constructing account content features of the target application account based on the target account content information includes: encoding the target account content information of the target application account using a content coding network to construct account content features.

[0230] Since the target account content information can include multiple different pieces of information, when using a content coding network for encoding, each piece of content information can be encoded sequentially to obtain the content features corresponding to each piece of content information. Concatenating the content features corresponding to multiple pieces of content information yields the account content features corresponding to the target application account. For example... Figure 13 As shown, the target account content information includes: account avatar, account nickname, and account actions such as "creating a chat group," "adding friends," and "posting content." The above content information is encoded sequentially using a content encoding network 1310 to obtain the corresponding content features. These five content features constitute the account content features corresponding to the target application account.

[0231] Content encoding networks can use the same network structure and parameters as node encoding networks. Since the target account content information can contain both image and text content—for example, the account avatar is an image, while the account nickname and account actions are text—the content encoding network can include image encoding subnetworks and text encoding subnetworks, respectively, to encode image and text content information. The structure is the same as in node encoding networks, and will not be elaborated further here.

[0232] After obtaining the account content features, a fused feature can be generated based on the account content features and related feature sequences. The fused feature can simultaneously represent the content information of the target account and the content information of multiple elements.

[0233] In one implementation, generating fused features based on account content features and associated feature sequences includes: inputting account content features and associated feature sequences into a second neural network to generate fused features.

[0234] like Figure 14 As shown, the second neural network 1430 can fuse and encode the account content feature 1420 and the associated feature sequence 1410 to obtain the fused feature 1440. This maps the account content feature 1420 and the associated feature sequence 1410 into a semantic space that the large language model can understand, enabling the large language model to fully understand each feature and the relationships between features. The second neural network 1430 is similar to the first neural network used to encode the node association matrix in the aforementioned embodiment; it can be a multilayer perceptron or a converter network. The second neural network 1430 can also be pre-trained based on a predetermined neural network for the application scenarios of this disclosure embodiment.

[0235] Step 350: Input the preset account detection prompt text, correlation features and fusion features into the large language model to obtain the anomaly detection results output by the large language model.

[0236] Large language models (MLMs) are deep learning models trained on large amounts of text data. They can generate natural language text and deeply understand the meaning of language text. There are various types of MLMs, and any one of them can be used for anomaly detection of target application accounts. However, since MLMs typically need to process a large number of relational and fusion features, it is advisable to select a MLM capable of handling and generating extremely long text sequences, such as those with input lengths of 4096 characters or more. Based on preset account detection text, relational features, and fusion features, MLMs can detect anomalies in target application accounts.

[0237] Preset account detection prompts can guide the large language model in its anomaly detection direction and provide output examples. For example, a preset account detection prompt might be: "Please determine whether this account is an abnormal account. Output example: 'Account {*}{is / is not} abnormal account'". This preset prompt guides the large language model in detecting account abnormalities and indicates the model's output format.

[0238] The preset account detection prompt text, relationship features, and fusion features are input into the large language model. Guided by the preset account detection prompt text, the large language model can identify the relationship features and fusion features, fully understand the relationship between the target application account and the account content, and output the anomaly detection results.

[0239] In one implementation, a preset account detection prompt text, correlation features, and fusion features are input into a large language model to obtain the anomaly detection results output by the large language model, including:

[0240] Obtain the target preset account detection prompt text corresponding to the target detection scenario;

[0241] By inputting the target preset account detection prompt text, correlation features, and fusion features into the large language model, the anomaly detection results of the target detection scenario are obtained.

[0242] The target detection scenario can instruct the large language model to perform anomaly detection on the target application account. The pre-defined target account detection prompt text is used to guide the large language model towards the target detection scenario.

