Anomalous user detection method and system

Abstract

The embodiments of this specification provide an abnormal user detection method and system. The method includes: acquiring first feature data corresponding to each active user in the current time period, and second feature data corresponding to multiple historical users in historical time periods, wherein the first feature data is obtained based on the interaction data of active users on a target interactive platform and the attribute information of active users, and the second feature data is obtained based on the interaction data of historical users on the target interactive platform and the attribute information of historical users; performing vector representation processing on the first feature data to obtain a first high-dimensional dense vector corresponding to the active user, performing vector representation processing on each second feature data to obtain a second high-dimensional dense vector corresponding to each historical user; and determining whether the active user is an abnormal user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vector corresponding to the multiple historical users.

Description

Technical Field

[0001] This specification relates to the field of data processing technology, and in particular to an abnormal user detection method and system. Background Technology

[0002] If users generate interactive information containing sensitive content during social interactions on interactive platforms (such as applications or large language models), such users can be identified as abnormal users.

[0003] In related technologies, the operation and maintenance personnel of the interactive platform need to control the various interactive data generated by the abnormal user within the interactive platform in order to eliminate the platform security risks caused by the flow of sensitive information and maintain the compliance of the social environment of the interactive platform.

[0004] Therefore, how to accurately detect abnormal users among the massive number of users on an interactive platform has become an urgent technical problem to be solved.

[0005] The background information is merely information known only to the inventor and does not imply that such information had entered the public domain before the date of this application, nor does it imply that it could be considered prior art in this disclosure. Summary of the Invention

[0006] This specification provides a method and system for detecting abnormal users, applicable to social scenarios based on interactive platforms.

[0007] In a first aspect, this specification provides an abnormal user detection method, comprising: acquiring first feature data corresponding to each active user in the current time period, and second feature data corresponding to multiple historical users in historical time periods, wherein the first feature data is obtained based on the interaction data of the active user on the target interaction platform and the attribute information of the active user, and the second feature data is obtained based on the interaction data of the historical users on the target interaction platform and the attribute information of the historical users; performing vector representation processing on the first feature data to obtain a first high-dimensional dense vector corresponding to the active user, performing vector representation processing on each of the second feature data to obtain a second high-dimensional dense vector corresponding to each historical user; and determining whether the active user is an abnormal user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vector corresponding to the multiple historical users.

[0008] In some embodiments, obtaining the first feature data corresponding to each active user in the current time period and the second feature data corresponding to multiple historical users in historical time periods includes: obtaining the first original interaction data generated by the active user in the target interaction platform in the current time period and the attribute information of the active user; obtaining the second original interaction data generated by multiple historical users in the target interaction platform in historical time periods and the attribute information of each historical user; sorting the interaction statements in the first original interaction data according to the recurrence frequency of each interaction statement in the first original interaction data to obtain the first target interaction data corresponding to the active user; determining the first feature data based on the first target interaction data and the attribute information of the active user; and, for each historical user, sorting the interaction statements in the second original interaction data corresponding to the historical user according to the recurrence frequency of each interaction statement to obtain the second target interaction data corresponding to the historical user; and determining the second feature data corresponding to the historical user based on the second target interaction data and the attribute information of the historical user.

[0009] In some embodiments, determining the first feature data based on the first target interaction data and the attribute information of the active user includes: truncating the first target interaction data at the end to obtain first truncated data, and obtaining the first feature data based on the first truncated data and the attribute information of the active user; determining the second feature data corresponding to the historical user based on the second target interaction data and the attribute information of the historical user includes: truncating the second target interaction data at the end to obtain second truncated data, and obtaining the second feature data corresponding to the historical user based on the second truncated data and the attribute information of the historical user.

[0010] In some embodiments, determining whether an active user is an anomalous user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users includes: determining, among multiple historical users, a historical target user with the smallest outlier degree relative to the active user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users; and determining whether the active user is an anomalous user based on a preset threshold and the outlier degree between the historical target user and the active user.

[0011] In some embodiments, determining the historical target user with the smallest outlier than the active user among multiple historical users based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users respectively includes: constructing the first high-dimensional dense vector into a first planar index based on Euclidean distance; constructing the second high-dimensional dense vector corresponding to any historical user into a second planar index based on Euclidean distance for any historical user; and using the first planar index, performing nearest neighbor search or K-nearest neighbor search in the second planar indices corresponding to multiple historical users respectively, determining the second planar index with the smallest outlier than the first planar index as the second target planar index, and determining the historical user corresponding to the second target planar index as the historical target user.

[0012] In some embodiments, determining whether an active user is an anomalous user based on a preset threshold and the outlier between the historical target user and the active user includes: determining the Euclidean distance between the first plane index and the second target plane index; determining the active user as an anomalous user if the Euclidean distance is greater than the preset threshold; and determining the active user as a non-abnormal user if the Euclidean distance is less than or equal to the preset threshold.

[0013] In some embodiments, the number of the plurality of historical users is M, and the plurality of historical users includes N historical abnormal users, wherein N is an integer greater than 1, and M is an integer greater than N; after determining that the active user is an abnormal user, the method further includes: sorting the second plane indices corresponding to the N historical abnormal users according to the Euclidean distance between the first plane index and the second plane index corresponding to each historical abnormal user, and obtaining a sorting result; filtering out Q historical abnormal users from the N historical abnormal users according to a preset filtering strategy, wherein Q is an integer greater than or equal to 1 and less than or equal to N; and determining the target abnormal category label corresponding to the active user according to the abnormal category labels corresponding to the Q historical abnormal users.

[0014] In some embodiments, after determining that the active user is an anomalous user, the method further includes: performing dimensionality reduction processing on the first high-dimensional dense vector to obtain a first planar vector corresponding to the active user; for each historical user, performing dimensionality reduction processing on the second high-dimensional dense vector corresponding to the historical user to obtain a second planar vector corresponding to the historical user; and generating an interactive scatter plot based on the first planar vector and the second planar vectors corresponding to the multiple historical users, the interactive scatter plot including: first data points mapped by the first planar vector and second data points mapped by the multiple second planar vectors, wherein the color intensity of the first data points is used to characterize the outlier degree of the active user relative to the multiple historical users.

[0015] In some embodiments, generating an interactive scatter plot based on the first plane vector and the second plane vectors corresponding to multiple historical users includes: determining the outlier of the active user relative to multiple historical users based on the first plane vector and the second plane vectors corresponding to multiple historical users; determining the dialogue keywords, user identifiers, and dialogue fragments corresponding to the active user based on the first feature data, and generating user feature labels corresponding to the active user based on the dialogue keywords, the user identifiers, the dialogue fragments, and the outlier; and generating an interactive scatter plot based on the first plane vector, the second plane vectors corresponding to multiple historical users, and the user feature labels, wherein the interactive scatter plot includes: first data points mapped by the first plane vector, second data points mapped by multiple second plane vectors, and controls mapped by the user feature labels, wherein the controls display the user feature labels in the interactive scatter plot in response to an expand instruction, and hide the user feature labels in the interactive scatter plot in response to a collapse instruction.

[0016] Secondly, this specification also provides an abnormal user detection system, comprising: at least one storage medium storing at least one instruction set for performing abnormal user detection; and at least one processor communicatively connected to the at least one storage medium, wherein when the abnormal user detection system is running, the at least one processor reads the at least one instruction set and executes the method described in the first aspect according to the instructions of the at least one instruction set.

[0017] Thirdly, this specification also provides a computer-readable non-volatile storage medium, wherein the computer-readable non-volatile storage medium stores at least one instruction set, which, when executed by at least one processor, implements the method described in the first aspect above.

[0018] As can be seen from the above technical solutions, the abnormal user detection system and method provided in this specification can acquire the first feature data corresponding to each active user in the current time period, and the second feature data corresponding to multiple historical users in historical time periods. The first feature data of active users is encoded into a first high-dimensional dense vector, and the second feature data of each historical user is encoded into a second high-dimensional dense vector. The second high-dimensional dense vectors corresponding to multiple historical users can form a reference vector group. If the first feature data of active users contains implicitly expressed sensitive information or variant forms of sensitive information, the semantics of this sensitive information will deviate from normal logic, causing the first high-dimensional dense vector corresponding to the active user to naturally move away from this reference vector group, appearing as a large-distance outlier in the vector space. Therefore, the abnormal user detection system can accurately and efficiently identify various novel abnormal users that have never appeared before in the target interaction platform through an unsupervised outlier detection paradigm.

