User identification method, computing device, storage medium, and program product

Abstract

Embodiments of the present application provide a user identification method, a computing device, a storage medium and a program product. In the method, a user feature of a target user is obtained, the target user is subjected to abnormality identification based on the user feature and an identification model, a first identification result is obtained, the target user is subjected to feature matching with an abnormal sample user based on the user feature, a second identification result is obtained according to a matching result of the target user subjected to abnormality identification, and whether the target user is an abnormal user is determined by combining the first identification result and the second identification result. The technical solution provided by the embodiments of the present application can improve the accuracy of identifying abnormal users.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a user identification method, computing device, storage medium, and program product. Background Technology

[0002] The development of electronic technology has led to the increasing popularity of applications such as social networking, shopping, and financial applications. Users can obtain various services provided by application service providers by installing applications on their devices and registering user accounts. While this brings convenience to users, it also creates security risks. In actual applications, there are a large number of abnormal behaviors of abnormal users, such as order-grabbing and cheating, which leads to service abuse and seriously affects the fairness of the application and the user experience.

[0003] In existing technologies, rules are typically used to identify whether a user is an abnormal user based on whether user behavior data matches preset rules. However, this approach is not very accurate. Summary of the Invention

[0004] This application provides a user identification method, computing device, storage medium, and program product to solve the problem of low accuracy in identifying abnormal users in the prior art.

[0005] In a first aspect, embodiments of this application provide a user identification method, including:

[0006] Obtain user characteristics of the target users;

[0007] Based on the user characteristics, the target user is identified using an anomaly identification model to obtain a first identification result;

[0008] Based on the user characteristics, the target user is matched with abnormal sample users, and the target user is identified as abnormal based on the matching results to obtain a second identification result;

[0009] By combining the first identification result and the second identification result, it is determined whether the target user is an abnormal user.

[0010] Optionally, the recognition model is trained using a training dataset; the training dataset includes sample user features and training labels of sample users.

[0011] The method further includes:

[0012] Collect user data corresponding to multiple registered users, and extract user features corresponding to each of the multiple registered users;

[0013] For any registered user, based on the user characteristics of the registered user, feature matching is performed between the registered user and sample users in the training dataset;

[0014] If no target sample user matches the registered user, then label the registered user with training labels.

[0015] The registered users are used as sample users to update the recognition model using their user characteristics and training labels.

[0016] Optionally, the step of matching the target user with abnormal sample users based on the user characteristics, and identifying the target user as an anomaly based on the matching result to obtain a second identification result includes:

[0017] Based on the user characteristics, determine the target user set to which the target user belongs from multiple user sets;

[0018] Based on whether the sample users in the target user set are abnormal sample users, the target users are identified as abnormal to obtain a second identification result.

[0019] Optionally, it also includes:

[0020] The training dataset contains multiple sample users. Based on the characteristics of each sample user, these users are aggregated to form multiple user sets.

[0021] Optionally, the acquisition of user characteristics of the target user includes:

[0022] Acquire user data of the target user; the user data includes user behavior data and user environment data.

[0023] Extract user features from the user data.

[0024] Optionally, the user environment data includes user network data and user device data; the user behavior data includes at least one behavior parameter data; the user network data includes at least one network parameter data; and the user device data includes at least one device parameter data.

[0025] The extraction of user features from the user data includes:

[0026] From the user data, at least one sequence feature is extracted from parameter data with time distribution characteristics, and at least one data feature is extracted from parameter data without time distribution characteristics;

[0027] The user characteristics of the target user are constituted by the at least one sequence feature and the at least one data feature.

[0028] Optionally, it also includes:

[0029] The target identification result obtained by combining the first identification result and the second identification result is sent to the target server.

[0030] Alternatively, if the target user is determined to be an abnormal user, perform one or more of the following processing operations:

[0031] The user account, network address, or user device corresponding to the target user shall be subject to restriction and control measures.

[0032] Output an error message;

[0033] Send a verification prompt message to the target user;

[0034] Add the target user to the blacklist.

[0035] Optionally, determining whether the target user is an abnormal user by combining the first identification result and the second identification result includes:

[0036] If the first identification result or the second identification result identifies the target user as abnormal, the target user is determined to be an abnormal user; otherwise, the target user is determined to be a normal user.

[0037] Optionally, it also includes:

[0038] A third identification result is obtained based on whether the target user is a blacklisted user;

[0039] The fourth identification result is obtained by identifying whether the user data of the target user meets the anomaly rules.

[0040] The step of combining the first identification result and the second identification result to determine whether the target user is an abnormal user includes:

[0041] By combining the first identification result, the second identification result, the third identification result, and the fourth identification result, it is determined whether the target user is an abnormal user.

[0042] Optionally, the user environment data includes user network data and user device data;

[0043] The extraction of user features from the user data includes:

[0044] Extract user behavior features from the user behavior data;

[0045] Extract user network features from the user network data;

[0046] Extract user equipment features from the user equipment data;

[0047] The step of using the recognition model to perform anomaly identification on the target user based on the user characteristics and obtaining a first identification result includes:

[0048] Based on user behavior characteristics, an anomaly identification is performed on the target user using a behavior recognition model to obtain behavior recognition results;

[0049] Based on user network characteristics, an anomaly identification is performed on the target user using a network identification model to obtain network identification results;

[0050] Based on user equipment characteristics, an anomaly identification is performed on the target user using a device identification model to obtain device identification results;

[0051] The first identification result is determined by combining the behavior identification result, the network identification result, and the device identification result.

[0052] Optionally, if the step of determining that the target user is an abnormal user further includes:

[0053] Based on the user data corresponding to different abnormal users, identify multiple abnormal users who have at least one user behavior with the same time and behavior type, at least one network parameter, at least one device parameter, and / or belong to the same user set; the user set is obtained by grouping multiple sample users in the training dataset based on the sample user features;

[0054] The abnormality type of the multiple abnormal users was determined to be group control behavior.

[0055] Secondly, this application provides a user identification method applied to a detection plugin, wherein the detection plugin is integrated into a target client, and the method includes:

[0056] Collect user data from target users; the user data includes user behavior data and user environment data.

[0057] The user data is sent to the detection server, which extracts user features from the user data. Based on the user features, an anomaly detection model is used to identify the target user and obtain a first identification result. Based on the user features, the target user is matched with abnormal sample users, and the target user is identified as an anomaly based on the matching result to obtain a second identification result. Combining the first identification result and the second identification result, it is determined whether the target user is an abnormal user.

[0058] Thirdly, this application provides a computing device including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the user identification method as described in the first aspect above or the user identification method as described in the second aspect above.

[0059] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements the user identification method as described in the first aspect or the user identification method as described in the second aspect.

[0060] Fifthly, in an embodiment of this application, a computer program product includes a computer program / instruction, which, when executed by a computer, implements the user identification method as described in the first aspect or the user identification method as described in the second aspect.

[0061] This application embodiment obtains user characteristics of a target user, uses an identification model to identify anomalies in the target user based on these characteristics, and obtains a first identification result. Based on the user characteristics, the target user is matched with anomalous sample users, and anomaly identification is performed on the target user according to the matching result, obtaining a second identification result. Combining the first and second identification results, it is determined whether the target user is an anomalous user. Specifically, matching the target user with anomalous sample users effectively identifies known anomaly types, ensuring the stability of the identification process. The identification model has generalization ability, enabling effective identification and prediction on unseen data, and can be continuously updated to identify new anomaly types, exhibiting scalability and improving the flexibility of the identification process. Combining the two identification results enhances the system's fault tolerance and improves the accuracy of the identification.

[0062] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This application provides a schematic diagram illustrating the structure of one embodiment of a system.

[0065] Figure 2A flowchart of one embodiment of a user identification method provided in this application is shown;

[0066] Figure 3 A flowchart of one embodiment of a user identification method provided in this application is shown;

[0067] Figure 4 This invention provides a schematic diagram of the structure of one embodiment of a user identification device.

[0068] Figure 5 This invention provides a schematic diagram of the structure of one embodiment of a user identification device.

[0069] Figure 6 A schematic diagram of one embodiment of a computing device provided in this application is shown. Detailed Implementation

[0070] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0071] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0072] The technical solutions of this application embodiment can be applied to abnormal user identification scenarios, such as scenarios where abnormal identification is performed on registered users of an application.

[0073] As described in the background section, when users install applications to obtain various services provided by application service providers, there may be a large number of abnormal behaviors from abusive users. These include group control behavior, malicious attacks, or resource abuse. Group control behavior refers to the abnormal behavior of controlling multiple user devices to perform consistent operations, such as using group control devices to control multiple user devices to frequently access shopping applications to generate fake traffic, publish false information, and engage in malicious activities like order grabbing. Currently, the method of identifying abnormal users based on whether user behavior data matches preset rules is not very accurate.

[0074] In this application embodiment, to improve identification accuracy, the inventors have proposed the technical solution of this application after a series of studies. In this application embodiment, user characteristics of the target user are obtained. Based on the user characteristics, an anomaly identification model is used to identify the target user, obtaining a first identification result. Based on the user characteristics, the target user is matched with abnormal sample users, and anomaly identification is performed on the target user according to the matching result, obtaining a second identification result. Combining the first identification result and the second identification result, it is determined whether the target user is an abnormal user. Among them, matching the target user with abnormal sample users can effectively identify known anomaly types and ensure the stability of identification. The identification model has generalization ability, can effectively identify and predict on unseen data, and can be continuously updated to identify new anomaly types, which has scalability and can improve the flexibility of identification. Combining the two identification results can enhance the fault tolerance of the system and improve the accuracy of identification.

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0076] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0077] It should be noted that the technical solutions of this application embodiment are applicable to the network virtual environment, and the described users generally refer to "virtual users". Real users can register user accounts on the server through registration to obtain user identity in the network environment.

[0078] Figure 1 A system architecture diagram is shown in which the technical solution of an embodiment of this application can be applied. The system architecture may include a target server 101 and a target client 102. In addition, in some implementations, the system architecture may also include a detection server 103.

[0079] The target server 101, target client 102, and detection server 103 can establish a connection via a network. The network provides a communication link medium between the target server 101, target client 102, and detection server 103. The network can include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0080] The target client 102 can be a browser, an app (application), a web application such as an H5 (HyperText Markup Language 5) application, a lightweight application (also known as a mini-program), or a cloud application, etc. The client can be deployed on an electronic device and depends on the device to run or on certain apps on the device. The electronic device may have a display screen and support information browsing, such as a personal mobile terminal like a mobile phone, tablet, personal computer, desktop computer, smart speaker, smartwatch, etc. The electronic device typically includes at least one processing component and at least one storage component. The electronic device may also include basic configurations such as a network card chip, I / O bus, and audio / video components; this application does not limit its scope. Optionally, depending on the implementation of the electronic device, it may also include some peripheral devices, such as a keyboard, mouse, pen, printer, etc.; this application does not limit its scope.

[0081] The target server 101 and the detection server 103 can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. The server can also be a server in a distributed system, or a server integrated with blockchain. The server can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology; this application does not limit this.

[0082] The detection server 103 can be a server that is independent of the target server 101, or the detection server 103 can be integrated into the target server 101.

[0083] In a practical application, the target client can refer to the application provided by the application service provider, while the target server can be the server provided by the application service provider, used to interact with the target client and provide corresponding functions to the user. The detection server can be provided by a cloud computing provider; the application service provider can purchase or rent cloud computing services from the provider to achieve user identification, etc. When the detection server and the target server are independent, the target client can integrate a detection plugin corresponding to the detection server. This plugin can collect user data and interact with the detection server to achieve user identification, etc.

[0084] The target client can collect real-time user behavior data and report it to the target server. The target server can provide corresponding services based on the user behavior data. For example, if the user behavior data is an order operation for a product, the target server can generate a product order based on it. Since the target client may be maliciously manipulated, resulting in abnormal user behavior, the technical solution of this application embodiment can effectively and accurately identify abnormal users.

[0085] Taking user identification via a detection server as an example, in this embodiment, the detection plugin in the target client 102 can collect user data of the target user and report the user data to the detection server 103. The detection server 103 can extract user features from the user data and, based on the user features, use an identification model to perform anomaly identification on the target user to obtain a first identification result. Based on the user features, it can perform feature matching between the target user and abnormal sample users, and perform anomaly identification on the target user according to the matching result to obtain a second identification result. Thus, by combining the first identification result and the second identification result, it can be determined whether the target user is an abnormal user and obtain the final target identification result. The detection server 103 can send the target identification result to the target server 101, so that the target server 101 can perform anomaly handling operations on the target user, such as restricting or controlling the user account, network address, or user device corresponding to the target user.

[0086] Of course, the target server can also integrate user identification functions, and the target client can also integrate the data collection functions of the detection plugin. Thus, the target client or the detection plugin can collect user data and report the user data to the target server. The target server can then perform the aforementioned feature extraction, anomaly identification, and other operations to obtain the first identification result and the second identification result. By combining the first identification result and the second identification result, it can be determined whether the target user is an abnormal user, thus obtaining the final target identification result. Based on the target identification result, anomaly handling operations can then be performed.

[0087] The implementation details of the technical solutions in the embodiments of this application are described in detail below. Figure 2 This is a flowchart of an embodiment of a user identification method provided in this application. The technical solution of this embodiment can be executed by a target server or a detection server.

[0088] This method may include the following steps:

[0089] 201: Obtain the user characteristics of the target user.

[0090] The target user can refer to any registered user on the target server, or it can refer to a specific user.

[0091] Registered users refer to "virtual users" corresponding to user accounts. Real users can register user accounts on the target server using the target client, thereby obtaining a user identity in the network environment and obtaining functions provided by the target server based on the user account.

[0092] User characteristics may include user behavior characteristics, and may also include user environment characteristics. Optionally, user environment characteristics may include user network characteristics and user device characteristics, etc.

[0093] Alternatively, user characteristics can be extracted from user data.

[0094] User data can include user behavior data and user environment data, as well as user attribute data.

[0095] User environment data can include user network data and user device data.

[0096] User behavior data may include at least one behavioral parameter. This parameter may include, for example, at least one of the following: accessed resources, resource access frequency, resource access dwell time, request method, and access path. The accessed resources may refer to pages or functional modules accessed by the user, the request method may be a GET request or a POST request, and the access path may reflect the order in which the user accessed resources.

[0097] User network data may include at least one network parameter. This at least one network parameter may include, for example, at least one of IP (Internet Protocol Address) address, network latency, and data traffic.

[0098] User device data may include at least one device parameter. This device parameter may include, for example, at least one of the following: operating system version, device model, device manufacturer, device name, device battery level, network type, installed applications, screen resolution, and screen status.

[0099] In this embodiment, when the technical solution is executed by the detection server, the detection plugin integrated in the target client can collect the target user's user data and send it to the detection server.

[0100] Those skilled in the art will understand that, in order to improve data quality, user data can be preprocessed first, such as data standardization, removal of noise and redundant information from user data, data integration, etc., and then user features can be extracted from the preprocessed user data.

[0101] User characteristics can be extracted from user data through statistical analysis, time series analysis, and / or encoding. Multiple dimensions of characteristics can be statistically obtained from user data, such as user behavior characteristics (e.g., resource access frequency, average resource access duration, peak resource access times, behavioral path sequences representing access paths, behavioral conversion sequences representing behavioral conversions); user device characteristics (e.g., operating system version, device model, screen resolution); and user network characteristics (e.g., IP address, data traffic, network latency). These multiple dimensions of characteristics can then be combined or merged to obtain the final user characteristics.

[0102] 202: Based on user characteristics, use the recognition model to identify anomalies in the target user and obtain the first recognition result.

[0103] The recognition model can be a machine learning model, for example, it can be trained using a decision tree algorithm.

[0104] The recognition model can be trained using a training dataset. The training dataset consists of multiple sample users and may include their user characteristics and training labels. The training labels for the sample users can indicate whether they are abnormal; the initial recognition result can include whether the target user is normal or abnormal.

[0105] 203: Based on user characteristics, the target user is matched with abnormal sample users, and the target user is identified as abnormal based on the matching results to obtain a second identification result.

[0106] The feature matching between the target user and the abnormal sample user can be achieved by calculating the first feature similarity between the user features of the target user and the user features of the abnormal sample user. If the first feature similarity reaches a first similarity threshold, the matching result is that the target user and the abnormal sample user are matched; if the first feature similarity does not reach the first similarity threshold, the matching result is that the target user and the abnormal sample user are not matched. This first similarity can be obtained by calculating the Euclidean distance or cosine distance between the user features of the target user and the user features of the abnormal sample user.

[0107] If the matching result is that the target user matches the abnormal sample user, then the second identification result is that the target user is an abnormal user. If the matching result is that the target user does not match the abnormal sample user, then the second identification result is that the target user is a normal user.

[0108] 204: Combining the first identification result and the second identification result, determine whether the target user is an abnormal user.

[0109] In this embodiment, user characteristics of the target user are acquired. Based on these user characteristics, an anomaly identification model is used to identify the target user, resulting in a first identification result. Then, based on the user characteristics, feature matching is performed between the target user and anomalous sample users. Based on the matching result, anomaly identification is performed on the target user, resulting in a second identification result. Combining the first and second identification results, it is determined whether the target user is an anomalous user. Feature matching between the target user and anomalous sample users effectively identifies known anomaly types, ensuring the stability of the identification process. The identification model has generalization capabilities, enabling effective identification and prediction on unseen data. It can be continuously updated to identify new anomaly types, exhibiting scalability and improving the flexibility of the identification process. Combining the two identification results enhances the system's fault tolerance and improves the accuracy of the identification.

[0110] User data, including user behavior data, user network data, and user device data, can reveal various aspects. User device data reflects a user's hardware configuration and usage habits, potentially indicating unauthorized intrusion or tampering. User network data reflects a user's network activity and connection status, potentially revealing the risk of malicious attacks or fraud. User behavior data reflects a user's specific actions, potentially revealing improper or unethical behavior. Multi-dimensional data provides more comprehensive information, resulting in richer user features extracted. Identification results based on these features can cover more types of abnormal behavior, improving the comprehensiveness, accuracy, and reliability of the identification process.

[0111] In some embodiments, the method may further include: collecting sample user data corresponding to multiple sample users from historical data records; extracting sample user features corresponding to multiple sample users from the sample user data; and adding the sample user features and training labels corresponding to multiple sample users to the training dataset.

[0112] The training dataset can be used to train the recognition model. Furthermore, the training dataset can be used to divide multiple sample users into multiple user sets. These user sets can be used to determine the target user set to which the target user belongs. Based on whether the sample users in the target user set are abnormal sample users, anomaly identification is performed on the target user to obtain a second recognition result. Specific implementation details are provided below.

[0113] The sample users can include registered users, and user data corresponding to registered users can be collected from the historical data records of registered users as sample user data.

[0114] This application embodiment can utilize historical data records generated by the target server for data collection and model training. These historical data records originate from the server's past operational records, possessing authenticity and representativeness, and containing rich user behavior patterns. This helps the model adapt to the target server's environment during the recognition process, improving recognition accuracy. Of course, the training dataset can also be entirely manually compiled; this application does not impose any limitations on this.

[0115] In some embodiments, the method may further include: collecting user data corresponding to multiple registered users and extracting user features corresponding to multiple registered users; for any registered user, matching the registered user with sample users in the training dataset based on the user features of the registered user; if there is no target sample user that meets the matching conditions with the registered user, labeling the registered user with training labels; and using the registered user as a sample user to update the recognition model using the user features and training labels of the registered user.

[0116] If there are target sample users who match the registered user, the registered user will not be included as a sample user.

[0117] Feature matching between registered users and sample users in the training dataset can be achieved by calculating the second feature similarity between the registered user and the sample users in the training dataset. This second feature similarity can be obtained by calculating the Euclidean distance or cosine distance between the user features of the registered user and the user features of the sample users in the training dataset. The matching condition could be, for example, that the second feature similarity between the registered user and the sample users reaches a second similarity threshold. If the second feature similarity between the registered user and all sample users in the training dataset does not reach the second similarity threshold (i.e., there are no target sample users similar to the registered user), then the registered user is considered a sample user. If there is a sample user whose second feature similarity reaches the second similarity threshold, then this sample user is similar to the registered user, and the registered user is not considered a sample user.

[0118] In this embodiment, registered users who differ significantly from the sample users can be added to the training dataset. Retraining the recognition model based on this training dataset can update the model parameters and increase the richness of the training dataset. This allows the retrained recognition model to learn more data features, adapt to data changes, and improve the generalization ability of the recognition model.

[0119] This allows for the real-time collection of user data from multiple registered users, and the use of registered users as sample users when no target sample user matches the registered user, thus enabling real-time updates to the recognition model.

[0120] In some embodiments, labeling training data for registered users may include: outputting labeling prompts; and determining the training labels to be labeled for the registered users based on the labeling request. For example, the labeling prompts may be output to developers, who then label the training data for the registered users.

[0121] In some embodiments, based on user characteristics, the target user is matched with abnormal sample users, and the target user is identified as an anomaly based on the matching results to obtain a second identification result. This may include: based on user characteristics, determining the target user set to which the target user belongs from multiple user sets; and identifying the target user as an anomaly based on whether the sample users in the target user set are abnormal sample users to obtain a second identification result.

[0122] Based on whether the sample users in the target user set are abnormal sample users, the target user is identified as an anomaly. The second identification result can be: if the sample users in the target user set are abnormal sample users, then the second identification result is that the target user is an abnormal user; if the sample users in the target user set are normal sample users, then the second identification result is that the target user is a normal user.

[0123] Users can be manually pre-labeled to indicate anomalies, thus dividing multiple user samples into multiple user sets. There are several ways to divide users into multiple sets. In some embodiments, multiple user samples corresponding to the training dataset can be aggregated based on their respective user features to form multiple user sets. That is, clustering can be used to aggregate multiple user samples into multiple user sets, ensuring that the user samples in each set have similar features.

[0124] Alternatively, multiple user sets can be formed by dividing multiple sample users into multiple user sets based on the characteristics of the sample users corresponding to the multiple sample users in the training dataset according to predetermined partitioning rules or classification algorithms.

[0125] The target user set to which the target user belongs can be the set of users whose user features are most similar to those of the target user among multiple user sets. For example, determining the target user set to which the target user belongs from multiple user sets obtained through aggregation based on user features can be achieved by calculating the third feature similarity between the target user's user features and the average feature of each user set, and taking the user set with the highest third feature similarity as the target user set to which the target user belongs. The third feature similarity can be obtained by calculating the Euclidean distance or cosine distance between the target user's user features and the average feature of each user set, where the average feature of each user set can be obtained iteratively using a clustering algorithm during the aggregation process to obtain multiple user sets.

[0126] In some embodiments, the method may further include: determining whether multiple user sets are abnormal user sets based on whether the sample users corresponding to the multiple user sets are abnormal sample users.

[0127] For example, whether a user set is an abnormal user set can be determined by whether the proportion of abnormal sample users in the user set reaches a predetermined proportion. Assuming the predetermined proportion is 50%, then if the proportion of abnormal sample users in the user set reaches 50%, the user set is determined to be an abnormal user set; if the proportion of abnormal users in the user set is less than 50%, the user set is determined to be a normal user set.

[0128] The above-mentioned method of identifying target users based on whether sample users in the target user set are abnormal sample users, and obtaining a second identification result, can include: obtaining a second identification result based on whether the target user set is an abnormal user set. Specifically, if the target user set is an abnormal user set, the second identification result is that the target user is abnormal; if the target user set is a normal user set, the second identification result is that the target user is normal.

[0129] Furthermore, matching rules can be set between feature combinations and anomaly types. Different combinations of user features correspond to different anomaly types, which may include, for example, group control behavior, malicious attacks, and resource abuse. Based on these matching rules and the user characteristics of anomalous sample users in the anomalous user set, the anomaly type of the anomalous user set is determined. If the target user set to which the target user belongs is an anomalous user set, the anomaly type of that anomalous user set can be used as the anomaly type of the target user.

[0130] In some embodiments, extracting user features from user data may include: extracting at least one sequence feature from parameter data with time distribution characteristics from user data, and extracting at least one data feature from parameter data without time distribution characteristics; the user features of the target user are composed of at least one sequence feature and at least one data feature.

[0131] Among them, parameter data with time distribution characteristics can refer to parameter data recorded in chronological order that can reflect changes in user behavior over time, such as access to resources and the time spent accessing resources.

[0132] For example, suppose the parameter data used to extract sequence features is accessed resources and the time spent accessing those resources. Based on this parameter data, a sequence of the number of times the resource was accessed at each time interval within a predetermined period can be extracted, such as the sequence of the number of times a user accessed the resource each day for the past 7 days: [3, 5, 2, 4, 6, 1, 3]. Alternatively, the sequence of time intervals between two consecutive accesses to the resource within a predetermined period can also be extracted based on this parameter data, such as the time interval (in hours) between two consecutive accesses to the resource the user accessed the previous day: [8, 2, 2]. For example, user device data such as operating system version, device model, device manufacturer, device name, device battery level, network type, installed applications, and screen resolution are usually fixed and do not change frequently over time. Device data itself does not contain a time dimension and cannot reflect the temporal order or trend of user behavior. Therefore, this data can be used as parameter data with non-temporally distributed characteristics.

[0133] Sequence features can capture the patterns and trends of user behavior over time. These patterns and trends help identify abnormal behavior. By extracting sequence features, the identification model can learn user behavior patterns and improve the accuracy of identifying abnormal behavior.

[0134] There are several ways to determine whether a target user is an anomalous user by combining the first and second identification results. One optional approach is to determine whether a target user is an anomalous user by combining the first and second identification results: if either the first or second identification result indicates the target user is anomalous, then the target user is determined to be an anomalous user; otherwise, the target user is determined to be a normal user. In other words, if either the first or second identification result indicates the target user is anomalous, then the target user is determined to be an anomalous user; otherwise, the target user is determined to be a normal user. This optional approach can avoid false negatives.

[0135] As an alternative approach, the target user can be determined to be an abnormal user only if both the first and second identification results indicate that the target user is abnormal; otherwise, the target user can be determined to be a normal user. This avoids false positives in the final determination of whether the target user is abnormal due to a single false positive result.

[0136] In some embodiments, the method may further include: obtaining a third identification result based on whether the target user is a blacklisted user; and obtaining a fourth identification result based on whether the user data of the target user meets anomaly rules.

[0137] Specifically, if the target user is on a blacklist, the third identification result is that the target user is an abnormal user; if the target user is not on a blacklist, the third identification result is that the target user is a normal user. If the target user's user data meets the anomaly rules, the fourth identification result is that the target user is an abnormal user; if the target user's user data does not meet the anomaly rules, the fourth identification result is that the target user is a normal user.

[0138] Determining whether a target user is an anomalous user by combining the first and second identification results can include: determining whether a target user is an anomalous user by combining the first, second, third, and fourth identification results.

[0139] Optionally, determining whether a target user is an anomalous user by combining the first, second, third, and fourth identification results can mean that any one of the first, second, third, and fourth identification results identifies the target user as an anomalous user, thus confirming the target user as an anomalous user and avoiding false positives. Alternatively, determining whether a target user is an anomalous user by combining the first, second, third, and fourth identification results can mean that all of the first, second, third, and fourth identification results identify the target user as an anomalous user, thus confirming the target user as an anomalous user and avoiding false positives.

[0140] In this embodiment, multiple identification results are obtained through various identification methods to determine whether the target user is abnormal. This can comprehensively capture the abnormal behavior of the target user and improve the accuracy of identification.

[0141] In some embodiments, user environment data may include user network data and user device data. Extracting user features from user data may include: extracting user behavior features from user behavior data; extracting user network features from user network data; and extracting user device features from user device data.

[0142] Based on user characteristics, anomaly identification of target users using an identification model to obtain a first identification result may include: based on user behavior characteristics, anomaly identification of target users using a behavior identification model to obtain a behavior identification result; based on user network characteristics, anomaly identification of target users using a network identification model to obtain a network identification result; based on user device characteristics, anomaly identification of target users using a device identification model to obtain a device identification result; and combining the behavior identification result, network identification result, and device identification result to determine the first identification result.

[0143] Among them, the behavior recognition model can be trained using the sample user behavior features and training labels of the sample users; the network recognition model can be trained using the sample user network features and training labels of the sample users; and the device recognition model can be trained using the sample user device features and training labels of the sample users.

[0144] Optionally, the first identification result is determined by combining the behavior recognition result, network recognition result, and device recognition result. This can mean that if any one of the behavior recognition result, network recognition result, or device recognition result identifies the target user as abnormal, the first identification result is that the target user is an abnormal user; otherwise, the first identification result is that the target user is a normal user. Alternatively, the first identification result is determined by combining the behavior recognition result, network recognition result, and device recognition result. This can mean that if all three result identify the target user as abnormal, the first identification result is that the target user is an abnormal user; otherwise, the first identification result is that the target user is a normal user. Alternatively, the first identification result is determined by combining the behavior recognition result, network recognition result, and device recognition result. This can mean that if two of the three result identify the target user as abnormal, the first identification result is that the target user is an abnormal user; otherwise, the first identification result is that the target user is a normal user.

[0145] This embodiment utilizes different recognition models to identify users based on different types of user characteristics, which can improve the accuracy of recognition and thus improve the accuracy of identifying whether the target user is abnormal.

[0146] In some embodiments, when the target user is determined to be an abnormal user, the method may further include: identifying multiple abnormal users who share at least one user behavior of the same time and behavior type, at least one identical network parameter, at least one identical device parameter, and / or belong to the same user set, based on the user data corresponding to different abnormal users; and determining that the abnormality type of the multiple abnormal users is group control behavior. The user set is obtained by grouping multiple sample users in the training dataset based on sample user characteristics.

[0147] If multiple abnormal users have at least one user behavior with the same time and behavior type, at least one identical network parameter, at least one identical device parameter, and / or belong to the same user set, then the abnormal type of the multiple abnormal users can be determined as group control behavior.

[0148] For example, different types of user behavior can include browsing, clicking, searching, and purchasing. Multiple abnormal users exhibiting at least one identical behavior type and time can be multiple abnormal users making purchases simultaneously. Similarly, multiple abnormal users with at least one identical network parameter can be multiple abnormal users sharing the same IP address. Likewise, multiple abnormal users with at least one identical device parameter can be multiple abnormal users with the same device type and screen status. Since group control often involves multiple users performing the same behavior simultaneously, users on the same network segment, or multiple devices of the same type, the presence of at least one identical user behavior type, network parameter, or device parameter among these abnormal users can be used as criteria for determining whether multiple abnormal users constitute group control behavior. In particular, multiple abnormal users in group control typically share similar characteristics; users within the same user set exhibit similar characteristics. Multiple abnormal users belonging to the same user set can reflect similar characteristics among multiple abnormal users, thus allowing the abnormality type of multiple abnormal users to be determined as group control behavior.

[0149] Furthermore, when the technical solution of this application embodiment is executed by the detection server, after the detection server determines that the abnormal type of the target user is group control behavior, it can perform one or more of the following processing operations: restrict control on the user account, network address, or user device corresponding to the target user; send verification prompt information to the target user; add the target user to the blacklist, etc. It can also send group control prompt information to the target server so that the target server can perform one or more of the above processing operations.

[0150] In some embodiments, where the technical solution of this application is executed by the detection server, as an optional implementation, the method may further include: if the target user is determined to be an abnormal user, performing one or more of the following processing operations: restricting or controlling the user account, network address, or user device corresponding to the target user; outputting abnormal prompt information; sending verification prompt information to the target user; and adding the target user to the blacklist.

[0151] As an alternative implementation, the detection server can send the target identification result obtained by combining the first identification result and the second identification result to the target server, so that the target server can perform corresponding operations based on the target identification result, such as performing one or more of the above-mentioned processing operations if the target identification result indicates that the target user is an abnormal user.

[0152] This includes restricting the user account corresponding to the target user, such as limiting the user account's functions. Restricting the network address or user device, such as blocking the user's network address or user device. Outputting abnormal prompts, such as indicating that the target user's current behavior is abnormal. Verification prompts sent to the target user can be used for secondary verification, such as security questions.

[0153] As described above, the anomaly type of a target user can be determined through feature combinations and anomaly type matching rules. Different processing operations can be adopted for different anomaly types.

[0154] For example, if the target user's anomaly type is group control behavior, you can temporarily restrict the target user's login account or limit the use of certain functions. If the target user's anomaly type is malicious attack, you can permanently freeze the user's account. If the target user's anomaly type is resource abuse, you can restrict the target user's resource usage. The specific handling actions for different anomaly types can be limited based on actual needs. Determining the anomaly type allows for more precise anomaly handling.

[0155] In this embodiment, by processing abnormal users and restricting their behavior, security threats can be prevented, abnormal users can be prevented from interfering with other normal users, and the user experience can be improved.

[0156] Figure 3 This is a flowchart illustrating an embodiment of a user identification method provided in this application. The technical solution of this embodiment can be executed by a detection plugin, which is integrated into the target client. In a practical application, the target client can refer to an application provided by an application service provider, while the target server can be the server corresponding to the application service provider, used to interact with the target client and provide corresponding functions to the user. The detection server can be provided by a cloud computing provider. The application service provider can purchase or rent cloud computing services provided by the cloud computing provider, thereby using the detection server to achieve abnormal user identification, etc. The cloud computing provider can provide detection plugins such as SDKs (Software Development Kits) to the application provider of the target application. When the detection server and the target server are independent of each other, the target client can integrate the detection plugin corresponding to the detection server, enabling the target client to establish a connection with the detection server through the detection plugin, etc.

[0157] This method may include the following steps:

[0158] 301: Collect user data from the target users.

[0159] User data can include user behavior data, user environment data, and user attribute data, etc.

[0160] 302: Send user data to the detection server so that the detection server can extract user features from the user data; based on the user features, use the recognition model to identify the target user as an anomaly and obtain a first recognition result; based on the user features, perform feature matching between the target user and the abnormal sample user, and perform anomaly identification on the target user according to the matching result to obtain a second recognition result; combine the first recognition result and the second recognition result to determine whether the target user is an abnormal user.

[0161] For details on how the detection server identifies whether a target user is an abnormal user based on user data, please refer to the above. Figure 2 As illustrated in the embodiments, the details will not be repeated here.

[0162] In this embodiment, the detection plugin acquires user data of the target user and sends it to the detection server. The detection server extracts user features from the user data, uses a recognition model to identify anomalies in the target user based on these features, and obtains a first recognition result. Based on the user features, the target user is matched with anomalous sample users, and the target user is further identified as an anomaly based on the matching result, obtaining a second recognition result. Combining the first and second recognition results, it is determined whether the target user is an anomalous user. Matching the target user with anomalous sample users effectively identifies known anomaly types, ensuring the stability of the identification process. The recognition model has generalization capabilities, enabling effective identification and prediction on unseen data, and can be continuously updated to identify new anomaly types, providing scalability and improving the flexibility of the identification process. Combining the two recognition results enhances the system's fault tolerance and improves the accuracy of the identification.

[0163] Figure 4 This application provides a schematic diagram of the structure of a user identification device according to one embodiment. The device includes:

[0164] Module 401 is used to acquire user characteristics of the target user.

[0165] The first identification module 402 is used to identify anomalies in the target user based on user characteristics and using an identification model to obtain a first identification result.

[0166] The second identification module 403 is used to perform feature matching between the target user and abnormal sample users based on user characteristics, and to identify the target user as an anomaly based on the matching results, thereby obtaining a second identification result.

[0167] The determination module 404 is used to combine the first identification result and the second identification result to determine whether the target user is an abnormal user.

[0168] In some embodiments, the device may further include:

[0169] The first collection module is used to collect sample user data corresponding to multiple sample users from historical data records; extract sample user features corresponding to multiple sample users from the sample user data; and add the sample user features and training labels corresponding to multiple sample users to the training dataset.

[0170] In some embodiments, the first collection module can also be used to collect user data corresponding to multiple registered users respectively, and extract user features corresponding to multiple registered users respectively; for any registered user, based on the user features of the registered user, the registered user is matched with the sample users in the training dataset; if there is no target sample user that meets the matching conditions with the registered user, the registered user is labeled with training labels; the registered user is used as a sample user to update the recognition model by using the user features and training labels of the registered user.

[0171] In some embodiments, labeling training data for registered users may include: outputting labeling prompts; and determining the training labels to be labeled for the registered users based on the labeling request. For example, the labeling prompts may be output to developers, who then label the training data for the registered users.

[0172] In some embodiments, the second identification module performs feature matching between the target user and abnormal sample users based on user characteristics, and performs anomaly identification on the target user based on the matching results to obtain the second identification result. This may include: determining the target user set to which the target user belongs from multiple user sets based on user characteristics; and performing anomaly identification on the target user based on whether the sample users in the target user set are abnormal sample users to obtain the second identification result.

[0173] In some embodiments, multiple sample users corresponding to the training dataset can be aggregated based on the features corresponding to each sample user to divide them into multiple user sets. That is, multiple sample users can be aggregated into multiple user sets through clustering, so that the sample users in each user set have similar features.

[0174] Alternatively, multiple user sets can be formed by dividing multiple sample users into multiple user sets based on the characteristics of the sample users corresponding to the multiple sample users in the training dataset according to predetermined partitioning rules or classification algorithms.

[0175] In some embodiments, the second identification module can be used to determine whether multiple user sets are abnormal user sets based on whether the sample users corresponding to the multiple user sets are abnormal sample users.

[0176] In some embodiments, the acquisition module can acquire user data of the target user and extract user features from the user data. Extracting user features from the user data by the acquisition module may include: extracting at least one sequence feature from parameter data with time distribution characteristics, and extracting at least one data feature from parameter data without time distribution characteristics; the user features of the target user are composed of at least one sequence feature and at least one data feature.

[0177] There are several ways to determine whether a target user is an anomalous user by combining the first and second identification results. One optional approach is to determine whether a target user is an anomalous user by combining the first and second identification results: if either the first or second identification result indicates the target user is anomalous, then the target user is determined to be an anomalous user; otherwise, the target user is determined to be a normal user. In other words, if either the first or second identification result indicates the target user is anomalous, then the target user is determined to be an anomalous user; otherwise, the target user is determined to be a normal user. This optional approach can avoid false negatives.

[0178] As an alternative approach, the target user can be determined to be an abnormal user only if both the first and second identification results indicate that the target user is abnormal; otherwise, the target user can be determined to be a normal user. This avoids false positives in the final determination of whether the target user is abnormal due to a single false positive result.

[0179] In some embodiments, the device may further include:

[0180] The third identification module is used to obtain a third identification result based on whether the target user is a blacklisted user; and to obtain a fourth identification result based on whether the target user's user data meets the abnormal rules.

[0181] The determination module, by combining the first and second identification results, determines whether the target user is an abnormal user. This can include: combining the first, second, third, and fourth identification results to determine whether the target user is an abnormal user.

[0182] In some embodiments, user environment data may include user network data and user device data. The acquisition module may extract user features from the user data by: extracting user behavior features from user behavior data; extracting user network features from user network data; and extracting user device features from user device data.

[0183] The first identification module, based on user characteristics, uses an identification model to identify anomalies in the target user and obtain a first identification result, which may include: based on user behavior characteristics, using a behavior identification model to identify anomalies in the target user and obtain a behavior identification result; based on user network characteristics, using a network identification model to identify anomalies in the target user and obtain a network identification result; based on user device characteristics, using a device identification model to identify anomalies in the target user and obtain a device identification result; and combining the behavior identification result, network identification result, and device identification result to determine the first identification result.

[0184] Among them, the behavior recognition model can be trained using the sample user behavior features and training labels of the sample users; the network recognition model can be trained using the sample user network features and training labels of the sample users; and the device recognition model can be trained using the sample user device features and training labels of the sample users.

[0185] In some embodiments, when the target user is determined to be an abnormal user, the determining module can also be used to determine, based on the user data corresponding to different abnormal users, multiple abnormal users that have at least one user behavior with the same time and behavior type, at least one network parameter, at least one device parameter, and / or belong to the same user set; and determine that the abnormal type of the multiple abnormal users is group control behavior.

[0186] In some embodiments, the device may further include a processing module.

[0187] As an optional implementation, if the target user is determined to be an abnormal user, the processing module can perform one or more of the following processing operations: restrict the user account, network address or user device corresponding to the target user; output an abnormal prompt message; send a verification prompt message to the target user; or add the target user to the blacklist.

[0188] As another optional implementation, the processing module can be used to send the target identification result obtained by combining the first identification result and the second identification result to the target server; so that the target server can perform corresponding operations based on the target identification result, such as performing one or more of the above-mentioned processing operations if the target identification result indicates that the target user is an abnormal user.

[0189] Figure 4 The user identification device can perform Figure 2 The implementation principle and technical effects of the user identification method described in the illustrated embodiments will not be repeated here. The specific methods by which each module and unit of the user identification device in the above embodiments performs its operations have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0190] Figure 5 This application provides a schematic diagram of the structure of a user identification device according to one embodiment. The device includes:

[0191] The second collection module 501 is used to collect user data of the target user;

[0192] The sending module 502 is used to send user data to the detection server so that the detection server can extract user features from the user data; based on the user features, the detection server uses a recognition model to perform anomaly recognition on the target user and obtain a first recognition result; based on the user features, the target user is matched with abnormal sample users, and the target user is identified as an anomaly according to the matching result to obtain a second recognition result; combining the first recognition result and the second recognition result, the server determines whether the target user is an abnormal user.

[0193] Figure 5 The user identification device can perform Figure 3 The implementation principle and technical effects of the user identification method described in the illustrated embodiments will not be repeated here. The specific methods by which each module and unit of the user identification device in the above embodiments performs its operations have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0194] This application also provides a computing device, such as... Figure 6 As shown, the device may include a storage component 601 and a processing component 602;

[0195] The storage component 601 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component to achieve, for example... Figure 2 or Figure 3 The user identification method described in the illustrated embodiment.

[0196] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0197] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc. Communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0198] The processing component 602 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0199] Storage component 601 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0200] It should be noted that the aforementioned computing devices can be physical devices or elastic computing hosts provided by cloud computing platforms. They can be implemented as a distributed cluster of multiple servers or terminal devices, or as a single server or a single terminal device.

[0201] It should be noted that the above-mentioned computing devices implement Figure 2 In the user identification method described in the illustrated embodiment, it can be a physical device or an elastic computing host provided by a cloud computing platform. It can be implemented as a distributed cluster composed of multiple servers or terminal devices, or as a single server or a single terminal device. The aforementioned computing device implements... Figure 3 In the case of the user identification method described in the illustrated embodiment, it can be specifically implemented as an electronic device. The electronic device can refer to a device used by the user that has the computing, internet access, communication and other functions required by the user, such as a mobile phone, tablet computer, personal computer, wearable device, etc.

[0202] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 2 or Figure 3 The user identification method described in the illustrated embodiment. This computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device.

[0203] This application also provides a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program, when executed by a computer, can perform the above-described functions. Figure 2 or Figure 3 The user identification method is illustrated in the embodiment. In such an embodiment, the computer program may be downloaded and installed from a network, and / or installed from a removable medium. When the computer program is executed by a processor, it performs the various functions defined in the system of this application.

[0204] In the foregoing embodiments, the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0205] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0206] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0207] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0208] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A user identification method, characterized in that, include: Obtain user characteristics of the target users; Based on the user characteristics, the target user is identified using an anomaly identification model to obtain a first identification result; Based on the user characteristics, the target user is matched with abnormal sample users, and the target user is identified as abnormal based on the matching results to obtain a second identification result; By combining the first identification result and the second identification result, it is determined whether the target user is an abnormal user.

2. The method according to claim 1, characterized in that, The recognition model is obtained by training a training dataset; the training dataset includes sample user features and training labels of sample users. The method further includes: Collect user data corresponding to multiple registered users, and extract user features corresponding to each of the multiple registered users; For any registered user, based on the user characteristics of the registered user, feature matching is performed between the registered user and sample users in the training dataset; If no target sample user matches the registered user, then label the registered user with training labels. The registered users are used as sample users to update the recognition model using their user characteristics and training labels.

3. The method according to claim 1, characterized in that, The step of matching the target user with abnormal sample users based on the user characteristics, and identifying the target user as an anomaly based on the matching results to obtain a second identification result includes: Based on the user characteristics, determine the target user set to which the target user belongs from multiple user sets; Based on whether the sample users in the target user set are abnormal sample users, the target users are identified as abnormal to obtain a second identification result.

4. The method according to claim 3, characterized in that, Also includes: The training dataset contains multiple sample users. Based on the characteristics of each sample user, these users are aggregated to form multiple user sets.

5. The method according to claim 1, characterized in that, The user characteristics of the target user include: Acquire user data of the target user; the user data includes user behavior data and user environment data. Extract user features from the user data.

6. The method according to claim 5, characterized in that, The user environment data includes user network data and user device data; the user behavior data includes at least one behavior parameter; the user network data includes at least one network parameter; the user device data includes at least one device parameter. The extraction of user features from the user data includes: From the user data, at least one sequence feature is extracted from parameter data with time distribution characteristics, and at least one data feature is extracted from parameter data without time distribution characteristics; The user characteristics of the target user are constituted by the at least one sequence feature and the at least one data feature.

7. The method according to claim 1, characterized in that, Also includes: The target identification result obtained by combining the first identification result and the second identification result is sent to the target server. Alternatively, if the target user is determined to be an abnormal user, perform one or more of the following processing operations: The user account, network address, or user device corresponding to the target user shall be subject to restriction and control measures. Output an error message; Send a verification prompt message to the target user; Add the target user to the blacklist.

8. The method according to claim 1, characterized in that, The step of combining the first identification result and the second identification result to determine whether the target user is an abnormal user includes: If the first identification result or the second identification result identifies the target user as abnormal, the target user is determined to be an abnormal user; otherwise, the target user is determined to be a normal user.

9. The method according to claim 1, characterized in that, Also includes: A third identification result is obtained based on whether the target user is a blacklisted user; The fourth identification result is obtained by identifying whether the user data of the target user meets the anomaly rules. The step of combining the first identification result and the second identification result to determine whether the target user is an abnormal user includes: By combining the first identification result, the second identification result, the third identification result, and the fourth identification result, it is determined whether the target user is an abnormal user.

10. The method according to claim 5, characterized in that, The user environment data includes user network data and user device data; The extraction of user features from the user data includes: Extract user behavior features from the user behavior data; Extract user network features from the user network data; Extract user equipment features from the user equipment data; The step of using the recognition model to perform anomaly identification on the target user based on the user characteristics and obtaining a first identification result includes: Based on user behavior characteristics, an anomaly identification is performed on the target user using a behavior recognition model to obtain behavior recognition results; Based on user network characteristics, an anomaly identification is performed on the target user using a network identification model to obtain network identification results; Based on user equipment characteristics, an anomaly identification is performed on the target user using a device identification model to obtain device identification results; The first identification result is determined by combining the behavior identification result, the network identification result, and the device identification result.

11. The method according to claim 1, characterized in that, The method of determining that the target user is an abnormal user also includes: Based on the user data corresponding to different abnormal users, identify multiple abnormal users who have at least one user behavior with the same time and behavior type, at least one network parameter, at least one device parameter, and / or belong to the same user set; the user set is obtained by grouping multiple sample users in the training dataset based on the sample user features; The abnormality type of the multiple abnormal users was determined to be group control behavior.

12. A user identification method, characterized in that, The method, applied to a detection plugin integrated into a target client, includes: Collect user data from target users; the user data includes user behavior data and user environment data. The user data is sent to the detection server, which extracts user features from the user data. Based on the user features, an anomaly detection model is used to identify the target user and obtain a first identification result. Based on the user features, the target user is matched with abnormal sample users, and the target user is identified as an anomaly based on the matching result to obtain a second identification result. Combining the first identification result and the second identification result, it is determined whether the target user is an abnormal user.

13. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be invoked and executed by the processing component to implement the user identification method as described in any one of claims 1 to 11 or the user identification method as described in claim 12.

14. A computer storage medium, characterized in that, The device contains a computer program that, when executed by a computer, implements the user identification method as described in any one of claims 1 to 11 or the user identification method as described in claim 12.

15. A computer program product, characterized in that, It includes a computer program / instruction, which, when executed by a computer, implements the user identification method according to any one of claims 1 to 11 or the user identification method according to claim 12.

Images