[0243] For example Figure 15As shown, when the target detection scenario is risk type detection, based on the corresponding preset target account detection prompt text 1510, the large language model 1540 can determine the risk type of the target application account according to the correlation feature 1520 and the fusion feature 1530. Depending on the content of the illegal activities undertaken by the target application account, the target application account may have multiple risk types. In the risk type identification scenario, the large language model 1540 can accurately output the risk type of the target application account, so that the target application account can be processed based on the specific risk type. When the target detection scenario is account action prediction, based on the corresponding preset target account detection prompt text 1510, the large language model 1540 can determine whether the target application account will perform a certain abnormal action according to the correlation feature 1520 and the fusion feature 1530. In the account action prediction scenario, pre-intervention is achieved by predicting whether the target application account will perform a certain abnormal action, thus preventing the action from threatening the internet application environment. When the target detection scenario is account similarity detection, based on the corresponding preset account detection prompt text 1510, the large language model 1540 can determine whether the target application account is similar to another account based on the association feature 1520 and the fusion feature 1530. In the account similarity detection scenario, the similarity judgment result of the target application account can be used to check whether the target application account has other team members, thereby identifying the abnormal account team.

[0244] Therefore, the large language model can perform detection in multiple target detection scenarios based on correlation features and fusion features. Pre-set target account detection prompts can guide the large language model in its detection scenarios. For different detection scenarios, the large language model can be fine-tuned in advance to obtain more accurate anomaly detection results.

[0245] Different preset account detection prompts can be set for different target detection scenarios. For example, in the risk type detection scenario, the preset account detection prompt could be "Determine the risk type of this account. Output example: Account {*} is {risk type R1 / risk type R2 / risk type R3 / no risk account}"; in the account action prediction scenario, when predicting whether a target application account will post harmful content, the preset account detection prompt could be "Determine whether this account will post harmful content. Output example: Account {*} {will / will not} post harmful content"; in the account similarity detection scenario, after determining that account A1 is an abnormal account, the preset account detection prompt could be "Determine the similarity between this account and account A1, and determine whether they belong to the same team. Output example: Account {*} and account A1 have a similarity of {*%}, and they {belong to / do not belong to} the same team."

[0246] Detection based on pre-defined account detection prompts allows large language models to perform different detection tasks, thereby expanding the diversity of account anomaly detection.

[0247] In summary, the abnormal account detection method of this disclosure can extract rich social dimension features related to the target application account through the relationship graph. By utilizing the social dimension features and account content dimension features, and leveraging the powerful semantic recognition and reasoning capabilities of the large language model, the accuracy of abnormal account detection is improved. Since the large language model cannot directly recognize the relationship graph, this disclosure embodiment can extract the first and second relationships from the relationship graph to construct relationship features, thereby representing the relationship dimension features of the target application account; and construct a relationship feature sequence based on the element content information and category information corresponding to each element object node, thereby representing the content features of elements of multiple categories that are related to the target application account. The relationship features and relationship feature sequence can fully express the social dimension features represented by the relationship graph. The fusion feature integrates the account content features of the target application account itself and the content features of each element. By using the large language model and preset account detection prompt text to perform semantic understanding of the relationship features and fusion features, the abnormal detection result of the target application account is determined from the relationship dimension and rich content dimension of the target application account. Therefore, the abnormal account detection method of this disclosure utilizes a more comprehensive account evaluation dimension and improves the accuracy of abnormal account detection by leveraging the powerful semantic recognition and reasoning capabilities of a large language model.

[0248] This disclosure provides a detailed description of embodiments in conjunction with specific application scenarios.

[0249] like Figure 16 The diagram shown illustrates the specific process of applying the abnormal account detection method provided in this disclosure to an account risk type detection scenario. The abnormal account detection method includes:

[0250] Step 1610: Obtain the relationship graph corresponding to the target application account to be detected.

[0251] The target application account can be an application account being monitored within an internet application. The relationship graph includes element object nodes of various categories that are associated with the target application account based on multiple relationships. Thus, the relationship graph can represent the connections between the target application account and other elements within the internet application.

[0252] The categories of element object nodes can include account categories, group categories, and content categories. The relationship between account category element object nodes and the target application account can include: friend association, phone number association, and device number association. The relationship between group category element object nodes and the target application account can include group management association and group member association. The relationship between content category element object nodes and the target application account can include: published content association and interactive content association.

[0253] The relationship graph can include not only element object nodes that are directly related to the target application account, but also element object nodes that are indirectly related to the target application account.

[0254] The relationship graph can be pre-generated or generated on the fly when performing anomaly detection on the target application account. When anomaly detection is required for the target application account, the relationship graph corresponding to the target application account can be retrieved.

