CN112163932A

CN112163932A - Malicious seat occupying order identification method and device and electronic equipment

Info

Publication number: CN112163932A
Application number: CN202011059772.4A
Authority: CN
Inventors: 刘斌; 姚一; 周中雨; 李洋
Original assignee: China Travelsky Holding Co
Current assignee: China Travelsky Technology Co Ltd; China Travelsky Holding Co
Priority date: 2020-09-30
Filing date: 2020-09-30
Publication date: 2021-01-01

Abstract

The application discloses a malicious seat occupying order identification method and device and electronic equipment. The identification method comprises the following steps: when a ticket order is received, flight inquiry data of a next single person in a first time period before the current time is obtained, and order data of the ticket order is obtained; determining characteristic data according to flight query data and order data; inputting the characteristic data into a malicious behavior recognition model which is trained in advance to obtain the malicious seat occupation probability which is output after the malicious behavior recognition model processes the characteristic data; and if the malicious seat occupying probability is greater than a preset probability threshold value, determining that the ticket order is a malicious seat occupying order. According to the technical scheme, based on the characteristic values of multiple dimensions and the malicious behavior recognition model which completes training in advance, whether the ticket order is a malicious seat occupying order or not can be accurately recognized, so that an airline company can process the malicious seat occupying order, and the problem of malicious seat occupying is solved.

Description

Malicious seat occupying order identification method and device and electronic equipment

Technical Field

The application belongs to the technical field of data processing, and particularly relates to a malicious seat occupying order identification method and device and electronic equipment.

Background

With the development of economy and the improvement of living standard of people, an airplane has become one of basic transportation modes. The quickness of the air ticket reservation is an important factor influencing the civil aviation service quality. The current air ticket selling channel mainly comprises direct selling and distribution. The distribution is an agency system, and the airline companies sell the air tickets to passengers through agents; direct marketing is the sale of airline tickets directly to passengers through their own web sites. The ticket distribution model brings about a serious malicious seat occupation problem. The malicious seat occupation means: the user preempts the order in the air ticket sale system, but does not pay for the order. The seat of the flight is occupied due to malicious seat occupation, and the seat cannot be sold in a short time, so that the ticket buying experience of a normal user is reduced, and the occupied seat is not sold finally easily.

At present, aiming at the problem of malicious seat occupation, the adopted processing scheme mainly comprises the following steps: and adding a verification link before booking tickets. For example, the user needs to input a verification code before booking a ticket, or needs to perform cell phone verification. However, the ticket buying experience of a normal user is influenced, and a malicious user can complete mobile phone verification by using a false mobile phone number and a short message receiver through a machine identification verification code, so that the problem of malicious seat occupation cannot be solved well.

Therefore, how to alleviate the malicious seat occupation problem in the air ticket reservation process is an urgent problem to be solved by those skilled in the art.

Disclosure of Invention

In view of this, an object of the present application is to provide a method and an apparatus for identifying a malicious seat occupancy order, and an electronic device, which can accurately identify whether a ticketing order is a malicious seat occupancy order, so as to process the malicious seat occupancy order and alleviate the problem of malicious seat occupancy.

In order to achieve the above purpose, the present application provides the following technical solutions:

the application provides a method for identifying a malicious seat occupying order, which comprises the following steps:

when a ticket order is received, flight inquiry data of a next single person in a first time period before the current time is obtained, and order data of the ticket order is obtained;

determining feature data according to the flight query data and the order data, wherein the feature data comprises: a first characteristic value indicating that the ticket order is a number of times the placing person places the ticket in the first time period; a second characteristic value indicating a time when the next person last queried for the flight; a third characteristic value indicating a time interval between the time of placing the ticket order and the time of the last flight enquiry by the person placing the order; a fourth feature value indicating a time interval between a time of a last query flight by the next single person and a time of a previous query flight; a fifth characteristic value indicating a number of times the placing person inquires of a flight within a second time period before a placing time of the ticket order; a sixth feature value indicating a last query location contact level for the next person; a seventh characteristic value indicating that the next-person most recently queried flight is the number of queries within the first time period; an eighth characteristic value indicating whether the next person inquired about a flight in the ticket order within the first time period;

inputting the characteristic data into a malicious behavior recognition model which is trained in advance to obtain the malicious seat occupation probability which is output after the malicious behavior recognition model processes the characteristic data;

and if the malicious seat occupying probability is greater than a preset probability threshold value, determining that the ticket order is a malicious seat occupying order.

