CN110336838A - Account method for detecting abnormality, device, terminal and storage medium - Google Patents
Account method for detecting abnormality, device, terminal and storage medium Download PDFInfo
- Publication number
- CN110336838A CN110336838A CN201910726917.2A CN201910726917A CN110336838A CN 110336838 A CN110336838 A CN 110336838A CN 201910726917 A CN201910726917 A CN 201910726917A CN 110336838 A CN110336838 A CN 110336838A
- Authority
- CN
- China
- Prior art keywords
- account
- detected
- dimensional
- data
- characteristic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Debugging And Monitoring (AREA)
Abstract
The present invention provides a kind of account method for detecting abnormality, device, terminal and storage medium, extract the foundation characteristic data of account to be detected in preset time period, foundation characteristic data based on account to be detected, generate the multi-dimensional time sequence characteristic spectrum that account to be detected is corresponded in preset time period, multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, obtain abnormal account, wherein presupposition analysis model is obtained by the supervision sample training multidimensional convolution neural network of abnormal account.Solve the problems, such as it is existing extract that feature carries out time-consuming caused by account abnormality detection and accuracy is low using artificial, improve the detection exception accuracy of account and the extraction efficiency of account foundation characteristic data to be detected.
Description
Technical field
The present invention relates to technical field of data processing, and in particular to a kind of account method for detecting abnormality, device, terminal and deposits
Storage media.
Background technique
With the development of cybertimes, user is using disparate networks tool or while logging in website has oneself exclusive
Account name can also become account.Account is particularly in the identification code of used network tool or website.
In the environment of increasingly paying close attention to network security, the account for detecting user also becomes a kind of with the presence or absence of abnormal
Routine operation.There are mainly two types of existing account method for detecting abnormality, one is: pass through the basic data progress manually to account
The aggregation extent for logging in IP or equipment, or the channel logged in are such as extracted in feature extraction, in conjunction with account attribute data feature,
Classified using supervised classification model, so that it is determined that abnormal account.Another kind is: using figure method for digging, first passes through account
Between relation chain map interlinking, then use community's partitioning algorithm, extract the poly- a small bundle of straw, etc. for silkworms to spin cocoons on of clique, it is each cluster in again manually carry out feature
Extraction, determine abnormal account by assemblage characteristic threshold value or plus supervised classification model.
With upper type, require to carry out feature extraction from a large amount of information by the way of artificial, it is not only time-consuming, if behaviour
Make personnel and do not have extremely strong professional knowledge, feature quantity and the precision for also resulting in extraction are inadequate, reduce and detect abnormal account
Number precision.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of account method for detecting abnormality, device, terminal and storage medium, with
It solves the problems, such as existing using manually extraction feature carries out time-consuming caused by account abnormality detection and accuracy is low.
To achieve the above object, on the one hand, this application provides a kind of account method for detecting abnormality to include:
The foundation characteristic data of account to be detected in preset time period are extracted, are included at least in the foundation characteristic data dynamic
State behavioural characteristic data；
Based on the foundation characteristic data of the account to be detected, generates and correspond to the account to be detected in the preset time period
Number multi-dimensional time sequence characteristic spectrum；
Multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, abnormal account is obtained, it is described default
Analysis model is obtained by the supervision sample training multidimensional convolution neural network of abnormal account.
In one possible implementation, if in the foundation characteristic data including dynamic behaviour characteristic and static state
Characteristic, the foundation characteristic data based on the account to be detected, generate in the preset time period it is corresponding it is described to
Detect the multi-dimensional time sequence characteristic spectrum of account, comprising:
Obtain each fisrt feature data and the static state in the dynamic behaviour characteristic of the account to be detected
Each second feature data in characteristic, each fisrt feature data correspond to different behavior classifications, and described each second
Characteristic corresponds to different account static informations；
It is corresponding first single to establish the account to be detected each fisrt feature data in the preset time period
Tie up temporal aspect matrix and the account to be detected each second feature data in the preset time period corresponding the
Two one-dimensional temporal aspect matrixes；
According to the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix, it is special to generate multi-dimensional time sequence
Levy map.
It is in one possible implementation, described that establish the account to be detected described every in the preset time period
The corresponding first one-dimensional temporal aspect matrix of a fisrt feature data, comprising:
According to the data volume of each fisrt feature data of acquisition, the first coordinate range is determined；
It is established in first coordinate range and corresponds to the of each fisrt feature data in the preset time period
One one-dimensional temporal aspect matrix.
In one possible implementation, described to establish each second feature data pair in the preset time period
The the second one-dimensional temporal aspect matrix answered, comprising:
According to the data volume of each second feature data of acquisition, the second coordinate range is determined；
It is established in second coordinate range and corresponds to the of each second feature data in the preset time period
Two one-dimensional temporal aspect matrixes.
In one possible implementation, described according to the first one-dimensional temporal aspect matrix and second one-dimensional
Temporal aspect matrix generates multi-dimensional time sequence characteristic spectrum, comprising:
Normalizing is carried out to the data in the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix
Change processing；
The first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix after combining normalized generate multidimensional
Temporal aspect map.
In one possible implementation, described to carry out multi-dimensional time sequence characteristic spectrum input presupposition analysis model
Analysis, obtains abnormal account, comprising:
The multi-dimensional time sequence characteristic spectrum is inputted into presupposition analysis model, extracts the spy in the multi-dimensional time sequence characteristic spectrum
It levies data and carries out feature calculation, obtain characteristic probability value；
If the characteristic probability value is in abnormal probit range, determine the multi-dimensional time sequence characteristic spectrum it is corresponding to
Detecting account is abnormal account.
Another aspect, the application also provide a kind of account abnormal detector, comprising:
Extraction module, for extracting the foundation characteristic data of account to be detected in preset time period, the foundation characteristic number
Dynamic behaviour characteristic is included at least in；
Map generation module generates the preset time period for the foundation characteristic data based on the account to be detected
The multi-dimensional time sequence characteristic spectrum of the interior correspondence account to be detected；
Analysis module obtains exception for analyzing multi-dimensional time sequence characteristic spectrum input presupposition analysis model
Account, the presupposition analysis model are obtained by the supervision sample training multidimensional convolution neural network of abnormal account.