[0255] Step 1620: Extract the first association between each element object node and the target node corresponding to the target application account based on the association graph, and extract the second association between different element object nodes.

[0256] When an element object node is connected to a target node in the relationship graph, a first relationship can be established between the element object node and the target node, and this relationship can be extracted. When two element object nodes are connected, a second relationship can be established between the two element object nodes, and this relationship can be extracted.

[0257] Step 1630: Construct the degree matrix and adjacency matrix corresponding to the association graph based on the first association relationship and the second association relationship; construct the node association matrix based on the degree matrix and adjacency matrix; input the node association matrix into the first neural network to generate association relationship features.

[0258] A degree matrix can be used to represent the number of associations corresponding to a target node and each element object node. Constructing a degree matrix based on the first and second associations allows us to determine the degree of the target node in the association graph by the number of first associations, and the degree of each element object node in the association graph by the first and second associations. Specifically, the degree of an element object node is equal to the number of that element object node contained in each of the first and second associations.

[0259] An adjacency matrix can represent whether there are edges between target nodes and element nodes in an association graph. When constructing an adjacency matrix based on the first and second association relationships, if there is a first or second association relationship between two nodes, the corresponding matrix value is 1; otherwise, if there is no first or second association relationship between two nodes, the corresponding matrix value is 0.

[0260] The node association matrix is ​​equal to the difference between the degree matrix and the adjacency matrix. After constructing the node association matrix, it can be input into the first neural network to generate association relationship features.

[0261] The first neural network can encode the node association matrix, thereby mapping the node association matrix to a semantic space that a large language model can understand. The first neural network can be a multilayer perceptron or a converter network. The first neural network can be pre-trained based on a predetermined neural network for the account risk type detection scenario of this disclosure embodiment.

[0262] Step 1640: Sort multiple element object nodes based on the category information corresponding to each element object node to obtain the node order.

[0263] The node order determines the ranking of the element content features corresponding to each element object node within the associated feature sequence. When determining the node order based on category information, element object nodes of the same category can be arranged together, while element object nodes of different categories can be sorted according to a predetermined category order. Multiple element object nodes of a single category can be arranged in any order.

[0264] Step 1650: Input multiple element attributes corresponding to each element object node into the node encoding network according to the node order; when the element attribute is a text attribute, generate element text attribute features based on the text encoding sub-network; when the element attribute is an image attribute, generate element image attribute features based on the image encoding sub-network; construct an associated feature sequence based on the element text attribute features and element image attribute features corresponding to each element object node.

[0265] Multiple element attributes can represent multiple pieces of content for an element. For example, account-related elements may have multiple element attributes such as: account avatar, account nickname, account introduction, and account description. Group-related elements may have multiple element attributes such as: group avatar, group nickname, group introduction, and group announcement. Content-related elements may have multiple element attributes such as: content cover, content title, content body, and content tags.

[0266] Element attributes can be text attributes, such as account nickname, group introduction, and content body; or they can be image attributes, such as account avatar, group avatar, and content cover.

[0267] Node-encoding networks can map element attributes to a vector space, forming corresponding feature vectors. A node-encoding network includes an image encoding sub-network and a text encoding sub-network. The image encoding sub-network processes image attributes, and the text encoding sub-network processes text attributes.

[0268] Following the node order, multiple element attributes corresponding to each element object node are sequentially input into the node encoding network. The image encoding sub-network processes the image attributes to obtain image attribute features, and the text encoding sub-network processes the text attributes to obtain text attribute features. Based on the image or text attribute features corresponding to each element attribute, element features of the element object node are generated. Concatenating these element features according to the node order constructs the associated feature sequence corresponding to the target application account.

[0269] Step 1660: Obtain the target account content information of the target application account and input the target account content information into the content encoding network; when the content information is text-based, use the text encoding sub-network to generate text content features; when the content information is image-based, use the image encoding sub-network to generate image content features; construct account content features based on the text content features and image content features corresponding to each content information.

[0270] The target account content information refers to the content related to the target application account itself, which may include multiple pieces of information, such as the account nickname, account avatar, and account actions. The target account content information can be either image content or text content.

[0271] The target account content information is input into the content encoding network. The content encoding network can use the same network structure and parameters as the node encoding network. The content encoding network includes an image encoding subnetwork and a text encoding subnetwork. The image encoding subnetwork is used to process image content information, and the text encoding subnetwork is used to process text content information.