Therefore, the beneficial effects of the application are as follows:

according to the identification method of the malicious seat occupying order, when a ticket order is received, flight query data of an order placing person of the ticket order in a first time period before the order placing moment and order data of the ticket order are obtained, feature data are determined based on the flight query data and the order data, wherein the feature data comprise feature values of multiple dimensions, the feature data are input into a malicious behavior identification model which is trained in advance, the input feature data are processed by the malicious behavior identification model, the malicious seat occupying probability of the ticket order is output, and if the malicious seat occupying probability of the ticket order is larger than a preset probability threshold, the ticket order is determined to be the malicious seat occupying order. According to the identification method for the malicious seat occupying order, when a ticketing order is received, flight inquiry data of an order maker in a period of time before the order is placed and order data of the ticketing order are used as a basis, characteristic values of multiple dimensions are obtained from the flight inquiry data, and whether the ticketing order is the malicious seat occupying order can be accurately identified based on the characteristic values of the multiple dimensions and a malicious behavior identification model which is trained in advance, so that an airline company can process the malicious seat occupying order, and the problem of malicious seat occupying is solved.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a flowchart of a method for identifying a malicious seat occupancy order according to an embodiment of the present application;

fig. 2 is a flowchart of a method for training a malicious behavior recognition model according to another embodiment of the present application;

fig. 3 is a schematic structural diagram of an apparatus for identifying a malicious seat occupancy order according to another embodiment of the present disclosure;

fig. 4 is a schematic structural diagram of an electronic device according to another embodiment of the present application;

fig. 5 is a schematic diagram of flightlayering data provided in another embodiment of the present application;

fig. 6 is a schematic diagram of selseal data provided in another embodiment of the present application.

Detailed Description

The embodiment of the application provides a method and a device for identifying a malicious seat occupying order, which can accurately identify whether a ticketing order is a malicious seat occupying order, so that the malicious seat occupying order is processed, and the problem of malicious seat occupying is solved.

Technical terms appearing in the embodiments of the present application are explained below:

IBE: an e-commerce support platform;

flightlayering: inquiring flights;

selseal: flight booking;

etdz: booking seat invoicing;

kafka: a distributed message distribution system;

redis: a key-value type database;

xgboost: a machine learning algorithm;

SVM: a machine learning algorithm.

Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are for illustration purposes only and are not intended to limit the scope of the present application.

The term "include" and variations thereof as used herein are open-ended, i.e., "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description.

It should be noted that the terms "first", "second", and the like in the present application are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.

It is noted that references to "a", "an", and "the" modifications in this application are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that reference to "one or more" unless the context clearly dictates otherwise.

Referring to fig. 1, fig. 1 is a flowchart of a method for identifying a malicious seat occupancy order according to an embodiment of the present application. The execution subject of the method is an electronic device, such as a server or a server cluster. The identification method comprises the following steps:

s101: when a ticket order is received, flight inquiry data of a next single person in a first time period before the current time (namely the time of placing the ticket order, which can also be called the time of booking the ticket) is obtained, and order data of the ticket order is obtained.

Through a large amount of data statistical analysis, the following results are found: the booking behavior of a normal user and the inquiry flight behavior before booking are in great relation. The normal user usually inquires about the flight concerned, and when the proper flight is inquired, the operations of booking and drawing tickets are carried out. While a malicious user (such as a cattle) randomly inquires flights, or only carries out a large amount of inquiry on hot routes, the malicious user can book the flights of some sections for many times in the ticket booking stage. Compared with normal users, the malicious users are different in distribution from the query volume, the ticket booking volume, the departure arrival city pair of the query flight and the departure arrival city pair of the ticket booking flight.

Therefore, in the embodiment of the application, when a ticket order is received, the flight query data of the order placing person in a period of time before the order placing person places the order and the order data of the ticket order are used as the basis to determine whether the ticket order is a malicious seat occupying order.

In one possible implementation, the flight query data includes: the order taker inquires about the time of the flight, and the order taker inquires about the departure-arrival city pair for the flight. The order data includes: the time of the order of the ticket order, and the departure-arrival city pair of the flight in the ticket order.

In another possible implementation, the flight query data may further include: whether the next person correctly obtains the identification of the query result. The order data may also include: the departure time of the flight and the identification of whether the booking is successful in the ticket order.

S102: and determining characteristic data according to the flight query data and the order data.

Wherein the characteristic data includes:

the first characteristic value is used for indicating that the ticket order is the order placing of the order placing person for the second time within the first time period; a second characteristic value indicating the time when the next individual last queried the flight; a third characteristic value indicating a time interval between the time of placing the ticket order and the time when the person placing the order inquires the flight last time; a fourth feature value indicating a time interval between a time of a last flight query by a next single person and a time of a previous flight query; a fifth characteristic value indicating a number of times the placing person inquires of the flight within a second time period before a placing time of the ticket order; a sixth characteristic value for indicating a degree of coincidence of the last query location of the next single person; a seventh characteristic value indicating that the last flight query by the next person is the query of the second time period; an eighth characteristic value indicating whether the next person inquires about a flight in the ticket order within the first time period.