[0019] Other functionalities of the abnormal user detection system and methods provided in this specification will be partially listed in the following description. The inventive aspects of the abnormal user detection system and methods provided in this specification can be fully understood through practice or use of the methods, apparatus, and combinations described in the detailed examples below. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This diagram illustrates an application scenario of an abnormal user detection method provided in an embodiment of this specification. Figure 2 A schematic diagram of the structure of the example computer system 200 is shown; Figure 3 One of the flowcharts of an abnormal user detection method provided according to an embodiment of this specification is shown; Figure 4 A second schematic flowchart of an abnormal user detection method provided according to an embodiment of this specification is shown; Figure 5 The third flowchart of the abnormal user detection method provided according to the embodiments of this specification is shown; Figure 6 The fourth schematic flowchart of the abnormal user detection method provided according to the embodiments of this specification is shown, and Figure 7An example diagram of an interactive scatter plot provided according to an embodiment of this specification is shown. Detailed Implementation

[0022] The following description provides specific application scenarios and requirements for this specification, intended to enable those skilled in the art to make and use the contents of this specification. Various partial modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments and applications without departing from the spirit and scope of this specification. Therefore, this specification is not limited to the embodiments shown, but rather to the widest scope consistent with the claims.

[0023] The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not restrictive. For example, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” used herein may also include the plural forms. When used in this specification, the terms “comprising,” “including,” and / or “containing” mean that the associated integers, steps, operations, elements, and / or components are present, but do not exclude the presence of one or more other features, integers, steps, operations, elements, components, and / or groups, or that other features, integers, steps, operations, elements, components, and / or groups may be added to the system / method.

[0024] Considering the following description, these and other features of this specification, as well as the operation and function of the related components of the structure, and the economy of assembly and manufacture of the parts, can be significantly improved. All of these form part of this specification with reference to the accompanying drawings. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to limit the scope of this specification. It should also be understood that the drawings are not drawn to scale.

[0025] The flowcharts used in this specification illustrate operations implemented according to some embodiments of this specification. It should be clearly understood that the operations in the flowcharts may not be implemented in a sequential order. Instead, the operations may be implemented in reverse order or simultaneously. Furthermore, one or more additional operations may be added to the flowcharts. One or more operations may be removed from the flowcharts.

[0026] In this specification, "X includes at least one of A, B, or C" means that X includes at least A, or X includes at least B, or X includes at least C. That is, X may include only one of A, B, and C, or any combination of A, B, and C, as well as other possible content / elements. The arbitrary combination of A, B, and C can be A, B, C, AB, AC, BC, or ABC.

[0027] It should be noted that in the embodiments described in this specification, any processing of user personal information (including but not limited to collection, storage, use, processing, transmission, provision, or disclosure) is conducted with the user's consent or on other legal grounds (such as the performance of contracts or legal obligations), and strictly complies with relevant laws.

[0028] The user tag design and use involved in the embodiments of this specification serve technical purposes and do not solidify or amplify any social biases that may lead to discrimination or unfair treatment; the rule settings and decision-making logic involved are based on the principles of fairness and non-discrimination, and do not violate the value orientation of legal protection such as equality of life and basic human rights; the generated recommendation results or decision results are not used to carry out any behavior that violates the law or social morality, nor will they cause damage to the public interest.

[0029] For ease of description, the terms that will appear later in this manual will be explained first.

[0030] Outlier detection: An unsupervised learning method for identifying anomalous samples that significantly deviate from the expected normal data distribution pattern. In the embodiments of this specification, this method refers to identifying anomalous users with abnormal behavioral patterns from a massive user base in the absence of labels. It should be noted that in the embodiments of this specification, "abnormal user" can be understood as a "potentially high-risk user" exhibiting sensitive behavior, such as an anomalous user sending sensitive information in batches to multiple other users during interactions on an interactive platform.

[0031] Semantic representation refers to the method of transforming unstructured text data into high-dimensional dense vectors using a large language model containing deep neural networks. Its purpose is to make semantically similar texts closer together in the vector space.

[0032] Vector Similarity Retrieval Library: An engineering library for efficient similarity retrieval and clustering of high-dimensional vectors. For example, this vector similarity retrieval library can support efficient retrieval of billions of vectors.

[0033] t-distributed stochastic neighbor embedding (t-SNE): A nonlinear dimensionality reduction algorithm that can well preserve the local structure of data and is suitable for scenarios that map high-dimensional data to two-dimensional (or three-dimensional) space for visualization.

[0034] Plotly: A tool for creating interactive charts that can generate advanced charts that are scalable, clickable, allow hovering to view data, and allow downloading of images.

[0035] Large Language Models (LLMs): Also known simply as large models, LLMs are natural language processing models based on deep learning techniques. They typically have a high number of parameters, ranging from billions to hundreds of billions or even more, and possess powerful language understanding and generation capabilities. LLMs can employ the Transformer architecture or its variants (such as GPT and BERT), which utilizes an attention mechanism to globally model sequential data, efficiently handling long-distance dependencies and thus performing exceptionally well in natural language tasks. LLMs can be used to perform various tasks such as text generation, language translation, text summarization, and question answering reasoning.

[0036] In some embodiments, large language models can also have the ability to understand and generate data from other modalities (such as visual, audio, etc.). In this case, large language models can also be called multimodal large language models (MLLMs). MLLMs provide a richer and more natural interactive experience by integrating multiple types of input and output, such as text, images, and sound.

[0037] It should be noted that the key technologies of large language models can be found in the detailed description in the paper "A Survey of Large Language Models" (paper number: arXiv:2303.18223v18, published on March 8, 2026), and will not be repeated here.

[0038] In embodiments of this specification, the large language model can be exemplarily a text embedding model or a text representation model, which can transform unstructured text data into high-dimensional dense vectors.

[0039] The following section introduces the application scenarios of this manual.

[0040] In social scenarios (such as payment-based social scenarios), as violations evolve and sensitive information becomes more concealed, interactive platforms face a constant stream of new risks. To ensure the compliance of the social environment of interactive platforms, the platform's operations and maintenance personnel need to accurately detect abnormal users among the platform's massive user base and implement risk control measures on various interactive data of these abnormal users within the platform to eliminate platform security risks caused by the flow of sensitive information.

[0041] It should be noted that in the embodiments of this specification, the terms "violation" can be used interchangeably with "sensitive behavior", "abnormal behavior" and "risky behavior", and the terms "sensitive information" can be used interchangeably with "violation information", "abnormal information", "abnormal content" and "non-compliant information".

[0042] Therefore, how to accurately detect abnormal users among the massive number of users on an interactive platform has become an urgent technical problem to be solved.

[0043] In some embodiments, operations and maintenance personnel can pre-configure and maintain a sensitive word database within the operations and maintenance system. For each user on the interactive platform, the system can match the user's interaction data with the content in the sensitive word database using regular expressions, and determine whether the user is an abnormal user based on the matching results. While this method offers fast response times, it suffers from weak generalization capabilities, cannot parse semantic context, and struggles to capture sensitive information in variations. Furthermore, the manpower cost of maintaining the sensitive word database increases exponentially with task complexity.

[0044] In other embodiments, the operation and maintenance system can also use models such as BERT to achieve binary classification risk discrimination between abnormal and normal users. However, this method relies heavily on large-scale labeled samples and has limited generalization ability, making it unable to adapt to unknown risk scenarios outside the distribution. It is prone to misjudging violation patterns that have not been learned before (such as identifying abnormal samples as normal samples). At the same time, the iteration and update cycle of this type of model is long, making it difficult to adapt to the real-time risk control management needs of interactive platforms.

[0045] In other embodiments, the operation and maintenance system can also use Term Frequency-Inverse Document Frequency (TF-IDF) or basic word vector methods, combined with traditional clustering algorithms, to identify abnormal users from a massive number of users. However, the text features constructed by this method are relatively sparse, with weak semantic representation capabilities, making it difficult to capture the deep semantic intent of long texts; at the same time, traditional clustering algorithms have high computational complexity when processing large-scale data, and the algorithm hyperparameters are difficult to adaptively optimize.

[0046] In summary, abnormal user detection on interactive platforms faces the following problems: the volume of user log data is enormous, and full manual review is costly and inefficient; at the same time, sensitive information can be disguised using homophones, code words, and other variant forms to bypass keyword detection mechanisms, resulting in a decrease in detection accuracy.

[0047] Therefore, embodiments of this specification provide an abnormal user detection method and system. In this method, the abnormal user detection system can perform the following steps: acquiring first feature data corresponding to each active user in the current time period, and second feature data corresponding to multiple historical users in historical time periods; performing vector representation processing on the first feature data to obtain a first high-dimensional dense vector corresponding to the active user, performing vector representation processing on each second feature data to obtain a second high-dimensional dense vector corresponding to each historical user; and determining whether the active user is an abnormal user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vector corresponding to multiple historical users.

