CN110390542B

CN110390542B - Method and device for detecting media display platform and storage medium

Info

Publication number: CN110390542B
Application number: CN201810347878.0A
Authority: CN
Inventors: 胡一伟; 陈韶宇; 郭晓; 臧霖; 郭睿睿; 刘蒙蒙
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2018-04-18
Filing date: 2018-04-18
Publication date: 2023-08-11
Anticipated expiration: 2038-04-18
Also published as: CN110390542A

Abstract

The application discloses a detection method of media display platforms, each media display platform is used for displaying promotion information of one or more applications, and the detection method comprises the following steps: for an application, acquiring one or more media display platforms for displaying popularization information of the application; acquiring operation data related to the application of each media display platform in the one or more media display platforms, wherein the operation data comprises release data of popularization information of the application displayed by the media display platform and log data of the application operated by the popularization information displayed by the media display platform; and determining suspicious media display platforms in the one or more media display platforms according to the operation data of each media display platform in the one or more media display platforms. The application also provides a corresponding device and a storage medium.

Description

Method and device for detecting media display platform and storage medium

Technical Field

The present application relates to the field of internet technologies, and in particular, to a method and apparatus for detecting a media display platform, and a storage medium.

Background

At present, with the continuous development of the internet and intelligent terminals, more and more internet companies are pushing various application clients (including APP clients and web page clients) for users, and the popularization of the application clients needs to acquire users by means of external network platforms and channels (i.e., media display platforms). The revenue and separation of these platforms and channels is often determined by new users brought about by the channels, the retention of users, the payment of users, etc., which results in many of the channels charging the internet companies with excess fees by way of the amount of the brush, increasing the operating costs of the internet companies.

For example, when games (or other apps) are marketed, it is necessary to promote through different channels (media presentation platforms) to introduce more users. But channels are introduced into users that may intentionally or unintentionally contain malicious users. Here, a malicious user refers to a robot, a studio operating multiple accounts, or a natural person for the purpose of registration profit. The brush amount mode of the malicious user comprises the following steps: automatic brushing, namely automatically running a game through mobile phone or computer software, executing game tasks and the like; the manual brushing amount is that a plurality of mobile phones are operated by one person to simulate the game of a normal user, and the manual brushing amount is common in a working room; the method also comprises the step of exciting the brushing amount, namely, issuing a task through a network, enabling a real user to register a game, and enabling the user to obtain physical rewards such as RMB after registering.

Technical content

An embodiment of the present application provides a method for detecting media display platforms, applied to a detection server, where each media display platform is configured to display promotion information of one or more applications, including:

for an application, acquiring one or more media display platforms for displaying popularization information of the application;

acquiring operation data related to the application of each media display platform in the one or more media display platforms, wherein the operation data comprises release data of popularization information of the application displayed by the media display platform and log data of the application operated by the popularization information displayed by the media display platform;

And determining suspicious media display platforms in the one or more media display platforms according to the operation data of each media display platform in the one or more media display platforms.

The embodiment of the application also provides a detection device of the media display platform, which is applied to the detection server, wherein each media display platform is used for displaying promotion information of one or more applications and comprises the following components:

the acquisition unit is used for acquiring one or more media display platforms for displaying popularization information of an application aiming at the application; acquiring operation data related to the application of each media display platform in the one or more media display platforms, wherein the operation data comprises release data of popularization information of the application displayed by the media display platform and log data of the application operated by the popularization information displayed by the media display platform;

and the determining unit is used for determining suspicious media display platforms in the one or more media display platforms according to the operation data of each media display platform in the one or more media display platforms.

The present application also provides a computer-readable storage medium having stored thereon computer-readable instructions for causing at least one processor to perform a method as described above.

By adopting the scheme provided by the application, the determined suspicious media display platform is more accurate.

Drawings

In order to more clearly illustrate the embodiments of the application or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are only some embodiments of the application, and that other drawings can be obtained according to these drawings without inventive faculty for a person skilled in the art.

FIG. 1 is a system architecture diagram in accordance with an example of the present application;

FIG. 2 is a flow chart of a method for detecting a media display platform according to the present application;

FIG. 3 is a schematic diagram of an example delivery data structure according to the present application;

FIG. 4 is a schematic diagram of a log data structure according to an embodiment of the present application;

FIG. 5 is a schematic diagram of log data of an example media content presentation platform of the present application;

FIG. 6 is a flow diagram of an example suspicious channel handling according to the present application;

FIG. 7 is a schematic diagram of an example of the present application for analyzing source data of suspicious channels;

FIG. 8 is a detailed flow diagram of an exemplary media display platform detection of the present application;

FIG. 9 is a schematic diagram of a detection device of an exemplary media display platform according to the present application; and

FIG. 10 is a schematic diagram of a computing device composition in an embodiment of the application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

In some examples, the discrimination of channel cheating is made using behavior data of the user prior to registration. For example, whether the channel is cheated is judged by whether the exposure distribution of the popularization information of the application client is normal, whether the situation that no exposure has clicking occurs, whether the exposure clicking rate of the user is normal, and the like. In other examples, whether the channel is cheating may also be determined by the internal behavior data of the user after registering the application client. For example, whether the channel is cheating is assessed by the long-term retention of the new user of the channel, or payment, etc. For example, a channel may be judged malicious with an average payment that is very low after 7 days, with very low retention.