Here, the query location overlap ratio is explained: query site overlap refers to the degree to which city pairs in a ticket order for a single person match city pairs in previously queried flights. For example, if the city in the ticket order that the order sender places is Beijing, Shanghai, Chengdu, Guangzhou, and the city pair in the ticket order that the order sender places is Beijing and Shanghai, an overlap ratio value is calculated.

The respective characteristic values are explained here with reference to examples.

When a ticket order is received, flight inquiry data of an order placing person between the zero point of the day and the current time (namely the order placing time of the ticket order) is obtained, and order data of the ticket order is obtained.

That is, the first time period may be configured to: the time period from the time of day zero to the time of the ticket order placement.

Of course, the first period of time is not limited thereto. For example, the first time period may be configured to: hours (e.g., 2 hours) before the time of placing the ticket order.

The ticket order is determined to be the order made by the same person making the order the number of times today, and a first characteristic value is generated accordingly. And determining the time of the last flight inquiry of the order placing person of the ticket order, and generating a second characteristic value according to the time. And determining the time interval between the order placing time of the ticket order and the time when the order placing person inquires the flight last time, and generating a third characteristic value according to the time interval. And determining the time interval between the time of last inquiry flight and the time of last inquiry flight of the order maker of the ticket order, namely determining the time interval of last two inquiry flights of the order maker of the ticket order, and generating a fourth characteristic value according to the time interval. A fifth characteristic value is generated based on determining the number of times the person placing the ticket order inquires about flights within a second time period (e.g., 5 seconds) before placing the order. And determining the coincidence degree of the latest query place of the next single person, and generating a sixth characteristic value according to the coincidence degree. And determining the next single person last-time query flight as the today's second-time query, and generating a seventh characteristic value according to the determined flight number. It is determined whether the user inquires of flights in the ticket order today, and an eighth feature value is generated accordingly.

It can be seen that the above feature information includes feature values of multiple dimensions, so that whether the ticket booking behavior of the user is a malicious seat occupation behavior can be more comprehensively measured.

S103: and inputting the characteristic data into a malicious behavior recognition model which is trained in advance to obtain the malicious seat occupation probability which is output after the malicious behavior recognition model processes the characteristic data.

The malicious behavior recognition model is obtained through training of a large number of training samples, each training sample is generated based on one historical ticketing order, each training sample is provided with marking information, and the marking information indicates whether the historical ticketing order of the training sample is a malicious seat occupying order or not. The malicious behavior recognition model has the capability of enabling the prediction result of the ticket order to be close to the actual situation.

S104: and if the malicious seat occupying probability is greater than a preset probability threshold value, determining that the ticket order is a malicious seat occupying order.

And the malicious behavior recognition model processes the input characteristic data and outputs the malicious seat occupation probability. And if the malicious seat occupation probability is greater than a preset probability threshold, determining that the ticket order is a malicious order. The ticket order may then be marked as a malicious seat-occupying order, which is processed by the airline. The processing of the malicious seat occupancy order by the airline includes, but is not limited to, cancelling the ticketing order.

In one embodiment, obtaining flight query data for a next individual within a first time period prior to a current time, obtaining order data for a ticketing order, comprises:

acquiring full-channel data from a message distribution system; and analyzing the full-channel data to obtain flight query data of the single person in a first time period before the current time and order data of the ticket order.

The following is a detailed description:

an airline ticket sales system (e.g., IBE) sends full channel data generated during user query flight and booking to a message distribution system (e.g., kafka).

And after the full-channel data is acquired from the message distribution system, analyzing the flightposting data and the selseal data in the full-channel data. Specifically, the IP address of the user querying the flight, the time of the querying flight, and the takeoff-arrival city pair of the querying flight are analyzed from the flightshoping data, the time (which may be in seconds) between the time of the querying flight and the current zero point of the day is calculated, then the takeoff-arrival city pair of the querying flight and the time between the time of the querying flight and the current zero point of the day are stored in a dictionary, the IP address of the user and the date (such as a certain day of a month) of the flight query are used as keys, and the dictionary is used as a value and stored in a database (such as Redis). After sellseat data of a ticket order is obtained, an IP address of an order issuer of the ticket order, the occurrence time (namely, the order issuing time) of the ticket order, a takeoff-arrival city pair of a flight in the ticket order are analyzed, the IP address of a single person and the occurrence date (such as a certain day in a month) of the ticket order are used as keys, and a value corresponding to the key is searched in the data, so that flight query data is obtained.