In one possible implementation, the map generation module, comprising:
Obtaining unit, each fisrt feature number in the dynamic behaviour characteristic for obtaining the account to be detected
According to second feature data each in static nature data, each fisrt feature data correspond to different behavior classifications, described
Each second feature data correspond to different account static informations；
One-dimensional map establishes unit, for establishing the account to be detected described each first in the preset time period
The corresponding first one-dimensional temporal aspect map of characteristic and the account to be detected are described each in the preset time period
The corresponding second one-dimensional temporal aspect map of second feature data；
Multidimensional map generation unit, for special according to the first one-dimensional temporal aspect map and the second one-dimensional timing
Map is levied, multi-dimensional time sequence characteristic spectrum is generated.
Another aspect, the application also provide a kind of terminal, comprising:
Processor and memory；
Wherein, the processor is for executing the program stored in the memory；
For storing program, described program is at least used for the memory:
The foundation characteristic data of account to be detected in preset time period are extracted, are included at least in the foundation characteristic data dynamic
State behavioural characteristic data；
Based on the foundation characteristic data of the account to be detected, generates and correspond to the account to be detected in the preset time period
Number multi-dimensional time sequence characteristic spectrum；
Multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, abnormal account is obtained, it is described default
Analysis model is determined by the supervision sample training multidimensional convolution neural network of abnormal account.
It is executable to be stored with computer present invention also provides a kind of storage medium for another aspect in the storage medium
Instruction when the computer executable instructions are loaded and executed by processor, is realized as disclosed in above-mentioned the application first aspect
Account method for detecting abnormality.
Based on a kind of cloud platform upgrade method, device, terminal and storage medium that the embodiments of the present invention provide, the party
Method are as follows: extract the foundation characteristic data of account to be detected in preset time period, the foundation characteristic data based on account to be detected are raw
At the multi-dimensional time sequence characteristic spectrum for corresponding to account to be detected in preset time period, multi-dimensional time sequence characteristic spectrum is inputted into presupposition analysis
Model is analyzed, and abnormal account is obtained, wherein presupposition analysis model is refreshing by the supervision sample training multidimensional convolution of abnormal account
It is obtained through network.It solves existing using manually extraction feature carries out time-consuming caused by account abnormality detection and accuracy is low
Problem improves the abnormal accuracy of account of detection and the extraction efficiency of account foundation characteristic data to be detected.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
The embodiment of invention for those of ordinary skill in the art without creative efforts, can also basis
The attached drawing of offer obtains other attached drawings.
Fig. 1 is a kind of flow chart of account method for detecting abnormality provided in an embodiment of the present invention；
Fig. 2 is the multi-dimensional time sequence spy that account to be detected is corresponded in a kind of generation preset time period provided in an embodiment of the present invention
Levy the flow chart of map；
Fig. 3 is provided in an embodiment of the present invention a kind of to establish account to be detected each fisrt feature number within a preset period of time
According to the flow chart of corresponding first one-dimensional temporal aspect matrix；
Fig. 4 is provided in an embodiment of the present invention a kind of to establish account to be detected each second feature number within a preset period of time
According to the flow chart of corresponding second one-dimensional temporal aspect matrix；
Fig. 5 is a kind of flow chart for generating multi-dimensional time sequence characteristic spectrum provided in an embodiment of the present invention；
Fig. 6 is provided in an embodiment of the present invention a kind of based on convolutional neural networks building presupposition analysis model progress malice account
Number detection logical flow chart；
Fig. 7 is a kind of logic chart of the account abnormality detection based on convolutional neural networks provided in an embodiment of the present invention；
Fig. 8 is a kind of structural schematic diagram of account abnormal detector provided in an embodiment of the present invention；
Fig. 9 is a kind of structural block diagram of terminal provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
In this application, the terms "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion,
So that the process, method, article or equipment for including a series of elements not only includes those elements, but also including not having
The other element being expressly recited, or further include for elements inherent to such a process, method, article, or device.Do not having
There is the element limited in the case where more limiting by sentence "including a ...", it is not excluded that in the mistake including the element
There is also other identical elements in journey, method, article or equipment.
As shown in Figure 1, being a kind of flow chart of account method for detecting abnormality provided in an embodiment of the present invention, this method includes
Following steps:
Step S101: the foundation characteristic data of account to be detected in preset time period are extracted.
In step s101 it should be noted that foundation characteristic information data includes at least dynamic behaviour characteristic.Its
In, dynamic behaviour characteristic is to carry out operating generated characteristic for corresponding account to be detected.Optionally, including
But it is not limited to the characteristics such as the register for the account to be detected, the login times generated based on register.
During implementing step S101, optionally, it can use big data platform and extract in preset time period
The foundation characteristic data of account to be detected.
During specific implementation, according to the business datum amount of preset time period and account to be detected, first determine for mentioning
The big data platform for taking foundation characteristic data is then based on determining big data platform and extracts account to be detected in preset time period
Foundation characteristic data.Data of all accounts to be detected in the preset time period are uploaded to big data platform, by big
Data platform automatically extracts the foundation characteristic data of account to be detected, solves the foundation characteristic number of manual extraction account to be detected
According to and the problem of lead to low efficiency.
Such as: there are 100 accounts to be detected, need to extract foundation characteristic number of 100 accounts to be detected in 3 days
According to, which is uploaded to the big data platform, it should based on big data platform extraction
100 foundation characteristic data in account to be detected 3 days.
It should be noted that it is above-mentioned for example, preset time period includes being not limited to 3 days, according to actual demand,
The foundation characteristic data of the account to be detected of corresponding preset time period are extracted in big data platform.
In embodiments of the present invention, optionally, big data platform can be spark big data platform, or
Tensorflow big data platform.
Step S102: the foundation characteristic data based on account to be detected generate in preset time period and correspond to account to be detected
Multi-dimensional time sequence characteristic spectrum.
In step s 102 it should be noted that multi-dimensional time sequence characteristic spectrum refers to: being based on institute within a preset period of time
By account to be detected the characteristic spectrum that forms of multiple characteristics.