[0048] Large language models (such as text embedding models) can convert text into high-dimensional dense vectors, ensuring that semantically similar texts are close to each other in the vector space, while semantically dissimilar texts are far apart. In this method, the anomaly user detection system can leverage this semantic generalization capability of large language models (such as text embedding models) to encode the first feature data of active users into a first high-dimensional dense vector, and the second feature data of each historical user into a second high-dimensional dense vector. The second high-dimensional dense vectors corresponding to multiple historical users can form a baseline vector group. If the first feature data of an active user contains implicitly expressed sensitive information or variant forms of sensitive information, the semantics of this sensitive information will deviate from normal logic, causing the first high-dimensional dense vector corresponding to the active user to naturally move away from this baseline vector group, appearing as a large-distance outlier in the vector space. Therefore, the anomaly user detection system can accurately and efficiently identify an active user as an anomaly user through an unsupervised outlier detection paradigm.

[0049] This method leverages the deep semantic understanding capabilities of large language models to semantically embed the primary feature data of active users and the secondary feature data of historical users, generating corresponding high-dimensional dense vectors. These vectors are then combined with an outlier detection algorithm to determine whether an active user is an anomalous user. In this process, the method combines semantic embedding-based vectorization with an unsupervised outlier detection paradigm, deeply mining implicit and variant forms of sensitive information in the primary feature data. This improves the detection accuracy of sensitive information and thus enhances the identification accuracy of anomalous users. Simultaneously, the method transforms the semantic association analysis between unstructured feature data into distance comparison analysis in vector space, thereby eliminating reliance on labeled samples and enabling the anomalous user detection system to avoid the cold start problem. This anomalous user detection system can directly identify various novel anomalous users never before seen on the target interaction platform in an unsupervised mode, giving it stronger generalization capabilities and adaptability to various unknown risk scenarios. Furthermore, this method can be automated, reducing manual review costs and improving the efficiency of anomalous user detection.

[0050] The technical solutions provided in this manual are applicable to payment-based social scenarios. Below, we will combine... Figure 1 This document describes the application scenarios of an abnormal user detection method provided in this manual.

[0051] Figure 1 A schematic diagram illustrating an application scenario of an abnormal user detection method provided according to an embodiment of this specification is shown. For example... Figure 1 As shown, it includes: user 110, user 120, terminal 130, terminal 140, target interaction platform 150, and abnormal user detection system 160. It should be understood that... Figure 1 The number of users, terminals, target interaction platforms, and abnormal user detection systems shown is merely illustrative. Depending on implementation needs, there can be any number of users, terminals, target interaction platforms, and abnormal user detection systems.

[0052] Users 110 and 120 are participants in the interactive behavior. User 110 accesses the target interactive platform 150 through terminal 130 to interact with user 120. Similarly, user 120 can access the target interactive platform 150 through terminal 140 to interact with user 110.

[0053] Terminals 130 and 140 refer to access devices used by users. A terminal can serve as a carrier for users to log in and access the target interactive platform 150, enabling platform access and interactive operations. In some embodiments, the terminal may include, but is not limited to, a mobile device, tablet computer, or laptop computer. In some embodiments, the mobile device may include smart home devices, smart mobile devices, virtual reality devices, augmented reality devices, or similar devices, or any combination thereof. In some embodiments, the smart home device may include a smart TV, desktop computer, etc., or any combination thereof. In some embodiments, the smart mobile device may include a smartphone, personal digital assistant, gaming device, navigation device, etc., or any combination thereof.

[0054] The target interaction platform 150 refers to a platform capable of providing interactive services to users, which can interact with terminals 130, 140, and the abnormal user detection system 160 respectively. In some embodiments, the target interaction platform 150 may include, but is not limited to, an application that provides users 110 and 120 with the ability and interface to interact with the outside world via a network. Apps include, but are not limited to: web browser apps, search apps, chat apps, shopping apps, video apps, financial apps, instant messaging tools, email clients, social media platform software, etc.

[0055] The abnormal user detection system 160 refers to a computer system capable of executing the abnormal user detection method provided in this specification and capable of interacting with the target interactive platform. It should be noted that the detailed process of the abnormal user detection system 160 executing the abnormal user detection method will be described in detail later. Figures 3-6 Detailed explanation is provided in the embodiments.

[0056] In some embodiments, the target interaction platform 150 and the abnormal user detection system 160 can be deployed independently in different devices or device clusters, such as physical servers, server clusters, cloud servers, and other physical devices. Alternatively, the target interaction platform 150 and the abnormal user detection system 160 can be deployed in an integrated manner, jointly deployed in the same device, the same server cluster, or the same cloud service node, to achieve data interconnection and collaborative operation. The embodiments in this specification do not specifically limit this approach.

[0057] It should be noted that the aforementioned payment-based social scenarios are just one of the many application scenarios provided in this specification. The abnormal user detection methods and systems provided in this specification can be applied not only to social scenarios but also to various scenarios involving social risk control and abnormal user detection, such as sensitive information detection scenarios, illegal user screening scenarios, and illegal behavior control scenarios. Those skilled in the art should understand that when the abnormal user detection methods and systems provided in this specification are applied to other application scenarios, their implementation methods and technical effects are similar.

[0058] Below, in conjunction with Figure 2 This manual describes the computer system provided.

[0059] Figure 2 A schematic diagram of the structure of an example computer system 200 is shown. In some embodiments, one or more computer systems 200 may perform one or more steps of one or more methods described or illustrated herein. In some embodiments, one or more computer systems 200 may also provide the functionality described or illustrated herein, such as one or more abnormal user detection functions (or other arbitrary functions) in the abnormal user detection system 160.

[0060] This specification considers any suitable number of computer systems 200. The computer systems 200 are considered to take any suitable physical form. By way of example and not limitation, the computer system 200 may be an embedded computer system, a system-on-a-chip (SOC), a single-board computer system (SBC) (e.g., a computer-on-module (COM) or system-on-module (SOM)), a desktop computer system, a notebook or laptop system, an interactive kiosk, a mainframe, a grid of computer systems, a mobile phone, a personal digital assistant (PDA), a server, a tablet computer system, or any suitable combination thereof. Where appropriate, one or more computer systems 200 may be single or distributed; may span multiple locations or multiple machines; may span one or more data centers; or reside in the cloud, which may include one or more cloud components and communicate through one or more networks. Where appropriate, one or more computer systems 200 may perform one or more steps of one or more methods described or illustrated herein without substantial spatial or temporal limitations, and may perform in real-time or batch mode, or at different times and / or different locations.

[0061] In some embodiments, computer system 200 includes: processor 202, memory 204, storage 206, input / output (I / O) interface 208, communication interface 210, and interconnect structure 212. Although this specification describes and illustrates an example computer system 200 having a specific number of specific components in a specific arrangement, this specification contemplates any suitable number of any suitable components and any suitable arrangement.

[0062] In some embodiments, processor 202 is used to execute instructions. Processor 202 can retrieve instructions through internal registers, internal caches, memory 204, or storage 206, decode and execute them, and write one or more results to internal registers, internal caches, memory 204, or storage 206. Where appropriate, processor 202 may include one or more internal caches. Processor 202 may also include one or more internal registers, one or more arithmetic logic units (ALUs), and one or more processor cores. Processor 202 may be a multi-core processor and may include, but is not limited to: microcontrollers, microprocessors, RISC, ASICs, ASIPs, CPUs, GPUs, PPUs, DSPs, FPGAs, ARMs, and programmable logic devices (PLDs), or other circuits or processors capable of performing one or more functions, or any combination thereof.

[0063] In some embodiments, memory 204 may be used to store instructions to be executed by processor 202 and / or data to be operated by processor 202. Memory 204 may include main memory and may include random access memory (RAM). Where appropriate, memory 204 may be volatile memory (e.g., dynamic RAM (DRAM) or static RAM (SRAM)), or other suitable memory types. Processor 202 may couple to memory 204 via one or more memory paths for instruction and data access. Where appropriate, memory 204 may include one or more memory cells.

[0064] In some embodiments, storage 206 may be used to provide non-volatile storage for data and / or instructions. Storage 206 may include, but is not limited to: hard disk drive (HDD), solid-state drive (SSD), flash memory, ROM, erasable ROM, optical media (e.g., optical disc), magnetic media (e.g., magnetic disk or magnetic tape), USB storage device, or combinations thereof. Where appropriate, storage 206 may be located inside or outside computer system 200 and may include one or more storage control units to facilitate communication between processor 202 and storage 206.

[0065] In some embodiments, I / O interface 208 may be used to provide an interface between computer system 200 and one or more I / O devices. I / O interface 208 may include hardware, software, or a combination of both. I / O devices enable communication between a person and computer system 200 or between computer system 200 and external devices. Exemplary I / O devices may include, but are not limited to: keyboard, keypad, microphone, display, mouse, printer, scanner, speaker, camera, touch input device, stylus, trackball, tablet, and other suitable I / O devices; and I / O devices may also include one or more sensors. Where appropriate, I / O interface 208 may include one or more device or software drivers to enable processor 202 to control one or more associated I / O devices.

[0066] In some embodiments, communication interface 210 may be used to provide a communication interface between computer system 200 and one or more other computer systems 200 and / or one or more networks. Communication interface 210 may include hardware, software, or a combination of both. Communication interface 210 may support wired or wireless communication and may include a network interface controller (NIC) or a wireless adapter (e.g., a Wi-Fi adapter). Exemplary networks may include, but are not limited to: ad hoc networks, personal area networks (PANs), local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), one or more portions of the Internet, and so on. Where appropriate, communication interface 210 may include one or more communication interfaces 210.

[0067] In some embodiments, the interconnect structure 212 is used to interconnect the components of the computer system 200. The interconnect structure 212 may include, but is not limited to: bus, switching structure, crossbar switch, on-chip interconnect network, point-to-point interconnect or other suitable interconnect structure, or any combination thereof.

[0068] Below, in conjunction with Figures 3-6 The present specification describes the abnormal user detection method provided in the embodiments.

[0069] Figure 3 One of the flowcharts illustrating an abnormal user detection method provided according to an embodiment of this specification is shown. Computer system 200 can execute the abnormal user detection method of this specification. Specifically, processor 202 in computer system 200 can read an instruction set stored in its local storage medium and then execute the abnormal user detection method of this specification according to the provisions of the instruction set. Figure 3 As shown, the method may include: S310: Obtain the first feature data corresponding to each active user in the current time period, and the second feature data corresponding to multiple historical users in the historical time period.

[0070] The first feature data is obtained based on the interaction data of active users on the target interactive platform and the attribute information of active users. The second feature data is obtained based on the interaction data of historical users on the target interactive platform and the attribute information of historical users. It should be noted that this process will... Figure 4 Detailed explanation is provided in the embodiments.

[0071] The current time period is a preset time period used to collect primary characteristic data of active users. Its duration can be flexibly configured. For example, the current time period can be set to a single day or multiple hours.

[0072] The historical time period refers to the period preceding the current time period. For example, if the current time period is set to a single day, the historical time period can be the week preceding that day or the month preceding that day.

[0073] It should be understood that there may be one or more active users on the target interaction platform during the current time period, and the abnormal user detection system can obtain the first feature data corresponding to each active user. For each active user, this first feature data can be used to characterize the active user's interactive behavior on the target interaction platform during the current time period, as well as the inherent characteristics of the active user.

[0074] For each active user, within the current time period, the active user can interact with multiple users. The interaction data of the active user includes: the interaction data of the active user with each user on the target interaction platform within the target time period.

[0075] The historical users can include: historical normal users and historical abnormal users. Historical normal users refer to users whose interactive behavior on the target interactive platform is normal during the historical period; historical abnormal users refer to users whose interactive behavior on the target interactive platform is abnormal during the historical period.

[0076] In some embodiments, multiple historical users can be selected from all users of the target interaction platform within a historical time period, or from a subset of users that have been filtered for comparative value. For example, the filtering rule could be: historical users who have not logged in or used the target interaction platform for more than a preset period are deemed invalid reference samples and removed. Such long-term silent users cannot effectively reflect the normal interaction characteristics of the platform; removing them can improve the accuracy of subsequent vector alignment and outlier detection results.

[0077] For each historical user, within a historical time period, that historical user can interact with multiple users. The interaction data of that historical user includes: the interaction data of that historical user with each user on the target interaction platform within the historical time period.

[0078] For each historical user, this second feature data can be used to characterize the historical user's interactive behavior within a historical time period on the target interactive platform, based on the inherent characteristics of the historical user.

[0079] Interaction data can be used to reflect a user's interactive behavior, which may include interaction intent, interaction form (such as text, voice, or images), interaction time period, interaction frequency, message volume, and interaction partners. For example, interaction data may include the user's chat content with other users.

[0080] Attribute information is used to reflect the inherent characteristics of a user. For example, attribute information may include account identifier, registration information, geolocation information, and authentication status.

[0081] S320: Perform vector representation processing on the first feature data to obtain the first high-dimensional dense vector corresponding to the active user, and perform vector representation processing on each second feature data to obtain the second high-dimensional dense vector corresponding to each historical user.

[0082] The abnormal user detection system can use a text vectorization tool to perform vector representation processing on the first feature data and each second feature data. This text vectorization tool can be used to map any text (such as sentences, paragraphs or documents) into dense vectors of fixed dimensions.

[0083] In some embodiments, the text vectorization tool can be a large language model. For example, the large language model can include, but is not limited to, an 8 billion-parameter text embedding model, which can be deployed using a very large language model serving system (vLLM) inference framework. The abnormal user detection system can leverage the deep semantic understanding capabilities of the large language model to encode unstructured first feature data into a single high-dimensional dense vector, and to encode each unstructured second feature data into a single high-dimensional dense vector.

[0084] S330: Determine whether an active user is an abnormal user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users.

[0085] For each active user, the abnormal user detection system can perform vector representation processing on the first feature data corresponding to the active user to obtain the first high-dimensional dense vector corresponding to the active user; and, based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users, determine whether the active user is an abnormal user.

[0086] An abnormal user detection system can determine the outlier degree of a first high-dimensional dense vector relative to multiple second high-dimensional dense vectors based on an outlier detection algorithm, and determine whether the active user is an abnormal user based on the outlier degree and a preset threshold. In some embodiments, the preset threshold can be pre-configured by operations and maintenance personnel in the abnormal user detection system based on the accuracy requirements of abnormal user analysis.

[0087] The smaller the outlier, the closer the first high-dimensional dense vector is to multiple second high-dimensional dense vectors in the vector space; the larger the outlier, the farther the first high-dimensional dense vector is from multiple second high-dimensional dense vectors in the vector space.

[0088] In some embodiments, the abnormal user detection system can determine the historical target user with the smallest outlier degree among multiple historical users based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users; and determine whether the active user is an abnormal user based on a preset threshold and the outlier degree between the historical target user and the active user.

[0089] In the embodiments of this specification, for each user in the target interaction platform, the user can be a historical normal user or a historical abnormal user within a historical time period, or an active user within the current time period. That is, the user can possess both the attributes of a historical user and an active user. Based on this characteristic, the method can utilize multiple historical users within a historical time period as reference samples, use a large language model to semantically embed the second feature data of each historical user, generate a second high-dimensional dense vector, and construct a benchmark vector group based on the second high-dimensional dense vectors corresponding to multiple historical users, and perform vector comparison with this benchmark vector group as a reference. If the interaction characteristics reflected by the first high-dimensional dense vector of an active user deviate from the feature category of historical normal users and are not included in the feature system of historical abnormal users, this first high-dimensional dense vector will become an outlier in the vector space. Using this characteristic, the method can accurately detect new types of abnormal users that have not appeared before.

[0090] For each second high-dimensional dense vector in the baseline vector group, if the distance between the second high-dimensional dense vector and the first high-dimensional dense vector in the vector space is the closest, that is, if the outlier degree between the second high-dimensional dense vector and the first high-dimensional dense vector is the smallest, the historical user corresponding to the second high-dimensional dense vector can be identified as the historical target user.

[0091] If the outlier between the historical target user and the active user is greater than a preset threshold, the active user is identified as an abnormal user; if the outlier between the historical target user and the active user is less than or equal to the preset threshold, the active user is identified as a normal user.

[0092] This method utilizes a first high-dimensional dense vector and multiple second high-dimensional dense vectors to locate the historical target user with the lowest outlier among multiple historical users. Based on a preset threshold and the outlier between the historical target user and the active user, it determines whether the active user is an anomalous user. The entire process does not rely on labeled samples, enabling the anomalous user detection system to directly identify novel anomalous users never before seen on the target interaction platform in an unsupervised mode. This results in a stronger generalization ability, allowing the system to adapt to various unknown risk scenarios.

[0093] It should be noted that the term "non-abnormal user" in this specification requires further evaluation to determine whether it is a compliant, normal user. In some embodiments, when active users are non-abnormal users, the multiple historical users include these multiple historical abnormal users. The abnormal user detection system can perform outlier matching between the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to the multiple historical abnormal users, and determine the historical abnormal user with the smallest outlier than the active user as the historical target abnormal user. Based on the outlier between the first high-dimensional dense vector and the second high-dimensional dense vector corresponding to the historical target abnormal user, and a target threshold, it can be determined whether the active user is a compliant, normal user. In some embodiments, this target threshold can be pre-configured by operations and maintenance personnel in the abnormal user detection system based on the accuracy requirements of normal user analysis.

[0094] If among multiple historical abnormal users there is a historical target abnormal user, and the outlier between the first high-dimensional dense vector and the second high-dimensional dense vector corresponding to the historical target abnormal user is less than or equal to the target threshold, it indicates that the active user may be an abnormal user that appeared in the historical time period; if the outlier between the first high-dimensional dense vector and the second high-dimensional dense vector corresponding to the historical target abnormal user is greater than the target threshold, it indicates that the active user is a compliant normal user.

[0095] The abnormal user detection method provided in the embodiments of this specification utilizes the deep semantic understanding capabilities of a large language model to perform semantic embedding on the first feature data of active users and the second feature data of each historical user, generating corresponding high-dimensional dense vectors. Then, it combines an outlier detection algorithm to determine whether the active user is an abnormal user. The entire process requires no manual intervention or review and does not rely on labeled samples. It can not only accurately identify hidden and variant forms of sensitive information, but also has excellent generalization ability, enabling the abnormal user detection system to accurately and efficiently identify various new types of abnormal users among the massive number of users on the target interactive platform.

[0096] This abnormal user detection method also involves the following steps: obtaining the first feature data corresponding to each active user in the current time period, and the second feature data corresponding to multiple historical users in historical time periods. Below, we will combine... Figure 4 This section describes one implementation method for this step.

[0097] Figure 4 A second schematic flowchart of an abnormal user detection method provided according to an embodiment of this specification is shown. Computer system 200 can execute the abnormal user detection method of this specification. Specifically, processor 202 in computer system 200 can read the instruction set stored in its local storage medium and then execute the abnormal user detection method of this specification according to the provisions of the instruction set. Figure 4 As shown, the method may include: S410: Obtain the first raw interaction data and attribute information of active users generated on the target interaction platform within the current time period, and obtain the second raw interaction data and attribute information of each of the multiple historical users generated on the target interaction platform within the historical time period.

[0098] The first set of raw interaction data may include: all chat logs generated by active users on the target interaction platform within the current time period. An active user may interact with multiple users within the current time period, and this first set of raw interaction data may include: all chat logs generated by an active user during their interactions with each user on the target interaction platform within the current time period.

[0099] The second set of raw interaction data may include: all chat logs generated by historical users on the target interaction platform within a historical time period. Each historical user may interact with multiple users within a historical time period, and this second set of raw interaction data may include: all chat logs generated by historical users during their interactions with each user on the target interaction platform within the historical time period.

[0100] Attribute information can be used to reflect a user's inherent characteristics. For example, attribute information may include account identifiers, registration information, geolocation information, and authentication status.

[0101] Optionally, the abnormal user detection system can obtain the first raw interaction data and attribute information of active users on the target interaction platform in the current time period by interacting with the target interaction platform in real time or periodically, as well as the second raw interaction data and attribute information of each historical user on the target interaction platform in the historical time period.

[0102] S420: Based on the recurrence frequency of each interaction statement in the first original interaction data, sort the interaction statements in the first original interaction data to obtain the first target interaction data corresponding to the active user. Based on the first target interaction data and the attribute information of the active user, determine the first feature data.

[0103] The initial raw interaction data may include multiple interaction statements. Typically, if the active user is an anomalous user, they may send the same interaction statements to different users during interactions with other users. Therefore, the interaction statements in the initial raw interaction data can be sorted according to their frequency of recurrence, from highest to lowest, so that the most frequently occurring interaction statements are listed first, and duplicate interaction statements are removed. Through this sorting and deduplication process, the interaction intent of the active user within the current time period can be effectively inferred, thus facilitating subsequent judgment of the active user's abnormal behavior.

[0104] After obtaining the first target interaction data, if the total data volume determined by the first target interaction data and the attribute information of active users exceeds the input data specification of the large language model, the first target interaction data needs to be segmented. However, segmentation may cause the large language model to lose cross-segment contextual dependencies when performing semantic representation, resulting in semantic fragmentation.

[0105] To address this issue, the abnormal user detection system can further truncate the first target interaction data to obtain truncated first data. Based on this truncated first data and the attribute information of active users, first feature data can be derived. The truncation process can include: based on the input data specifications of the large language model and the total data volume determined by the first target interaction data and the attribute information of active users, selecting the top K interaction statements from the first target interaction data according to the sorting result as the truncated first data, where K is an integer greater than 1. Through this processing, the first feature data can effectively retain key interaction statements that reflect the interaction intent of active users while conforming to the input data specifications of the large language model. This approach controls computational overhead while preserving the core information that best reflects the interaction intent of active users.

[0106] In some embodiments, the first K interactive statements can be determined in the first target interactive data in the following manner: a first remaining encoding length is determined based on the length of the input data of the large language model and the encoding length of the attribute information of active users; the first K interactive statements are selected from the first target interactive data based on the first remaining encoding length, wherein the encoding length of the first K interactive statements is less than or equal to the first remaining encoding length.

[0107] S430: For each historical user, in the second original interaction data corresponding to the historical user, sort the interaction statements in the second original interaction data according to the recurrence frequency of each interaction statement to obtain the second target interaction data corresponding to the historical user. Based on the second target interaction data and the attribute information of the historical user, determine the second feature data corresponding to the historical user.

[0108] The second set of original interaction data may include multiple interaction statements. In the embodiments of this specification, the interaction statements in the second set of original interaction data can be sorted according to their frequency of recurrence, from highest to lowest, so that the interaction statements with higher recurrence frequencies are listed first, and duplicate interaction statements are deleted. Through the above sorting and deduplication process, the interaction intentions of historical users within a historical time period can be effectively inferred, thereby facilitating subsequent comparative analysis with the active users.

[0109] After obtaining the second target interaction data, if the total data volume determined by the second target interaction data and the attribute information of historical users exceeds the input data specification of the large language model, the abnormal user detection system can further truncate the second target interaction data to obtain second truncated data. Based on the second truncated data and the attribute information of historical users, second feature data is obtained. The truncation of the second target interaction data can include: according to the input data specification of the large language model and the total data volume determined by the second target interaction data and the attribute information of historical users, selecting the top K interaction statements from the second target interaction data according to the sorting result as the second truncated data, where K is an integer greater than 1. Through this processing, the second feature data can effectively retain the key interaction statements that reflect the interaction intent of historical users while conforming to the input data specification of the large language model. In this way, computational overhead is controlled while retaining the core information that best reflects the interaction intent of historical users.

[0110] In some embodiments, the first K interactive statements can be determined in the second target interactive data in the following manner: a second remaining encoding length is determined based on the length of the input data of the large language model and the encoding length of the attribute information of historical users; the first K interactive statements are selected from the second target interactive data based on the second remaining encoding length, wherein the encoding length of the first K interactive statements is less than or equal to the second remaining encoding length.

[0111] The abnormal user detection method provided in the embodiments of this specification also involves the following steps: how to determine historical target users, and how to determine whether an active user is an abnormal user based on a preset threshold and the outlier between historical target users and active users. The following will describe this in conjunction with... Figure 5This section describes one implementation method for this step.

[0112] Figure 5 This is the third schematic flowchart illustrating an abnormal user detection method provided according to an embodiment of this specification. Computer system 200 can execute the abnormal user detection method of this specification. Specifically, processor 202 in computer system 200 can read the instruction set stored in its local storage medium and then execute the abnormal user detection method of this specification according to the provisions of the instruction set. For example... Figure 5 As shown, the method may include: S510: Construct the first high-dimensional dense vector into a first plane index based on Euclidean distance.

[0113] In some embodiments, the abnormal user detection system can load a first high-dimensional dense vector into the memory of the computer system 200 and construct a first planar index based on Euclidean distance using a vector similarity retrieval library. By converting the first high-dimensional dense vector into the first planar index, retrieval efficiency can be improved in subsequent outlier comparison and difference analysis based on vector space.

[0114] S520: For any historical user, construct a second plane index based on Euclidean distance from the second high-dimensional dense vector corresponding to the historical user.

[0115] In some embodiments, the abnormal user detection system can load the second high-dimensional dense vectors corresponding to multiple historical users into the memory of the computer system 200, and use a vector similarity retrieval library to construct a second plane index based on Euclidean distance for each second high-dimensional dense vector. Through multiple second plane indices, a benchmark distribution boundary or benchmark clustering range can be constructed in the vector space, thereby providing a reference benchmark for subsequent difference comparisons.

[0116] S530: Using the first plane index, perform nearest neighbor or K-nearest neighbor retrieval in the second plane indexes corresponding to multiple historical users respectively, determine the second plane index with the smallest outlier degree with the first plane index as the second target plane index, and determine the historical users corresponding to the second target plane index as historical target users.

[0117] In some embodiments, the abnormal user detection system may utilize a vector similarity retrieval library, based on the nearest neighbor algorithm or the K-nearest neighbor search algorithm, and use a first plane index to perform nearest neighbor retrieval or K-nearest neighbor retrieval in the second plane indexes corresponding to multiple historical users respectively. The second plane index with the smallest outlier degree with the first plane index shall be determined as the second target plane index, and the historical users corresponding to the second target plane index shall be determined as historical target users.

[0118] In this method, a planar index based on Euclidean distance can be constructed for each high-dimensional dense vector to improve the efficiency of outlier comparison and difference analysis in the vector space, thereby improving the detection efficiency of abnormal users.

[0119] S540: Determine the Euclidean distance between the first plane index and the second target plane index.

[0120] In some embodiments, the abnormal user detection system can utilize a vector similarity retrieval library to determine the Euclidean distance between the first plane index and the second target plane index based on the first high-dimensional dense vector and the second high-dimensional dense vector corresponding to the historical target user.

[0121] Understandably, for each second high-dimensional dense vector, the closer the Euclidean distance between the second high-dimensional dense vector and the first high-dimensional dense vector, the smaller the outlier between the second plane index corresponding to the second high-dimensional dense vector and the first plane index. Conversely, the farther the Euclidean distance between the second high-dimensional dense vector and the first high-dimensional dense vector, the greater the outlier between the second plane index corresponding to the second high-dimensional dense vector and the first plane index.

[0122] S550: If the Euclidean distance is greater than a preset threshold, the active user is identified as an abnormal user.

[0123] S560: If the Euclidean distance is less than or equal to a preset threshold, determine that the active user is not an abnormal user.

[0124] Understandably, for each active user, if the first plane index corresponding to that active user cannot find a corresponding second target plane index within the baseline distribution boundary or baseline clustering range constructed from multiple second plane indices (i.e., the Euclidean distance between the first plane index and any second plane index is greater than a preset threshold), then the active user's behavior pattern can be determined to be an unseen anomaly, and the active user can be identified as an anomalous user. Conversely, if a second target plane index corresponding to the first plane index can be found within the baseline distribution boundary or baseline clustering range constructed from multiple second plane indices, then the active user is considered a normal user.

[0125] This method transforms the semantic association analysis between unstructured feature data into distance comparison analysis in vector space, eliminating the dependence on labeled samples. This enables the abnormal user detection system to directly identify various new types of abnormal users that have never appeared in the target interaction platform in an unsupervised mode, thereby giving the abnormal user detection system a stronger generalization ability and making it adaptable to various unknown risk scenarios.

[0126] In some embodiments, if the active user is a non-abnormal user, the method may further include the following steps: The multiple historical users include the multiple historical anomalous users; the anomalous user detection system can utilize a first plane index to perform nearest neighbor or K-nearest neighbor retrieval in the second plane indices corresponding to the multiple historical anomalous users, determining the second plane index with the smallest outlier degree to the first plane index as the reference second plane index; if the Euclidean distance between the reference second plane index and the first plane index is less than or equal to a preset distance threshold, it indicates that the active user may be an anomalous user that appeared within a historical time period; if the Euclidean distance between the reference second plane index and the first plane index is greater than the preset distance threshold, it indicates that the active user is a normal user. In some embodiments, the preset distance threshold can be pre-configured by maintenance personnel in the anomalous user detection system based on the accuracy requirements of normal user analysis.

[0127] In some embodiments, if the number of historical users is M, and the historical users include N historically anomalous users, where N is an integer greater than 1 and M is an integer greater than N, the method may further include the following steps after determining that an active user is an anomalous user: S570: Sort the second plane indices corresponding to the N historical abnormal users according to the Euclidean distance between the first plane index and the second plane index corresponding to each historical abnormal user, and obtain the sorting result.

[0128] In some embodiments, the second plane indices corresponding to the N historical abnormal users can be sorted according to the Euclidean distance from nearest to farthest to obtain the sorting result.

[0129] S580: According to the preset filtering strategy, select Q historical abnormal users from N historical abnormal users, where Q is an integer greater than or equal to 1 and less than or equal to N.

[0130] This preset filtering strategy can be used to indicate how to filter out Q historical abnormal users from N historical abnormal users.

[0131] In some embodiments, the preset filtering strategy may be: filtering historical abnormal users sequentially from front to back according to the sorting results, and ensuring that the filtered historical abnormal users have different abnormal category labels, until Q historical abnormal users are filtered out.

[0132] S590: Based on the anomaly category labels corresponding to the Q historical anomaly users, determine the target anomaly category label corresponding to the active user.

[0133] For each of the Q historically anomalous users, the first feature data obtained by the anomalous user detection system may include its corresponding anomalous category label. Optionally, the anomalous category labels of historically anomalous users can be pre-labeled by operations and maintenance personnel based on historical audit results and stored in the anomalous user database. The anomalous user detection system can retrieve the corresponding anomalous category label for each historically anomalous user from this anomalous user database based on the identifier of each historically anomalous user. This anomalous category label can be determined based on one or more of the application scenario, type, severity, and occurrence pattern of the anomalous behavior.

[0134] In some embodiments, the abnormal user detection system may perform the following steps: obtain the abnormal category label recognition process for each of the Q historical abnormal users, resulting in Q abnormal category label recognition processes; apply the Q abnormal category label recognition processes to active users respectively, resulting in Q label recognition results for the active users; and determine the target abnormal category label corresponding to the active user based on the Q label recognition results. For example, the label recognition result with the highest score among the Q label recognition results can be used to determine the target abnormal category label corresponding to the active user.

[0135] Optionally, the database stores multiple anomaly category label recognition processes pre-configured by operations and maintenance personnel. The anomaly user detection system can request the database to obtain the anomaly category label recognition process for each of the Q historical anomaly users.

[0136] The abnormal user detection method provided in the embodiments of this specification, after determining that an active user is an abnormal user, can further filter out Q historical abnormal users from N historical abnormal users, and determine the target abnormal category label corresponding to the active user based on the abnormal category labels corresponding to the Q historical abnormal users, which helps to improve the efficiency of abnormal identification of active users.

[0137] In some embodiments, after determining that an active user is an anomalous user, the method can also generate an interactive scatter plot. Below, in conjunction with... Figure 6 The process of generating this interactive scatter plot is explained.

[0138] Figure 6 Fourthly, a flowchart illustrating an abnormal user detection method provided according to an embodiment of this specification is shown. Computer system 200 can execute the abnormal user detection method of this specification. Specifically, processor 202 in computer system 200 can read an instruction set stored in its local storage medium and then execute the abnormal user detection method of this specification according to the provisions of the instruction set. Figure 6 As shown, the method may include: S610: Perform dimensionality reduction on the first high-dimensional dense vector to obtain the first planar vector corresponding to the active user.

[0139] In some embodiments, the abnormal user detection system can reduce the dimensionality of a first high-dimensional dense vector using a vector dimensionality reduction algorithm. This vector dimensionality reduction algorithm can be any algorithm in the related art that can be used to reduce a high-dimensional dense vector to a planar vector.

[0140] For example, the t-SNE algorithm can effectively preserve the local structure of high-dimensional vector spaces, making it suitable for scenarios where high-dimensional dense vectors are mapped to two-dimensional space for visualization. Anomaly detection systems can use the t-SNE algorithm to reduce the dimensionality of a first high-dimensional dense vector to a first planar vector. The t-SNE algorithm parameters (such as the number of iterations) can be adaptively adjusted based on the number of historical users. For instance, when the number of historical users is large, while meeting accuracy requirements, the number of iterations in the t-SNE algorithm can be appropriately reduced or the learning rate increased to reduce computational overhead, accelerate algorithm convergence, and thus improve processing efficiency while ensuring dimensionality reduction quality.

[0141] S620: For each historical user, perform dimensionality reduction on the second high-dimensional dense vector corresponding to the historical user to obtain the second planar vector corresponding to the historical user.

[0142] For example, an abnormal user detection system can use the t-SNE algorithm to reduce the second high-dimensional dense vector to a second planar vector.

[0143] S630: Generate an interactive scatter plot based on the first plane vector and the second plane vectors corresponding to multiple historical users.

[0144] The interactive scatter plot includes: a first data point mapped by a first plane vector and second data points mapped by multiple second plane vectors respectively. The color intensity of the first data point is used to characterize the outlier degree of active users relative to multiple historical users.

[0145] For example, a higher outlier indicates that the first data point is farther away from the baseline distribution interval composed of multiple second data points, and the darker the color of the first data point; a lower outlier indicates that the first data point is closer to the baseline distribution interval composed of multiple second data points, and the lighter the color of the first data point. Through the above processing, it can help operation and maintenance personnel quickly identify abnormal users with high outlier values.

[0146] In some embodiments, the abnormal user detection system can generate an interactive scatter plot based on a first plane vector and second plane vectors corresponding to multiple historical users using an interactive charting tool. For example, this interactive charting tool may include, but is not limited to, Plotly.

[0147] In some embodiments, S630 may further include the following steps: S6301: Determine the outlier degree of an active user relative to multiple historical users based on the first plane vector and the second plane vectors corresponding to multiple historical users respectively.

[0148] S6302: Based on the first feature data, determine the dialogue keywords, user identifiers and dialogue fragments corresponding to active users, and generate user feature labels corresponding to active users based on the dialogue keywords, user identifiers, dialogue fragments and outliers.

[0149] In some embodiments, the abnormal user detection system may perform the following steps: using a large language model or text extraction algorithm, extracting dialogue keywords, user identifiers, and dialogue fragments corresponding to active users from the first feature data; and filling the dialogue keywords, user identifiers, dialogue fragments, and outliers into the corresponding filled areas of a label template to obtain user feature labels corresponding to the active user. For example, the text extraction algorithm may include, but is not limited to, a Term Frequency-Inverse Document Frequency (TF-IDF) keyword extraction algorithm. The label template may include multiple fields and corresponding filled areas for each field, the multiple fields including: dialogue keywords, user identifiers, dialogue fragments, and outliers.

[0150] S6303: Generate an interactive scatter plot based on the first plane vector, the second plane vectors corresponding to multiple historical users, and user feature labels.

[0151] The interactive scatter plot includes: first data points mapped by a first plane vector, second data points mapped by multiple second plane vectors respectively, and a control mapped by user feature labels. The control displays user feature labels in the interactive scatter plot in response to an expand command, and hides user feature labels in the interactive scatter plot in response to a collapse command.

[0152] In this specification, controls are interactive graphical elements (such as clickable triangle markers) that expand or collapse to display corresponding user feature tags in response to user clicks or touches.

[0153] Some abnormal user detection systems can use interactive chart creation tools to generate interactive scatter plots based on a first plane vector, second plane vectors corresponding to multiple historical users, and user feature labels.

[0154] In some embodiments, the multiple historical users include multiple historical normal users and multiple historical abnormal users. The second data points mapped by the second plane vector corresponding to historical normal users and the second data points mapped by the second plane vector corresponding to historical abnormal users may have different colors and / or patterns in the interactive scatter plot. Optionally, historical users with different abnormal category labels may have the same pattern and different colors for their mapped second data points.

[0155] In some embodiments, based on the second feature data, the dialogue keywords, user identifiers, and dialogue fragments corresponding to historical users can be determined, and user feature tags corresponding to historical users can be generated based on the dialogue keywords, user identifiers, and dialogue fragments corresponding to historical users. The interactive scatter plot may also include controls mapped to the user feature tags corresponding to historical users.

[0156] Figure 7 An example diagram of an interactive scatter plot provided according to an embodiment of this specification is shown. Please refer to [link to relevant documentation]. Figure 7 The first type of interactive scatter plot includes multiple triangles and multiple circles. The triangles are mapped by a first plane vector corresponding to active users, and the circles are mapped by a second plane vector corresponding to historical users. The triangles are colored from gray to dark, representing the increasing outlier degree of active users relative to multiple historical users.

[0157] The second type of interactive scatter plot includes multiple triangle controls, multiple circles, and multiple squares. The triangle controls are mapped from a first plane vector corresponding to active users and the user feature labels of those users. The circles are mapped from a second plane vector corresponding to historically normal users, and the squares are mapped from a second plane vector corresponding to historically abnormal users. The colors of the triangle controls, from gray to dark, represent the outlier degree of active users relative to multiple historical users, from small to large. The different patterns of the squares represent different anomaly category labels corresponding to historically abnormal users.

[0158] The abnormal user detection system can send this interactive scatter plot to the user's corresponding terminal, which can then display it. The user can trigger an expand command on the interactive scatter plot via their terminal to view the user's feature labels within it. Figure 7 As shown, in response to the expand command, the triangle control displays user feature labels in the interactive scatter plot; in response to the collapse command, the triangle control hides user feature labels in the interactive scatter plot.

[0159] In the embodiments of this specification, by generating an interactive scatter plot, an abnormal user can be presented intuitively. By adding interpretable user feature labels to the interactive scatter plot, maintenance personnel can quickly complete the anomaly analysis based on the characteristics of the abnormal user, which helps to shorten the anomaly analysis time and improve the anomaly handling efficiency.

[0160] In summary, the abnormal user detection method and system provided in this specification, after acquiring the first feature data corresponding to each active user in the current time period and the second feature data corresponding to multiple historical users in historical time periods, can utilize the semantic generalization capability of large language models (such as text embedding models) to encode the first feature data of active users into a first high-dimensional dense vector, and the second feature data of each historical user into a second high-dimensional dense vector. If the first feature data of active users contains implicitly expressed sensitive information or variant forms of sensitive information, the semantics of this sensitive information will deviate from normal logic, causing the first high-dimensional dense vector corresponding to the active user to naturally deviate from the baseline vector group, appearing as a large-distance outlier in the vector space. Therefore, this abnormal user detection system can accurately locate a very small number of abnormal users from a massive number of daily active users without prior knowledge, which is beneficial for improving the ability to proactively perceive risks in social scenarios.

[0161] This abnormal user detection system can also achieve a closed-loop risk detection process. It can directly identify various novel abnormal users that have never appeared in the target interaction platform before, thus possessing stronger generalization ability and adapting to various unknown risk scenarios. Simultaneously, the identified novel abnormal users can provide high-quality negative samples for subsequent iterations of anomaly detection rules and model training. Furthermore, this method also visualizes the distribution and user feature labels of abnormal users by generating interactive scatter plots, which helps improve the efficiency of operations and maintenance personnel in analyzing abnormal users.

[0162] This specification also provides an unsupervised outlier detection framework based on large-model semantic representation. It combines a tail-truncation strategy with the text embedding capabilities of a large language model (built using vLLM acceleration technology) to construct high-dimensional dense vectors reflecting user interaction intentions from user feature data. It can also utilize a vector similarity retrieval library to construct a baseline index space based on the second high-dimensional dense vectors corresponding to multiple historical users, and construct a first plane index based on the first high-dimensional dense vector corresponding to active users. Based on this, it can use the first plane index to perform nearest neighbor or K-nearest neighbor searches in the second plane indices corresponding to multiple historical users, determining the second plane index with the smallest outlier degree compared to the first plane index as the second target plane index. Then, based on a preset threshold and the outlier degree between the first plane index and the second target plane index, it determines whether the active user is an anomalous user. Through this method, the detection of anomalous users can be transformed into a vector distance metric, thereby achieving cold-start discovery of unknown anomalous users under unlabeled data conditions. This method can also integrate the t-SNE algorithm and the TF-IDF keyword extraction algorithm to construct an interactive scatter plot based on a first high-dimensional dense vector and multiple second high-dimensional dense vectors. This interactive scatter plot can visualize the distribution of abnormal users and their feature labels. The user feature labels have strong semantic generalization capabilities, enabling operations and maintenance personnel to quickly identify and analyze various new types of abnormal users, thus improving the efficiency of anomaly analysis.

[0163] Optionally, this specification may also provide a multi-level user classification mechanism, which is used to refine user types and configure corresponding outlier determination thresholds and control strategies for each refined user type, thereby achieving refined hierarchical identification of user abnormal states, replacing the single normal / abnormal binary classification determination mode, and helping to improve the granularity and practicality of abnormal user detection.

[0164] For example, for each active user, the active user may be any one of the following types: non-abnormal user, low-risk abnormal user, medium-risk abnormal user, and high-risk abnormal user. The relationship between the outlier degree and threshold for each type of user, as well as the control strategy, is shown in Table 1.

[0165] Table 1

[0166] In some embodiments, the thresholds at each level in Table 1 can be dynamically and adaptively adjusted according to the user volume of the target interaction platform, the characteristics of the interaction scenario, and the distribution of historical abnormal data, so as to adapt to the anomaly detection requirements of different interaction scenarios.

[0167] This specification also provides a computer-readable non-volatile storage medium that stores a computer program. When executed by a processor, the computer program can be used to perform one or more steps of one or more methods described or shown herein, or to implement one or more functions described or shown herein. The computer-readable non-volatile storage medium may include one or more semiconductor or other integrated circuit (IC) based memories (e.g., FPGA or ASIC built-in memory / configuration memory), HDDs, HHDs, optical discs, optical disc drives (ODDs), magneto-optical discs, magneto-optical drives, floppy disks, floppy disk drives (FDDs), magnetic tapes, SSDs, RAM drives, secure digital cards, or combinations thereof, or other suitable media.