The following describes a training process of the malicious behavior recognition model used in the embodiment of the present application.

Referring to fig. 2, fig. 2 is a flowchart of a training method for a malicious behavior recognition model according to another embodiment of the present application. The training method comprises the following steps:

s201: a plurality of training samples are obtained.

Wherein a training sample is generated based on a sample ticket order. Each training sample has marking information, and the marking information is used for indicating whether the sample ticket order is a malicious seat occupying order. Specifically, the sample ticketing order for drawing tickets is determined as a normal order, and the sample ticketing order for not drawing tickets is determined as a malicious seat occupying order.

It is understood that the training samples generated based on normal orders are positive samples and the training samples generated based on malicious occupancy orders are negative samples. That is, the plurality of training samples used for training the learning model include positive samples and negative samples, which enables the learning model to better learn the difference between a normal order and a malicious seat occupying order, thereby improving the accuracy of the prediction result.

Each training sample is characteristic data of a sample ticket order, and the characteristic data comprises the following components:

a first characteristic value indicating that the sample ticket order is a second order made by the order taker within a first time period (prior to the time of the order made by the sample ticket order); a second characteristic value indicating a time when an order taker of the sample ticket order last queried the flight; a third characteristic value indicating a time interval between the time of placing the sample ticket order and the time of last flight inquiry by the person placing the sample ticket order; a fourth characteristic value indicating a time interval between a time of a last query flight and a time of a previous query flight for an order issuer of the sample ticket order; a fifth characteristic value for indicating the number of times the order taker of the sample ticket order inquires for flights in a second time period prior to the order time of the sample ticket order; a sixth characteristic value for indicating a most recent query location overlap for the person placing the sample ticketing order; a seventh characteristic value for indicating that the person placing the sample ticket order has last queried the flight for the number of queries in the first time period; an eighth characteristic value indicating whether an order issuer of the sample ticket order inquires of flights in the sample ticket order within the first time period.

S202: and predicting the training sample by using a pre-constructed learning model to obtain a prediction result.

The prediction result is the malicious seat occupation probability of the training sample.

S203: and adjusting the learning model according to the prediction result and the labeling information until the adjusted learning model meets the preset convergence condition, and determining the learning model meeting the preset convergence condition as the malicious behavior recognition model.

Initial model parameters of the pre-constructed learning model are all self-defined values, and the process of training the learning model is a process of optimizing the model parameters so as to gradually converge the learning model and gradually improve the accuracy of the prediction result. And when the learning model meets the preset convergence condition, determining the current learning model as a malicious behavior recognition model.

In one embodiment, the preset convergence condition is: the recognition accuracy of the learning model reaches a preset value.

In another embodiment, the preset convergence condition is: the recognition accuracy of the learning model does not rise any more.

In one embodiment, the training samples are generated as follows:

1) and obtaining flight inquiry data of the order placing person of the sample ticket order in a first time period before the order placing time to obtain order data of the sample ticket order.

In one possible implementation, the flight query data includes: the time of flight was queried by the order issuer of the sample ticketing order, and the departure-arrival city pair of the flight was queried by the order issuer of the sample ticketing order. The order data includes: the time of the order placement of the sample ticket order, and the departure-arrival city pair of the flights in the sample ticket order.

In another possible implementation, the flight query data may further include: whether the person placing the sample ticket order correctly obtains the identification of the query result. The order data may also include: the departure time of the flight and the identification of whether the booking was successful in the sample ticket order.

2) And determining the characteristic data of the sample ticket order according to the flight query data of the order placing person of the sample ticket order in a first time period before the order placing time and the order data of the sample ticket order, and taking the characteristic data of the sample ticket order as a training sample.

Wherein the characteristic data of the sample ticket order is as described above.

3) And obtaining the ticket drawing information of the sample ticket order.

4) And marking the training sample according to the ticket drawing information of the sample ticket order.

For example, if the sample ticket order is drawn, the sample ticket order is determined to be a normal order, and the marking information is 1; and if the sample ticket order is not taken, determining that the sample ticket order is a malicious seat occupying order, wherein the marking information is 0.

In one embodiment, obtaining flight query data for an order issuer of a sample ticket order within a first time period prior to an order issue time, obtaining order data for the sample ticket order, comprises:

obtaining a production log;

analyzing the production log to obtain the full channel information of the order placing person of the sample ticket order;

analyzing the full channel information of the order placing person of the sample ticket order to obtain flight query data of the order placing person of the sample ticket order in a first time period before the order placing time and order data of the sample ticket order.

The user information acquisition component acquires operations of inquiring flights, browsing information, reserving seats and the like of a user on an airline website and other ticket purchasing APPs, and records an IP address of the user and data generated by the operations in a production log. In practice, the production log may be stored in a ticket sales system, such as an IBE.