During implementing step S102, the basis based on all accounts to be detected extracted in preset time period
Characteristic generates in preset time period according to data type difference for each account to be detected and corresponds to the account to be detected
One-dimensional temporal aspect map.I.e. the one-dimensional temporal aspect map, which contains, corresponds to the same of account to be detected in preset time period
The characteristic of data type.
Such as: in preset one-month period section, in the dynamic behaviour characteristic of one extracted account to be detected but
The login times of account including but not limited to be detected log in scene and operation scenario etc..For the account to be detected, with 1
Login times in a month section are the one-dimensional temporal aspect map that radix generates the corresponding login times.Likewise, being directed to
The one-dimensional temporal aspect map of corresponding logon operation also can be generated in the account to be detected.
It should be noted that the multi-dimensional time sequence feature spectrogram of composition includes but is not limited to dynamic row in the embodiment of the present invention
Data are characterized, the data of other attributes can be also introduced, generate corresponding account to be detected jointly with dynamic behaviour characteristic
Multi-dimensional time sequence characteristic spectrum.So that multi-dimensional time sequence characteristic spectrum is more complete.
Step S103: multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, abnormal account is obtained.
In step s 103 it should be noted that presupposition analysis model in the embodiment of the present invention by abnormal account supervision
Sample training multidimensional convolution neural network determines.
Wherein, convolutional neural networks refer to: one kind comprising convolutional calculation and with depth structure feedforward neural network,
It is one of the representative algorithm of deep learning.Convolutional neural networks have representative learning ability, can be according to its hierarchical structure to defeated
Enter information and carry out translation invariant classification, therefore convolutional neural networks are also referred to as " translation invariant artificial neural network ".
In embodiments of the present invention, the network structure of used multidimensional convolution neural network, according to the prison of abnormal account
The demand of sample training is superintended and directed, the multidimensional convolution neural network of smaller network structure can be used.For example, 2 convolution can be used
Layer and 1 full connection layer building multidimensional convolution neural network；It can also be more using 3 convolutional layers and 1 full connection layer building
Convolutional neural networks are tieed up, the network structure embodiment of the present invention of multidimensional convolution neural network is not limited to that.
Specifically, during using 2 convolutional layers and 1 full connection layer building multidimensional convolution neural network, it can
Choosing, every layer of convolution kernel size are as follows: 3*3*32, port number are as follows: 3*3*64 passes through above-mentioned 2 convolution during training
After layer, the classification of softmax layers of progress malice account of input after obtained intermediate result is handled by full articulamentum, for
For the network structure of multidimensional convolution neural network, every layer of convolution kernel size and port number can also become according to demand
Change, to this embodiment of the present invention without limiting.
It should be noted that the supervision samples sources of the abnormal account in the embodiment of the present invention, the mainly feedback of user
It complains, group's sexual abnormality etc. that the strike of traditional business security strategy differentiates and clustering obtains is hit using these tradition
Tactful main batch operation aggregation of being biased to differentiates.The supervision sample of these comprehensive abnormal accounts, from individual behavior and attribute
Modeling more acurrate can more fully determine abnormal account.
During implementing step S103, because presupposition analysis model is by the supervision sample of many abnormal accounts
This training multidimensional convolution neural network obtains, so the multi-dimensional time sequence characteristic spectrum of acquisition is input in presupposition analysis model
It is analyzed and is calculated, may finally obtain whether the corresponding account to be detected of the multi-dimensional time sequence characteristic spectrum is abnormal account
As a result.
Specifically, obtain the corresponding account to be detected of the multi-dimensional time sequence characteristic spectrum whether be abnormal account result reality
Existing process are as follows: multi-dimensional time sequence characteristic spectrum is inputted into presupposition analysis model, extracts the characteristic in multi-dimensional time sequence characteristic spectrum
Feature calculation is carried out, characteristic probability value is obtained, if characteristic probability value is in abnormal probit range, determines multi-dimensional time sequence feature
The corresponding account to be detected of map is abnormal account.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that by to be checked in preset time period
The foundation characteristic data for surveying account extract, and are then based on the foundation characteristic data of these accounts to be detected, generate to be detected
The multi-dimensional time sequence characteristic spectrum of account, by the multi-dimensional time sequence characteristic spectrum of the account to be detected be input in presupposition analysis model into
Row analysis, finally obtains abnormal account.It solves existing using consumption caused by artificial extraction feature progress account abnormality detection
When and the low problem of accuracy, improve the extraction effect of the accuracy and account foundation characteristic data to be detected that detect abnormal account
Rate.
Based on account method for detecting abnormality disclosed in embodiments of the present invention Fig. 1, if in the foundation characteristic number of extraction
It can also include static nature data in addition to including dynamic behaviour characteristic in.Step S102 shown in Fig. 1: it is based on
The foundation characteristic data of account to be detected generate the tool that the multi-dimensional time sequence characteristic spectrum of account to be detected is corresponded in preset time period
Body realizes process, as shown in Fig. 2, specifically including that
Step S201: each fisrt feature data and static nature in the dynamic behaviour characteristic of account to be detected are obtained
Each second feature data in data.
It in step s 201, include account static information in static nature data, wherein account static information includes but not
It is limited to the grade of account, using the age of user of the account, the gender of user and business number etc..
In step s 201, each fisrt feature data correspond to different behavior classifications in dynamic behaviour characteristic.It is static
Each second feature data correspond to different account static informations in characteristic.
Explanation is needed further exist for, each fisrt feature data correspond to different behavior classifications and include but is not limited to: to be checked
Survey login times and the register classification etc. of account.
Each second feature data correspond to different account static informations: when the use of account to be detected
Between, the message that is sent using the account to be detected of user good friend quantity present in account to be detected, user and number etc. of posting.
During implementing step S201, obtain each first in the dynamic behaviour characteristic of account to be detected
Each second feature data in characteristic and static nature data.
Step S202: establish account to be detected within a preset period of time each fisrt feature data corresponding first one-dimensional when
Sequence characteristics matrix and the account to be detected corresponding second one-dimensional temporal aspect square of each second feature data within a preset period of time
Battle array.