[0272] The target account content information is input into a content encoding network. The image encoding subnetwork processes the image content information to obtain image content features, and the text encoding subnetwork processes the text content information to obtain text content features. The image content features or text content features corresponding to each piece of content information are concatenated to obtain the account content features of the target application account.

[0273] Step 1670: Input the account content features and associated feature sequences into the second neural network to generate fused features.

[0274] The fused features can simultaneously represent the content information of the target account and the content information of multiple elements. The second neural network can fuse and encode the account content features and the associated feature sequences to obtain fused features. This maps the account content features and the associated feature sequences into a semantic space that the large language model can understand, enabling the large language model to fully understand each feature and the relationships between features.

[0275] The second neural network is similar to the first neural network and can be a multilayer perceptron or a converter network. The second neural network can also be pre-trained based on a predetermined neural network for the account risk type detection scenario of this disclosure embodiment.

[0276] Step 1680: Input the preset account detection prompt text, correlation features and fusion features into the large language model to obtain the anomaly detection results output by the large language model.

[0277] Preset account detection prompts can guide the detection direction of large language models and provide output examples for them. Different preset account detection prompts can be used for different anomaly detection scenarios. In the account risk type detection scenario, the preset account detection prompt could be "Determine the risk type of this account. Output example: Account {*} is {risk type R1 / risk type R2 / risk type R3 / no-risk account}".

[0278] The large language model receives a pre-set account detection prompt text and determines whether the target application account poses a threat to the Internet application based on the correlation features and fusion features.

[0279] In summary, the abnormal account detection method of this disclosure embodiment can be expressed as follows: Figure 17 First, a relationship graph 1740 is constructed using the relationship 1710. Based on the relationships obtained from the relationship graph 1740, the relationship attributes 1720 corresponding to each element, and the account content 1730 of the target application account itself, the powerful semantic recognition and reasoning capabilities of the large language model 1750 are used to detect the risk type 1760.

[0280] The evaluation results of binary classification for account anomaly detection using the abnormal account detection method of this embodiment on an evaluation set of 10,000 samples in the experiment are shown in Table 2:

[0281] Accuracy Recall rate F1 score normal 0.97 0.98 0.97 abnormal 0.92 0.88 0.9

[0282] Table 2

[0283] The results of the risk type classification task are shown in Table 3:

[0284] Accuracy Recall rate F1 score Suspected risks 0.84 0.86 0.85 normal 0.97 0.98 0.97 Risk type R1 0.82 0.95 0.88 Risk type R2 0.59 0.39 0.47 Risk type R3 0.79 0.59 0.68

[0285] Table 3

[0286] As can be seen from Tables 2 and 3, the abnormal account detection method of this disclosure embodiment performs well in both binary anomaly detection and risk type identification tasks, and can effectively detect anomalies in accounts in Internet applications.

[0287] Description of apparatus and devices according to embodiments of this disclosure

[0288] It is understood that although the steps in the above flowcharts are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this embodiment, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the above flowcharts may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0289] It should be noted that in various specific embodiments of this application, when processing is required based on data related to the characteristics of the target content, such as target content attribute information or attribute information sets, permission or consent from the target content provider will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require obtaining target content attribute information, separate permission or consent from the target content provider will be obtained through pop-ups or redirection to a confirmation page. Only after obtaining the separate permission or consent from the target content provider will the necessary target content-related data for the normal operation of the embodiments of this application be obtained.

[0290] Figure 18 This is a schematic diagram of the structure of the abnormal account detection device 1800 provided in an embodiment of the present disclosure. The abnormal account detection device 1800 includes:

[0291] The acquisition unit 1810 is used to acquire the association graph corresponding to the target application account to be detected. The association graph includes element object nodes of various categories that are associated with the target application account based on multiple association relationships.

[0292] The first generation unit 1820 is used to extract the first association relationship between each element object node and the target node corresponding to the target application account based on the association relationship graph, and to extract the second association relationship between different element object nodes, and to generate association relationship features based on the first association relationship and the second association relationship.