In the above example, the data used for analyzing the malicious channels is single, so that the accuracy of detecting the malicious channels is low. For example, experienced cheating channels may be deliberately logged in or self-recharging in time to meet retention requirements in malicious channel detection, where they are not detected. In addition, some channels have some normal users, while deliberately doping some false users, as well as "doping into wine". At this time, the payment and retention of the channel have small differences from the normal channel, and the channel cannot be detected in channel detection. In addition, through retention and payment only lag analysis, the problem of time lag exists, and whether the channel is suspicious can be judged after 2 weeks usually, and at the moment, the important popularization period of application is over, and part of popularization cost is generated.

In order to solve the above technical problems, the present application provides a method, an apparatus and a storage medium for detecting a media display platform, and a system architecture diagram related to the present application is shown in fig. 1, where the system architecture includes terminal devices 101a-101n, a delivery server 102, a media server 103, an application server 104, a social server 105, a delivery database 106, an account relationship database 107, a log database 108, a social database 109, a channel database 111 and a detection server 110. The terminal devices 101a-101n are connected with the delivery server 102, the media server 103, the application server 104 and the social server 105 through the Internet. The delivery server 102 may be a server for delivering content, or may be a detection server of a third party, for collecting and monitoring delivery data of delivering content. The media server 103 may be a server in the internet capable of providing various media content presentations to users, such as: portal servers, online video servers, news servers, email servers, e-commerce platform servers (servers of platforms such as jindong, nakeda, amazon, etc.), and the like. A corresponding media client 1001 is provided in the terminal device. The application server 104 provides corresponding application services to the promoted applications, and the terminal device is correspondingly provided with an application client 1002. For example, when the promoted application is a game application, the application server 104 is a game server, the client 1002 is a game client, and when the promoted application is a video application, the application server 104 is a video server, and the client 1002 is a video client. The social server 105 may be a server in the internet that can provide social services to users, such as: social application servers (e.g., microblogs, micro-letters, instant messaging servers, etc.), email servers, social networking platform servers (e.g., blogs, BBS servers, etc.).

The media client 1001 in the terminal device requests media data from the media server 103 and displays the requested media data on the media client 1001, and displays corresponding media content on the media client 1001. And when the media client displays the media content, the media client simultaneously displays popularization information of one or more applications. The promotion information may be a download link of an installation package of the corresponding application, or may be a link of a registration web page of the application. The promotion information may be integrated in the media data by the media server 103, and sent to the media client 1001 by the media server 103 for display, or when the media client 1001 requests the media server 103 for the media data, the media client 1001 sends a push request to the delivery server 102, and the delivery server 102 sends the promotion information of the application corresponding to the requested media data to the media client 1001 for display.

When the terminal device displays the popularization information of the application, a user at the terminal device downloads an installation package of the application or displays a webpage of the application by operating the popularization information of the application, for example, clicking the popularization information. When the terminal device displays the popularization information of the application, or when a user at the terminal device operates the popularization information of the application, the terminal device sends the release data of the popularization information of the application to the release server, and the release server stores the release data of the application in the release database 106. And the terminal equipment can install the APP of the application on the terminal equipment according to the installation package, register, log in and run the application through the APP, or register, log in and run the application through a webpage page of the application. When a user registers, logs in and runs the application through the application APP or the webpage application client, log data of the application is stored in the log database 108 of the application server 104. The log database 108 stores log data of each application account, where the log data of each application account also carries an IP and an IMEI (International Mobile Equipment Identity ) of a terminal device where an application client is located, and also carries an identifier of a media party from which the application client is derived, that is, an identifier of a media party (media display platform) displaying popularization information of an application, where the identifier of the media party may be an identifier of a media server associated with the media client 1001 and the media server 103.

When a user opens an application or runs an application through the application client 1002, device data of a terminal device where the application client 1002 is located may also be sent to the application server, which also stores the device data in the log database. The device data may include an identification of the device, such as IMEI (International Mobile Equipment Identity), device IP, whether the device is jail-broken, whether the device uses a simulator, whether a key puck is used, etc.

When a user registers an application through the application client 1002, the user is required to perform account authentication for the application account registered by the user, and in the authentication process, the application client 1002 sends a corresponding relationship between the application account and the social account of the user to the application server 104, and the application server 104 stores the application relationship between the application account and the social account in the account relationship database 107. In another implementation, the user may log into the application directly using the social account, in which case the application account is the user's social account. The terminal device is also provided with a social client 1003, and the user reports social data operated by the social client to the social server 105, and the social data is stored in the social database 109 by the social server 105.

The detection server 110 is configured to detect whether a media display platform (also called a media party or a channel) for popularization and application has a cheating situation. The media display platform displays popularization information of the application. For an application, the channel database 111 stores the mapping relation between the application and the media display platform displaying the popularization information of the application, the detection server 110 obtains one or more media display platforms displaying the popularization information of the application from the channel database 111, and the application data of the popularization information of the application displayed by each media display platform is obtained from the application database 106 according to the identification of each media display platform and the identification of the application. The detection server 110 further obtains log data corresponding to each media display platform from the log database according to the identifier of each media display platform, compares each dimension in the put data and the log data of each media display platform with the corresponding dimension in the large disk (the data set formed by the put data and the log data of each media display platform), when the deviation between one dimension and the dimension in the large disk is large, the dimension is suspicious, and when one dimension in the put data and the log data of the media display platform is suspicious, the media display platform is also determined to be suspicious. In other implementations, the log data includes log data corresponding to each application account, and the social account corresponding to each application account may be obtained according to a corresponding relationship between the application account and the social account in the account relationship database 107, and social data of each media display platform (channel) may be obtained by sending each social account to the social database 109, and the social data may be added to the analysis data. Aiming at each media display platform for popularization and application, the data of the terminal equipment where the application is running through the media display platform can be obtained in the log database, and the data of the terminal equipment is also added into the analysis data. Whether the cheating condition exists on the comprehensive data sharing media display platform or not is used, and the analysis accuracy is higher.