In step S202, optionally, it is respectively scale value or minute as the abscissa of scale value using hour, is with number of days
The ordinate of scale value constructs coordinate system based on each fisrt feature data, so that it is corresponding to obtain each fisrt feature data
First one-dimensional temporal aspect matrix.
Likewise, being respectively scale value or minute as the abscissa of scale value using hour, using number of days as the vertical seat of scale value
Mark constructs coordinate system based on each second feature data, to obtain the corresponding second one-dimensional timing of each second feature data
Eigenmatrix.
It should be noted that the selection of the scale value for ordinate, can also enliven feelings according to business own user
Condition and the quantity of user are determined.
Such as: the range of coordinate is determined according to the frequency habit of user's operation under operation scenario, if under operation scenario
User's operation is seldom, at this point, just the period is divided longer.Such as 2 hours, one scale, thus it can make data not
As for too sparse.If user's operation is frequent under operation scenario, the period can be finely divided, such as 10 minutes one
A scale.
Need further exist for explanation, the scale value of abscissa and ordinate, according to the data volume size under different scenes
The scale value of ordinate, as data volume reaches 10,000,000,000 grades, can be set as one month or so, the scale value of abscissa is set as by adjustment
Half an hour.
During implementing step S201, account to be detected each fisrt feature number within a preset period of time is established
According to corresponding first one-dimensional temporal aspect matrix and account to be detected, each second feature data are corresponding within a preset period of time
The second one-dimensional temporal aspect matrix.Complete corresponding first list of each fisrt feature data in dynamic behaviour characteristic
Tie up the foundation of temporal aspect matrix.And when completing corresponding second one-dimensional of each second feature data in static nature data
The foundation of sequence characteristics matrix.
Such as: in dynamic behaviour characteristic login times and register to establish a corresponding timing respectively special
Levy matrix.To the account to be detected in static nature data using user good friend quantity present in time, account to be detected,
The message and number etc. of posting that user is sent using the account to be detected equally establish a corresponding temporal aspect square respectively respectively
Battle array.
It should be noted that specifically establish how many a temporal aspect matrixes depend on obtain fisrt feature data quantity and
The quantity of second feature data.
Step S203: according to the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix, multi-dimensional time sequence is generated
Characteristic spectrum.
During implementing step S203, step S202 will be executed and each of obtain the first one-dimensional temporal aspect square
Battle array and the second one-dimensional temporal aspect matrix are combined, and the multi-dimensional time sequence characteristic spectrum of the corresponding account to be detected can be generated.
It should be noted that each corresponding multi-dimensional time sequence characteristic spectrum of account to be detected.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that extract to be detected in preset time period
The foundation characteristic data of account, the foundation characteristic data based on account to be detected generate in preset time period and correspond to account to be detected
Number multi-dimensional time sequence characteristic spectrum, by multi-dimensional time sequence characteristic spectrum input presupposition analysis model analyze, obtain abnormal account.
It solves the problems, such as that the artificial extraction feature of existing use carries out time-consuming caused by account abnormality detection and accuracy is low, improves
Detect the abnormal accuracy of account and the extraction efficiency of account foundation characteristic data to be detected.
Based on account method for detecting abnormality disclosed in embodiments of the present invention Fig. 2, step S202 shown in Figure 2:
Establishing account to be detected, the corresponding first one-dimensional temporal aspect matrix of each fisrt feature data is specifically real within a preset period of time
Existing process, as shown in figure 3, specifically including that
Step S301: according to the data volume of each fisrt feature data of acquisition, the first coordinate range is determined.
It is as secondary in logged in for the data volume of each fisrt feature data of acquisition during implementing step S301
Number logs in scene and operation scenario etc., can choose the ordinate in using number of days as first coordinate according to these data volumes
Scale value, it is final to determine the first coordinate range as the abscissa scale value in the first coordinate, to establish coordinate system constantly.
It should be noted that determined according to the data volume for obtaining each fisrt feature data the first coordinate abscissa and
The scale value of ordinate, data volume is different, and the abscissa of the first coordinate and the scale value of ordinate are also different, therefore the first coordinate
Range is also different.
Step S302: the first list that each fisrt feature data are corresponded in preset time period is established in the first coordinate range
Tie up temporal aspect matrix.
During implementing step S302, using each fisrt feature data of the account to be detected as radix,
Execute constructed by the transverse and longitudinal coordinate that step S301 is determined the of corresponding each fisrt feature data of building in the first coordinate range
One one-dimensional temporal aspect matrix.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that extract to be detected in preset time period
The foundation characteristic data of account, the foundation characteristic data based on account to be detected generate in preset time period and correspond to account to be detected
Number multi-dimensional time sequence characteristic spectrum, by multi-dimensional time sequence characteristic spectrum input presupposition analysis model analyze, obtain abnormal account.
It solves the problems, such as that the artificial extraction feature of existing use carries out time-consuming caused by account abnormality detection and accuracy is low, improves
Detect the abnormal accuracy of account and the extraction efficiency of account foundation characteristic data to be detected.
Based on account method for detecting abnormality disclosed in embodiments of the present invention Fig. 2, step S202 shown in Figure 2: build
The specific implementation process of the corresponding second one-dimensional temporal aspect matrix of each second feature data, such as Fig. 4 in vertical preset time period
It is shown, it specifically includes that
Step S401: according to the data volume of each second feature data of acquisition, the second coordinate range is determined.
During implementing step S401, for the data volume of each second feature data of acquisition, such as account
Grade, using the age of user of the account, the gender of user and business number etc., can equally be selected according to these data volumes
The ordinate scale value in using number of days as first coordinate is selected, as the abscissa scale value in the first coordinate, to build constantly
Vertical coordinate system, it is final to determine the second coordinate range.
It should be noted that the determination for the second coordinate range, is according to the data for obtaining each second feature data
It measures to determine the abscissa of the second coordinate and the scale value of ordinate, data volume is different, the abscissa and ordinate of the second coordinate
Scale value it is also different, therefore the second coordinate range is also different.
Step S402: the second list that each second feature data are corresponded in preset time period is established in the second coordinate range
Tie up temporal aspect matrix.
During implementing step S402, is established in the second coordinate range in preset time period and correspond to each
Second one-dimensional temporal aspect matrix of two characteristics.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that in the preset time period of foundation
Second one-dimensional temporal aspect matrix of each second feature data provides guarantee to obtain multi-dimensional time sequence eigenmatrix.
Based on account method for detecting abnormality disclosed in embodiments of the present invention Fig. 2, step S203 shown in Figure 2: root
According to the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix, the specific implementation of multi-dimensional time sequence characteristic spectrum is generated
Journey, as shown in figure 5, specifically including that
Step S501: normalizing is carried out to the data in the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix
Change processing.
During implementing step S501, to the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect square
Data in battle array are normalized.It is real using simply and effectively (a+x)/(b+x) function is calculated in embodiments of the present invention
The normalized of existing data.
It should be noted that for realizing the number in the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix
According to the method being normalized, including but not limited to (a+x)/(b+x) function, specifically, sigmod function also can be used
The normalized of data is realized with tanh function.
Step S502: the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect square after combination normalized
Battle array generates multi-dimensional time sequence characteristic spectrum.
During implementing step S502, the first one-dimensional timing after the processing of step S501 data normalization will be executed
Eigenmatrix and the second one-dimensional temporal aspect matrix are combined, and the multi-dimensional time sequence feature of the corresponding account to be detected can be generated
Map.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that extract to be detected in preset time period
The foundation characteristic data of account, the foundation characteristic data based on account to be detected generate in preset time period and correspond to account to be detected
Number multi-dimensional time sequence characteristic spectrum, by multi-dimensional time sequence characteristic spectrum input presupposition analysis model analyze, obtain abnormal account.
It solves the problems, such as that the artificial extraction feature of existing use carries out time-consuming caused by account abnormality detection and accuracy is low, improves
Detect the abnormal accuracy of account and the extraction efficiency of account foundation characteristic data to be detected.
As shown in fig. 6, disclosing a kind of based on convolutional neural networks building presupposition analysis model progress malice account detection
Logical flow chart.
S601: by log in/basic datas such as account attribute/business operation behavior/social data carry out arrangement collection,
And after data are interfered in removal, numeric data is converted by obtained basic data, using the numeric data as basic characteristic
According to.
It in S601, optionally, can arrange in the default time limit, such as all kinds of basic datas of the user in 1 month.
S602: basic modeling is carried out according to foundation characteristic data.
In S602, basis modeling is mainly according to foundation characteristic data creation multidimensional graph model.It should be noted that
The multidimensional graph model of creation is the multi-dimensional time sequence characteristic spectrum in the embodiment of the present invention.
S603: the multi-dimensional time sequence characteristic spectrum is exported into analysis model and carries out malice analysis processing.
S604: delineation malice account is abnormal account.
Based on account method for detecting abnormality disclosed in the embodiments of the present invention, Fig. 7 is provided in an embodiment of the present invention one
The logic chart of account abnormality detection of the kind based on convolutional neural networks.Specific implementation process are as follows:
Firstly, the foundation characteristic data based on account to be detected, generate in preset time period and correspond to the more of account to be detected
Tie up temporal aspect map 701.It include multiple one-dimensional temporal aspect squares in multi-dimensional time sequence characteristic spectrum 701.
Then, which is input in presupposition analysis model 702.The presupposition analysis model 702
Multi-dimensional time sequence characteristic spectrum 701 is analyzed, available exception account 703, while determined in addition to abnormal account 703
Normal account 704.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that by to be checked in preset time period
The foundation characteristic data for surveying account extract, and are then based on the foundation characteristic data of these accounts to be detected, generate to be detected
The multi-dimensional time sequence characteristic spectrum of account, by the multi-dimensional time sequence characteristic spectrum of the account to be detected be input in presupposition analysis model into
Row analysis, finally obtains abnormal account.It solves existing using consumption caused by artificial extraction feature progress account abnormality detection
When and the low problem of accuracy, improve the extraction effect of the accuracy and account foundation characteristic data to be detected that detect abnormal account
Rate.
It is corresponding with a kind of account method for detecting abnormality that the embodiments of the present invention provide, as shown in figure 8, the present invention is real
It applies example and a kind of structural schematic diagram of account abnormal detector is also provided, specifically include that extraction module 80, map generation module 81
With analysis module 82.
Extraction module 80, for extracting the foundation characteristic data of account to be detected in preset time period, foundation characteristic data
In include at least dynamic behaviour characteristic.Optionally, extraction module 80 using big data platform extract preset time period in
Detect the foundation characteristic data of account.
Map generation module 81 generates corresponding in preset time period for the foundation characteristic data based on account to be detected
The multi-dimensional time sequence characteristic spectrum of account to be detected.
Analysis module 82 obtains abnormal account for analyzing multi-dimensional time sequence characteristic spectrum input presupposition analysis model
Number, presupposition analysis model is determined by the supervision sample training multidimensional convolution neural network of abnormal account.
The account method for detecting abnormality according to disclosed in the embodiments of the present invention is it is found that by to be checked in preset time period
The foundation characteristic data for surveying account extract, and are then based on the foundation characteristic data of these accounts to be detected, generate to be detected
The multi-dimensional time sequence characteristic spectrum of account, by the multi-dimensional time sequence characteristic spectrum of the account to be detected be input in presupposition analysis model into
Row analysis, finally obtains abnormal account.It solves existing using consumption caused by artificial extraction feature progress account abnormality detection
When and the low problem of accuracy, improve the extraction effect of the accuracy and account foundation characteristic data to be detected that detect abnormal account
Rate.
A kind of alternative construction of map generation module 81 includes acquiring unit, one-dimensional map in apparatus of the present invention embodiment
Establish unit and multidimensional map generation unit.
Obtaining unit, each fisrt feature data and static state in the dynamic behaviour characteristic for obtaining account to be detected
Each second feature data in characteristic, each fisrt feature data correspond to different behavior classifications, each second feature data
Corresponding different account static information.
One-dimensional map establishes unit, for establishing account to be detected each fisrt feature data within a preset period of time
Corresponding first one-dimensional temporal aspect map and account to be detected each second feature data corresponding within a preset period of time
Two one-dimensional temporal aspect maps.
It includes: first to determine that subelement, first establish subelement, second determine that son is single that specific one-dimensional map, which establishes unit,
Member and second establishes subelement.
First determines subelement, for the data volume according to each fisrt feature data of acquisition, determines the first coordinate model
It encloses.
First establishes subelement, and each fisrt feature number is corresponded in preset time period for establishing in the first coordinate range
According to the first one-dimensional temporal aspect matrix.
Second determines subelement, for the data volume according to each second feature data of acquisition, determines the second coordinate model
It encloses.
Second establishes subelement, and each second feature number is corresponded in preset time period for establishing in the second coordinate range
According to the second one-dimensional temporal aspect matrix.
Multidimensional map generation unit is used for according to the first one-dimensional temporal aspect map and the second one-dimensional temporal aspect map,
Generate multi-dimensional time sequence characteristic spectrum.
Specific multidimensional map generation unit includes: normalization subelement and combination subelement.
Subelement is normalized, for the data in the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix
It is normalized.
Subelement is combined, it is special for combining the first one-dimensional temporal aspect matrix after normalized and the second one-dimensional timing
Matrix is levied, multi-dimensional time sequence characteristic spectrum is generated.
A kind of alternative construction of analysis module 82 includes computing unit and determination unit in apparatus of the present invention embodiment.
Computing unit extracts multi-dimensional time sequence characteristic spectrum for multi-dimensional time sequence characteristic spectrum to be inputted presupposition analysis model
In characteristic carry out feature calculation, obtain characteristic probability value.
Determination unit determines multi-dimensional time sequence characteristic spectrum pair if being in abnormal probit range for characteristic probability value
The account to be detected answered is abnormal account.
Preferably, the embodiment of the invention also provides a kind of terminals, as shown in figure 9, showing offer of the embodiment of the present invention
A kind of terminal structural block diagram, which includes: processor 91 and memory 92.
Processor 91, for executing the program stored in memory 92.
Memory 92, for storing program, which is at least used for: extracting the basis of account to be detected in preset time period
Characteristic includes at least dynamic behaviour characteristic in foundation characteristic data；Foundation characteristic data based on account to be detected,
Generate the multi-dimensional time sequence characteristic spectrum that account to be detected is corresponded in preset time period；By default point of the input of multi-dimensional time sequence characteristic spectrum
Analysis model is analyzed, and abnormal account is obtained, and presupposition analysis model is neural by the supervision sample training multidimensional convolution of abnormal account
Network determines.
On the other hand, the embodiment of the present invention also provides a kind of storage medium, and it is executable that computer is stored in storage medium
Instruction, when computer executable instructions are loaded and executed by processor, for realizing described in any one embodiment as above
Account method for detecting abnormality.
In conclusion the embodiment of the present invention provides a kind of account method for detecting abnormality, device, terminal and storage medium, it should
Method are as follows: extracted by the foundation characteristic data to account to be detected in preset time period, it is to be detected to be then based on these
The foundation characteristic data of account generate the multi-dimensional time sequence characteristic spectrum of account to be detected, by the multi-dimensional time sequence of the account to be detected
Characteristic spectrum is input in presupposition analysis model and is analyzed, and finally obtains abnormal account.It solves existing using artificial extraction
Feature carries out time-consuming caused by account abnormality detection and the low problem of accuracy, improve detect the accuracy of abnormal account with
The extraction efficiency of account foundation characteristic data to be detected.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system or
For system embodiment, since it is substantially similar to the method embodiment, so describing fairly simple, related place is referring to method
The part of embodiment illustrates.System and system embodiment described above is only schematical, wherein the conduct
The unit of separate part description may or may not be physically separated, component shown as a unit can be or
Person may not be physical unit, it can and it is in one place, or may be distributed over multiple network units.It can root
According to actual need that some or all of the modules therein is selected to achieve the purpose of the solution of this embodiment.Ordinary skill
Personnel can understand and implement without creative efforts.
Professional further appreciates that, unit described in conjunction with the examples disclosed in the embodiments of the present disclosure
And algorithm steps, can be realized with electronic hardware, computer software, or a combination of the two, in order to clearly demonstrate hardware and
The interchangeability of software generally describes each exemplary composition and step according to function in the above description.These
Function is implemented in hardware or software actually, the specific application and design constraint depending on technical solution.Profession
Technical staff can use different methods to achieve the described function each specific application, but this realization is not answered
Think beyond scope of the present application.
The foregoing description of the disclosed embodiments makes professional and technical personnel in the field can be realized or use the application.
Various modifications to these embodiments will be readily apparent to those skilled in the art, as defined herein
General Principle can be realized in other embodiments without departing from the spirit or scope of the application.Therefore, the application
It is not intended to be limited to the embodiments shown herein, and is to fit to and the principles and novel features disclosed herein phase one
The widest scope of cause.
Claims (10)
1. a kind of account method for detecting abnormality, which is characterized in that the described method includes:
The foundation characteristic data of account to be detected in preset time period are extracted, include at least dynamic row in the foundation characteristic data
It is characterized data；
Based on the foundation characteristic data of the account to be detected, generates and correspond to the account to be detected in the preset time period
Multi-dimensional time sequence characteristic spectrum；
Multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, abnormal account, the presupposition analysis are obtained
Model is obtained by the supervision sample training multidimensional convolution neural network of abnormal account.
2. the method according to claim 1, wherein if in the foundation characteristic data including dynamic behaviour feature
Data and static nature data, the foundation characteristic data based on the account to be detected, generate in the preset time period
The multi-dimensional time sequence characteristic spectrum of the corresponding account to be detected, comprising:
Obtain each fisrt feature data and the static nature in the dynamic behaviour characteristic of the account to be detected
Each second feature data in data, each fisrt feature data correspond to different behavior classifications, each second feature
Data correspond to different account static informations；
When establishing corresponding first one-dimensional of the account to be detected each fisrt feature data in the preset time period
Sequence characteristics matrix and the account to be detected each second feature data in the preset time period are corresponding second single
Tie up temporal aspect matrix；
According to the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix, multi-dimensional time sequence characteristic pattern is generated
Spectrum.