[0293] Construction unit 1830 is used to construct the associated feature sequence corresponding to the target application account based on the element content information and category information corresponding to each element object node;

[0294] The second generation unit 1840 is used to obtain the account content features of the target application account and generate fused features based on the account content features and the associated feature sequence.

[0295] Input unit 1850 is used to input the preset account detection prompt text, correlation features and fusion features into the large language model to obtain the anomaly detection results output by the large language model.

[0296] Optionally, in one implementation, the building unit 1830 is specifically used for:

[0297] The node order is obtained by sorting multiple element object nodes based on the category information corresponding to each element object node.

[0298] Construct a sequence of associated features for the target application account based on the node order and the element content information corresponding to each element object node.

[0299] Optionally, in one implementation, the element content information includes multiple element attributes;

[0300] Building unit 1830 is specifically used for:

[0301] In the order of nodes, input the multiple element attributes corresponding to each element object node into the node encoding network to obtain multiple element attribute features.

[0302] Based on the multiple element attribute features corresponding to each element object node, the element content features corresponding to each element object node are generated, and based on the element content features, the associated feature sequence corresponding to the target application account is constructed.

[0303] Optionally, in one implementation, element attributes include text attributes and image attributes;

[0304] Building unit 1830 is specifically used for:

[0305] According to the node order, the multiple element attributes corresponding to each element object node are input into the node encoding network, which includes a text encoding sub-network and an image encoding sub-network.

[0306] When the element attribute is a text attribute, the element text attribute feature is generated based on the text encoding sub-network;

[0307] When an element attribute is an image attribute, the element's image attribute features are generated based on the image encoding subnetwork.

[0308] Optionally, in one embodiment, the first generating unit 1820 is specifically used for:

[0309] Construct a node association matrix based on the first and second association relationships;

[0310] The node association matrix is ​​input into the first neural network to generate association relationship features.

[0311] Optionally, in one embodiment, the first generating unit 1820 is specifically used for:

[0312] Construct the degree matrix and adjacency matrix corresponding to the association graph based on the first association relationship and the second association relationship;

[0313] Construct a node association matrix based on the degree matrix and the adjacency matrix.

[0314] Optionally, in one embodiment, the first generating unit 1820 is specifically used for:

[0315] Based on the first and second association relationships, obtain the third association relationship between different element object nodes of the same category;

[0316] Generate association features based on the first association, the second association, and the third association.

[0317] Optionally, in one embodiment, the first generating unit 1820 is specifically used for:

[0318] Node groups are determined based on the first and second association relationships. Each node group includes multiple element object nodes of the same category, and these multiple element object nodes are connected to the same intermediate node in the association relationship graph.

[0319] For each node group, obtain the third association relationship based on the association relationship category between each element object node and its corresponding intermediate node.

[0320] Optionally, in one implementation, the association graph corresponding to the target application account to be detected is generated through the following process:

[0321] Obtain first elements of various categories that are linked to the target application account based on multiple relationships;

[0322] Retrieve second elements of various categories that are related to the first element based on multiple relationships;

[0323] Generate a relationship graph based on the target application account, the first element, and the second element.

[0324] Optionally, in one implementation, obtaining second elements of multiple categories that are associated with the first element based on multiple relationships includes:

[0325] Retrieve multiple candidate elements of various categories that are related to the first element based on multiple relationships;

[0326] Determine multiple relevance scores between multiple candidate elements and the target application account;

[0327] The second element is determined from multiple candidate elements based on multiple correlation scores.

[0328] Optionally, in one embodiment, the input unit 1850 is specifically used for:

[0329] Obtain the target preset account detection prompt text corresponding to the target detection scenario;

[0330] By inputting the target preset account detection prompt text, correlation features, and fusion features into the large language model, the anomaly detection results of the target detection scenario are obtained.

[0331] Reference Figure 19 , Figure 19 To implement the structural block diagram of a portion of the terminal 140 according to an embodiment of this disclosure, the terminal includes: a radio frequency (RF) circuit 1910, a memory 1915, an input unit 1930, a display unit 1940, a sensor 1950, an audio circuit 1960, a wireless fidelity (WiFi) module 1970, a processor 1980, and a power supply 1990, among other components. Those skilled in the art will understand that... Figure 19 The terminal 140 structure shown does not constitute a limitation on a mobile phone or computer, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0332] The RF circuit 1910 can be used to receive and transmit signals during information transmission or calls. In particular, it receives downlink information from the base station and processes it with the processor 1980; in addition, it transmits uplink data to the base station.

[0333] The memory 1915 can be used to store software programs and modules. The processor 1980 executes various functional applications of the content terminal and abnormal account detection by running the software programs and modules stored in the memory 1915.

[0334] The input unit 1930 can be used to receive input numeric or character information, and to generate key signal inputs related to the settings and function control of the content terminal. Specifically, the input unit 1930 may include a touch panel 1931 and other input devices 1932.

[0335] Display unit 1940 can be used to display input or provided information, as well as various menus of the content terminal. Display unit 1940 may include display panel 1941.

[0336] Audio circuitry 1960, speaker 1961, and microphone 1962 provide an audio interface.

[0337] In this embodiment, the processor 1980 included in the object terminal 140 can execute the abnormal account detection method of the previous embodiment.

[0338] The target terminal 140 in this disclosure includes, but is not limited to, mobile phones, computers, intelligent voice exchange devices, smart home appliances, vehicle terminals, and aircraft. This invention can be applied to various scenarios, including but not limited to recommendation systems and social systems.

[0339] Figure 20 This is a partial structural block diagram of a server 110 implementing an embodiment of the present disclosure. The server 110 can vary significantly due to different configurations or performance characteristics, and may include one or more central processing units (CPUs) 2022 (e.g., one or more processors) and memory 2032, and one or more storage media 2030 (e.g., one or more mass storage devices) for storing application programs 2042 or data 2044. The memory 2032 and storage media 2030 may be temporary or persistent storage. The program stored in the storage media 2030 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server. Furthermore, the CPU 2022 may be configured to communicate with the storage media 2030 and execute the series of instruction operations in the storage media 2030 on the server.

[0340] Server 110 may also include one or more power supplies 2026, one or more wired or wireless network interfaces 2050, one or more input / output interfaces 2058, and / or one or more operating systems 2041, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0341] The central processing unit 2022 in server 110 can be used to execute the abnormal account detection method of the present disclosure embodiments.

[0342] This disclosure also provides a computer-readable storage medium for storing program code for executing the abnormal account detection methods of the foregoing embodiments.

[0343] This disclosure also provides a computer program product comprising a computer program. The processor of an electronic device reads and executes the computer program, causing the electronic device to perform the aforementioned abnormal account detection method.

[0344] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in this disclosure and the foregoing drawings are used to distinguish similar terms and are not necessarily used to describe a particular order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this disclosure described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “including,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0345] It should be understood that in this disclosure, "at least one item" refers to one or more items, and "more than one item" refers to two or more items. "And / or" is used to describe the relationship between related content, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related content are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0346] It should be understood that in the description of the embodiments disclosed herein, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0347] In this disclosure, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0348] In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0349] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0350] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0351] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0352] It should also be understood that the various implementation methods provided in this disclosure can be combined arbitrarily to achieve different technical effects.

[0353] The above is a detailed description of the embodiments of this disclosure. However, this disclosure is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this disclosure. All such equivalent modifications or substitutions are included within the scope defined by the claims of this disclosure.

Claims

1. An abnormal account detection method, characterized in that, The method comprises: obtaining an association graph corresponding to a target application account to be detected, the association graph comprising a plurality of element object nodes of a plurality of categories associated with the target application account based on a plurality of association relationships; extracting a first association relationship between each element object node and a target node corresponding to the target application account based on the association graph, and extracting a second association relationship between different element object nodes, and generating an association relationship feature based on the first association relationship and the second association relationship; constructing an association feature sequence corresponding to the target application account according to element content information and category information corresponding to each element object node; obtaining an account content feature of the target application account, and generating a fusion feature based on the account content feature and the association feature sequence; inputting a preset account detection prompt text, the association relationship feature and the fusion feature into a large language model to obtain an abnormality detection result output by the large language model.

2. The method of claim 1, wherein, The method comprises: sorting the plurality of element object nodes based on category information corresponding to each element object node to obtain a node order; constructing an association feature sequence corresponding to the target application account according to the node order and element content information corresponding to each element object node.

3. The method of claim 2, wherein, The element content information comprises a plurality of element attributes. The method comprises: inputting the plurality of element attributes corresponding to each element object node into a node encoding network in the node order to obtain a plurality of element attribute features; generating an element content feature corresponding to each element object node based on the plurality of element attribute features corresponding to each element object node, and constructing an association feature sequence corresponding to the target application account based on the element content feature.

4. The method of claim 3, wherein, The element attributes comprise text attributes and picture attributes. The method comprises: inputting the plurality of element attributes corresponding to each element object node into a node encoding network in the node order, the node encoding network comprising a text encoding sub-network and a picture encoding sub-network; when the element attribute is the text attribute, generating an element text attribute feature based on the text encoding sub-network; when the element attribute is the picture attribute, generating an element picture attribute feature based on the picture encoding sub-network.

5. The method of claim 1, wherein, The method comprises: constructing a node association matrix based on the first association relationship and the second association relationship; inputting the node association matrix into a first neural network to generate an association relationship feature.

6. The method of claim 5, wherein, The method comprises: construct a degree matrix and an adjacency matrix corresponding to the association graph based on the first association relationship and the second association relationship; construct a node association matrix based on the degree matrix and the adjacency matrix.

7. The method of claim 1, wherein, The generating an association relationship feature based on the first association relationship and the second association relationship comprises: obtaining a third association relationship between different element object nodes of the same category based on the first association relationship and the second association relationship; generating an association relationship feature based on the first association relationship, the second association relationship and the third association relationship.

8. The method of claim 7, wherein, The obtaining a third association relationship between different element object nodes of the same category based on the first association relationship and the second association relationship comprises: determining a node group based on the first association relationship and the second association relationship, the node group including a plurality of element object nodes of the same category, and the plurality of element object nodes being connected to a same intermediate node in the association graph; for each node group, obtaining a third association relationship based on the association relationship category between each element object node and the corresponding intermediate node.

9. The method of claim 1, wherein, The association graph corresponding to the target application account to be detected is generated through the following process: obtaining a plurality of categories of first elements associated with the target application account based on a plurality of association relationships; obtaining a plurality of categories of second elements associated with the first elements based on the plurality of association relationships; generating an association graph based on the target application account, the first elements and the second elements.

10. The method of claim 9, wherein, The obtaining a plurality of categories of second elements associated with the first elements based on the plurality of association relationships comprises: obtaining a plurality of candidate elements of a plurality of categories associated with the first elements based on the plurality of association relationships; determining a plurality of association scores of the plurality of candidate elements and the target application account; determining the second elements from the plurality of candidate elements based on the plurality of association scores.

11. The method of claim 1, wherein, The inputting the preset account detection prompt text, the association relationship feature and the fusion feature into a large language model to obtain an abnormality detection result output by the large language model comprises: obtaining a target preset account detection prompt text corresponding to a target detection scenario; inputting the target preset account detection prompt text, the association relationship feature and the fusion feature into a large language model to obtain an abnormality detection result of the target detection scenario.

12. An abnormal account detection apparatus characterized by comprising: comprises: an obtaining unit, configured to obtain an association graph corresponding to a target application account to be detected, the association graph including a plurality of categories of element object nodes associated with the target application account based on a plurality of association relationships; a first generating unit, configured to extract a first association relationship between each element object node and a target node corresponding to the target application account based on the association graph, extract a second association relationship between different element object nodes, and generate an association relationship feature based on the first association relationship and the second association relationship; a constructing unit, configured to construct an association feature sequence corresponding to the target application account based on element content information and category information corresponding to each element object node. A second generation unit is configured to obtain an account content feature of the target application account, and generate a fusion feature according to the account content feature and the sequence of association features. An input unit is configured to input a preset account detection prompt text, the sequence of association features, and the fusion feature into a large language model to obtain an abnormality detection result output by the large language model.

13. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the abnormal account detection method according to any one of claims 1-11.

14. A storage medium storing a computer program, characterized in that, The computer program is executed by the processor to implement the abnormal account detection method according to any one of claims 1-11.

15. A computer program product, comprising a computer program, which is read and executed by a processor of an electronic device, so that the electronic device performs the abnormal account detection method according to any one of claims 1-11.

Images