The application provides a detection method of media display platforms, which is applied to a detection server, wherein each media display platform is used for displaying promotion information of one or more applications, as shown in fig. 2, and the method comprises the following steps:

s201: for an application, one or more media display platforms displaying promotional information for the application are obtained.

In this example, each test is for an application, testing which channels are cheating in the media presentation platform (channel) that promoted the application. As described above, the channel database 111 stores therein the application and the mapping relation of the media presentation platform for presenting the promotion information of the application. One or more media presentation platforms for presenting promotional information for an application may be determined based on the identification of the application and the mapping in the channel database. The media presentation platform is also referred to herein as a channel. The media display platform can be a media party such as microblog, weChat, news and the like.

S202: and acquiring operation data related to the application of each media display platform in the one or more media display platforms, wherein the operation data comprises release data of popularization information of the application displayed by the media display platform and log data of the application operated by the popularization information displayed by the media display platform.

The delivery database 106 stores delivery data of the popularization information of the plurality of applications displayed by the plurality of media display platforms, and the delivery data comprises an identification of the application and an identification of the media display platform displaying the popularization information of the application. The detection server 110 obtains, in the delivery database 106, delivery data of the popularization information of the application displayed by each media display platform according to the identification of the application and the identification of each media display platform according to the one or more media display platforms obtained in step S201. For example, for the application a, the delivery data corresponding to one media display platform 1 for popularizing the application is shown in fig. 3, where the number of media display platforms for popularizing the application a may be one or multiple. The dimension 1-dimension n may include: exposure distribution, no exposure clicks, continuous clicks, exposure click rate, click registration rate, etc.

The method comprises the steps that popularization information displayed through a media display platform is used for running an application, an installation package of a popularization information downloading application displayed through the media display platform is included, an application APP is installed on terminal equipment according to the installation package, and the application is registered and run through the application APP; the method also comprises the step of operating the popularization information displayed by the media display platform, and the step of running the application, for example, the step of operating a registration page or a login page of the popularization information display application. The application client 1002 on the terminal device reports the log data of the application running on the terminal device to the application server 104, where the log data includes one or more pieces of log data, and each piece of log data includes an application account number of the user registration application, an identifier of the terminal device where the application is located, an identifier of a source of the application (i.e., an identifier of a media display platform displaying popularization information of the application), and one or more pieces of dimension data. The format of one piece of log data in the log database is shown in fig. 4, wherein the dimensions 1-n may include: login time, online time length, grade, retention and the like. For example, when the application is a game, the dimensions include a registration platform (a platform corresponding to an account number of the login game, for example, when a micro signal is used as the login account number of the game, the registration platform is a micro signal platform, and when a QQ number is used as the login account number of the game, the registration platform is a QQ platform), a retention, a payment, an online time period, a class, a occupation, a terminal device IP where the game is located, and in addition, the dimensions of creating a character, a role name, equipment, skills, a fight, a score, money, an item, a transaction, a movement, a switching map, a speaking, a team, a party, a friend, an operation frequency, an online time, a payment, a suspicious process of injecting the game, a suspicious on-hook script, and the like may be included. The detection server 110 obtains one or more pieces of log data as shown in fig. 4 according to the identity of the media display platform for any one of the one or more media display platforms. For example, for a media presentation platform m, log data of the media presentation platform m is obtained as shown in fig. 5.

S203: and determining suspicious media display platforms in the one or more media display platforms according to the operation data of each media display platform in the one or more media display platforms.

In this example, whether the media display platform has a cheating condition or not is detected according to the put data and the log data of each media display platform, that is, whether the media display platform has a brushing amount condition is detected. Each media display platform corresponds to respective operation data, and the operation data comprises the delivery data and log data of the corresponding media display platform. The running data of each media presentation platform constitutes the running data of the application (also referred to as large disc data), which includes the running data of each media presentation platform.

Comparing the operation data of each media display platform with the large-disc data (namely, the operation data of the application), and determining that one media display platform is suspicious when the deviation between the operation data of the media display platform and the large-disc data is large. The large disc data is formed by combining the operation data of all the media display platforms, wherein the large disc data and the operation data of all the media display platforms comprise one or more dimensions, and the number of the included dimensions is the same. When comparing the operation data of the media display platform with the large disk data, each dimension in the operation data of the media display platform can be respectively compared with the corresponding dimension in the large disk data. The running data can be obtained in real time, for example, the online time length can be obtained every day, so that suspicious channels (i.e. suspicious media display platforms) can be detected every day in the time period of application and popularization, and the problem of time delay of malicious channel detection is avoided.

By adopting the method for detecting the media display platform, the suspicious media display platform is determined by the application promotion information delivery data delivered by the media display platform for promotion and application and the log data of the media display platform running application. By having more data dimensions, the accuracy of identifying suspicious media presentation platforms is higher.

In some examples, in performing the determining suspicious ones of the one or more media presentation platforms based on the operational data for each of the one or more media presentation platforms, comprising the steps of:

determining the operation data of the application according to the operation data of each media display platform;

and determining whether the media display platform is suspicious according to the running data of the media display platform and the running data of the application aiming at one media display platform in the one or more media display platforms.

In this example, it is determined whether the media presentation platform is suspicious by comparing the operational data of the media presentation platform to the large disk data. When the parameters are compared, the dimension in the operation data of the media display platform and the parameters of the corresponding dimension in the large disk data can be compared, when the parameter deviation is large, the dimension is suspicious, and when the dimension of the media display platform comprises a suspicious dimension, the media display platform is determined to be suspicious. And meanwhile, the number threshold of the suspicious dimensions can also be determined, and when the number of the suspicious dimensions included in the operation data of the media display platform exceeds the number threshold, the suspicious media display platform is determined.

In one or more media presentation platforms (in one or more media) that promote an application, after the suspicious media presentation platform is determined, the suspicious media presentation platform (channel) is sent to a data marketing system, which is used to present the suspicious channel (media). Thus, popularization personnel of the application can conveniently perform corresponding operations according to the displayed suspicious channels, for example, release of popularization information of the application on the suspicious channels is stopped, or release of the suspicious channels is not settled or corresponding punishment is performed on the suspicious channels. In one example, the process of suspicious channels by the application's popularization personnel may employ the following procedure, as shown in fig. 6, including the following steps:

s601, determining suspicious media for popularizing an application by adopting the detection method of the media display platform. When the media is not suspicious, step S606 is executed, and if not, step S602 is executed.

S602: the media is notified of a message that determines that the media is suspicious.

S603: it is determined whether the media is complaint.

S604: when media complaints, the data fed back by the media are combined for investigation. The media feedback data comprise the delivery data of the popularization information of the media delivery application and corresponding log data, and the investigation is carried out according to the delivery data and the log data.

S605: when the media is checked to have no cheating condition according to the data fed back by the media, step S606 is executed to perform normal settlement on the cost of the media.

S606: when the media is not complained, checking the number of violations of the media, wherein aiming at a plurality of channels popularized and applied, each day, detecting the cheating channel in the plurality of channels, and adding 1 to the number of violations after the channel is detected to be cheated. The number of violations when one channel extends multiple applications can be accumulated.

S607: the fee with the media party is settled based on the number of violations and it is determined whether to suspend collaboration based on the number of violations.

In some examples, the running data includes one or more dimensions, and the determining whether the media display platform is suspicious according to the running data of the media display platform and the running data of the application includes the steps of:

Determining a first parameter of each dimension in the running data of the media display platform and a second parameter in the running data of the application;

when the suspicious dimension exists in each dimension according to the first parameter and the second parameter of each dimension, the suspicious media display platform is determined.

When determining whether the media display platform is suspicious according to the operation data of one media display platform and the large disc data (the operation data of an application), analyzing each dimension in the operation data of the media display platform respectively. And determining whether the media display platform is suspicious according to the first parameter and the second parameter of each dimension. When the deviation between the first parameter and the second parameter is larger, one dimension is suspicious, and when one dimension exists in the operation data of one media display platform, the media display platform is determined to be suspicious. When the deviation of the first parameter and the second parameter is determined, a deviation threshold value can be preset, and when the deviation exceeds the deviation threshold value, the dimension is determined to be suspicious. The first parameter and the second parameter can be input into a verification model corresponding to the dimension, and whether the corresponding dimension is suspicious or not can be output by the model. For example, for a game application, three parameters including warrior, mr, shooter are included in the professional dimension in the big disk data, the corresponding ratios are 33%, 41%, 26%, respectively, and in channel a, the ratios of the three parameters are: 97%,% 1, 2%, the professional dimension of channel A is greatly different from the large disc data, thus determining channel A as a suspicious channel.

In some examples, the log data for each media presentation platform includes one or more application accounts registering the application and log data for each application account;

the detection method of the media display platform provided by the application further comprises the following steps:

s11: and acquiring the mapping relation between the application account number and the social account number reported when registering the application.

The account relation database in fig. 1 stores the mapping relation between the application account and the social account. The mapping relationship can be an application account reported in the authentication process and a corresponding social account when the terminal equipment registers the application account as a user. In some examples, the social account may also be used as an account for logging into an application, in which case the application account and the social account are the same account.

S12: and determining social account numbers corresponding to the one or more application account numbers respectively according to the one or more application account numbers in the log data of one media display platform and the mapping relation.

As shown in fig. 5, the obtained log data of one media display platform includes log data corresponding to a plurality of application accounts. And determining social account numbers corresponding to the application account numbers according to the application account numbers 1-n in one media display platform and the mapping relation obtained in the step S11.

S13: and acquiring social data corresponding to each social account according to the social account corresponding to each of the one or more application accounts.

Social data corresponding to the social account number is stored in the social database in fig. 1. And according to each social account number acquired in the step S12, acquiring social data corresponding to each social account number in a social database. Also included in the social data are one or more dimensions, which may include: the registration date, the activity degree of the account, the number of friends, the age and the like, and the social account can also comprise data of playing other games, using other applications and the like of a user corresponding to the application account.

S14: and adding the social data corresponding to each social account to the operation data of the corresponding media display platform.

And further merging the acquired social data into the existing operation data according to the mapping relation between the social account number and the application account number, and merging the acquired social data into the operation data of the application in the same way. In this example, social data associated with the log data is also added to the running data, the running data has more dimensions, so that the media display platform is analyzed in a more comprehensive dimension, when one dimension of the one dimension data is suspicious, the media display platform is determined to be suspicious, the determined accuracy of the suspicious media display platform is higher, and the possibility that the suspicious media display platform is missed is prevented.

In some examples, the method for detecting a media display platform provided by the application further comprises the following steps:

s21: and aiming at each media display platform in the one or more media display platforms, acquiring the equipment data of the terminal equipment where the application is located, wherein the equipment data is reported when the application is operated by the popularization information displayed by the media display platform.

As shown in fig. 5, the obtained log data of one media display platform m includes identifiers of terminal devices corresponding to each application account. When the user runs the application on the terminal equipment and reports the log data, the equipment data of the terminal equipment where the application is located is also reported to the application server. The device data of each terminal device is acquired according to the terminal devices 1-n in fig. 5. The device data includes one or more dimensions therein, which may include: device model, device fingerprint, network card address, IMEI, whether the device is root/jail broken, whether simulator, ip address, wiFi, geographic location (e.g., GPS), etc.

S22: and adding the equipment data corresponding to each media display platform into the corresponding operation data.

And merging the equipment data into the operation data of the corresponding media display platform according to the identification of the equipment, and merging the equipment data into the operation data of the application in the same way. In this example, the device data associated with the log data is also added to the operational data, the dimensions of the operational data are more, and the determined suspicious media presentation platform is more accurate.

As shown in fig. 7, the data for analyzing whether the media display platform is suspicious includes log data of an application, social data related to the application, data of a terminal device where the application is located, and release data related to the application (release data of popularization information of the application). The operation data and the large disk data of the media display platform can be formed according to any two of the above data, or the operation data and the large disk data of the media display platform can be formed according to any three or four of the above data.

In a specific example, when the promoted application is a game, the media presentation platform is analyzed using the log data of the game, the social data related to the game, and the device data related to the game, the log data of the game includes dimensions: occupation, online duration; the device data includes dimensions: whether or not to use a simulator, the social data includes dimensions: whether the recent QQ speech is active. The obtained log data of the game and the large disc data after the equipment data are combined are shown in table 1, wherein the large disc data comprise running data of each channel (media display platform).

TABLE 1

In this example, according to each account in table 1, social data corresponding to each account is obtained, where the obtained social data is shown in table 2 (in this example, the application account and the social account are the same account):

Account number	Whether or not the recent QQ speech is active
		67912	Whether or not
121254	Whether or not
		310555	Whether or not
705933	Whether or not
		409570	Whether or not
948346	Is that
		678944	Is that
738634	Whether or not
		118179	Is that
742616	Is that
		...	...

TABLE 2

The social data in table 2 are combined into table 1 according to the application account numbers to form final large disc data (running data of the application), as shown in table 3:

TABLE 3 Table 3

A second parameter in the large disk data for each dimension is calculated, for example, for the dimension: for occupation, parameters of three parameters of fighter, shooter and teacher in occupation dimension are determined according to the large disc data shown in table 3, and the obtained second parameters are shown in table 4: in the above data, the "professional" variable is a discrete variable that may take the values of "fighter", "teacher", "shooter". The distribution of occupation data (i.e., all channels put together without distinction) selected by the new user on the day is counted.

TABLE 4 Table 4

Calculating first parameters of three parameters in the occupational dimension in each channel, wherein the calculated first parameters are shown in table 5:

channel	New user occupational distribution (fighter: mr: shooter)
		Channel A	97％:1％:2％
Channel B	32％:40％:28％
		Channel C	33％:38％:29％
...	...

TABLE 5

Inputting the first parameters of occupations of each channel and the second parameters in the large disc into a chi-square verification model, for example, for channel a, the occupational distribution vector x= (0.97,0.01,0.02) corresponding to channel a, the occupational distribution vector p= (0.33,0.41,0.26) in the large disc data, and the parameter n=sum (x) =1.0; vector e=n×p=p= (0.33,0.41,0.26), result of chi-square check chisq=sum ((x-E) ² and/E), obtaining the chi-square verification result of the channel A as 1.852994. The chi-square verification results for each channel are obtained in the same manner as shown in table 6. The chi-square threshold can be preset, when the chi-square value of a channel exceeds the chi-square threshold, the channel is considered to have obvious difference from a large disc, the probability of random occurrence is extremely low, and the probability of random occurrence is very likely to be the result of manual control. For example, channel a distribution is significantly different from a large disc.

TABLE 6

For the online time dimension in table 3, the parameters in the "online time" dimension are continuous variables, the average value of the online time in the statistical large disk data is 3.2 hours, and the standard deviation is 2.8 hours. The mean standard deviation of the online time length in each channel is counted, and the structure is shown in table 7:

channel	On-line time length average value	Standard deviation of on-line time length
			Channel A	0.5	0.1
Channel B	4.1	3.8
			Channel C	3.5	4.2
...	...	...

TABLE 7

Presetting a verification condition of mean variance, wherein the condition comprises the following steps:

a) The online time is too low (the online is performed only by registering and logging, and the average value of the online time is smaller than 1/3 of the large disc), and the suspicion of obvious registration expense is realized.

b) The time length is too long (such as 12 hours online, etc., and is greater than the average value of 3 times of online time length of the large disk), and the method is obvious in that the online time length is on-hook in batches to obtain the behavior of the gold stamping studio of the resources in the game, and is an abnormal player.

c) The standard deviation of the duration is too small (< 1/3 of the standard deviation of the large disc), i.e. the on-line duration of a group of people is very consistent, obviously controlled by the same program.

The average value and variance of the online time length of each channel are input into a mean value and variance verification model, and the verification result output by the mean value and variance verification model is shown in table 8:

channel	On-line time length average value	Standard deviation of on-line time length	Whether or not to be suspicious
				Channel A	0.5	0.1	Is that
Channel B	4.1	3.8	Whether or not
				Channel C	3.5	4.2	Whether or not
...	...	...	...

TABLE 8

The parameters in the dimension "use simulator" and the dimension "whether the recent QQ speech is active" in table 3 belong to boolean variables, and the values are yes/no. For the dimension of the boolean variables, only the "whether simulator is used" is taken as an example for explanation, and the analysis of whether the QQ speech is active recently is similar. The proportion of simulators used in the large disc data is 3%, the proportion of simulators used in each channel is counted, and the calculated results are shown in table 9:

channel	Using simulator ratio
		Channel A	95％
Channel B	2％
		Channel C	4％
...	...

TABLE 9

Channel	Using simulator ratio	Whether or not to be suspicious
			Channel A	95％	Is that
Channel B	2％	Whether or not
			Channel C	4％	Whether or not
...	...	...

Table 10

When detecting malicious channels according to occupation, online time and whether using a simulator, the obtained detection results are shown in table 11, and when one channel is suspicious in a plurality of dimensions corresponding to the channel, the channel is determined to be suspicious.

TABLE 11

In some examples, the detection server stores a verification model corresponding to each dimension, the verification model being used to determine whether the corresponding dimension is suspicious;

the determining that the media display platform is suspicious when the suspicious dimension exists in the dimensions according to the first parameter and the second parameter of the dimensions comprises:

and inputting the first parameters and the second parameters of each dimension into corresponding verification models, and determining that the media display platform is suspicious when the results output by the verification models comprise suspicious dimensions.

When each dimension is verified, different verification models are adopted for different dimensions. For example, in the above example, for the dimensions of discrete variables, a chi-square check model is employed, for the dimensions of continuous variables, a mean variance check model is employed, and for the dimensions of boolean variables, a ratio check model is employed.

In some examples, when the variable in one dimension is a discrete variable, the verification model corresponding to the dimension is a chi-square verification model, the first parameter includes a proportion of the variable in the dimension that appears in the running data of the corresponding media presentation platform, and the second parameter includes a proportion of the variable in the dimension that appears in the running data of the application; when the variable in one dimension is a continuous variable, the verification model corresponding to the dimension is a mean variance verification model, the first parameter comprises a mean value and a standard deviation of the variable in the dimension in the running data of the corresponding media display platform, and the second parameter comprises a mean value and a standard deviation of the variable in the dimension in the running data of the application; when the variable in one dimension is a boolean variable, the verification model corresponding to the dimension is a rate verification model, the first parameter includes a rate at which the variable in the dimension appears in the running data of the corresponding media presentation platform, and the second parameter includes a rate at which the variable in the dimension appears in the running data of the application.

In addition, other models may be employed to analyze whether dimensions are suspicious. For example, machine learning models such as logistic regression, decision trees, neural networks and the like can be adopted to learn the parameters of the existing normal channels and the parameters of the cheating channels to obtain detection models, and then all dimensions of the channels are analyzed according to the obtained detection models.

In some examples, when the media presentation platform is determined to be suspicious when the suspicious dimensions are determined to exist in the dimensions according to the first parameter and the second parameter of the dimensions, the method comprises the steps of:

and determining that the media display platform is suspicious when the difference between the first parameter and the second parameter of one or more dimensions meets a preset condition.

In this example, a difference threshold between the first parameter and the second parameter may be preset, and when a difference between the first parameter of a dimension and the second parameter in the big disc data exceeds the difference threshold, the dimension is determined to be suspicious, and the first test data includes a channel of the suspicious dimension to be suspicious.

In some examples, the log data of each media presentation platform includes one or more application accounts for registering the application, and a terminal device IP corresponding to each application account;

For one or more of the one or more media presentation platforms that are determined to be non-suspicious, the method further comprises:

for each media display platform in the one or more media display platforms, determining the number of application accounts corresponding to each terminal device IP according to one or more application accounts in the log data of the media display platform and the terminal device IP corresponding to each application account;

and determining the number of terminal equipment IP meeting the preset condition as target terminal equipment IP.

For a channel (media display platform) for popularizing an application, application accounts which are theoretically registered or run the application through the channel can be scattered everywhere, and physical aggregation does not exist. In this example, the channel users are grouped by physical attribute, if a large number of users appear on a certain device of a certain channel and the distribution difference from a large disk is large, the device of the channel is judged to have cheating condition.

In this example, further analysis is performed on the channel determined to be normal by the example shown above, and it is detected whether there is a partial cheating in the normal channel. In this example, the groups are divided by "channel+ip", and the "partial cheating" situation in the channel is identified in finer granularity, that is, the cheating IP in the normal channel and the application account corresponding to the IP are identified. As shown in table 12 below, channel B is normal overall, but this channel aggregates many application accounts at a certain ip, and this portion of application accounts can be found to be cheating after analysis according to the flow of this example. By the example, the cheating IP and the corresponding application account number in the overall normal channel can be detected.

"channel+IP" dividing group	Whether or not to be suspicious	Application account
			Channel A_114.94.13.55	Is that	79
Channel A_1.57.76.97	Is that	48
			Channel A_112.247.133.40	Is that	19
Channel B_171.91.2.10	Whether or not	10
			Channel B_140.240.26.192	Is that	37
Channel B_49.87.252.254	Whether or not	3
			Channel C_14.131.101.94	Whether or not	5
Channel C_27.27.252.207	Whether or not	2
			...	...	...

Table 12

The detailed flowchart of one specific example of the detection method of the media display platform provided by the application is shown in fig. 8, and mainly comprises the following steps:

s801: and reading data, wherein in the process of reading the data, the data are mainly read from a delivery database, a log database, a social database, an account relation database and a channel database.

S802: and merging data, wherein in the process of merging data, for a plurality of media display platforms (also called channels) for popularizing an application, the running data of each media display platform and the running data (also called large disk data) of the application are formed.

S803: the running data and the large disc data of the media display platform comprise one or more dimensions, and when parameters in one dimension are discrete variables, the steps S803a-S803c are executed.

S803a: a second parameter of the discrete variable in the large disk is calculated.

S803b: a first parameter of a discrete variable in a channel is calculated.

S803c: and determining whether one dimension in the media display platform is suspicious according to the first parameter and the second parameter.

S804: when one dimension is a continuous variable, steps S804a-S804c are performed.

S804a: a second parameter of the continuous variable in the large disc is calculated.

S804b: a first parameter of a continuous variable in a channel is calculated.

S804c: determining whether the dimension in the channel is suspicious according to the first parameter and the second parameter.

S805: when one dimension is a boolean variable, steps S805a-S805c are performed.

S805a: a second parameter of the boolean variable in the large disk is calculated.

S805b: a first parameter of a boolean variable in a channel is calculated.

S805c: determining whether the dimension in the channel is suspicious according to the first parameter and the second parameter.

S806: and merging results, wherein the merged results comprise data whether each dimension in each channel is suspicious or not.

S807: and outputting a channel detection structure. When suspicious dimensions exist in a plurality of dimensions of the operation data corresponding to the channel, determining that the channel is suspicious, and outputting the suspicious channel.

The application also provides a detection device 900 of media display platforms, which is applied to a detection server, wherein each media display platform is used for displaying promotion information of one or more applications, as shown in fig. 9, and the device comprises:

An obtaining unit 901, configured to obtain, for an application, one or more media display platforms that display popularization information of the application; acquiring operation data related to the application of each media display platform in the one or more media display platforms, wherein the operation data comprises release data of popularization information of the application displayed by the media display platform and log data of the application operated by the popularization information displayed by the media display platform;

a determining unit 902, configured to determine a suspicious media display platform in the one or more media display platforms according to the operation data of each media display platform in the one or more media display platforms.

In some examples, the determining unit 902 is further configured to determine the running data of the application according to the running data of each media presentation platform; and determining whether the media display platform is suspicious according to the running data of the media display platform and the running data of the application aiming at one media display platform in the one or more media display platforms.

In some examples, where the operation data includes one or more dimensions, the determining unit 902 is further configured to:

In some examples, the log data for each media presentation platform includes one or more application accounts registered for the application and log data for each application account; the obtaining unit 901 is further configured to: acquiring a mapping relation between an application account number and a social account number reported when registering the application; determining social account numbers corresponding to one or more application account numbers in log data of a media display platform according to the mapping relation and one or more application account numbers in the log data of the media display platform; acquiring social data corresponding to each social account according to the social account corresponding to each of the one or more application accounts; and adding the social data corresponding to each social account to the operation data of the corresponding media display platform.

In some examples, the acquisition unit 901 is also to:

aiming at each media display platform in the one or more media display platforms, acquiring equipment data of terminal equipment where the application is located, wherein the equipment data is reported when the application is operated by the popularization information displayed by the media display platform; and adding the equipment data corresponding to each media display platform into the corresponding operation data.

In some examples, the log data of each media presentation platform includes one or more application accounts for registering the application, and a terminal device IP corresponding to each application account; the apparatus further comprises a target device IP determination unit 903 to:

The application also provides a computer readable storage medium having stored thereon computer readable instructions for causing at least one processor to perform a method as described above.

Fig. 10 shows a block diagram of the components of a computing device in which the detection apparatus 900 of the media presentation platform is located. As shown in fig. 10, the computing device includes one or more processors (CPUs) 1002, a communication module 1004, a memory 1006, a user interface 1010, and a communication bus 1008 for interconnecting these components.

The processor 1002 may receive and transmit data via the communication module 1004 to enable network communication and/or local communication.

The user interface 1010 includes one or more output devices 1012, including one or more speakers and/or one or more visual displays. The user interface 1010 also includes one or more input devices 1014 including, for example, a keyboard, mouse, voice command input unit or microphone, touch screen display, touch sensitive tablet, gesture capture camera or other input buttons or controls, and the like.

Memory 1006 may be a high-speed random access memory such as DRAM, SRAM, DDR RAM, or other random access solid state memory devices; or non-volatile memory such as one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, or other non-volatile solid state storage devices.

The memory 1006 stores a set of instructions executable by the processor 1002, including:

an operating system 1016 including programs for handling various basic system services and for performing hardware-related tasks;

application 1018 includes some or all of the elements or modules of detection apparatus 900 of the media presentation platform. At least one unit in the detection device 900 of the media presentation platform may store machine executable instructions. The processor 1002 may be capable of performing the functions of at least one of the units or modules described above by executing machine-executable instructions in at least one of the units in the memory 1006.

It should be noted that not all the steps and modules in the above processes and the structure diagrams are necessary, and some steps or modules may be omitted according to actual needs. The execution sequence of the steps is not fixed and can be adjusted as required. The division of the modules is merely for convenience of description and the division of functions adopted in the embodiments, and in actual implementation, one module may be implemented by a plurality of modules, and functions of a plurality of modules may be implemented by the same module, and the modules may be located in the same device or different devices.

The hardware modules in the embodiments may be implemented in hardware or in hardware platforms plus software. The software includes machine readable instructions stored on a non-volatile storage medium. Accordingly, embodiments may also be embodied as a software product.

In various examples, the hardware may be implemented by dedicated hardware or hardware executing machine-readable instructions. For example, the hardware may be a specially designed permanent circuit or logic device (e.g., a special purpose processor such as an FPGA or ASIC) for performing certain operations. The hardware may also include programmable logic devices or circuits (e.g., including a general purpose processor or other programmable processor) temporarily configured by software for performing particular operations.

In addition, each instance of the present application can be realized by a data processing program executed by a data processing apparatus such as a computer. Obviously, the data processing program constitutes the application. In addition, a data processing program typically stored in one storage medium is executed by directly reading the program out of the storage medium or by installing or copying the program into a storage device (such as a hard disk and/or a memory) of the data processing apparatus. Thus, such a storage medium also constitutes the present application, and the present application also provides a nonvolatile storage medium in which a data processing program is stored, such a data processing program being usable to execute any one of the above-described method examples of the present application.

The machine-readable instructions corresponding to the modules of fig. 10 may cause an operating system or the like operating on a computer to perform some or all of the operations described herein. The non-volatile computer readable storage medium may be a memory provided in an expansion board inserted into the computer or a memory provided in an expansion unit connected to the computer. The CPU or the like mounted on the expansion board or the expansion unit can perform part and all of the actual operations according to the instructions.

The foregoing description of the preferred embodiments of the invention is not intended to be limiting, but rather to enable any modification, equivalent replacement, improvement or the like to be made within the spirit and principles of the invention.

Claims

1. The method for detecting the media display platforms is characterized by comprising the following steps of:

combining the operation data of each media display platform to form the operation data of the application; the operation data comprises one or more dimensions;

determining, for each of the one or more dimensions, a first parameter of the dimension in the running data of the media display platform and a second parameter of the dimension in the running data of the application for one of the one or more media display platforms;

Setting a verification model corresponding to each dimension, wherein the verification model is used for determining whether the corresponding dimension is suspicious; inputting the first parameter and the second parameter of each dimension into a corresponding verification model, and determining that the media display platform is suspicious when the result output by each verification model comprises suspicious dimensions;

the log data of each media display platform comprises one or more application account numbers of the application and log data of each application account number;

the method further comprises:

acquiring a mapping relation between an application account number and a social account number reported when registering the application;

determining social account numbers corresponding to one or more application account numbers in log data of a media display platform according to the mapping relation and one or more application account numbers in the log data of the media display platform;

acquiring social data corresponding to each social account according to the social account corresponding to each of the one or more application accounts; adding the social data corresponding to each social account to the operation data of the corresponding media display platform;

wherein, for each of the one or more media display platforms, the method further comprises: acquiring equipment data of terminal equipment where the application is when the popularization information displayed by the media display platform runs the application; and adding the equipment data corresponding to each media display platform into the corresponding operation data.

2. The method of claim 1, wherein when the variable in one dimension is a discrete variable, the check model corresponding to the dimension is a chi-square check model, the first parameter comprises a proportion of the variable in the dimension that appears in the operational data of the corresponding media presentation platform, and the second parameter comprises a proportion of the variable in the dimension that appears in the operational data of the application; when the variable in one dimension is a continuous variable, the verification model corresponding to the dimension is a mean variance verification model, the first parameter comprises a mean value and a standard deviation of the variable in the dimension in the running data of the corresponding media display platform, and the second parameter comprises a mean value and a standard deviation of the variable in the dimension in the running data of the application; when the variable in one dimension is a boolean variable, the verification model corresponding to the dimension is a rate verification model, the first parameter includes a rate at which the variable in the dimension appears in the running data of the corresponding media presentation platform, and the second parameter includes a rate at which the variable in the dimension appears in the running data of the application.

3. The method of claim 1, wherein the step of determining the position of the substrate comprises,

4. The method of claim 1, wherein the log data for each media presentation platform includes one or more application accounts for registering the application, and a terminal device IP for each application account;

5. The utility model provides a detection device of media display platform, is applied to the detection server, and each media display platform is used for showing the popularization information of one or more application, its characterized in that includes:

the determining unit is used for merging the operation data of each media display platform to form the operation data of the application; the operation data comprises one or more dimensions;

The log data of each media display platform comprises one or more application account numbers of the application and log data of each application account number; the acquisition unit is further configured to: acquiring a mapping relation between an application account number and a social account number reported when registering the application; determining social account numbers corresponding to one or more application account numbers in log data of a media display platform according to the mapping relation and one or more application account numbers in the log data of the media display platform; acquiring social data corresponding to each social account according to the social account corresponding to each of the one or more application accounts; adding the social data corresponding to each social account to the operation data of the corresponding media display platform;

the acquisition unit is further configured to: aiming at each media display platform in the one or more media display platforms, acquiring equipment data of terminal equipment where the application is located, wherein the equipment data is reported when the application is operated by the popularization information displayed by the media display platform; and adding the equipment data corresponding to each media display platform into the corresponding operation data.

6. The apparatus of claim 5, wherein the log data for each media presentation platform comprises one or more application accounts for registering the application, and a terminal device IP for each application account; the apparatus further comprises a target device IP determination unit configured to:

7. A computer readable storage medium storing computer readable instructions for causing at least one processor to perform the method of any one of claims 1-4.