3. according to the method described in claim 2, it is characterized in that, described establish the account to be detected in the preset time
The corresponding first one-dimensional temporal aspect matrix of each fisrt feature data in section, comprising:
According to the data volume of each fisrt feature data of acquisition, the first coordinate range is determined；
The first list that each fisrt feature data are corresponded in the preset time period is established in first coordinate range
Tie up temporal aspect matrix.
4. according to the method described in claim 2, it is characterized in that, described establish described each second in the preset time period
The corresponding second one-dimensional temporal aspect matrix of characteristic, comprising:
According to the data volume of each second feature data of acquisition, the second coordinate range is determined；
The second list that each second feature data are corresponded in the preset time period is established in second coordinate range
Tie up temporal aspect matrix.
5. according to the method described in claim 2, it is characterized in that, described according to the first one-dimensional temporal aspect matrix and institute
The second one-dimensional temporal aspect matrix is stated, multi-dimensional time sequence characteristic spectrum is generated, comprising:
Place is normalized to the data in the first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix
Reason；
The first one-dimensional temporal aspect matrix and the second one-dimensional temporal aspect matrix after combining normalized generate multi-dimensional time sequence
Characteristic spectrum.
6. method according to any one of claims 1-5, which is characterized in that described by the multi-dimensional time sequence characteristic spectrum
Input presupposition analysis model is analyzed, and abnormal account is obtained, comprising:
The multi-dimensional time sequence characteristic spectrum is inputted into presupposition analysis model, extracts the characteristic in the multi-dimensional time sequence characteristic spectrum
According to feature calculation is carried out, characteristic probability value is obtained；
If the characteristic probability value is in abnormal probit range, determine that the multi-dimensional time sequence characteristic spectrum is corresponding to be detected
Account is abnormal account.
7. a kind of account abnormal detector, which is characterized in that described device includes:
Extraction module, for extracting the foundation characteristic data of account to be detected in preset time period, in the foundation characteristic data
Including at least dynamic behaviour characteristic；
Map generation module, for the foundation characteristic data based on the account to be detected, it is right in the preset time period to generate
Answer the multi-dimensional time sequence characteristic spectrum of the account to be detected；
Analysis module is analyzed for the multi-dimensional time sequence characteristic spectrum to be inputted presupposition analysis model, obtains abnormal account,
The presupposition analysis model is obtained by the supervision sample training multidimensional convolution neural network of abnormal account.
8. device according to claim 7, which is characterized in that the map generation module, comprising:
Obtaining unit, in the dynamic behaviour characteristic for obtaining the account to be detected each fisrt feature data and
Each second feature data in static nature data, each fisrt feature data correspond to different behavior classifications, described each
Second feature data correspond to different account static informations；
One-dimensional map establishes unit, for establishing the account to be detected each fisrt feature in the preset time period
The corresponding first one-dimensional temporal aspect map of data and the account to be detected are described each second in the preset time period
The corresponding second one-dimensional temporal aspect map of characteristic；
Multidimensional map generation unit, for according to the first one-dimensional temporal aspect map and the second one-dimensional temporal aspect figure
Spectrum generates multi-dimensional time sequence characteristic spectrum.
9. a kind of terminal characterized by comprising
Processor and memory；
Wherein, the processor is for executing the program stored in the memory；
For storing program, described program is at least used for the memory:
The foundation characteristic data of account to be detected in preset time period are extracted, include at least dynamic row in the foundation characteristic data
It is characterized data；
Based on the foundation characteristic data of the account to be detected, generates and correspond to the account to be detected in the preset time period
Multi-dimensional time sequence characteristic spectrum；
Multi-dimensional time sequence characteristic spectrum input presupposition analysis model is analyzed, abnormal account, the presupposition analysis are obtained
Model is determined by the supervision sample training multidimensional convolution neural network of abnormal account.
10. a kind of storage medium, which is characterized in that be stored with computer executable instructions, the calculating in the storage medium
When machine executable instruction is loaded and executed by processor, as above account abnormality detection as claimed in any one of claims 1 to 6 is realized
Method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910726917.2A CN110336838B (en) | 2019-08-07 | 2019-08-07 | Account abnormity detection method, device, terminal and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910726917.2A CN110336838B (en) | 2019-08-07 | 2019-08-07 | Account abnormity detection method, device, terminal and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110336838A true CN110336838A (en) | 2019-10-15 |
| CN110336838B CN110336838B (en) | 2022-07-08 |
Family
ID=68148869
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910726917.2A Active CN110336838B (en) | 2019-08-07 | 2019-08-07 | Account abnormity detection method, device, terminal and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110336838B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111107107A (en) * | 2019-12-31 | 2020-05-05 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131314A (en) * | 2019-12-31 | 2020-05-08 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131322A (en) * | 2019-12-31 | 2020-05-08 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN113420148A (en) * | 2021-06-22 | 2021-09-21 | 中国平安人寿保险股份有限公司 | Training text acquisition method, system and equipment for sensitive content quality inspection model |
| CN113434566A (en) * | 2021-05-18 | 2021-09-24 | 广东中发星通技术有限公司 | Method and system for extracting abnormal shape features in one-dimensional time sequence detection data |
| CN113569879A (en) * | 2020-04-28 | 2021-10-29 | 中国移动通信集团浙江有限公司 | Training method of abnormal recognition model, abnormal account recognition method and related device |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015043491A1 (en) * | 2013-09-30 | 2015-04-02 | 腾讯科技（深圳）有限公司 | Method and system for performing security verification on login of internet account |
| US20160012465A1 (en) * | 2014-02-08 | 2016-01-14 | Jeffrey A. Sharp | System and method for distributing, receiving, and using funds or credits and apparatus thereof |
| CN106372938A (en) * | 2015-07-21 | 2017-02-01 | 华为技术有限公司 | Abnormal account identification method and system |
| CN106685996A (en) * | 2017-02-23 | 2017-05-17 | 上海万雍科技股份有限公司 | Method for detecting account abnormal logging based on HMM model |
| WO2017114290A1 (en) * | 2015-12-31 | 2017-07-06 | 武汉安天信息技术有限责任公司 | Method and system for detecting sample relevance, electronic device and storage medium |
| CN109558951A (en) * | 2018-11-23 | 2019-04-02 | 北京知道创宇信息技术有限公司 | A kind of fraud account detection method, device and its storage medium |
| CN109818942A (en) * | 2019-01-07 | 2019-05-28 | 微梦创科网络科技（中国）有限公司 | A kind of user account number method for detecting abnormality and device based on temporal aspect |
| US20190222592A1 (en) * | 2016-06-01 | 2019-07-18 | Nippon Telegraph And Telephone Corporation | Detection device, detection method, detection system, and detection program |
-
2019
- 2019-08-07 CN CN201910726917.2A patent/CN110336838B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015043491A1 (en) * | 2013-09-30 | 2015-04-02 | 腾讯科技（深圳）有限公司 | Method and system for performing security verification on login of internet account |
| US20160012465A1 (en) * | 2014-02-08 | 2016-01-14 | Jeffrey A. Sharp | System and method for distributing, receiving, and using funds or credits and apparatus thereof |
| CN106372938A (en) * | 2015-07-21 | 2017-02-01 | 华为技术有限公司 | Abnormal account identification method and system |
| WO2017114290A1 (en) * | 2015-12-31 | 2017-07-06 | 武汉安天信息技术有限责任公司 | Method and system for detecting sample relevance, electronic device and storage medium |
| US20190222592A1 (en) * | 2016-06-01 | 2019-07-18 | Nippon Telegraph And Telephone Corporation | Detection device, detection method, detection system, and detection program |
| CN106685996A (en) * | 2017-02-23 | 2017-05-17 | 上海万雍科技股份有限公司 | Method for detecting account abnormal logging based on HMM model |
| CN109558951A (en) * | 2018-11-23 | 2019-04-02 | 北京知道创宇信息技术有限公司 | A kind of fraud account detection method, device and its storage medium |
| CN109818942A (en) * | 2019-01-07 | 2019-05-28 | 微梦创科网络科技（中国）有限公司 | A kind of user account number method for detecting abnormality and device based on temporal aspect |
Non-Patent Citations (1)
| Title |
|---|
| 李映壮: "一种隐私数据主动防御的研究", 《科技创新导报》 * |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111107107A (en) * | 2019-12-31 | 2020-05-05 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131314A (en) * | 2019-12-31 | 2020-05-08 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131322A (en) * | 2019-12-31 | 2020-05-08 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111107107B (en) * | 2019-12-31 | 2022-03-29 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131314B (en) * | 2019-12-31 | 2022-04-12 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN111131322B (en) * | 2019-12-31 | 2022-04-15 | 奇安信科技集团股份有限公司 | Network behavior detection method and device, computer equipment and storage medium |
| CN113569879A (en) * | 2020-04-28 | 2021-10-29 | 中国移动通信集团浙江有限公司 | Training method of abnormal recognition model, abnormal account recognition method and related device |
| CN113569879B (en) * | 2020-04-28 | 2024-03-19 | 中国移动通信集团浙江有限公司 | Training method of abnormal recognition model, abnormal account recognition method and related device |
| CN113434566A (en) * | 2021-05-18 | 2021-09-24 | 广东中发星通技术有限公司 | Method and system for extracting abnormal shape features in one-dimensional time sequence detection data |
| CN113420148A (en) * | 2021-06-22 | 2021-09-21 | 中国平安人寿保险股份有限公司 | Training text acquisition method, system and equipment for sensitive content quality inspection model |
| CN113420148B (en) * | 2021-06-22 | 2024-02-09 | 中国平安人寿保险股份有限公司 | Training text acquisition method, system and equipment for sensitive content quality inspection model |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110336838B (en) | 2022-07-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110336838A (en) | Account method for detecting abnormality, device, terminal and storage medium | |
| Fortin et al. | On the role of spatial stochastic models in understanding landscape indices in ecology | |
| CN110147732A (en) | Refer to vein identification method, device, computer equipment and storage medium | |
| Conley et al. | A genetic approach to detecting clusters in point data sets | |
| CN106228554B (en) | Fuzzy coarse central coal dust image partition method based on many attribute reductions | |
| Li et al. | Assembly processes of waterbird communities across subsidence wetlands in China: A functional and phylogenetic approach | |
| CN109104688A (en) | Wireless network access point model is generated using aggregation technique | |
| CN106803039B (en) | A kind of homologous determination method and device of malicious file | |
| CN109116312A (en) | Radar signal classification method based on QMFB and convolutional neural networks | |
| Raimbault et al. | Space matters: Extending sensitivity analysis to initial spatial conditions in geosimulation models | |
| CN110334264A (en) | A kind of community detection method and device for isomery dynamic information network | |
| CN107870988A (en) | A kind of information verification method, terminal device and storage medium | |
| CN109598931B (en) | Group division and difference analysis method and system based on traffic safety risk | |
| CN107480702A (en) | Towards the feature selecting and Feature fusion of the identification of HCC pathological images | |
| CN109324960A (en) | Automatic test approach and terminal device based on big data analysis | |
| CN112800115B (en) | Data processing method and data processing device | |
| CN112990330A (en) | User energy abnormal data detection method and device | |
| CN117556369B (en) | Power theft detection method and system for dynamically generated residual error graph convolution neural network | |
| CN115033591A (en) | Intelligent detection method and system for electricity charge data abnormity, storage medium and computer equipment | |
| CN110472659A (en) | Data processing method, device, computer readable storage medium and computer equipment | |
| Petersen | Data mining for network intrusion detection: A comparison of data mining algorithms and an analysis of relevant features for detecting cyber-attacks | |
| Li et al. | Decomposing multiple β‐diversity reveals non‐random assembly of the waterbird communities across anthropogenic subsidence wetlands | |
| Yin et al. | A feature selection method for improved clonal algorithm towards intrusion detection | |
| CN111091194B (en) | Operation system identification method based on CAVWBB _ KL algorithm | |
| CN114495137B (en) | Bill abnormity detection model generation method and bill abnormity detection method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |