Anomaly identification model generation method, anomaly identification method, and device

Abstract

The application provides an abnormality identification model generation method, an abnormality identification method and device. The abnormality identification model generation method comprises: training an initial account model and an initial content model based on sample account data and sample content data, and constructing a candidate account model and a candidate content model; performing account abnormality identification based on the candidate account model to obtain an account identification result; performing content abnormality identification based on the candidate content model to obtain a content identification result; updating the output of the initial account model in the candidate content model based on the account identification result to obtain a candidate content update model, and updating the output of the initial content model in the candidate account model based on the content identification result to obtain a candidate account update model; and performing interactive training on the candidate account update model and the candidate content update model to obtain an abnormal account identification model and an abnormal content identification model. The application can iteratively train the content model and the account model interactively to improve the identification accuracy of the model.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and specifically relates to an anomaly recognition model generation method, an anomaly recognition method, and an apparatus. Background Technology

[0002] Malicious content refers to content that poses legal compliance risks or harms the platform's ecosystem. Existing technologies typically fine-tune the content model and account model once on a task dataset, using this fine-tuned model to identify malicious content and malicious accounts respectively.

[0003] However, by fine-tuning the content model and account model on the task dataset to identify malicious content and malicious accounts separately, the content model and account model cannot mutually reinforce each other, thus limiting the accuracy of malicious content identification or malicious account identification. Summary of the Invention

[0004] To address the aforementioned technical problems, this application provides an anomaly identification model generation method, an anomaly identification method, and an apparatus.

[0005] On the one hand, this application proposes an anomaly recognition model generation method, the method comprising:

[0006] Obtain sample account data and sample content data of the sample account; the sample content data is data associated with the content published by the sample account;

[0007] Based on the sample account data and the sample content data, train the initial account model and the initial content model respectively;

[0008] Candidate account models are constructed based on the initial account model and the initial content model, wherein the output of the initial content model in the candidate account model is a missing value; candidate content models are constructed based on the initial account model and the initial content model, wherein the output of the initial account model in the candidate content model is a missing value.

[0009] The sample account data and sample content data are input into the candidate account model for account anomaly identification to obtain account identification results; the sample account data and sample content data are input into the candidate content model for content anomaly identification to obtain content identification results.

[0010] The output of the initial account model in the candidate content model is updated based on the account recognition result to obtain the candidate content update model; the output of the initial content model in the candidate account model is updated based on the content recognition result to obtain the candidate account update model.

[0011] Based on the sample account data and sample content data, the candidate account update model and the candidate content update model are trained iteratively to obtain the abnormal account identification model and the abnormal content identification model.

[0012] On the other hand, this application proposes an anomaly identification method, the method comprising:

[0013] Obtain the target account's account data, content data, and abnormal account identification model; the content data is data associated with the content published by the target account.

[0014] The account data and content data are input into the abnormal account identification model for abnormal account identification processing to obtain the abnormal identification result of the target account;

[0015] The abnormal account identification model is generated based on the abnormal identification model generation method described in any of the above embodiments.

[0016] On the other hand, this application proposes an anomaly identification method, the method comprising:

[0017] Obtain account data, content data, and anomaly content identification model for the target account; the content data is data associated with the content published by the target account.

[0018] The account data and the content data are input into the abnormal content recognition model for content anomaly recognition processing to obtain the anomaly recognition result of the content data.

[0019] The abnormal content recognition model is generated based on the abnormal recognition model generation method described in any of the above embodiments.

[0020] On the other hand, this application proposes an anomaly recognition model generation device, the device comprising:

[0021] The sample data acquisition module is used to acquire sample account data and sample content data of sample accounts; the sample content data is data associated with the content published by the sample account.

[0022] The initial training module is used to train the initial account model and the initial content model based on the sample account data and the sample content data, respectively.

[0023] A construction module is used to construct a candidate account model based on the initial account model and the initial content model, wherein the output of the initial content model in the candidate account model is a missing value; and to construct a candidate content model based on the initial account model and the initial content model, wherein the output of the initial account model in the candidate content model is a missing value.

[0024] The initial identification module is used to input the sample account data and the sample content data into the candidate account model to identify account anomalies and obtain account identification results; and to input the sample account data and the sample content data into the candidate content model to identify content anomalies and obtain content identification results.

[0025] The output update module is used to update the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, and to update the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model.

[0026] The interactive training module is used to perform interactive iterative training on the candidate account update model and the candidate content update model based on the sample account data and sample content data, so as to obtain the abnormal account identification model and the abnormal content identification model.

[0027] In an optional embodiment, the initial account model includes an account feature extraction sub-model and a first anomaly identification sub-model, and the candidate account model includes:

[0028] The candidate account model construction unit is used to construct the candidate account model based on the account feature extraction sub-model, the initial content model, and the first anomaly identification sub-model; wherein, the first anomaly identification sub-model is used to process the output of the account feature extraction sub-model and the output of the initial content model;

[0029] The initial content model includes a content feature extraction sub-model and a second anomaly identification sub-model; the candidate account model includes:

[0030] The candidate content model construction unit is used to construct the candidate content model based on the content feature extraction sub-model, the initial account model, and the second anomaly identification sub-model; wherein, the second anomaly identification sub-model is used to process the output of the content feature extraction sub-model and the output of the initial account model.

[0031] In an optional embodiment, the sample account data is data associated with the attributes and operations of the sample account, and the initial identification module includes:

[0032] The first input unit is used to input the sample account data and the sample content data into the candidate account model;

[0033] The first extraction unit is used to extract the account attribute features and account operation features of the sample account from the sample account data based on the account feature extraction sub-model in the candidate account model, and to perform content anomaly identification on the sample content data based on the initial content model in the candidate account model to obtain a first content auxiliary identification result; the value of the first content auxiliary identification result is a missing value.

[0034] The first identification unit is used to perform account anomaly identification processing on the account attribute features, the account operation features and the first content-assisted identification result based on the first anomaly identification sub-model in the candidate account model, so as to obtain the account identification result.

[0035] In an optional embodiment, the initial identification module includes:

[0036] The second input unit is used to input the sample account data and the sample content data into the candidate content model;

[0037] The second extraction unit is used to extract the content features of the sample content data based on the content feature extraction sub-model in the candidate content model, and to perform account anomaly identification on the sample account data based on the initial account model in the candidate content model to obtain a first account auxiliary identification result; the value of the first account auxiliary identification result is a missing value.

[0038] The second identification unit is used to perform content anomaly identification processing on the content features and the first account-assisted identification result based on the second anomaly identification sub-model in the candidate content model, so as to obtain the content identification result.

[0039] In an optional embodiment, the output update module includes:

[0040] The first filling unit is used to fill the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, so that the output of the initial account model in the candidate content model for account anomaly recognition of the sample account data is the account recognition result.

[0041] The second filling unit is used to fill the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model, so that the output obtained by the initial content model in the candidate account model to perform content anomaly recognition on the sample content data is the content recognition result.

[0042] In an optional embodiment, the interactive training module includes:

[0043] The current model determination unit is used to take the candidate account update model as the current account model and the candidate content update model as the current content model.

[0044] The current identification result determination unit is used to input the sample account data and sample content data into the current account model to perform account anomaly identification and obtain the current account identification result, and to input the sample account data and sample content data into the current content model to perform content anomaly identification and obtain the current content identification result;

[0045] The loss data determination unit is used to determine the current account loss data based on the difference between the current account identification result and the abnormal tags corresponding to the sample account data, and to determine the current content loss data based on the difference between the current content identification result and the abnormal tags corresponding to the sample content data.

[0046] The re-determination unit is used to update the output of the initial account model in the current content model based on the current account identification result when the current account loss data and the current content loss data do not meet the preset conditions, and to use the updated model as the current content model again. It also updates the output of the initial content module in the current account model based on the current content identification result and uses the updated model as the current account model again.

[0047] The repeating unit is used to repeat the process of inputting the sample account data and the sample content data into the current account model for account anomaly identification, until the updated model is used as the current account model again, until the current account loss data and the current content loss data meet the preset conditions or the number of iterations meets the preset number threshold, so as to obtain the abnormal account identification model and the abnormal content identification model.

[0048] In an optional embodiment, the current identification result determination unit includes:

[0049] The first current data input subunit is used to input the sample account data and sample content data into the current account model;

[0050] The first auxiliary identification result generation subunit is used to extract the account attribute features and account operation features of the sample account data based on the current account model, and to perform content anomaly identification on the sample content data based on the initial content model in the current account model, so as to obtain the second content auxiliary identification result.

[0051] The current account identification result generation unit is used to perform account anomaly identification processing on the account attribute features, account operation features and second content-assisted identification results based on the current account model to obtain the current account identification result.

[0052] In an optional embodiment, the current identification result determination unit includes:

[0053] The second current data input subunit is used to input the sample account data and sample content data into the current content model;

[0054] The second auxiliary identification result generation subunit is used to extract the content features of the sample content data based on the current content model, and to perform account anomaly identification on the sample account data based on the initial account model in the current content model, so as to obtain the second account auxiliary identification result.

[0055] The current content recognition result generation unit is used to perform content anomaly recognition processing on the content features and the second account-assisted recognition result based on the current content model to obtain the current content recognition result.

[0056] In an optional embodiment, the re-determination unit includes:

[0057] The content model is redefined subunit, which is used to fill the output of the initial account model in the current content model based on the current account identification result, and the filled model is used as the current content model again, so that the output of the initial account model in the redefined current content model for account anomaly identification of the sample account data is the current account identification result.

[0058] The re-determination unit includes:

[0059] The account model is redefined as a sub-unit, which is used to fill the output of the initial content model in the current account model based on the current content recognition result, and the filled model is used as the current account model again, so that the output of the initial content model in the redefined current account model for content anomaly recognition of the sample content data is the current content recognition result.

[0060] In an optional embodiment, the sample content data is multimodal data, and the abnormal account identification model and the abnormal content identification model are multimodal models.

[0061] On the other hand, this application proposes an anomaly detection device, the device comprising:

[0062] The first data acquisition module is used to acquire account data, content data, and an abnormal account identification model of the target account; the content data is data associated with the content published by the target account.

[0063] The account recognition module is used to input the account data and the content data into the abnormal account recognition model to perform account anomaly recognition processing and obtain the anomaly recognition result of the target account.

[0064] The abnormal account identification model is generated based on the abnormal identification model generation method described in any of the above embodiments.

[0065] On the other hand, this application proposes an anomaly detection device, the device comprising:

[0066] The second data acquisition module is used to acquire account data, content data, and an abnormal content identification model of the target account; the content data is data associated with the content published by the target account.

[0067] The content recognition module is used to input the account data and the content data into the abnormal content recognition model for content anomaly recognition processing, and obtain the anomaly recognition result of the content data;

[0068] The abnormal content recognition model is generated based on the abnormal recognition model generation method described in any of the above embodiments.

[0069] On the other hand, this application proposes an electronic device including a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the anomaly recognition model generation method or anomaly recognition method as described above.

[0070] On the other hand, this application proposes a computer-readable storage medium storing at least one instruction or at least one program, which is loaded and executed by a processor to implement the anomaly recognition model generation method or anomaly recognition method as described above.

[0071] On the other hand, this application proposes a computer program product, including a computer program that, when executed by a processor, implements the anomaly recognition model generation method or anomaly recognition method as described above.

[0072] This application provides a method for generating an anomaly detection model. The method first trains an initial account model and an initial content model. Based on these models, a candidate account model is constructed, with the output of the initial content model set to missing values. Similarly, a candidate content model is constructed, also with the output of the initial account model set to missing values. Next, interactive training is performed: sample account data and sample content data are input into the candidate account model for account anomaly detection, yielding an account detection result. This result is then used to update the output of the initial account model in the candidate content model, resulting in an updated candidate content model. Similarly, sample account data and sample content data are input into the candidate content model for content anomaly detection, yielding a content detection result. This result is then used to update the output of the initial content model in the candidate account model, resulting in an updated candidate account model. Finally, interactive iterative training is performed on the candidate account update model and candidate content update model based on the sample account data and sample content data until they converge, resulting in an anomaly account detection model and an anomaly content detection model. Therefore, by using account recognition results to update the output of the initial account model in the candidate content model, and using content recognition results to update the output of the initial content model in the candidate account model, the content model and the account model are interactively and iteratively trained. This allows the content model to assist in identifying abnormal accounts, and the account model to assist in identifying abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, thereby improving the recognition accuracy of the account model and the content model, and better protecting the security of users and the platform.

[0073] This application also provides an anomaly identification method. This method uses an abnormal account identification model trained through interactive iteration to identify abnormal accounts. Since the abnormal account identification model trained through interactive iteration includes an initial content model, the initial content model is used to assist in identifying abnormal accounts during the identification process, thereby improving the accuracy and effectiveness of abnormal account identification.

[0074] This application also provides a content anomaly identification method. This method uses an anomaly content identification model trained through interactive iteration to identify accounts. Since the anomaly content identification model trained through interactive iteration includes an initial account model, the initial account model is used to assist in identifying anomaly content during the identification process, thereby improving the accuracy and effectiveness of content anomaly identification. Attached Figure Description

[0075] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a schematic diagram illustrating an anomaly recognition model generation method and an implementation environment of the anomaly recognition method according to an exemplary embodiment.

[0077] Figure 2 This is a flowchart illustrating an anomaly detection model generation method according to an exemplary embodiment. Figure 1 .

[0078] Figure 3 This is a schematic diagram illustrating a candidate account model according to an exemplary embodiment.

[0079] Figure 4 This is a schematic diagram illustrating a candidate content model according to an exemplary embodiment.

[0080] Figure 5 This is a schematic diagram illustrating an example of obtaining an account identification result according to an exemplary embodiment.

[0081] Figure 6 This is a schematic diagram illustrating an example of obtaining an account identification result according to an exemplary embodiment.

[0082] Figure 7 This is a schematic diagram illustrating an interactive iterative training process according to an exemplary embodiment.

[0083] Figure 8 This is a schematic diagram illustrating an interactive iterative training according to an exemplary embodiment.

[0084] Figure 9 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 1 .

[0085] Figure 10 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 2 .

[0086] Figure 11 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 3 .

[0087] Figure 12 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 4 .

[0088] Figure 13 This is a schematic diagram illustrating an application scenario according to an exemplary embodiment.

[0089] Figure 14 This is a schematic diagram illustrating another application scenario according to an exemplary embodiment.

[0090] Figure 15 This is a block diagram illustrating an anomaly recognition model generation apparatus according to an exemplary embodiment.

[0091] Figure 16 This is a block diagram illustrating an anomaly detection device according to an exemplary embodiment.

[0092] Figure 17 This is a block diagram illustrating another anomaly detection device according to an exemplary embodiment.

[0093] Figure 18 This is a hardware structure block diagram of a server provided according to an exemplary embodiment. Detailed Implementation

[0094] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0095] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the present application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0096] It should be noted that, in the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program with a predetermined function, which works together with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0097] Figure 1 This is a schematic diagram illustrating an anomaly detection model generation method and an implementation environment of the anomaly detection method, according to an exemplary embodiment. Figure 1 As shown, the implementation environment may include at least a client 01 and a server 02. The client 01 and the server 02 may be directly or indirectly connected through wired or wireless communication. This embodiment of the application does not impose any limitations on this.

[0098] Specifically, server 02 can be used to generate anomaly detection models, or to perform anomaly detection processing on accounts based on anomaly account detection models, or to perform anomaly detection processing on content based on anomaly content detection models. Optionally, server 02 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0099] Specifically, the client 01 can be used to collect sample account data and sample content data. The client 01 can be, but is not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc.

[0100] It should be noted that, Figure 1 This is just one example. Other implementation environments may also be included in other scenarios.

[0101] It should be noted that in the specific implementation of this application, user information is involved, such as sample accounts, sample account data, sample content data, and other related data. When the embodiments of this application are applied to specific products or technologies, user permission or consent needs to be obtained, and the collection, use, and processing of related data need to comply with relevant laws, regulations, and standards.

[0102] Figure 2This is a flowchart illustrating an anomaly detection model generation method according to an exemplary embodiment. Figure 1 This method can be used for Figure 1 In the implementation environment described in this specification, the method operation steps are as illustrated in the embodiments or flowcharts. However, based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or server product execution, the method can be executed sequentially according to the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown in the embodiments or drawings... Figure 2 As shown, the method may include:

[0103] S101. Obtain sample account data and sample content data of the sample account; the sample content data is data associated with the content published by the sample account.

[0104] Optionally, the sample account can be of various types, without specific limitations. The sample account data carries corresponding anomaly tags, which are used to indicate whether the sample account is an abnormal account. These abnormal accounts include malicious accounts, which refer to authors who publish malicious content (e.g., malicious videos).

[0105] Optionally, the sample account data can be data associated with the attributes and operations of the sample account. The data associated with the sample account's attributes can be account attribute features, which may include, but are not limited to, username, bio, and profile picture. The data associated with the sample account's operations can be account operation features, which may include, but are not limited to, the sample account's login pattern, active time, and social network relationships (accounts followed / followed). These account operation features can be used to provide clues about account operations and help determine whether the account has engaged in abnormal activities.

[0106] Optionally, the sample content data can be data associated with content published by the sample account. This sample content data can be multimodal data, including but not limited to: text descriptions, image frames, audio, etc., of the content published by the sample account. The content published by the sample account can include, but is not limited to: videos, images, text, audio, etc. The sample content data carries corresponding anomaly tags, which are used to indicate whether the sample content is abnormal. Abnormal content includes malicious content, which refers to content that poses legal compliance risks or harms the platform.

[0107] S103. Based on the sample account data and sample content data, train the initial account model and the initial content model respectively.

[0108] In this embodiment, an initial account model can be trained first based on sample account data and corresponding anomaly labels. The specific process may include: inputting sample account data into a preset account model for anomaly prediction processing to obtain an output result; calculating the loss data between the output result and the corresponding label; and continuously adjusting the parameters of the preset account model based on the loss data until the preset account model converges, thus obtaining the initial account model. This initial account model can be an initial malicious account identification model, used to identify whether an account is malicious.

[0109] Simultaneously, an initial content model can be trained based on sample content data and corresponding anomaly labels. The specific process may include: inputting the sample content data into a pre-defined content model for anomaly prediction processing, obtaining the output result, calculating the loss data between the output result and the corresponding label, and continuously adjusting the parameters of the pre-defined content model based on this loss data until the pre-defined content model converges, thus obtaining the initial content model. This initial content model can be an initial malicious content identification model, used to identify whether content is malicious.

[0110] S105. Construct a candidate account model based on the initial account model and the initial content model. The output of the initial content model in the candidate account model is missing. Construct a candidate content model based on the initial account model and the initial content model. The output of the initial account model in the candidate content model is missing.

[0111] In this embodiment of the application, after training to obtain the initial account model and the initial content model, the initial account model and the initial content model can be combined to construct a candidate account model, and the output of the initial content model in the candidate account model is set to the missing value -1. Simultaneously, the initial account model and the initial content model are combined to construct a candidate account model, and the output of the initial account model in the candidate content model is set to the missing value -1.

[0112] S107. Input the sample account data and sample content data into the candidate account model to identify account anomalies and obtain the account identification results; input the sample account data and sample content data into the candidate content model to identify content anomalies and obtain the content identification results.

[0113] S109. Update the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model. Update the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model.

[0114] S1011. Based on sample account data and sample content data, interactive iterative training is performed on the candidate account update model and the candidate content update model to obtain the abnormal account recognition model and the abnormal content recognition model.

[0115] In this embodiment, after constructing the candidate account model and the candidate content model, interactive training can be performed on them. Specifically, sample account data and sample content data are input into the candidate account model for account anomaly identification to obtain the account identification result. This result is then used to update the output of the initial account model in the candidate content model, resulting in a candidate content update model. Similarly, sample account data and sample content data are input into the candidate content model for content anomaly identification to obtain the content identification result. This result is then used to update the output of the initial content model in the candidate account model, resulting in a candidate account update model. Next, based on the sample account data and sample content data, the candidate account update model and the candidate content update model are iteratively trained again until they converge, resulting in an anomaly account identification model and an anomaly content identification model.

[0116] Therefore, by using account recognition results to update the output of the initial account model in the candidate content model, and using content recognition results to update the output of the initial content model in the candidate account model, the content model and the account model are interactively and iteratively trained. This allows the content model to assist in identifying abnormal accounts, and the account model to assist in identifying abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, thereby improving the recognition accuracy of the account model and the content model, and better protecting the security of users and the platform.

[0117] In an optional embodiment, the initial account model includes an account feature extraction sub-model and a first anomaly identification sub-model. Therefore, in step S105, the construction of the candidate account model based on the initial account model and the initial content model may include:

[0118] A candidate account model is constructed based on the account feature extraction sub-model, the initial content model, and the first anomaly identification sub-model; wherein, the first anomaly identification sub-model is used to process the output of the account feature extraction sub-model and the output of the initial content model.

[0119] Figure 3 This is a schematic diagram illustrating a candidate account model according to an exemplary embodiment, such as... Figure 3As shown, the initial account model includes an account feature extraction sub-model and a first anomaly detection sub-model. The account feature extraction sub-model is used to extract account attribute features and account operation features from the sample account data. This embodiment does not limit the specific type of the account feature extraction sub-model; for example, it can be a multilayer perceptron (MLP). The first anomaly detection sub-model is used to process the output of the account feature extraction sub-model and the output of the initial content model. This embodiment also does not limit the specific type of the first anomaly detection sub-model; for example, it can be an extreme gradient boosting tree (XGBoost).

[0120] The initial content model may include a content feature extraction sub-model and a second anomaly detection sub-model. The content feature extraction sub-model is used to extract content features from the sample content. This application embodiment does not limit the specific type of the content feature extraction sub-model. For example, the content feature extraction sub-model can be a MiniCPM-V model, which is a large model composed of a visual base SigLip-400M, a language base MiniCPM-2.4B, and a bridging structure Q-Former. It can effectively extract video features for video classification. The second anomaly detection sub-model is used to process the output of the content feature extraction sub-model and the output of the initial account model. This application embodiment also does not limit the specific type of the second anomaly detection sub-model. For example, the second anomaly detection sub-model can also be an Extreme Gradient Boosting Tree (XGBoost).

[0121] In one approach, "constructing" in the aforementioned candidate account model construction can refer to combining the account feature extraction sub-model, the initial content model, and the first anomaly detection sub-model, such that the first anomaly detection sub-model processes the outputs of the account feature extraction sub-model and the initial content model to obtain the candidate account model. In another approach, the aforementioned construction can also refer to training a candidate account model based on the account feature extraction sub-model, the initial content model, and the first anomaly detection sub-model, enabling the first anomaly detection sub-model to process the outputs of the account feature extraction sub-model and the initial content model.

[0122] In an optional embodiment, the initial content model includes a content feature extraction sub-model and a second anomaly identification sub-model. Therefore, in step S105, the construction of the candidate content model based on the initial account model and the initial content model includes:

[0123] A candidate content model is constructed based on the content feature extraction sub-model, the initial account model, and the second anomaly identification sub-model.

[0124] Figure 4This is a schematic diagram illustrating a candidate content model according to an exemplary embodiment, such as... Figure 4 As shown, the initial content model includes a content feature extraction sub-model and a second anomaly detection sub-model. The content feature extraction sub-model is used to extract content features from the sample content data. This embodiment does not limit the specific type of the content feature extraction sub-model; for example, it can be a multi-MiniCPM-V model. The second anomaly detection sub-model is used to process the output of the content feature extraction sub-model and the output of the initial account model. This embodiment also does not limit the specific type of the second anomaly detection sub-model; for example, it can also be an Extreme Gradient Boosting Tree (XGBoost).

[0125] The initial account model may include an account feature extraction sub-model and a first anomaly identification sub-model.

[0126] In one approach, "constructing" in the above-mentioned construction of a candidate content model can refer to combining the content feature extraction sub-model, the initial account model, and the second anomaly detection sub-model, so that the second anomaly detection sub-model processes the outputs of the content feature extraction sub-model and the initial account model to obtain a candidate account model. In another approach, the above-mentioned construction can also refer to training a candidate account model based on the account feature extraction sub-model, the initial content model, and the first anomaly detection sub-model, so that the first anomaly detection sub-model has the function of processing the outputs of the account feature extraction sub-model and the initial content model.

[0127] Therefore, a candidate account model can be constructed based on the account feature extraction sub-model, the initial content model, and the first anomaly identification sub-model, and a candidate content model can be constructed based on the content feature extraction sub-model, the initial account model, and the second anomaly identification sub-model. The candidate account model includes the initial content model, and the output of the initial content model in the candidate account model is missing. This allows the content model to assist in identifying abnormal accounts when predicting account anomalies, and the account model to assist in identifying abnormal content when predicting content anomalies. As a result, the content model and the account model can promote each other and continuously optimize and improve each other's predictive capabilities.

[0128] Figure 5 This is a schematic diagram illustrating an example of obtaining an account identification result, as shown in an exemplary embodiment. Figure 5 As shown, in step S107 above, the sample account data and sample content data are input into the candidate account model for account anomaly identification to obtain the account identification result, including:

[0129] S1071-1. Input the sample account data and sample content data into the candidate account model.

[0130] S1071-3. Based on the account feature extraction sub-model in the candidate account model, extract the account attribute features and account operation features of the sample account from the sample account data, and perform content anomaly identification on the sample content data based on the initial content model in the candidate account model to obtain the first content auxiliary identification result; the value of the first content auxiliary identification result is a missing value.

[0131] S1071-5. Based on the first anomaly identification sub-model in the candidate account model, perform account anomaly identification processing on account attribute features, account operation features and the first content-assisted identification results to obtain the account identification results.

[0132] Optionally, for steps S1071-1 to S1071-3 above, sample account data and sample content data can be input into the candidate account model. For the sample account data, the account feature extraction sub-model in the candidate account model can be used to convert various attribute information of the account into a high-dimensional vector representation to capture the characteristics of the account. At the same time, account operation features are also taken into consideration. These account operation features can provide clues about account operations and help determine whether the account has abnormal operations.

[0133] For sample content data, since the sample content data published by sample accounts is also an important source of information, the initial content model in the candidate account model can be used to perform sentiment analysis, topic analysis, etc., on the sample content data to obtain a first content-assisted prediction result. This first content-assisted prediction result is used to help identify whether an account is abnormal. For example, the initial content model in the candidate account model includes a content feature extraction sub-model and a second anomaly identification sub-model. First, content features can be extracted from the sample content data based on the content feature extraction sub-model, and then the second anomaly identification sub-model can be used to perform sentiment analysis, topic analysis, etc., on the content features to obtain the first content-assisted prediction result.

[0134] It should be noted that the first content-assisted prediction result can be a score for malicious content. When the candidate account model is called for the first time, the output of the initial content model in the candidate account model is missing, that is, the value of the first content-assisted identification result is missing. For example, the output of the initial content model in the candidate account model can be set to -1.

[0135] It should be noted that when the sample content data is multimodal data such as text, images, and videos, the initial content model in the candidate account model can be used to perform sentiment analysis, topic analysis, etc. on the multimodal data such as text, images, and videos, thereby obtaining the content malice score of the sample content data.

[0136] Optionally, for steps S1071-5 above, the account attribute features, account operation features and the first content-assisted identification result of the sample account can be concatenated to obtain a first concatenation result. The first concatenation result is then input into the first anomaly identification sub-model for account anomaly identification. Since the first concatenation result is a combination of account attribute features, account operation features and the first content-assisted identification result, this combination of information can provide more comprehensive account information, helping the first anomaly identification sub-model to more accurately determine whether the sample account has malicious behavior and obtain the account identification result.

[0137] It should be noted that the training method of the first anomaly identification sub-model is not limited in this application embodiment. It only needs to have the function of processing account attribute features, account operation features, and the first content-assisted identification result to obtain the account identification result. For example, a training dataset can be obtained, which includes account training data, content training data, and labels indicating whether the account is abnormal. Account attribute features and account operation features are extracted from the account training data, and content-assisted identification results are obtained from the content training data. The account attribute features, account operation features, and content-assisted identification results are input into a preset model to predict account anomalies and obtain the prediction result. Loss data is calculated based on the prediction result and the corresponding labels. The model parameters of the preset model are continuously adjusted based on the loss data until the model converges, thus obtaining the first anomaly identification sub-model.

[0138] Therefore, by comprehensively utilizing multiple information sources such as account attribute features, account operation features, and sample content data published by sample accounts, the candidate account model can more accurately identify abnormal accounts. Furthermore, when the candidate account model is first invoked, the values ​​of the initial content model in the candidate account model are set to missing values, which facilitates subsequent interactive iterative training with the initial account model in the candidate content model. This allows the content model to assist in identifying abnormal accounts, and the account model to assist in identifying abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, and thus improve the identification accuracy of the account model and the content model.

[0139] Figure 6 This is a schematic diagram illustrating an example of obtaining an account identification result, as shown in an exemplary embodiment. Figure 6 As shown, in step S107 above, the sample account data and sample content data are input into the candidate content model for content anomaly identification to obtain the content identification result, including:

[0140] S1073-1. Input the sample account data and sample content data into the candidate content model.

[0141] S1073-3. Extract content features from sample content data based on the content feature extraction sub-model in the candidate content model, and perform account anomaly identification on sample account data based on the initial account model in the candidate content model to obtain the first account auxiliary identification result; the value of the first account auxiliary identification result is a missing value.

[0142] S1073-5. Based on the second anomaly identification sub-model in the candidate content model, perform content anomaly identification processing on the content features and the first account auxiliary identification results to obtain the content identification results.

[0143] Optionally, for steps S1073-1 to S1073-3 above, sample account data and sample content data can be input into the candidate content model. For the sample content data, content features can be extracted using the content feature extraction sub-model in the candidate account model.

[0144] For sample account data, the initial account model in the candidate content model can be used to predict account anomalies, resulting in a first account auxiliary prediction result. This first account auxiliary prediction result is used to assist in identifying whether the content is abnormal. For example, the initial account model in the candidate content model includes an account feature extraction sub-model and a first anomaly identification sub-model. Firstly, account attribute features and account operation features can be extracted based on the account feature extraction sub-model. Then, the first anomaly identification sub-model is used to predict account anomalies based on these account attribute features and account operation features, resulting in the first account auxiliary prediction result.

[0145] For example, the first account-assisted prediction result can be a malicious score for the account. When the candidate account model is called for the first time, the value of the initial account model in the candidate account model is missing, that is, the value of the first account-assisted identification result is missing. For example, the value of the initial account model in the candidate content model can be set to -1.

[0146] Optionally, for the above steps S1073-5, the content features and the first account-assisted identification result can be concatenated to obtain a second concatenation result. The second concatenation result is then input into the second anomaly identification sub-model for content anomaly identification. Since the second concatenation result is a combination of content features and the first account-assisted identification result, this combination information can provide more comprehensive content information, helping the second anomaly identification sub-model to more accurately determine whether the sample content is malicious content and obtain the content identification result.

[0147] It should be noted that the embodiments of this application do not limit the training method of the second anomaly recognition sub-model. It only needs to have the function of performing content anomaly recognition processing on content features and the second content-assisted recognition results to obtain the content recognition result. For example, a training dataset can be obtained, which includes account training data, content training data, and labels indicating whether the content is abnormal. The first account-assisted recognition result is obtained from the account training data, and content features are obtained from the content training data. The first account-assisted recognition result and the content features are input into a preset model to predict content anomalies and obtain a prediction result. Loss data is calculated based on the prediction result and the corresponding labels. The model parameters of the preset model are continuously adjusted based on the loss data until the model converges, thus obtaining the second anomaly recognition sub-model.

[0148] Therefore, by comprehensively utilizing multiple information sources such as account attribute features, account operation features, and sample content data published by sample accounts, the candidate content model can more accurately identify abnormal content. Furthermore, when the candidate content model is first invoked, the values ​​of the initial account model in the candidate content model are set to missing values, which facilitates subsequent interactive iterative training with the initial content model in the candidate account model. This allows the content model to assist in identifying abnormal accounts, and the account model to assist in identifying abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, and thus improve the identification accuracy of the account model and the content model.

[0149] In an optional embodiment, in step S109 above, the process of updating the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, and updating the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model, includes:

[0150] The output of the initial account model in the candidate content model is filled with the account recognition results to obtain the candidate content update model, so that the output of the initial account model in the candidate content model for identifying account anomalies in the sample account data becomes the account recognition result.

[0151] The output of the initial content model in the candidate account model is filled with the content recognition results to obtain the candidate account update model, so that the output of the initial content model in the candidate account model is the content recognition result obtained by the content anomaly recognition of the sample content data.

[0152] In this embodiment, since the output of the initial account model in the candidate content model is missing a value, after calling the candidate account model to perform account anomaly identification and obtaining the account identification result, the output of the initial account model in the candidate content model can be filled with the account identification result to obtain the candidate content update model. Because the output of the initial account model in the candidate content model is filled with the account identification result, when the initial account model in the candidate content model is subsequently used for account anomaly identification, the output of the initial account model in the candidate content model will be the account identification result.

[0153] Since the output of the initial content model in the candidate account model is missing values, after calling the candidate content model to perform content anomaly identification and obtaining the content identification result, this content identification result can be used to fill the output of the initial content model in the candidate account model, resulting in the candidate account update model. Because the output of the initial content model in the candidate account model is filled with this content identification result, when subsequently using the initial content model in the candidate account model to perform content anomaly identification, the output of the initial content model in the candidate account model will be this content identification result.

[0154] Therefore, by filling the output of the initial account model in the candidate content model with the account recognition results, and by filling the output of the initial content model in the candidate account model with the content recognition results, the content model and the account model are interactively and iteratively trained. This allows the content model to assist in identifying abnormal accounts, and the account model to assist in identifying abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, and thus improve the recognition accuracy of the account model and the content model, and better protect the security of users and the platform.

[0155] Figure 7 This is a schematic diagram illustrating an interactive iterative training process according to an exemplary embodiment, such as... Figure 7 As shown, in step S1011 above, the candidate account update model and candidate content update model are interactively and iteratively trained based on sample account data and sample content data to obtain the abnormal account identification model and abnormal content identification model, including:

[0156] S10111. Use the candidate account update model as the current account model, and the candidate content update model as the current content model.

[0157] S10113. Input the sample account data and sample content data into the current account model to perform account anomaly identification and obtain the current account identification result. Input the sample account data and sample content data into the current content model to perform content anomaly identification and obtain the current content identification result.

[0158] S10115. Based on the difference between the current account identification result and the abnormal tags corresponding to the sample account data, determine the current account loss data; based on the difference between the current content identification result and the abnormal tags corresponding to the sample content data, determine the current content loss data.

[0159] S10117. If the current account loss data and the current content loss data do not meet the preset conditions, update the output of the initial account model in the current content model based on the current account recognition result, and use the updated model as the current content model again. Update the output of the initial content module in the current account model based on the current content recognition result, and use the updated model as the current account model again.

[0160] S10119. Repeatedly input sample account data and sample content data into the current account model to identify account anomalies until the current content loss data is determined, until the current account loss data and current content loss data meet the preset conditions or the number of iterations meets the preset threshold, to obtain the abnormal account identification model and the abnormal content identification model.

[0161] In this embodiment, after obtaining the candidate account update model and the candidate content update model, interactive iterative training can be performed on these models to obtain the abnormal account identification model and the abnormal content identification model. Interactive iterative training can refer to: inputting sample account data and sample content data into the candidate account update model for account anomaly prediction, obtaining the output of the candidate account update model; inputting sample account data and sample content data into the candidate content update model for content anomaly prediction, obtaining the output of the candidate content update model. The output of the candidate account update model is used to populate the output of the account model in the candidate content update model, so that the output of the account model in the candidate content update model for account anomaly identification of sample account data is the "output of the candidate account update model". The output of the candidate content update model is used to populate the output of the content model in the candidate account update model, so that the output of the content model in the candidate account update model for content anomaly identification of sample content data is the "output of the candidate content update model". This iteration is repeated until the model converges or the number of iterations meets a preset threshold, resulting in the abnormal account identification model and the abnormal content identification model.

[0162] Figure 8 This is a schematic diagram illustrating an interactive iterative training method according to an exemplary embodiment, such as... Figure 8As shown, for steps S10111 to S10113 above, the candidate account update model can be used as the current account model, and the candidate content update model can be used as the current content model. Then, based on the current account model and the current content model, account anomaly identification and content anomaly identification are performed on the sample account data and sample content data respectively to obtain the current account identification result and the current content identification result.

[0163] Optionally, continue as follows Figure 8 As shown, for step S10115 above, the abnormal labels corresponding to the sample account data can be obtained, and the difference between the abnormal labels and the current account recognition result can be calculated using cross-entropy loss to obtain the current account loss data. Simultaneously, the abnormal labels corresponding to the sample content data can be obtained, and the difference between the abnormal labels and the current content recognition result can be calculated using cross-entropy loss to obtain the current content loss data.

[0164] Optionally, regarding step S10117 above, it is determined whether the current account loss data and the current content loss data meet preset conditions, or whether the current iteration count has reached a preset threshold. If the loss does not meet the preset conditions or the iteration count has not reached the preset threshold, interactive training is performed, that is: the output of the initial account model in the current content model is updated using the current account recognition result, and the updated model is used as the current content model again; the output of the initial content module in the current account model is updated based on the current content recognition result, and the updated model is used as the current account model again. If the current account loss data and the current content loss data meet the preset conditions, or the current iteration count reaches the preset threshold, the iteration terminates, and the current account model is used as the abnormal account recognition model, and the current content model is used as the abnormal content recognition model.

[0165] It should be noted that the "preset conditions" mentioned above, which state that the loss data does not meet, can be set according to actual needs, and there are no specific limitations on them. For example, the preset condition can be the condition for minimizing the loss data. The preset number of times threshold can also be set according to actual business needs, and there are no specific limitations on it.

[0166] Optionally, regarding step S10119 above, after redefining the current account model and the current content model, steps S10113 to S10117 can be repeated until the current account loss data and the current content loss data meet preset conditions or the number of iterations meets a preset threshold, thus obtaining the abnormal account identification model and the abnormal content identification model. That is, in each iteration, the output of the current account model is used to fill the output of the initial account model in the current content model, and the output of the current content model is also used to fill the output of the initial content model in the current account model, thereby realizing the interactive iterative training of the content model and the account model.

[0167] Therefore, after the first interactive iteration training, the current account model and the current content model are continuously trained interactively and iteratively by updating the output of the initial account model in the content model with the output of the current account model, and updating the output of the initial content model in the account model with the output of the current content model. This allows the content model to help identify abnormal accounts, and the account model to help identify abnormal content. As a result, the content model and the account model can promote each other, continuously optimize and improve each other's predictive capabilities, and thus improve the identification accuracy of the account model and the content model, and better protect the security of users and the platform.

[0168] In an optional embodiment, the sample account data is data associated with the attributes and operations of the sample account. In step S10113, the above-mentioned input of the sample account data and sample content data into the current account model for account anomaly identification to obtain the current account identification result includes:

[0169] Input the sample account data and sample content data into the current account model.

[0170] Based on the current account model, the account attribute features and account operation features of the sample account data are extracted. Based on the initial content model in the current account model, the sample content data is used to identify content anomalies, and a second content-assisted identification result is obtained.

[0171] Based on the current account model, account attribute features, account operation features, and second content-assisted identification results are used to perform account anomaly identification processing to obtain the current account identification result.

[0172] Optionally, in step S10113 above, sample account data and sample content data can be input into the current account model. For the sample account data, the account feature extraction sub-model in the current account model can be used to convert various attribute information of the sample account into a high-dimensional vector representation to capture the account's features. Simultaneously, account operation features are also considered; these features can provide clues about account operations and help determine whether the sample account has engaged in abnormal operations.

[0173] For sample content data, since the sample content data published by sample accounts is also an important source of information, the initial content model in the current account model can be used to perform sentiment analysis, topic analysis, etc., on the sample content data to obtain a second content-assisted prediction result. This second content-assisted prediction result is used to help identify whether the account is abnormal. For example, the initial content model in the current account model includes a content feature extraction sub-model and a second anomaly identification sub-model. Content features can be extracted first based on the content feature extraction sub-model, and then the second anomaly identification sub-model can be used to perform sentiment analysis, topic analysis, etc., on the content features to obtain the second content-assisted prediction result.

[0174] It should be noted that when the sample content data is multimodal data such as text, images, and videos, the initial content model in the current account model can perform sentiment analysis, topic analysis, etc. on the multimodal data such as text, images, and videos to obtain the content malice score of the sample content data.

[0175] Optionally, during account anomaly identification, the account attribute features, account operation features, and second content-assisted identification results of the sample account can be concatenated to obtain a third concatenated result. This third concatenated result is then input into the first anomaly identification sub-model for account anomaly identification. Since the third concatenated result is a combination of account attribute features, account operation features, and second content-assisted identification results, this combination of information can provide more comprehensive account information, helping the first anomaly identification sub-model to more accurately determine whether the sample account has malicious behavior and obtain the account identification result.

[0176] Therefore, by comprehensively utilizing multiple information sources such as account attribute features, account operation features, and sample content data published by sample accounts, the current account model can more accurately identify abnormal accounts.

[0177] In an optional embodiment, in step S10113 above, the input of sample account data and sample content data into the current content model for content anomaly identification to obtain the current content identification result includes:

[0178] Input the sample account data and sample content data into the current content model.

[0179] Based on the current content model, content features of the sample content data are extracted. Based on the initial account model in the current content model, account anomaly identification is performed on the sample account data to obtain the second account auxiliary identification result.

[0180] Based on the current content model, content anomaly identification processing is performed on the content features and the second account-assisted identification results to obtain the current content identification result.

[0181] Optionally, sample account data and sample content data can be input into the current content model. For the sample content data, content features can be extracted using the content feature extraction sub-model in the current account model.

[0182] For sample account data, the initial account model in the current content model can be used to predict account anomalies, resulting in a second auxiliary account prediction result. This second auxiliary prediction result is used to assist in identifying whether the content is abnormal. For example, the initial account model in the current content model includes an account feature extraction sub-model and a first anomaly identification sub-model. First, account attribute features and account operation features can be extracted based on the account feature extraction sub-model. Then, the first anomaly identification sub-model is used to predict account anomalies based on these account attribute features and account operation features, resulting in the second auxiliary account prediction result.

[0183] Optionally, during content anomaly identification, the content features and the second account-assisted identification results can be concatenated to obtain a fourth concatenation result. This fourth concatenation result is then input into the second anomaly identification sub-model for content anomaly identification. Since the fourth concatenation result is a combination of content features and the second account-assisted identification results, this combination information can provide more comprehensive content information, helping the second anomaly identification sub-model to more accurately determine whether the sample content is malicious and obtain the current content identification result.

[0184] Therefore, by comprehensively utilizing multiple information sources such as account attribute features, account operation features, and sample content data published by sample accounts, the candidate content model can more accurately identify abnormal content.

[0185] In an optional embodiment, in step S10117 above, updating the output of the initial account model in the current content model based on the current account identification result, and using the updated model as the current content model again, may include:

[0186] The output of the initial account model in the current content model is filled with the current account identification result, and the filled model is used as the current content model again, so that the output of the initial account model in the redefined current content model for identifying account anomalies in the sample account data becomes the current account identification result.

[0187] In step S10117 above, updating the output of the initial content module in the current account model based on the current content recognition result, and using the updated model as the current account model again, may include:

[0188] The output of the current account model in the candidate account model is filled based on the current content recognition result. The filled model is then used as the current internal account model again, so that the output of the initial content model in the redefined current internal account model for content anomaly recognition of sample content data becomes the current content recognition result.

[0189] In this embodiment, for the current content model, the output of the initial account model in the current content model can be filled with the current account identification result, and the filled model can be used again as the current content model. Since the output of the initial account model in the current content model is filled with the current account identification result, when the initial account model in the current content model is used for account anomaly identification in the future, the output of the initial account model in the current content model will be the current account identification result.

[0190] For the current account model, the output of the initial content model in the current account model can be filled using the current content recognition result, and the filled model can be used as the current account model again. Since the output of the initial content model in the current account model is filled with the current content recognition result, when the initial content model in the current account model is used for content anomaly recognition in the future, the output of the initial content model in the current account model will be the current content recognition result.

[0191] Therefore, by filling the output of the initial account model in the current content model with the current account recognition result, and by filling the output of the initial content model in the current account model with the current content recognition result, the current content model and the current account model are interactively and iteratively trained. This allows the current content model to assist in identifying abnormal accounts, and the current account model to assist in identifying abnormal content. As a result, the current content model and the current account model can promote each other, continuously optimize and improve each other's predictive capabilities, and thus improve the recognition accuracy of the current account model and the current content model, and better protect the security of users and the platform.

[0192] It should be noted that when the sample content data is multimodal, both the abnormal account identification model and the abnormal content identification model can be multimodal models. This allows them to process multiple data modalities simultaneously, such as images, text, videos, account attribute features, and account operation features. This enables them to better integrate information from different modalities. By leveraging the richness of multimodal data, the accuracy and effectiveness of abnormal content identification and abnormal account identification can be improved.

[0193] The following section uses video as an example to provide an overall explanation of the above-mentioned anomaly detection model generation method:

[0194] 1) Obtain sample account data and sample video data for the sample account; the sample video data is data associated with the videos published by the sample account. For example, the sample video data can be text descriptions, video frames, audio, etc., of the videos published by the sample account. The sample account data includes data related to the sample account's attributes and operations. The data associated with the sample account's attributes can be account attribute features, which may include, but are not limited to: username, bio, avatar, etc. The data associated with the sample account's operations can be account operation features, which may include, but are not limited to: the sample account's login mode, active time, social network relationships (accounts followed / followed), etc.

[0195] 2) Train an initial account model based on sample account data and corresponding abnormal tags, and train an initial content model based on sample video data and corresponding abnormal tags.

[0196] 3) Construct candidate account models based on the initial account model and the initial content model. The output of the initial content model in the candidate account model is missing. Construct candidate content models based on the initial account model and the initial content model. The output of the initial account model in the candidate content model is missing.

[0197] 4) Input the sample account data and sample video data into the candidate account model to identify account anomalies and obtain the account identification results; input the sample account data and sample content data into the candidate content model to identify content anomalies and obtain the content identification results.

[0198] 5) Update the output of the initial account model in the candidate content model based on the account recognition results to obtain the candidate content update model. Update the output of the initial content model in the candidate account model based on the content recognition results to obtain the candidate account update model.

[0199] 6) Use the candidate account update model as the current account model and the candidate content update model as the current content model.

[0200] 7) Input the sample account data and sample video data into the current account model to identify account anomalies and obtain the current account identification result. Input the sample account data and sample content data into the current content model to identify content anomalies and obtain the current content identification result.

[0201] 8) Based on the difference between the current account identification result and the abnormal tags corresponding to the sample account data, determine the current account loss data; based on the difference between the current content identification result and the abnormal tags corresponding to the sample video data, determine the current content loss data.

[0202] 9) If the current account loss data and the current content loss data do not meet the preset conditions, update the output of the initial account model in the current content model based on the current account identification result, and use the updated model as the current content model again. Update the output of the initial content module in the current account model based on the current content identification result, and use the updated model as the current account model again.

[0203] 10) Repeatedly input sample account data and sample video data into the current account model for account anomaly identification, until the updated model is used as the current account model again, until the current account loss data and current content loss data meet the preset conditions or the number of iterations meets the preset threshold, to obtain the abnormal account identification model and abnormal content identification model.

[0204] Figure 9 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 1 ,like Figure 9 As shown in the figure, this application provides an anomaly identification method, which includes:

[0205] S201. Obtain the target account's account data, content data, and abnormal account identification model; the content data is data associated with the content published by the target account.

[0206] Optionally, the target account can be of various types, without specific limitations. For example, the target account could be the author who published the content.

[0207] Optionally, the account data can be data associated with the attributes and operations of the target account. The data associated with the target account's attributes can be account attribute features, which may include, but are not limited to, username, bio, and profile picture. The data associated with the target account's operations can be account operation features, which may include, but are not limited to, the target account's login pattern, active time, and social network relationships (accounts followed / followed). These account operation features can be used to provide clues about account operations and help determine whether the account has engaged in abnormal activities.

[0208] Optionally, the content data can be data associated with content published by the target account. This content data can be multimodal data, which may include, but is not limited to, text descriptions, image frames, and audio of the content published by the target account.

[0209] S203. Input the account data and content data into the abnormal account identification model to perform account anomaly identification processing, and obtain the anomaly identification result of the target account; wherein, the abnormal account identification model is generated based on the above-mentioned anomaly identification model generation method.

[0210] In this embodiment of the application, the abnormal account identification model obtained by training includes an account feature extraction sub-model, an initial content model, and a first abnormal identification sub-model. The initial content model includes a content feature extraction sub-model and a second abnormal identification sub-model.

[0211] Figure 10 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 2 ,like Figure 10 As shown, in the process of account anomaly identification, account data and content data can be input into the anomaly account identification model. Based on the account feature extraction sub-model in this model, the account attribute features and account operation features of the target account are extracted from the account data. Based on the initial content model in the anomaly account identification model, content anomaly identification is performed on the content data to obtain the target content auxiliary identification result. Specifically: content features are extracted from the content data based on the content feature extraction sub-model, and anomaly identification is performed on the content features based on the second anomaly identification sub-model to obtain the target content auxiliary identification result. The account attribute features, account operation features, and target content auxiliary identification result of the target account are concatenated to obtain the target account concatenated features. Based on the first anomaly identification sub-model in the anomaly account identification model, account anomaly prediction is performed on the target concatenated features to obtain the target account anomaly identification result.

[0212] For example, the anomaly identification result of the target account includes the identification result of the target account being a normal account and the identification result of the target account being an abnormal account.

[0213] Therefore, the abnormal account identification model trained through interactive iteration is used for account identification. Since the abnormal account identification model trained through interactive iteration includes the initial content model, the initial content model is used to assist in the identification of abnormal accounts during the identification process, thereby improving the accuracy and effectiveness of abnormal account identification.

[0214] Figure 11 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 3 ,like Figure 11 As shown in the embodiment of this application, another method for identifying content anomalies is provided, which includes:

[0215] S301. Obtain the target account's account data, content data, and abnormal content identification model; the content data is data associated with the content published by the target account.

[0216] Optionally, the target account can be of various types, without specific limitations. For example, the target account could be the author who published the content.

[0217] Optionally, the account data can be data associated with the attributes and operations of the target account. The data associated with the target account's attributes can be account attribute features, which may include, but are not limited to, username, bio, and profile picture. The data associated with the target account's operations can be account operation features, which may include, but are not limited to, the target account's login pattern, active time, and social network relationships (accounts followed / followed). These account operation features can be used to provide clues about account operations and help determine whether the account has engaged in abnormal activities.

[0218] Optionally, the content data can be data associated with content published by the target account. This content data can be multimodal data, which may include, but is not limited to, text descriptions, image frames, and audio of the content published by the target account.

[0219] S303. Input the account data and content data into the abnormal content recognition model for content anomaly recognition processing to obtain the content data anomaly recognition result; wherein, the abnormal content recognition model is generated based on the anomaly recognition model generation method of any of the above embodiments.

[0220] In this embodiment, the abnormal content recognition model includes a content feature extraction sub-model, an initial account model, and a second abnormal recognition sub-model. The initial account model includes an account feature extraction sub-model and a first abnormal recognition sub-model.

[0221] Figure 12 This is a flowchart illustrating an anomaly identification method according to an exemplary embodiment. Figure 4 ,like Figure 12 As shown, during the content anomaly identification process, sample account data and sample content data can be input into the content feature extraction sub-model of the anomaly content identification model to extract content features from the content data. Based on the account feature extraction sub-model, account attribute features and account operation features are extracted from the account data. Then, based on the first anomaly identification sub-model of the anomaly content identification model, account anomaly identification is performed on the account attribute features and account operation features to obtain the target account auxiliary identification result. The account attribute features, account operation features, and target account auxiliary identification result are concatenated to obtain the target content splicing result. Finally, based on the target content splicing result of the second anomaly identification sub-model of the anomaly content identification model, content anomaly identification is performed to obtain the content data anomaly identification result.

[0222] For example, the anomaly identification results of the content data include the identification results of the content data being normal content and the identification results of the content data being abnormal content.

[0223] Therefore, the abnormal content recognition model trained through interactive iteration is used for account recognition. Since the abnormal content recognition model trained through interactive iteration includes the initial account model, the initial account model is used to assist in the recognition of abnormal content during the recognition process, thereby improving the accuracy and recognition effect of abnormal content recognition.

[0224] It should be noted that the general recall capability of the abnormal content recognition model provided in this application for abnormal video recognition is approximately 14 percentage points higher than that of the online XGBoost model, and it provides a large number of highly accurate incremental recalls in business applications. Currently, the maliciousness of the exposure of illegal videos is gradually decreasing, and the proactive recall rate of illegal videos and the coverage of the model's high-precision portion are also gradually improving, effectively promoting the healthy development of the platform's short video traffic. Here, AUCPR is the area under the PR curve, which is a curve formed by the model's precision and recall on the coordinate axes.

[0225] This application's embodiments can be applied to video account security business scenarios, specifically including:

[0226] Application Scenario 1: Identifying Malicious Videos

[0227] Figure 13 This is a schematic diagram illustrating an application scenario according to an exemplary embodiment, such as... Figure 13 As shown, in the process of identifying malicious videos, video data and account data (the author who published the video data) can be provided. The video data and account data are then input into the trained abnormal content recognition model to obtain the recognition result of whether the video data is an abnormal video or a normal video. The video data is then labeled based on the abnormal recognition result.

[0228] Application Scenario 2: Identifying Malicious Accounts

[0229] Figure 14 This is a schematic diagram illustrating another application scenario according to an exemplary embodiment, such as... Figure 14 As shown, in the process of identifying malicious accounts, video data and account data (the author who posted the video data) can be provided. The video data and account data are then input into the trained abnormal content recognition model to obtain the abnormal identification result of the account data as an abnormal account or a normal account. The abnormal identification result of the account data is then used to label the account data.

[0230] Figure 15 This is a block diagram illustrating an anomaly recognition model generation apparatus according to an exemplary embodiment, such as... Figure 15 As shown, the anomaly recognition model generation device includes:

[0231] The sample data acquisition module 401 is used to acquire sample account data and sample content data of the sample account; the sample content data is data associated with the content published by the sample account.

[0232] The initial training module 403 is used to train the initial account model and the initial content model based on the sample account data and the sample content data, respectively.

[0233] The construction module 405 is used to construct a candidate account model based on the initial account model and the initial content model, wherein the output of the initial content model in the candidate account model is missing; and to construct a candidate content model based on the initial account model and the initial content model, wherein the output of the initial account model in the candidate content model is missing.

[0234] The initial identification module 407 is used to input the sample account data and the sample content data into the candidate account model to perform account anomaly identification and obtain account identification results; and to input the sample account data and the sample content data into the candidate content model to perform content anomaly identification and obtain content identification results.

[0235] The output update module 409 is used to update the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, and to update the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model.

[0236] The interactive training module 4011 is used to perform interactive iterative training on the candidate account update model and the candidate content update model based on the sample account data and the sample content data, so as to obtain the abnormal account recognition model and the abnormal content recognition model.

[0237] In an optional embodiment, the initial account model includes an account feature extraction sub-model and a first anomaly identification sub-model, and the candidate account model includes:

[0238] The candidate account model construction unit is used to construct the candidate account model based on the account feature extraction sub-model, the initial content model, and the first anomaly identification sub-model; wherein, the first anomaly identification sub-model is used to process the output of the account feature extraction sub-model and the output of the initial content model;

[0239] The initial content model includes a content feature extraction sub-model and a second anomaly identification sub-model; the candidate account model includes:

[0240] The candidate content model construction unit is used to construct the candidate content model based on the content feature extraction sub-model, the initial account model, and the second anomaly identification sub-model; wherein, the second anomaly identification sub-model is used to process the output of the content feature extraction sub-model and the output of the initial account model.

[0241] In an optional embodiment, the sample account data is data associated with the attributes and operations of the sample account, and the initial identification module includes:

[0242] The first input unit is used to input the sample account data and the sample content data into the candidate account model;

[0243] The first extraction unit is used to extract the account attribute features and account operation features of the sample account from the sample account data based on the account feature extraction sub-model in the candidate account model, and to perform content anomaly identification on the sample content data based on the initial content model in the candidate account model to obtain a first content auxiliary identification result; the value of the first content auxiliary identification result is a missing value.

[0244] The first identification unit is used to perform account anomaly identification processing on the account attribute features, the account operation features and the first content-assisted identification result based on the first anomaly identification sub-model in the candidate account model, so as to obtain the account identification result.

[0245] In an optional embodiment, the initial identification module includes:

[0246] The second input unit is used to input the sample account data and the sample content data into the candidate content model;

[0247] The second extraction unit is used to extract the content features of the sample content data based on the content feature extraction sub-model in the candidate content model, and to perform account anomaly identification on the sample account data based on the initial account model in the candidate content model to obtain a first account auxiliary identification result; the value of the first account auxiliary identification result is a missing value.

[0248] The second identification unit is used to perform content anomaly identification processing on the content features and the first account-assisted identification result based on the second anomaly identification sub-model in the candidate content model, so as to obtain the content identification result.

[0249] In an optional embodiment, the output update module includes:

[0250] The first filling unit is used to fill the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, so that the output of the initial account model in the candidate content model for account anomaly recognition of the sample account data is the account recognition result.

[0251] The second filling unit is used to fill the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model, so that the output obtained by the initial content model in the candidate account model to perform content anomaly recognition on the sample content data is the content recognition result.

[0252] In an optional embodiment, the interactive training module includes:

[0253] The current model determination unit is used to take the candidate account update model as the current account model and the candidate content update model as the current content model.

[0254] The current identification result determination unit is used to input the sample account data and sample content data into the current account model to perform account anomaly identification and obtain the current account identification result, and to input the sample account data and sample content data into the current content model to perform content anomaly identification and obtain the current content identification result;

[0255] The loss data determination unit is used to determine the current account loss data based on the difference between the current account identification result and the abnormal tags corresponding to the sample account data, and to determine the current content loss data based on the difference between the current content identification result and the abnormal tags corresponding to the sample content data.

[0256] The re-determination unit is used to update the output of the initial account model in the current content model based on the current account identification result when the current account loss data and the current content loss data do not meet the preset conditions, and to use the updated model as the current content model again. It also updates the output of the initial content module in the current account model based on the current content identification result and uses the updated model as the current account model again.

[0257] The repeating unit is used to repeat the process of inputting the sample account data and the sample content data into the current account model for account anomaly identification, until the updated model is used as the current account model again, until the current account loss data and the current content loss data meet the preset conditions or the number of iterations meets the preset number threshold, so as to obtain the abnormal account identification model and the abnormal content identification model.

[0258] In an optional embodiment, the current identification result determination unit includes:

[0259] The first current data input subunit is used to input the sample account data and sample content data into the current account model;

[0260] The first auxiliary identification result generation subunit is used to extract the account attribute features and account operation features of the sample account data based on the current account model, and to perform content anomaly identification on the sample content data based on the initial content model in the current account model, so as to obtain the second content auxiliary identification result.

[0261] The current account identification result generation unit is used to perform account anomaly identification processing on the account attribute features, account operation features and second content-assisted identification results based on the current account model to obtain the current account identification result.

[0262] In an optional embodiment, the current identification result determination unit includes:

[0263] The second current data input subunit is used to input the sample account data and sample content data into the current content model;

[0264] The second auxiliary identification result generation subunit is used to extract the content features of the sample content data based on the current content model, and to perform account anomaly identification on the sample account data based on the initial account model in the current content model, so as to obtain the second account auxiliary identification result.

[0265] The current content recognition result generation unit is used to perform content anomaly recognition processing on the content features and the second account-assisted recognition result based on the current content model to obtain the current content recognition result.

[0266] In an optional embodiment, the re-determination unit includes:

[0267] The content model is redefined subunit, which is used to fill the output of the initial account model in the current content model based on the current account identification result, and the filled model is used as the current content model again, so that the output of the initial account model in the redefined current content model for account anomaly identification of the sample account data is the current account identification result.

[0268] The re-determination unit includes:

[0269] The account model is redefined as a sub-unit, which is used to fill the output of the initial content model in the current account model based on the current content recognition result, and the filled model is used as the current account model again, so that the output of the initial content model in the redefined current account model for content anomaly recognition of the sample content data is the current content recognition result.

[0270] In an optional embodiment, the sample content data is multimodal data, and the abnormal account identification model and the abnormal content identification model are multimodal models.

[0271] Figure 16 This is a block diagram illustrating an anomaly detection device according to an exemplary embodiment, such as... Figure 16 As shown, the anomaly detection device includes:

[0272] The first data acquisition module 501 is used to acquire account data, content data, and an abnormal account identification model of the target account; the content data is data associated with the content published by the target account.

[0273] The account recognition module 503 is used to input the account data and the content data into the abnormal account recognition model to perform account anomaly recognition processing and obtain the anomaly recognition result of the target account.

[0274] The abnormal account identification model is generated based on the abnormal identification model generation method described in any of the above embodiments.

[0275] Figure 17 This is a block diagram illustrating another anomaly detection device according to an exemplary embodiment, such as... Figure 17 As shown, the anomaly detection device includes:

[0276] The second data acquisition module 601 is used to acquire account data, content data, and an abnormal content identification model of the target account; the content data is data associated with the content published by the target account.

[0277] Content recognition module 603 is used to input the account data and the content data into the abnormal content recognition model for content anomaly recognition processing, and obtain the anomaly recognition result of the content data;

[0278] The abnormal content recognition model is generated based on the abnormal recognition model generation method described in any of the above embodiments.

[0279] It should be noted that the device embodiments provided in this application are based on the same inventive concept as the method embodiments described above.

[0280] This application also provides an electronic device, which includes a processor and a memory. The memory stores at least one instruction or at least one program. The processor loads and executes the at least one instruction or at least one program to implement the anomaly recognition model generation method or anomaly recognition method provided in any of the above embodiments.

[0281] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the anomaly recognition model generation method or anomaly recognition method as provided in any of the above embodiments.

[0282] Optionally, in the embodiments of this specification, the storage medium may be located at at least one of the multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0283] The memory described in this specification can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for functions, etc.; the data storage area may store data created based on the use of the device, etc. Furthermore, the memory may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor with access to the memory.

[0284] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the identification model generation method or anomaly identification method provided in the above-described method embodiments.

[0285] The anomaly detection model generation method or anomaly detection method embodiments provided in this application can be executed on a terminal, computer terminal, server, or similar computing device. Taking running on a server as an example, Figure 18 This is a hardware structure block diagram of a server according to an exemplary embodiment. For example... Figure 18 As shown, the server 700 can vary significantly due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 710 (CPUs 710 may include, but are not limited to, microprocessors (MCUs) or programmable logic devices (FPGAs), a memory 730 for storing data, and one or more storage media 720 (e.g., one or more mass storage devices) for storing application programs 723 or data 722. The memory 730 and storage media 720 may be temporary or persistent storage. The program stored in the storage media 720 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the CPU 710 may be configured to communicate with the storage media 720 and execute the series of instruction operations stored in the storage media 720 on the server 700. Server 700 may also include one or more power supplies 760, one or more wired or wireless network interfaces 750, one or more input / output interfaces 740, and / or one or more operating systems 721, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0286] The input / output interface 740 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of server 700. In one example, the input / output interface 740 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 740 may be a radio frequency (RF) module for wireless communication with the Internet.

[0287] Those skilled in the art will understand that Figure 18 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, server 700 may also include... Figure 18 The more or fewer components shown, or having the same Figure 18 The different configurations shown.

[0288] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0289] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and server embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0290] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0291] The above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for generating an anomaly detection model, characterized in that, The method includes: Obtain sample account data and sample content data of the sample account; the sample content data is data associated with the content published by the sample account; Based on the sample account data and the sample content data, train the initial account model and the initial content model respectively; Candidate account models are constructed based on the initial account model and the initial content model, wherein the output of the initial content model in the candidate account model is a missing value; candidate content models are constructed based on the initial account model and the initial content model, wherein the output of the initial account model in the candidate content model is a missing value. The sample account data and sample content data are input into the candidate account model for account anomaly identification to obtain account identification results; the sample account data and sample content data are input into the candidate content model for content anomaly identification to obtain content identification results. The output of the initial account model in the candidate content model is updated based on the account recognition result to obtain the candidate content update model; the output of the initial content model in the candidate account model is updated based on the content recognition result to obtain the candidate account update model. Based on the sample account data and sample content data, the candidate account update model and the candidate content update model are trained iteratively to obtain the abnormal account identification model and the abnormal content identification model.

2. The method according to claim 1, characterized in that, The initial account model includes an account feature extraction sub-model and a first anomaly identification sub-model. The construction of a candidate account model based on the initial account model and the initial content model includes: The candidate account model is constructed based on the account feature extraction sub-model, the initial content model, and the first anomaly identification sub-model; wherein, the first anomaly identification sub-model is used to process the output of the account feature extraction sub-model and the output of the initial content model; The initial content model includes a content feature extraction sub-model and a second anomaly identification sub-model. The construction of a candidate content model based on the initial account model and the initial content model includes: The candidate content model is constructed based on the content feature extraction sub-model, the initial account model, and the second anomaly identification sub-model; wherein, the second anomaly identification sub-model is used to process the output of the content feature extraction sub-model and the output of the initial account model.

3. The method according to claim 2, characterized in that, The sample account data is data associated with the attributes and operations of the sample account. The step of inputting the sample account data and the sample content data into the candidate account model for account anomaly identification to obtain the account identification result includes: Input the sample account data and the sample content data into the candidate account model; Based on the account feature extraction sub-model in the candidate account model, the account attribute features and account operation features of the sample account are extracted from the sample account data. Based on the initial content model in the candidate account model, the sample content data is used to identify content anomalies and obtain a first content auxiliary identification result. The value of the first content auxiliary identification result is a missing value. Based on the first anomaly identification sub-model in the candidate account model, the account attribute features, the account operation features, and the first content-assisted identification results are processed to identify account anomalies, thereby obtaining the account identification results.

4. The method according to claim 2, characterized in that, The step of inputting the sample account data and the sample content data into the candidate content model for content anomaly identification to obtain content identification results includes: Input the sample account data and the sample content data into the candidate content model; The content features of the sample content data are extracted based on the content feature extraction sub-model in the candidate content model, and the sample account data is used to identify account anomalies based on the initial account model in the candidate content model to obtain a first account auxiliary identification result; the value of the first account auxiliary identification result is a missing value. Based on the second anomaly identification sub-model in the candidate content model, the content features and the first account-assisted identification result are processed for content anomaly identification to obtain the content identification result.

5. The method according to claim 1, characterized in that, The process of updating the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, and updating the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model, includes: Based on the account identification result, the output of the initial account model in the candidate content model is filled to obtain the candidate content update model, so that the output of the initial account model in the candidate content model for account anomaly identification of the sample account data is the account identification result. The output of the initial content model in the candidate account model is filled with the content recognition result to obtain the candidate account update model, so that the output of the initial content model in the candidate account model for content anomaly recognition of the sample content data is the content recognition result.

6. The method according to claim 1, characterized in that, The step of interactively iteratively training the candidate account update model and the candidate content update model based on the sample account data and sample content data to obtain the abnormal account identification model and the abnormal content identification model includes: The candidate account update model is used as the current account model, and the candidate content update model is used as the current content model; The sample account data and sample content data are input into the current account model to identify account anomalies and obtain the current account identification result. The sample account data and sample content data are input into the current content model to identify content anomalies and obtain the current content identification result. Based on the difference between the current account identification result and the abnormal tags corresponding to the sample account data, the current account loss data is determined; based on the difference between the current content identification result and the abnormal tags corresponding to the sample content data, the current content loss data is determined. If the current account loss data and the current content loss data do not meet the preset conditions, update the output of the initial account model in the current content model based on the current account identification result, and use the updated model as the current content model again. Update the output of the initial content module in the current account model based on the current content identification result, and use the updated model as the current account model again. The process of inputting the sample account data and sample content data into the current account model for account anomaly identification is repeated until the updated model is used as the current account model again, until the current account loss data and current content loss data meet the preset conditions or the number of iterations meets the preset threshold, thus obtaining the abnormal account identification model and the abnormal content identification model.

7. The method according to claim 6, characterized in that, The sample account data is data associated with the attributes and operations of the sample account. The step of inputting the sample account data and sample content data into the current account model for account anomaly identification, and obtaining the current account identification result, includes: Input the sample account data and sample content data into the current account model; Based on the current account model, the account attribute features and account operation features of the sample account data are extracted. Based on the initial content model in the current account model, the sample content data is used to identify content anomalies and obtain a second content auxiliary identification result. Based on the current account model, the account attribute features, account operation features, and second content-assisted identification results are used to perform account anomaly identification processing to obtain the current account identification result.

8. The method according to claim 6, characterized in that, The step of inputting the sample account data and sample content data into the current content model for content anomaly identification to obtain the current content identification result includes: Input the sample account data and sample content data into the current content model; Based on the current content model, the content features of the sample content data are extracted, and based on the initial account model in the current content model, the sample account data is used to identify account anomalies, thereby obtaining a second account auxiliary identification result. Based on the current content model, the content features and the second account-assisted identification results are processed to identify content anomalies, thereby obtaining the current content identification result.

9. The method according to claim 6, characterized in that, The step of updating the output of the initial account model in the current content model based on the current account identification result, and using the updated model as the current content model again, includes: Based on the current account identification result, the output of the initial account model in the current content model is filled in, and the filled model is used as the current content model again, so that the output of the initial account model in the redefined current content model for account anomaly identification of the sample account data is the current account identification result. The step of updating the output of the initial content module in the current account model based on the current content recognition result, and using the updated model as the current account model again, includes: The output of the initial content model in the current account model is filled based on the current content recognition result, and the filled model is used as the current account model again, so that the output of the initial content model in the redefined current account model for content anomaly recognition of the sample content data is the current content recognition result.

10. The method according to any one of claims 1 to 9, characterized in that, The sample content data is multimodal data, and the abnormal account identification model and the abnormal content identification model are multimodal models.

11. An anomaly identification method, characterized in that, The method includes: Obtain the target account's account data, content data, and abnormal account identification model; the content data is data associated with the content published by the target account. The account data and content data are input into the abnormal account identification model for abnormal account identification processing to obtain the abnormal identification result of the target account; The abnormal account identification model is generated based on the abnormal identification model generation method according to any one of claims 1 to 10.

12. An anomaly identification method, characterized in that, The method includes: Obtain account data, content data, and anomaly content identification model for the target account; the content data is data associated with the content published by the target account. The account data and the content data are input into the abnormal content recognition model for content anomaly recognition processing to obtain the anomaly recognition result of the content data. The abnormal content recognition model is generated based on the abnormal recognition model generation method according to any one of claims 1 to 10.

13. An anomaly recognition model generation device, characterized in that, The device includes: The sample data acquisition module is used to acquire sample account data and sample content data of sample accounts; the sample content data is data associated with the content published by the sample account. The initial training module is used to train the initial account model and the initial content model based on the sample account data and the sample content data, respectively. A construction module is used to construct a candidate account model based on the initial account model and the initial content model, wherein the output of the initial content model in the candidate account model is a missing value; and to construct a candidate content model based on the initial account model and the initial content model, wherein the output of the initial account model in the candidate content model is a missing value. The initial identification module is used to input the sample account data and the sample content data into the candidate account model to identify account anomalies and obtain account identification results; and to input the sample account data and the sample content data into the candidate content model to identify content anomalies and obtain content identification results. The output update module is used to update the output of the initial account model in the candidate content model based on the account recognition result to obtain the candidate content update model, and to update the output of the initial content model in the candidate account model based on the content recognition result to obtain the candidate account update model. The interactive training module is used to perform interactive iterative training on the candidate account update model and the candidate content update model based on the sample account data and sample content data, so as to obtain the abnormal account identification model and the abnormal content identification model.

14. An anomaly detection device, characterized in that, The device includes: The first data acquisition module is used to acquire account data, content data, and an abnormal account identification model of the target account; the content data is data associated with the content published by the target account. The account recognition module is used to input the account data and the content data into the abnormal account recognition model to perform account anomaly recognition processing and obtain the anomaly recognition result of the target account. The abnormal account identification model is generated based on the abnormal identification model generation method according to any one of claims 1 to 10.

15. An anomaly detection device, characterized in that, The device includes: The second data acquisition module is used to acquire account data, content data, and an abnormal content identification model of the target account; the content data is data associated with the content published by the target account. The content recognition module is used to input the account data and the content data into the abnormal content recognition model for content anomaly recognition processing, and obtain the anomaly recognition result of the content data; The abnormal content recognition model is generated based on the abnormal recognition model generation method according to any one of claims 1 to 10.

Images