[0168] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0169] In summary, after reading this detailed disclosure, those skilled in the art will understand that the foregoing detailed disclosure is presented by way of example only and is not restrictive. Although not explicitly stated herein, those skilled in the art will understand that this specification requires various reasonable changes, improvements, and modifications to the embodiments. These changes, improvements, and modifications are intended to be made by this specification and are within the spirit and scope of the exemplary embodiments described herein.

[0170] Furthermore, certain terms in this specification have been used to describe embodiments of this specification. For example, "an embodiment," "an embodiment," and / or "some embodiments" mean that a particular feature, structure, or characteristic described in connection with that embodiment may be included in at least one embodiment of this specification. Therefore, it is to be emphasized and understood that two or more references to "an embodiment" or "an embodiment" or "alternative embodiment" in various parts of this specification do not necessarily refer to the same embodiment. Moreover, specific features, structures, or characteristics may be suitably combined in one or more embodiments of this specification.

[0171] It should be understood that in the foregoing description of the embodiments in this specification, various features are combined in a single embodiment, drawing, or description for the purpose of simplifying the description and to aid in understanding a feature. However, this does not mean that the combination of these features is necessary, and those skilled in the art, upon reading this specification, may readily identify some of the devices as separate embodiments. That is, the embodiments in this specification can also be understood as an integration of multiple secondary embodiments. And the content of each secondary embodiment is valid even if it contains fewer than all the features of a single foregoing disclosed embodiment.

[0172] Every patent, patent application, publication of a patent application, and other material such as articles, books, specifications, publications, documents, articles, etc., cited herein, except for those inconsistent with or conflicting with this document, or those having a restrictive effect on the widest scope of the claims, may be incorporated herein by reference for all purposes now or hereafter associated with this document. Furthermore, in the event of any inconsistency or conflict between the description, definition, and / or use of relevant terms in any material and the description, definition, and / or use of relevant terms in this document, the terms in this document shall prevail.

[0173] Finally, it should be understood that the embodiments disclosed herein are illustrative of the principles of the embodiments described in this specification. Other modified embodiments are also within the scope of this specification. Therefore, the embodiments disclosed in this specification are merely examples and not limitations. Those skilled in the art can implement the applications described in this specification using alternative configurations based on the embodiments in this specification. Therefore, the embodiments in this specification are not limited to the embodiments precisely described in the applications.

Claims

1. An abnormal user detection method, the method comprising: The system obtains first feature data corresponding to each active user in the current time period and second feature data corresponding to multiple historical users in the historical time period. The first feature data is obtained based on the interaction data of the active user on the target interaction platform and the attribute information of the active user. The second feature data is obtained based on the interaction data of the historical user on the target interaction platform and the attribute information of the historical user. The first feature data is processed by vector representation to obtain a first high-dimensional dense vector corresponding to the active user; each of the second feature data is processed by vector representation to obtain a second high-dimensional dense vector corresponding to each historical user; and Based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users, it is determined whether the active user is an abnormal user.

2. The method according to claim 1, wherein, The step of obtaining the first feature data corresponding to each active user in the current time period and the second feature data corresponding to multiple historical users in the historical time period includes: Obtain the first raw interaction data generated by the active user in the target interaction platform within the current time period and the attribute information of the active user, and obtain the second raw interaction data generated by multiple historical users in the target interaction platform within a historical time period and the attribute information of each historical user; Based on the recurrence frequency of each interaction statement in the first original interaction data, the interaction statements in the first original interaction data are sorted to obtain the first target interaction data corresponding to the active user. Based on the first target interaction data and the attribute information of the active user, the first feature data is determined; and For each historical user, the interaction statements in the second original interaction data corresponding to the historical user are sorted according to the recurrence frequency of each interaction statement to obtain the second target interaction data corresponding to the historical user. Based on the second target interaction data and the attribute information of the historical user, the second feature data corresponding to the historical user is determined.

3. The method according to claim 2, wherein, The step of determining the first feature data based on the first target interaction data and the attribute information of the active user includes: The first target interaction data is truncated at the end to obtain the first truncated data, and the first feature data is obtained based on the first truncated data and the attribute information of the active user. The step of determining the second feature data corresponding to the historical user based on the second target interaction data and the attribute information of the historical user includes: The second target interaction data is truncated at the end to obtain second truncated data. Based on the second truncated data and the attribute information of the historical user, the second feature data corresponding to the historical user is obtained.

4. The method according to claim 1, wherein, The step of determining whether an active user is an abnormal user based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users includes: Based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users, determine the historical target user with the smallest outlier degree from the active user among the multiple historical users; and Based on a preset threshold and the outlier ratio between the historical target user and the active user, it is determined whether the active user is an abnormal user.

5. The method according to claim 4, wherein, The step of determining the historical target user with the smallest outlier than the active user among multiple historical users based on the first high-dimensional dense vector corresponding to the active user and the second high-dimensional dense vectors corresponding to multiple historical users respectively includes: The first high-dimensional dense vector is constructed as a first plane index based on Euclidean distance; For any historical user, construct a second plane index based on Euclidean distance from the second high-dimensional dense vector corresponding to the historical user; and Using the first plane index, a nearest neighbor search or a K-nearest neighbor search is performed in the second plane indexes corresponding to multiple historical users respectively. The second plane index with the smallest outlier degree with the first plane index is determined as the second target plane index, and the historical user corresponding to the second target plane index is determined as the historical target user.

6. The method according to claim 5, wherein, The step of determining whether an active user is an anomalous user based on a preset threshold and the outlier between the historical target user and the active user includes: Determine the Euclidean distance between the first plane index and the second target plane index; If the Euclidean distance is greater than the preset threshold, the active user is determined to be an abnormal user; and If the Euclidean distance is less than or equal to the preset threshold, the active user is determined to be a non-abnormal user.

7. The method according to claim 6, wherein, The number of the plurality of historical users is M, and the plurality of historical users includes N historical abnormal users, wherein N is an integer greater than 1, and M is an integer greater than N; After determining that the active user is an abnormal user, the method further includes: Based on the Euclidean distance between the first plane index and the second plane index corresponding to each historical abnormal user, the second plane indices corresponding to the N historical abnormal users are sorted to obtain the sorting results. According to a preset filtering strategy, Q historical abnormal users are selected from N historical abnormal users, where Q is an integer greater than or equal to 1 and less than or equal to N; and Based on the anomaly category labels corresponding to the Q historical anomaly users, determine the target anomaly category label corresponding to the active user.

8. The method according to any one of claims 1-7, wherein, After determining that the active user is an abnormal user, the method further includes: The first high-dimensional dense vector is reduced in dimensionality to obtain the first planar vector corresponding to the active user. For each historical user, the second high-dimensional dense vector corresponding to the historical user is subjected to dimensionality reduction processing to obtain the second planar vector corresponding to the historical user; and An interactive scatter plot is generated based on the first plane vector and the second plane vectors corresponding to multiple historical users. The interactive scatter plot includes: a first data point mapped by the first plane vector and a second data point mapped by multiple second plane vectors respectively. The color intensity of the first data point is used to characterize the outlier degree of the active user relative to multiple historical users.

9. The method according to claim 8, wherein, The step of generating an interactive scatter plot based on the first plane vector and the second plane vectors corresponding to multiple historical users includes: Based on the first plane vector and the second plane vectors corresponding to multiple historical users, the outlier degree of the active user relative to the multiple historical users is determined. Based on the first feature data, the dialogue keywords, user identifier, and dialogue fragments corresponding to the active user are determined, and user feature tags corresponding to the active user are generated based on the dialogue keywords, user identifier, dialogue fragments, and outlier. An interactive scatter plot is generated based on the first plane vector, the second plane vectors corresponding to multiple historical users, and the user feature tags. The interactive scatter plot includes: a first data point mapped by the first plane vector, second data points mapped by multiple second plane vectors, and a control mapped by the user feature tags. The control displays the user feature tags in the interactive scatter plot in response to an expand command, and hides the user feature tags in the interactive scatter plot in response to a collapse command.

10. An abnormal user detection system, comprising: At least one storage medium storing at least one instruction set for abnormal user detection; as well as At least one processor is communicatively connected to the at least one storage medium, wherein, when the abnormal user detection system is running, the at least one processor reads the at least one instruction set and executes the abnormal user detection method as described in any one of claims 1-9 according to the instructions of the at least one instruction set.

Images