In the process of training the learning model, obtaining a production log, analyzing the production log to obtain the full channel information of a person placing a sample ticket order, analyzing the full channel information of the person placing the sample ticket order, and obtaining flight query data of the person placing the sample ticket order in a first time period before the time of placing the sample ticket order and order data of the sample ticket order.

The following is a detailed description:

acquiring full channel data from the production log may be considered an offline mode as compared to acquiring full channel data through the message distribution system.

In addition to obtaining flight query data of an order placing person of a sample ticket order in a first time period before the order placing time and order data of the sample ticket order, obtaining ticketing information of the sample ticket order is also needed. For example: relevant data of the ticket drawing ETDZ is analyzed from the production log, ticket booking sellseat data and the ticket drawing ETDZ data are jointly obtained through the PNR number, and whether the ticket drawing operation is continued after each sample ticket order can be determined, wherein the positive example of the ticket drawing is the negative example, and the negative example is the negative example.

In the off-line mode, the data demand is at least more than one continuous week, and a certain number of positive and negative ticket-out cases are selected from the ticket-booking sellseat data and the ticket-out ETDZ data to form all ticket-booking data during the training model. The method comprises the steps that the query flightlayering data in the offline mode can be obtained all at once, so the query flightlayering data do not need to be stored in a database, and the query flightlayering data are stored into JSON format files according to the same format as the real-time prediction mode; when a user orders ticket data is taken out from the ticket ordering data set, all inquiry flight data of the user between the current time and the morning of the day are inquired, 8 characteristic values of each user when the user orders the ticket are comprehensively calculated by combining the ticket ordering data and the inquiry data, whether the current user orders the ticket or not is obtained from the ticket drawing ETDZ, and each piece of seat ordering data selected is subjected to accumulative circulation processing to obtain a characteristic value file of all seat ordering users. And (3) carrying out xgboost machine learning training on the characteristic value files to obtain a trained model, and optimizing parameters of the model according to a result after test data testing to finally obtain a satisfactory malicious behavior recognition model.

The scheme for generating training samples is described herein with reference to an example.

The flightshopping data is shown in FIG. 5, and the sellseat data is shown in FIG. 6. The flightshopping data shown in fig. 5 and the sellseat data shown in fig. 6 are processed and calculated to obtain characteristic data (including 8 characteristic values) of each ticket order in fig. 6.

Take the first ticket order in FIG. 6 as an example:

in conjunction with flightposting data shown in fig. 5, the ticket order is determined to be the number of times the person places the ticket in a first time period (e.g., the current day), the time of the person who places the ticket order has last queried the flight is determined, the time interval between the time of placing the ticket order and the time of the person who places the ticket order has last queried the flight is determined, the time interval between the time of the person who places the ticket order has last queried the flight and the time of the previous query flight is determined, the number of times the person who places the ticket order has queried the flight in a second time period (e.g., 5 seconds) before the time of placing the ticket order is determined, the number of times the person who places the ticket order has last queried the flight is determined, the degree of coincidence of the person who places the ticket order has last queried the flight in the first time period is determined, and whether the person who places the ticket order has queried the flight in the sample ticket order in the first time period is determined.

The 8 characteristic values of the first ticket order in fig. 6 are:

1,23,13,20,0,0.0769230769231,19,1。

because a supervised machine learning model is used, labeling needs to be performed for each sample data. The ETDZ data includes a record of whether each ticket order is finally drawn, the drawn ticket is recorded as 1, and the non-drawn ticket is recorded as 0. If the identification bit is placed at the end of 8 characteristic values of the ticket order, the characteristic data and the label information of the first ticket order in fig. 6 are:

1,23,13,20,0,0.0769230769231,19,1,1。

in some embodiments, the clients, servers may communicate using any currently known or future developed network Protocol, such as HTTP (HyperText Transfer Protocol), and may interconnect with any form or medium of digital data communication (e.g., a communications network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed network.

It should be understood that the various steps recited in the method embodiments of the present application may be performed in a different order and/or in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present application is not limited in this respect.

The embodiment of the application discloses a method for identifying a malicious seat occupying order, and correspondingly, the embodiment of the application also discloses a device for identifying the malicious seat occupying order.

Referring to fig. 3, fig. 3 is a schematic structural diagram of an apparatus for identifying a malicious seat occupancy order according to another embodiment of the present application. The device is applied to electronic equipment, such as a server or a server cluster. The recognition apparatus includes a data acquisition unit 100, a feature data acquisition unit 200, a prediction unit 300, and a recognition unit 400.

Wherein:

the data acquiring unit 100 is configured to, when a ticket order is received, acquire flight query data of a next single person in a first time period before a current time, and acquire order data of the ticket order.

The characteristic data obtaining unit 200 is configured to determine characteristic data according to the flight query data and the order data.

Wherein the characteristic data includes: the first characteristic value is used for indicating that the ticket order is the order placing of the order placing person for the second time within the first time period; a second characteristic value indicating the time when the next individual last queried the flight; a third characteristic value indicating a time interval between the time of placing the ticket order and the time when the person placing the order inquires the flight last time; a fourth feature value indicating a time interval between a time of a last flight query by a next single person and a time of a previous flight query; a fifth characteristic value indicating a number of times the placing person inquires of the flight within a second time period before a placing time of the ticket order; a sixth characteristic value for indicating a degree of coincidence of the last query location of the next single person; a seventh characteristic value indicating that the last flight query by the next person is the query of the second time period; an eighth characteristic value indicating whether the next person inquires about a flight in the ticket order within the first time period.

The prediction unit 300 is configured to input the feature data into a malicious behavior recognition model that is trained in advance, and obtain a malicious seat occupation probability that is output after the malicious behavior recognition model processes the feature data.

The identifying unit 400 is configured to determine that the ticket order is a malicious seat occupying order when the malicious seat occupying probability is greater than a preset probability threshold.

According to the identification device for the malicious seat occupying order, when a ticketing order is received, flight query data of an order placing person of the ticketing order in a first time period before the order placing moment and order data of the ticketing order are obtained, feature data are determined based on the flight query data and the order data, wherein the feature data comprise feature values of multiple dimensions, the feature data are input into a malicious behavior identification model which is trained in advance, the input feature data are processed by the malicious behavior identification model, the malicious seat occupying probability of the ticketing order is output, and if the malicious seat occupying probability of the ticketing order is larger than a preset probability threshold, the ticketing order is determined to be the malicious seat occupying order. According to the identification device for the malicious seat-occupying orders, when a ticketing order is received, flight inquiry data of an order-placing person in a period of time before the order is placed and order data of the ticketing order are used as bases, characteristic values of multiple dimensions are obtained from the flight inquiry data, and whether the ticketing order is the malicious seat-occupying order can be accurately identified based on the characteristic values of the multiple dimensions and a malicious behavior identification model which is trained in advance, so that an airline company can process the malicious seat-occupying order, and the problem of malicious seat-occupying is solved.

In another embodiment of the present application, in the identification apparatus for malicious seat occupancy orders, the data acquisition unit 100 is specifically configured to:

acquiring full-channel data from a message distribution system; and analyzing the full-channel data to obtain flight query data of the next person in a first time period before the current time and order data of the ticket order.

In another embodiment of the present application, a model training unit is further provided on the basis of the above-mentioned identification device for malicious seat occupation orders. The model training unit is configured to:

obtaining a plurality of training samples, wherein one training sample is generated based on one sample ticketing order, each training sample is provided with marking information, the marking information is used for indicating whether the sample ticketing order is a malicious seat occupying order or not, the sample ticketing order which is taken out is determined as a normal order, and the sample ticketing order which is not taken out is determined as a malicious seat occupying order; predicting the training sample by utilizing a pre-constructed learning model to obtain a prediction result; and adjusting the learning model according to the prediction result and the labeling information until the adjusted learning model meets the preset convergence condition, and determining the learning model meeting the preset convergence condition as the malicious behavior recognition model.

In another embodiment of the present application, on the basis of the above identifying apparatus for a malicious seat occupation order, the model training unit generates the training sample in the following manner:

obtaining flight inquiry data of an order placing person of the sample ticket order in a first time period before the order placing time to obtain order data of the sample ticket order; determining characteristic data of the sample ticket order according to flight query data of a person placing the sample ticket order in a first time period before the placing time and order data of the sample ticket order, and taking the characteristic data of the sample ticket order as a training sample; obtaining the ticket drawing information of the sample ticket order; and marking the training sample according to the ticket drawing information of the sample ticket order.

In another embodiment of the application, on the basis of the identification apparatus for malicious seat occupation orders, the model training unit obtains flight query data of an order placing person of a sample ticket order in a first time period before an order placing time, and obtains order data of the sample ticket order, specifically:

obtaining a production log; analyzing the production log to obtain the full channel information of the order placing person of the sample ticket order; analyzing the full channel information of the order placing person of the sample ticket order to obtain flight query data of the order placing person of the sample ticket order in a first time period before the order placing time and order data of the sample ticket order.

Another embodiment of the present application further provides an electronic device, so as to implement the malicious seat occupation order identification method provided by the present application.

Referring to fig. 4, fig. 4 is a schematic structural diagram of an electronic device according to another embodiment of the present application. The electronic device may include a processor 401, a memory 402, and a communication interface 403.

Optionally, the server may further include: an input unit 404, a display 405 and a communication bus 406. The processor 401, the memory 402, the communication interface 403, the input unit 404, and the display 405 all communicate with each other through the communication bus 406.

In the embodiment of the present application, the processor 401 may be a Central Processing Unit (CPU), an application specific integrated circuit, a digital signal processor, an off-the-shelf programmable gate array or other programmable logic device, etc.

The processor 401 may call a program stored in the memory 402.

The memory 402 is used to store one or more programs, which may include program code including computer operating instructions. In the embodiment of the present application, a program for implementing any one of the above methods for identifying a malicious seat occupancy order is stored in the memory.

In one possible implementation, the memory 402 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, the above-mentioned programs, and the like; the storage data area may store data created during use of the computer device, and the like.

Further, the memory 402 may include high speed random access memory and may also include non-volatile memory.

The communication interface 403 may be an interface of a communication module.

The input unit 404 may include a touch sensing unit sensing a touch event on the touch display panel, a keyboard, and the like.

The display 405 includes a display panel, such as a touch display panel or the like.

Of course, the structure of the electronic device shown in fig. 4 does not constitute a limitation of the electronic device in the embodiment of the present application, and in practical applications, the electronic device may include more or less components than those shown in fig. 4, or some components may be combined.

It should be noted that the electronic device in the embodiment of the present application may include, but is not limited to, a server, for example, a server cluster or an independent server. The electronic device shown in fig. 4 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.

Another embodiment of the present application provides a storage medium executable by an electronic device, where the storage medium stores a program, and when the program is loaded and executed by a processor of the electronic device, the program causes the electronic device to implement any one of the methods for identifying a malicious seat occupation order disclosed in the foregoing description of the present application.

It should be noted that the computer readable medium mentioned above in the present application may be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer-readable storage medium may be, but is not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

According to one or more implementations of the present application, there is provided a method for identifying a malicious seat occupancy order, comprising:

According to one or more embodiments of the application, on the basis of the identification method of the malicious seat occupation order, the obtaining flight query data of the next person in a first time period before the current time and obtaining order data of the ticket order comprise:

acquiring full-channel data from a message distribution system;

and analyzing the full-channel data to obtain flight query data of the next person in a first time period before the current time and order data of the ticket order.

According to one or more embodiments of the application, on the basis of the identification method of the malicious seat occupying order, the flight inquiry data comprises: the time of the next individual for inquiring the flight and the takeoff-arrival city pair of the next individual for inquiring the flight; the order data includes: the time of placing the ticket order, and the departure-arrival city pair of the flights in the ticket order.

According to one or more embodiments of the present application, on the basis of the above method for identifying a malicious seat occupation order, the training process of the malicious behavior identification model includes:

obtaining a plurality of training samples, wherein one training sample is generated based on one sample ticketing order, each training sample is provided with marking information, the marking information is used for indicating whether the sample ticketing order is a malicious seat occupying order or not, the sample ticketing order which is taken out is determined to be a normal order, and the sample ticketing order which is not taken out is determined to be a malicious seat occupying order;

predicting the training sample by utilizing a pre-constructed learning model to obtain a prediction result;

and adjusting the learning model according to the prediction result and the labeling information until the adjusted learning model meets a preset convergence condition, and determining the learning model meeting the preset convergence condition as the malicious behavior recognition model.

According to one or more embodiments of the application, on the basis of the identification method of the malicious seat occupying order, the following method is adopted to generate a training sample:

obtaining flight inquiry data of an order placing person of a sample ticket order in a first time period before the order placing time to obtain order data of the sample ticket order;

determining characteristic data of the sample ticket order according to flight query data of a person placing the sample ticket order in a first time period before the placing time and order data of the sample ticket order, and taking the characteristic data of the sample ticket order as a training sample;

obtaining the ticket drawing information of the sample ticket order;

and marking the training sample according to the ticket drawing information of the sample ticket order.

According to one or more embodiments of the application, on the basis of the identification method for malicious seat occupation orders, the obtaining of flight query data of an order placing person of a sample ticket order in a first time period before an order placing time to obtain order data of the sample ticket order includes:

obtaining a production log;

According to one or more embodiments of the present application, on the basis of the identification method for a malicious seat occupation order, the preset convergence condition is: and the identification accuracy of the learning model reaches a preset value.

According to one or more embodiments of the present application, there is provided an identification apparatus for a malicious occupancy order, including:

the data acquisition unit is used for acquiring flight inquiry data of a next single person in a first time period before the current time when a ticket order is received, and acquiring order data of the ticket order;

a feature data obtaining unit, configured to determine feature data according to the flight query data and the order data, where the feature data includes: a first characteristic value indicating that the ticket order is a number of times the placing person places the ticket in the first time period; a second characteristic value indicating a time when the next person last queried for the flight; a third characteristic value indicating a time interval between the time of placing the ticket order and the time of the last flight enquiry by the person placing the order; a fourth feature value indicating a time interval between a time of a last query flight by the next single person and a time of a previous query flight; a fifth characteristic value indicating a number of times the placing person inquires of a flight within a second time period before a placing time of the ticket order; a sixth feature value indicating a last query location contact level for the next person; a seventh characteristic value indicating that the next-person most recently queried flight is the number of queries within the first time period; an eighth characteristic value indicating whether the next person inquired about a flight in the ticket order within the first time period;

the prediction unit is used for inputting the characteristic data into a malicious behavior recognition model which is trained in advance to obtain the malicious seat occupation probability which is output after the malicious behavior recognition model processes the characteristic data;

and the identification unit is used for determining the ticket order as a malicious seat occupying order under the condition that the malicious seat occupying probability is greater than a preset probability threshold.

According to one or more embodiments of the present application, on the basis of the apparatus for identifying a malicious seat occupancy order, the data acquisition unit is specifically configured to:

According to one or more embodiments of the present application, on the basis of the above identification apparatus for a malicious seat occupancy order, a model training unit is further provided, where the model training unit is configured to:

obtaining a plurality of training samples, wherein one training sample is generated based on one sample ticketing order, each training sample is provided with marking information, the marking information is used for indicating whether the sample ticketing order is a malicious seat occupying order or not, the sample ticketing order which is taken out is determined to be a normal order, and the sample ticketing order which is not taken out is determined to be a malicious seat occupying order; predicting the training sample by utilizing a pre-constructed learning model to obtain a prediction result; and adjusting the learning model according to the prediction result and the labeling information until the adjusted learning model meets a preset convergence condition, and determining the learning model meeting the preset convergence condition as the malicious behavior recognition model.

According to one or more embodiments of the application, on the basis of the identification device for the malicious seat occupation order, the model training unit generates a training sample in the following manner:

obtaining the ticket drawing information of the sample ticket order;

According to one or more embodiments of the application, on the basis of the identification device of the malicious seat occupation order, the model training unit obtains flight query data of an order placing person of the sample ticket order in a first time period before an order placing moment, and obtains order data of the sample ticket order, specifically:

obtaining a production log;

According to one or more embodiments of the present application, there is provided an electronic device comprising a processor, a memory, and a communication interface;

the processor is used for executing the program stored in the memory;

the memory is to store a program to at least:

According to one or more embodiments of the present application, a storage medium is provided, where a program is stored, and when the program is loaded and executed by a processor, the program implements any one of the methods for identifying a malicious seat occupation order provided by the present application.

In practice, computer program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including but not limited to an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

It is to be noted that the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of methods, apparatus, and electronic devices according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The names of messages or information exchanged between a plurality of devices in the embodiments of the present application are for illustrative purposes only, and are not intended to limit the scope of the messages or information.

Although the operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

While several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other embodiments in which any combination of the features described above or their equivalents does not depart from the spirit of the disclosure. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.

Claims

1. A method for identifying a malicious seat occupancy order, comprising:

2. The method of claim 1, wherein the obtaining flight query data for the next person within a first time period prior to a current time of day, obtaining order data for the ticket order, comprises:

acquiring full-channel data from a message distribution system;

3. An identification method according to claim 1 or 2, characterized in that said flight enquiry data comprises: the time of the next individual for inquiring the flight and the takeoff-arrival city pair of the next individual for inquiring the flight; the order data includes: the time of placing the ticket order, and the departure-arrival city pair of the flights in the ticket order.

4. The recognition method according to claim 1, wherein the training process of the malicious behavior recognition model comprises:

5. The recognition method of claim 4, wherein the training samples are generated by:

obtaining the ticket drawing information of the sample ticket order;

6. The identification method of claim 5, wherein obtaining the order data for the sample ticket order comprises obtaining flight query data for an order taker obtaining the sample ticket order within a first time period prior to an order placing time, comprising:

obtaining a production log;

7. The identification method according to claim 4, wherein the preset convergence condition is: and the identification accuracy of the learning model reaches a preset value.

8. An apparatus for identifying a malicious seat occupancy order, comprising:

9. The recognition apparatus according to claim 8, further comprising a model training unit configured to:

10. An electronic device comprising a processor, a memory, and a communication interface;

the processor is used for executing the program stored in the memory;

the memory is to store a program to at least: