CN115834244B

CN115834244B - Method, device, equipment and storage medium for detecting abnormal information

Info

Publication number: CN115834244B
Application number: CN202211739519.2A
Authority: CN
Inventors: 张旭; 张凯; 牛亚峰; 甘晓华
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2022-12-30
Filing date: 2022-12-30
Publication date: 2024-02-20
Anticipated expiration: 2042-12-30
Also published as: CN115834244A

Abstract

The application discloses a detection method, device and equipment for abnormal information and a storage medium, and belongs to the technical field of Internet. The method comprises the following steps: acquiring a plurality of first propagation information, wherein the first propagation information comprises a platform account number and key information, the plurality of first propagation information comprises first abnormal information, and the first abnormal information is abnormal platform account number or abnormal key information; determining a target propagation map based on the plurality of first propagation information and the initial abnormality index of each first abnormality information; and determining second abnormal information based on the target propagation graph, wherein the second abnormal information is a platform account corresponding to a node of which the target abnormal index of the platform account in the target propagation graph is greater than the first index threshold, or is key information corresponding to a node of which the target abnormal index of the key information in the target propagation graph is greater than the second index threshold. The method and the device realize the determination of the abnormal platform account number and the abnormal key information based on the target propagation diagram, and improve the network security.

Description

Method, device, equipment and storage medium for detecting abnormal information

Technical Field

The embodiment of the application relates to the technical field of internet, in particular to a method, a device, equipment and a storage medium for detecting abnormal information.

Background

With the continuous development of internet technology, various network platforms have been developed. Typically, an object needs to register a platform account on a network platform, and access various functions of the network platform through the platform account.

However, some abnormal platform accounts exist, and one object can transmit two-dimensional codes, resource memory card numbers and other abnormal key information through the abnormal platform account to guide the other object to the abnormal network platform. Based on this, how to detect abnormal information such as an abnormal platform account number and abnormal key information becomes a problem to be solved.

Disclosure of Invention

The application provides a method, a device, equipment and a storage medium for detecting abnormal information, which can be used for solving the problems in the related art.

In one aspect, a method for detecting abnormal information is provided, the method comprising:

acquiring a plurality of first propagation information, wherein any one of the first propagation information comprises a platform account number and one piece of key information propagated through the platform account number, the plurality of first propagation information comprises at least one piece of first abnormality information, any one of the first abnormality information is an abnormal platform account number or abnormal key information, the abnormal platform account number is the platform account number for propagating the abnormal key information, and the abnormal key information is information capable of misleading an object;

Determining initial abnormality indexes of the first abnormality information;

determining a target propagation graph based on the plurality of first propagation information and initial abnormality indexes of the first abnormality information, wherein one node of the target propagation graph represents a target abnormality index of a platform account or a target abnormality index of key information, and one side of the target propagation graph represents the number of times that a platform account corresponding to one end node propagates key information corresponding to the other end node;

and determining at least one piece of second abnormal information based on the target propagation graph, wherein any piece of second abnormal information is a platform account corresponding to a node of the platform account in the target propagation graph, wherein the target abnormal index of the node is greater than the first index threshold, or the target abnormal index of the key information in the target propagation graph is the key information corresponding to the node of the key information in the target propagation graph, wherein the target abnormal index of the node is greater than the second index threshold.

In another aspect, there is provided a detection apparatus of abnormal information, the apparatus including:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a plurality of first propagation information, any one of the first propagation information comprises a platform account number and one piece of key information propagated through the platform account number, the plurality of first propagation information comprises at least one piece of first abnormal information, any one piece of first abnormal information is an abnormal platform account number or abnormal key information, the abnormal platform account number is the platform account number for propagating the abnormal key information, and the abnormal key information is information capable of misleading an object;

The determining module is used for determining initial abnormality indexes of the first abnormality information;

the determining module is further configured to determine, based on the plurality of first propagation information and initial anomaly indexes of the first anomaly information, a target propagation graph, where one node of the target propagation graph represents a target anomaly index of one platform account or a target anomaly index of one key information, and one edge of the target propagation graph represents the number of times that one side of the target propagation graph is used to propagate the key information corresponding to the other side of the platform account corresponding to the one end node;

the determining module is further configured to determine at least one second anomaly information based on the target propagation graph, where any one of the second anomaly information is a platform account corresponding to a node in the target propagation graph, where a target anomaly index of the platform account is greater than a first index threshold, or any one of the second anomaly information is key information corresponding to a node in the target propagation graph, where a target anomaly index of the key information is greater than a second index threshold.

In a possible implementation manner, the acquiring module is configured to acquire a plurality of second propagation information and propagation times of the second propagation information, where any one of the second propagation information includes a platform account number and a key information propagated through the platform account number; and selecting each first propagation information with the propagation time within a set time range from the plurality of second propagation information.

In a possible implementation manner, the determining module is configured to construct an initial propagation graph based on the plurality of first propagation information and initial anomaly indexes of the first anomaly information, where one node of the initial propagation graph represents an initial anomaly index of one platform account or an initial anomaly index of one key information, and one edge of the initial propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node; and updating the initial propagation diagram to obtain a target propagation diagram.

In a possible implementation manner, the determining module is configured to update the initial propagation graph to obtain a first propagation graph, where one node of the first propagation graph represents a first abnormal index of a platform account or a first abnormal index of a key information, and one edge of the first propagation graph represents the number of times that a platform account corresponding to one end node propagates key information corresponding to another end node; and responding to the condition of meeting the update, and taking the first propagation diagram as the target propagation diagram.

In a possible implementation manner, the determining module is configured to determine, for a node corresponding to any one piece of key information in the initial propagation graph, a first anomaly index of the node corresponding to the any one piece of key information based on a number of times represented by at least one first relevant edge and initial anomaly indexes represented by first relevant nodes of each first relevant edge, where any one first relevant edge is an edge of the node corresponding to the any one piece of key information in the initial propagation graph, and a first relevant node of any one first relevant edge is a node of the other end of any one first relevant edge; for the node corresponding to any platform account in the initial propagation diagram, determining a first abnormality index of the node corresponding to any platform account based on the times represented by at least one second correlation edge and initial abnormality indexes represented by second correlation nodes of each second correlation edge, wherein one end of any second correlation edge is an edge of the node corresponding to any platform account in the initial propagation diagram, and the second correlation node of any second correlation edge is a node at the other end of any second correlation edge; and determining a first propagation graph based on the first abnormal index of the node corresponding to each platform account, the first abnormal index of the node corresponding to each key information and each side in the initial propagation graph.

In a possible implementation manner, the determining module is further configured to update the first propagation graph to obtain a second propagation graph in response to the update condition not being met, where one node of the second propagation graph represents a second abnormal index of one platform account or a second abnormal index of one key information, and one edge of the second propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node; and responding to the condition of the update, and taking the second propagation diagram as the target propagation diagram.

In one possible implementation, the apparatus further includes:

the determining module is further configured to determine, for any one of the second anomaly information, at least one third relevant edge and third relevant nodes of each third relevant edge based on the target propagation graph, where any one third relevant edge is an edge in the target propagation graph, where one end of the edge is a node corresponding to the any one of the second anomaly information, and the third relevant node of the any one third relevant edge is a node at the other end of the any one third relevant edge; determining the proving information of any one of the second anomaly information based on the times characterized by the at least one third correlation edge and the target anomaly indexes characterized by the third correlation nodes of the respective third correlation edges;

And the display module is used for displaying the proving information of each piece of second abnormal information through the display interface.

In one possible implementation manner, the determining module is configured to determine, for any one third phase joint point, a contribution weight of the any one third phase joint point to the any one second anomaly information based on the target anomaly index characterized by the any one third relevant node, the number of times characterized by the third relevant edge of the any one third relevant node, the number of times characterized by the at least one third relevant edge, and the target anomaly index characterized by the third relevant node of each third relevant edge; and determining the platform account number or the key information corresponding to any one of the third phase nodes as the proving information of any one of the second abnormal information in response to the fact that the contribution weight of any one of the third phase nodes to any one of the second abnormal information is greater than a weight threshold.

In a possible implementation manner, the determining module is further configured to determine at least one fourth related edge and fourth related nodes of each fourth related edge based on the target propagation graph, where any fourth related edge is an edge in the target propagation graph with one end being the any third related node, and the fourth related node of any fourth related edge is a node with the other end being the any fourth related edge; for any fourth-phase joint point, determining the contribution weight of the any fourth-phase joint point to the any second anomaly information based on the contribution weight of the any third correlation node to the any second anomaly information, the number of times characterized by the at least one fourth correlation edge and the target anomaly index characterized by the fourth correlation node of each fourth correlation edge; and determining the platform account number or key information corresponding to any one fourth-phase joint point as the proving information of any one second abnormal information in response to the fact that the contribution weight of any one fourth-phase joint point to any one second abnormal information is greater than a weight threshold.

In one possible implementation manner, the determining module is configured to determine a contribution weight of the any fourth phase joint point to the any third phase joint point based on the target abnormality index represented by the any fourth correlation node, the number of times represented by the fourth correlation edge of the any fourth correlation node, the number of times represented by the at least one fourth correlation edge, and the target abnormality index represented by the fourth correlation node of each fourth correlation edge; and determining the contribution weight of the fourth-phase joint point to the second abnormal information based on the contribution weight of the fourth-phase joint point to the third-phase joint point and the contribution weight of the third-phase joint point to the second abnormal information.

In another aspect, an electronic device is provided, where the electronic device includes a processor and a memory, where at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor, so that the electronic device implements any one of the above abnormal information detection methods.

In another aspect, there is further provided a computer readable storage medium having at least one computer program stored therein, where the at least one computer program is loaded and executed by a processor, so that an electronic device implements any one of the above-mentioned abnormal information detection methods.

In another aspect, there is also provided a computer program or a computer program product, where at least one computer program is stored, where the at least one computer program is loaded and executed by a processor, so as to enable an electronic device to implement a method for detecting any of the abnormal information described above.

The technical scheme provided by the application at least brings the following beneficial effects:

according to the technical scheme, the target propagation diagram is determined based on the first propagation information and initial abnormal indexes of the first abnormal information, and one node of the target propagation diagram represents the target abnormal index of one platform account or the target abnormal index of one key information. And determining at least one piece of second abnormal information based on the target propagation graph, wherein any piece of second abnormal information is a platform account corresponding to a node of which the target abnormal index of the platform account is greater than the first index threshold value, or key information corresponding to a node of which the target abnormal index of the key information is greater than the second index threshold value. The method and the device have the advantages that abnormal platform account numbers and abnormal key information are mined from the first propagation information, so that network safety is improved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic diagram of an implementation environment of a method for detecting abnormal information according to an embodiment of the present application;

fig. 2 is a flowchart of a method for detecting abnormal information according to an embodiment of the present application;

FIG. 3 is a schematic diagram illustrating selection of a propagation information according to an embodiment of the present application;

FIG. 4 is a schematic diagram of an original propagation map provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of an assigned raw propagation graph provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of an initial propagation diagram provided by an embodiment of the present application;

fig. 7 is a schematic diagram of an initial propagation diagram after updating a node corresponding to key information according to an embodiment of the present application;

fig. 8 is a schematic diagram of an initial propagation diagram after updating a node corresponding to a platform account according to an embodiment of the present application;

FIG. 9 is a schematic diagram of a target propagation diagram provided by an embodiment of the present application;

FIG. 10 is a schematic diagram of a second anomaly information, a third correlation edge, and a third correlation node according to an embodiment of the present application;

FIG. 11 is a schematic diagram of a method for detecting anomaly information according to an embodiment of the present application;

fig. 12 is a schematic structural diagram of a device for detecting abnormal information according to an embodiment of the present application;

fig. 13 is a schematic structural diagram of a terminal device provided in an embodiment of the present application;

fig. 14 is a schematic structural diagram of a server according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

Fig. 1 is a schematic diagram of an implementation environment of a method for detecting abnormal information according to an embodiment of the present application, where, as shown in fig. 1, the implementation environment includes a terminal device 101 and a server 102. The method for detecting the abnormal information in the embodiment of the present application may be performed by the terminal device 101, by the server 102, or by both the terminal device 101 and the server 102.

The terminal device 101 may be a smart phone, a game console, a desktop computer, a tablet computer, a laptop computer, a smart television, a smart car device, a smart voice interaction device, a smart home appliance, etc. The server 102 may be one server, or a server cluster formed by a plurality of servers, or any one of a cloud computing platform and a virtualization center, which is not limited in this embodiment of the present application. The server 102 may be in communication connection with the terminal device 101 via a wired network or a wireless network. The server 102 may have functions of data processing, data storage, data transceiving, and the like, which are not limited in the embodiments of the present application. The number of terminal devices 101 and servers 102 is not limited, and may be one or more.

In the field of internet technology, a variety of network platforms have evolved. Typically, an object needs to register a platform account on a network platform, and access various functions of the network platform through the platform account. However, there are some abnormal platform accounts, so that one object propagates the critical information of the abnormality through the abnormal platform account to guide the other object to the abnormal network platform, affecting the network security. Therefore, a method for detecting abnormal information is needed to detect abnormal platform account numbers and abnormal key information.

The embodiment of the application provides a detection method of abnormal information, which can be applied to the implementation environment, and can determine abnormal platform account numbers and abnormal key information, so that network security is improved. Taking the flowchart of the method for detecting abnormal information provided in the embodiment of the present application as shown in fig. 2 as an example, for convenience of description, the terminal device 101 or the server 102 that performs the method for detecting abnormal information in the embodiment of the present application is referred to as an electronic device, and the method may be performed by the electronic device. As shown in fig. 2, the method includes the following steps.

In step 201, a plurality of first propagation information is obtained, where any one of the first propagation information includes a platform account number and a key information propagated through the platform account number.

The platform account number is an account number of any network platform, through which key information can be propagated, where the key information includes, but is not limited to, a network site (site for short), a resource storage account number, a graphic code (e.g., a two-dimensional code, a bar code, etc.), a platform account number, and the like. One piece of propagation information may be used to characterize one platform account number and one piece of key information propagated through the platform account number, and the electronic device may acquire a plurality of pieces of propagation information and use each piece of propagation information as each piece of first propagation information. The method comprises the steps that multiple pieces of key information can be transmitted through the same platform account number, and the same piece of key information can be transmitted through the multiple platform account numbers.

It should be noted that, in the embodiment of the present application, the platform account number, the resource storage account number, and the like are account numbers after the fuzzy processing. The platform account number and the resource storage account number comprise a plurality of account number characters, and at least one account number character can be subjected to fuzzy processing to obtain the account number character after the fuzzy processing. In the embodiment of the application, when the platform account number or the resource storage account number is displayed by the electronic equipment, the account number characters which are included in the platform account number or the resource storage account number and are not subjected to fuzzy processing are displayed; and displaying the fuzzy account characters for the account characters of the platform account or the resource storage account. The account number character after the blurring process may be a special character (e.g., the special character is "×", "%", "-", etc.).

Taking a platform account number as an example, assuming that the platform account number is 1234567, performing fuzzy processing on characters 3 to 6 in the platform account number to obtain fuzzy processed account number characters. In this case, when the electronic device displays the platform account, since the characters 1 to 2 and 7 are not subjected to the blurring process, the characters 1 to 2 and 7 are displayed, and the characters 3 to 6 are subjected to the blurring process. That is, the platform account number displayed by the electronic device is: 12****7.

Optionally, step 201 includes: acquiring a plurality of second propagation information and propagation time of each second propagation information, wherein any one of the second propagation information comprises a platform account number and key information propagated through the platform account number; each first propagation information having a propagation time within a set time range is selected from the plurality of second propagation information.

The electronic device may acquire a plurality of pieces of propagation information, and take each piece of propagation information as each piece of second propagation information. For any one of the second propagation information, the second propagation information includes a platform account number and a key information, and the time of the platform account number for propagating the key information is the propagation time, and the electronic device can obtain the propagation time of the second propagation information. Table 1 below shows a plurality of second propagation information and propagation times of the respective second propagation information.

TABLE 1

Platform account	Key information	Propagation time
			ID_1	KEY_INFO_1	TIMESTAMP_1
ID_1	KEY_INFO_1	TIMESTAMP_2
			ID_1	KEY_INFO_2	TIMESTAMP_3
ID_2	KEY_INFO_2	TIMESTAMP_4
			ID_3	KEY_INFO_3	TIMESTAMP_5
ID_4	KEY_INFO_3	TIMESTAMP_6
			ID_5	KEY_INFO_4	TIMESTAMP_7
ID_6	KEY_INFO_5	TIMESTAMP_8

As can be seen from table 1, the first second propagation information includes id_1 and key_info_1 propagated through id_1, and the propagation time is TIMESTAMP _1; the second propagation information includes id_1 and key_info_1 propagated through id_1, whose propagation time is TIMESTAMP _2; and so on.

The electronic device may receive the time range of the object configuration, resulting in a set time range. For any one of the second propagation information, if the propagation time of the second propagation information is within a set time range, the second propagation information is selected as the first propagation information. Referring to fig. 3, fig. 3 is a schematic diagram illustrating selection of propagation information according to an embodiment of the present application, and fig. 3 illustrates selection of a plurality of first propagation information with propagation time within a set time range from a plurality of second propagation information.

The embodiment of the application does not limit the set time range. Optionally, the time range is set to be a time range between a first time and a current time, the first time being any time before the current time. Because the propagation time of the first propagation information is between the first time and the current time, the first propagation information can represent that the platform account number propagates the key information in the near term, so that the first propagation information is ensured to have certain timeliness, and the relevance between the platform account number and the key information can be accurately reflected.

In an exemplary embodiment, the plurality of first propagation information includes at least one first anomaly information, any of which is an anomalous platform account number or anomalous key information. That is, any one of the first propagation information includes a platform account number and key information, where the platform account number may be an abnormal platform account number, or a non-abnormal platform account number, and the key information may be abnormal key information, or non-abnormal key information. When the platform account number is an abnormal platform account number, the platform account number is first abnormal information, and when the key information is abnormal key information, the key information is first abnormal information. The abnormal platform account number is a platform account number for propagating abnormal key information, the abnormal key information is information capable of misleading the object, for example, the abnormal key information is a resource memory card, a two-dimensional code, a bar code and the like capable of misleading the object to transfer resources.

It should be noted that, the card number of the resource memory card includes a plurality of card number characters, and fuzzy processing can be performed on at least one card number character to obtain a card number character after the fuzzy processing. In the embodiment of the application, when the electronic device displays the card number of the resource memory card, the card number character which is included in the card number and is not subjected to fuzzy processing is displayed; and displaying the card number characters subjected to fuzzy processing for the card number characters subjected to fuzzy processing. The card number character after the blurring process may be a special character (e.g., the special character is "×", "%", "-", etc.).

Optionally, when the electronic device receives a reporting operation for a platform account, the platform account is determined to be the first abnormal information. Likewise, when the electronic device receives a reporting operation for certain key information, the key information is determined as first abnormal information.

Step 202, determining initial anomaly indexes of the first anomaly information.

Any one of the first abnormal information can be marked manually, and an initial abnormal index of the first abnormal information is obtained. The first anomaly information can be automatically marked based on the propagation times, types and the like of the first anomaly information, so that an initial anomaly index of the first anomaly information can be obtained. Wherein, the higher the propagation times of the first anomaly information, the larger the initial anomaly index of the first anomaly information.

The embodiment of the application does not limit the value of the initial abnormal index, and the value of the initial abnormal index can be any data. Alternatively, the initial abnormality index is data of 0 or more and 1 or less.

In step 203, a target propagation map is determined based on the plurality of first propagation information and the initial abnormality index of each first abnormality information.

One node of the target propagation graph represents a target abnormality index of a platform account or a target abnormality index of key information, and one side of the target propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node. The embodiment of the application does not limit the value of the target abnormal index, and the value of the target abnormal index can be any data. Alternatively, the target abnormality index is data of 0 or more and 1 or less.

Optionally, step 203 includes steps 2031 to 2032.

In step 2031, an initial propagation map is constructed based on the plurality of first propagation information and the initial abnormality index of each first abnormality information. One node of the initial propagation diagram represents an initial abnormal index of a platform account or an initial abnormal index of key information, and one side of the initial propagation diagram represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

An original propagation map may be constructed based on the plurality of first propagation information. Illustratively, each platform account number and each key information are taken as each node in the original propagation graph, in which case any node in the original propagation graph characterizes one platform account number or one key information. If one platform account propagates one piece of key information, edges exist between the node corresponding to the platform account and the node corresponding to the key information in the original propagation diagram, and in this case, any one edge in the original propagation diagram represents that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

Referring to fig. 4, fig. 4 is a schematic diagram of an original propagation chart according to an embodiment of the present application. As can be seen from fig. 4, the original propagation diagram includes nodes corresponding to the platform accounts id_1, id_2, and id_3 and nodes corresponding to the KEY information key_info_1, key_info_2, and key_info_3, where the node corresponding to the id_i is the node id_i, and the node corresponding to the key_info_i is any one of the values 1 to 3 of the nodes key_i and i. Since the platform account id_1 propagates the KEY information key_info_1, there is an edge between node id_1 and node key_1, and so on.

And then, counting the plurality of first propagation information to obtain the number of times of propagation of each key information by each platform account. And for any side in the original propagation graph, taking the number of times of the platform account corresponding to one end node to propagate key information corresponding to the other end node as the weight of the side, and carrying out weight assignment on each side in the original propagation graph by utilizing the number of times of each platform account to propagate each key information in the mode to obtain the assigned original propagation graph. At this time, any node in the assigned original propagation graph represents a platform account number or a key information, and any edge in the assigned original propagation graph represents the number of times that the platform account number corresponding to one end node propagates the key information corresponding to the other end node.

Referring to fig. 5, fig. 5 is a schematic diagram of an assigned original propagation chart according to an embodiment of the present application. As can be seen from fig. 5, the assigned original propagation graph includes nodes corresponding to the platform accounts id_1, id_2 and id_3 and nodes corresponding to the KEY information key_info_1, key_info_2 and key_info_3, where the node corresponding to the id_i is the node id_i, the node corresponding to the key_info_i is the node key_i, and the i takes any one of the values 1 to 3. Since the platform account id_1 propagates the KEY information key_info_1 twice, the weight of the edge between the node id_1 and the node key_1 is 2, and so on.

Then, based on the initial anomaly indexes and the setting data (such as 0, 0.01 and the like) of the first anomaly information, the anomaly indexes of the assigned original propagation map are initialized, and an initial propagation map is obtained. For any node in the assigned original propagation graph, if the platform account number or key information corresponding to the node is first abnormal information, taking an initial abnormal index of the first abnormal information as an initial abnormal index corresponding to the node; and if the platform account number or the key information corresponding to the node is not the first abnormal information, setting data as an initial abnormal index corresponding to the node. At this time, one node of the initial propagation diagram represents an initial anomaly index of one platform account or an initial anomaly index of one key information, and one side of the initial propagation diagram represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

Referring to fig. 6, fig. 6 is a schematic diagram of an initial propagation chart according to an embodiment of the present application. As can be seen from fig. 6, the initial propagation diagram includes nodes corresponding to platform accounts (i.e., nodes corresponding to accounts a to D) and nodes corresponding to key information (i.e., nodes corresponding to resource memory cards 1 to 2, nodes corresponding to two-dimensional codes 1 to 2, nodes corresponding to sites 1 to 3, and nodes corresponding to resource transfer codes). Each node has corresponding initial abnormality indexes, wherein account B and account C are first abnormality information, so that the initial abnormality index of account B is 1, the initial abnormality index of account C is 0.7, and the initial abnormality indexes of other nodes are set data 0. One edge of the initial propagation graph represents the number of times that the platform account corresponding to one end node propagates key information corresponding to the other end node, for example, the edge between the node corresponding to the two-dimensional code 2 and the node corresponding to the account B represents the account B propagated 1 time of the two-dimensional code 2, and so on.

Step 2032, updating the initial propagation map to obtain the target propagation map.

Updating the initial abnormal index represented by the node in the initial propagation graph based on the initial abnormal index represented by the node in the initial propagation graph and the propagation times represented by the edge to obtain a target propagation graph. One node of the target propagation graph represents a target abnormality index of one platform account or a target abnormality index of one key information, and one edge of the target propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

In one possible implementation, step 2032 includes steps 20321 to 20322.

In step 20321, the initial propagation map is updated to obtain a first propagation map.

Updating the initial anomaly index represented by the node in the initial propagation graph based on the initial anomaly index represented by the node in the initial propagation graph and the propagation times represented by the edge to obtain a first propagation graph. One node of the first propagation graph represents a first abnormal index of one platform account or a first abnormal index of one key information, and one edge of the first propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

Optionally, step 20321 includes steps A1 to A3.

And A1, determining a first abnormality index of a node corresponding to any one piece of key information based on the times represented by at least one first relevant edge and initial abnormality indexes represented by first relevant nodes of all first relevant edges for the node corresponding to any one piece of key information in an initial propagation diagram, wherein one end of any one first relevant edge is an edge of the node corresponding to any piece of key information in the initial propagation diagram, and the first relevant node of any one first relevant edge is a node at the other end of any one first relevant edge.

When the initial propagation diagram is updated, the nodes corresponding to the platform account numbers in the initial propagation diagram can be kept unchanged, and the nodes corresponding to the key information in the initial propagation diagram are updated based on the nodes and edges corresponding to the platform account numbers in the initial propagation diagram.

At least one first relevant edge exists in the node corresponding to any one piece of key information in the initial propagation diagram, one end of the first relevant edge is the node corresponding to any one piece of key information, and the other end of the first relevant edge is the first relevant node, namely the first relevant node is a neighbor node of the node corresponding to any one piece of key information. For example, in fig. 6, there are 2 first relevant edges of the node corresponding to the resource memory card 1, and these 2 first relevant edges are edges between the node corresponding to the resource memory card 1 and the node corresponding to the account B, and edges between the node corresponding to the resource memory card 1 and the node corresponding to the account a, respectively. The node corresponding to the account number B and the node corresponding to the account number a are first related nodes of the node corresponding to the resource memory card 1.

In an exemplary embodiment, for a node corresponding to any one of the key information, the number of times represented by any one of the first relevant edges is multiplied by an initial anomaly index represented by the first relevant node of the first relevant edge, so as to obtain a product result corresponding to the first relevant edge. And adding the product results corresponding to the first correlation edges to obtain an addition result. And activating the addition result to obtain an activation result, wherein the activation result is a first abnormal index represented by the node corresponding to the key information, and optionally, the first abnormal index represented by the node corresponding to the key information is greater than or equal to 0.

Optionally, the first abnormality index represented by the node corresponding to any one of the key information is determined according to the following formula (1).

f(i)＝sigmoid(∑ _neighbor eval_value weight formula (1)

F (i) represents a first abnormal index represented by a node corresponding to the ith key information, and sigmoid represents a function symbol of an activation function. The neighbor characterizes a one-degree neighbor node set of the node corresponding to the ith key information, and the one-degree neighbor node set comprises each first related node. The evil_value characterizes an initial anomaly indicator characterized by any one of the first correlation nodes, and the weight characterizes the number of times characterized by the first correlation edge of that first correlation node. Σ characterizes the function sign of the summation function.

By the method, the nodes corresponding to the key information in the initial propagation graph can be updated, and the first abnormal index represented by the nodes corresponding to the key information is obtained. Referring to fig. 7, fig. 7 is a schematic diagram of an initial propagation diagram after updating a node corresponding to key information according to an embodiment of the present application. Fig. 7 is an update of a node corresponding to the key information in the initial propagation diagram shown in fig. 6. In fig. 7, the first anomaly index represented by the node corresponding to the key information is greater than or equal to 0, for example, the first anomaly index represented by the node corresponding to the two-dimensional code 2 is 0.09, and the first anomaly index represented by the node corresponding to the site 3 is 0.27.

And A2, for the node corresponding to any platform account in the initial propagation diagram, determining a first abnormal index of the node corresponding to any platform account based on the times represented by at least one second relevant edge and initial abnormal indexes represented by the second relevant nodes of each second relevant edge, wherein any second relevant edge is an edge of the node corresponding to any platform account at one end in the initial propagation diagram, and the second relevant node of any second relevant edge is a node at the other end of any second relevant edge.

The nodes corresponding to the key information in the initial propagation diagram can be kept unchanged, and the nodes corresponding to the platform account numbers in the initial propagation diagram are updated based on the nodes and edges corresponding to the key information in the initial propagation diagram.

At least one second relevant edge exists in the node corresponding to any platform account in the initial propagation diagram, one end of the second relevant edge is the node corresponding to any platform account, and the other end of the second relevant edge is the second relevant node, namely, the second relevant node is a neighbor node of the node corresponding to any platform account. For example, in fig. 6, there are 4 second relevant edges on the node corresponding to the account B, and the 4 second relevant edges are edges between the node corresponding to the two-dimensional code 2 and the node corresponding to the account B, edges between the node corresponding to the site 3 and the node corresponding to the account B, edges between the node corresponding to the site 2 and the node corresponding to the account B, and edges between the node corresponding to the resource memory card 1 and the node corresponding to the account B. The node corresponding to the two-dimensional code 2, the node corresponding to the site 3, the node corresponding to the site 2 and the node corresponding to the resource memory card 1 are second related nodes of the node corresponding to the account number B.

In an exemplary embodiment, for a node corresponding to any platform account, multiplying the number of times represented by any second relevant edge by an initial anomaly index represented by a second relevant node of the second relevant edge to obtain a product result corresponding to the second relevant edge. And adding the product results corresponding to the second correlation edges to obtain an addition result. And activating the addition result to obtain an activation result, wherein the activation result is a first abnormal index represented by a node corresponding to the platform account, and optionally, the first abnormal index represented by the node corresponding to the platform account is greater than or equal to 0. Optionally, according to the principle of the formula (1), determining a first abnormal index represented by a node corresponding to any platform account.

By the method, the nodes corresponding to the platform accounts in the initial propagation graph can be updated, and the first abnormal index represented by the nodes corresponding to the platform accounts is obtained. Referring to fig. 8, fig. 8 is a schematic diagram of an initial propagation diagram after updating a node corresponding to a platform account according to an embodiment of the present application. Wherein, fig. 8 is an updated initial propagation diagram shown in fig. 7. The first anomaly index represented by the node corresponding to the platform account number in fig. 8 is greater than or equal to 0, for example, the first anomaly index represented by the node corresponding to the account number B in fig. 8 is 0.65, and the first anomaly index represented by the node corresponding to the account number a is 0.70.

And A3, determining a first propagation graph based on the first abnormal index of the node corresponding to each platform account, the first abnormal index of the node corresponding to each key information and each side in the initial propagation graph.

The first abnormal index of the node corresponding to each platform account and the first abnormal index of the node corresponding to each key information are used as each node in the first propagation graph, and each side in the initial propagation graph is used as each side in the first propagation graph, so that the first propagation graph is obtained. Alternatively, the first propagation map is shown in fig. 8.

In response to the update condition being met, step 20322, the first propagation map is taken as the target propagation map.

The embodiment of the application does not limit the condition of satisfying the update, and the condition of satisfying the update is that the update times reaches the set times, or the condition of satisfying the update is that the number of nodes where the update occurs is zero or less than a certain threshold. If the abnormal index represented by the node before updating is different from the abnormal index represented by the node after updating, the node is updated; if the abnormal index represented by the node before updating is the same as the abnormal index represented by the node after updating, the node is not updated. When the update condition is satisfied, the electronic device determines the first propagation map as a target propagation map.

Optionally, steps 20323 to 20324 are further included after step 20321.

In step 20323, in response to the update condition not being met, the first propagation graph is updated to obtain a second propagation graph, where one node of the second propagation graph represents a second abnormal index of one platform account or a second abnormal index of one key information, and one edge of the second propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node.

When the update condition is not satisfied, the electronic device updates the first propagation diagram according to the ways from the step A1 to the step A3 to obtain the second propagation diagram, and the update way can be described in the steps A1 to the step A3, and the implementation principles of the two are similar and are not repeated here.

In response to the update condition being met, the second propagation map is taken as the target propagation map, step 20324.

When the updating condition is met, the electronic device determines the second propagation map as a target propagation map; and when the updating condition is not met, the electronic equipment continuously updates the second propagation graph until the updating condition is met, so that the target propagation graph is obtained. The initial propagation map is updated continuously, so that the initial anomaly index is updated continuously, and the updating mode is also called iterative dyeing diffusion.

Referring to fig. 9, fig. 9 is a schematic diagram of a target propagation diagram according to an embodiment of the present application. Wherein, fig. 9 is a result of updating the initial propagation map shown in fig. 6 a plurality of times. The initial anomaly index of the same node in the initial propagation diagram is different from the target anomaly index in the target propagation diagram, for example, the initial anomaly index of the account number B in the initial propagation diagram is 1, and the target anomaly index of the account number B in the target propagation diagram is 0.51.

At step 204, at least one second anomaly information is determined based on the target propagation map.

Any one of the second abnormal information is a platform account number corresponding to a node of the platform account number in the target propagation graph, wherein the target abnormal index of the platform account number is greater than the first index threshold value, or any one of the second abnormal information is key information corresponding to a node of the key information in the target propagation graph, wherein the target abnormal index of the node is greater than the second index threshold value.

For any node in the target propagation graph, if the node is a node corresponding to the platform account number, determining that the platform account number is an abnormal platform account number when a target abnormal index represented by the node corresponding to the platform account number is greater than a first index threshold value, and at this time, the platform account number is second abnormal information; and when the target abnormal index represented by the node corresponding to the platform account number is not greater than the first index threshold, determining that the platform account number is a normal platform account number. If the node is the node corresponding to the key information, determining that the key information is abnormal key information when the target abnormal index represented by the node corresponding to the key information is larger than a second index threshold value, wherein the key information is second abnormal information; and when the target abnormal index represented by the node corresponding to the key information is not more than the second index threshold value, determining that the key information is normal key information.

The sizes of the first index threshold and the second index threshold are not limited in the embodiment of the application. Illustratively, the first indicator threshold is greater than or equal to or less than the second indicator threshold.

Referring to fig. 9, as can be seen by comparing fig. 9 and fig. 6, in the process of continuously updating the initial propagation diagram, the node corresponding to the account a with the initial anomaly index of 0 is raised to 0.82 by the updated target anomaly index. And determining that the account number A is an abnormal platform account number because 0.82 is larger than the first index threshold value, and indicating that a plurality of abnormal key information is transmitted through the account number A. Similarly, the key information of the abnormality can be determined through the target propagation graph, and the key information of the abnormality can be intercepted, the account number of the abnormal platform can be blocked, and the like.

And determining each piece of second abnormal information from the target propagation diagram is beneficial to early warning of abnormal key information and abnormal platform account numbers, and improves the safety of network information.

In one possible implementation, step 204 is followed by steps B1 to B3.

And B1, determining at least one third relevant edge and third relevant nodes of each third relevant edge based on the target propagation graph for any second anomaly information.

Any one of the third relevant edges is an edge of a node corresponding to any one of the second anomaly information in the target propagation graph, and the third relevant node of any one of the third relevant edges is a node at the other end of any one of the third relevant edges.

At least one third related edge exists in the node corresponding to any one of the second abnormal information in the target propagation graph, one end of the third related edge is the node corresponding to any one of the second abnormal information, and the other end of the third related edge is the third related node, namely the third related node is a neighbor node of the node corresponding to any one of the second abnormal information.

Referring to fig. 10, fig. 10 is a schematic diagram of a second anomaly information, a third relevant edge and a third relevant node according to an embodiment of the present application. The account A is second abnormal information. The node corresponding to the account A has 5 third related edges, and the 5 third related edges are edges between the node corresponding to the resource memory card 1 and the node corresponding to the account A, edges between the node corresponding to the site 1 and the node corresponding to the account A, edges between the node corresponding to the two-dimensional code 1 and the node corresponding to the account A, edges between the node corresponding to the resource memory card 2 and the node corresponding to the account A, and edges between the node corresponding to the site 2 and the node corresponding to the account A. The node corresponding to the resource memory card 1, the node corresponding to the site 1, the node corresponding to the two-dimensional code 1, the node corresponding to the resource memory card 2, and the node corresponding to the site 2 are third related nodes of the node corresponding to the account A.

And B2, determining the proving information of any one piece of second abnormal information based on the times represented by at least one third relevant edge and the target abnormal index represented by the third relevant node of each third relevant edge.

For any one of the third phase nodes, it may be determined whether the third phase node may serve as the certification information of any one of the second anomaly information based on the number of times at least one third correlation edge is characterized and the target anomaly index characterized by the third correlation node of each third correlation edge. The proving information of the second abnormal information is a platform account number or key information.

Optionally, step B2 includes step B21 and step B22.

And B21, for any one third joint point, determining the contribution weight of any one third relevant node to any one second abnormal information based on the target abnormal index characterized by any one third relevant node, the times characterized by the third relevant edges of any one third relevant node, the times characterized by at least one third relevant edge and the target abnormal index characterized by the third relevant node of each third relevant edge.

And for any third joint point, on one hand, multiplying the times represented by any third correlation edge by the target abnormality index represented by the third correlation node of the third correlation edge to obtain a product result corresponding to the third correlation edge, and adding the product results corresponding to the third correlation edges to obtain an addition result. On the other hand, the target abnormality index represented by any one of the third correlation nodes is multiplied by the number of times represented by the third correlation edge of the third correlation node, thereby obtaining a multiplication result. And calculating the ratio between the multiplication result and the addition result to obtain the contribution weight of the third related node to any one piece of second abnormal information.

Optionally, the contribution weight of any one third related node to any one second abnormality information is determined according to the following formula (2).

Wherein concrb (i) characterizes a contribution weight of the ith third related node to any one of the second anomaly information. value _i Characterizing a target anomaly index characterized by an ith third correlation node, weight _i Characterizing a secondary characterized by a third correlation edge of an ith third correlation nodeA number. The neighbor characterizes a one-degree neighbor node set of the node corresponding to any one of the second anomaly information, and the one-degree neighbor node set comprises each third correlation node. value characterizes a target anomaly index characterized by any one third correlation node, and weight characterizes the number of times characterized by a third correlation edge of the third correlation node. Σ characterizes the function sign of the summation function.

By the above manner, the contribution weight of each third related node to any one of the second abnormality information can be determined. Referring to the following table 2, the second abnormal information is an account a in fig. 10, and the third phase node includes a node corresponding to the resource memory card 1, a node corresponding to the resource memory card 2, a node corresponding to the site 1, a node corresponding to the site 2, and a node corresponding to the two-dimensional code 1 in fig. 10.

TABLE 2

And step B22, determining the platform account number or the key information corresponding to any one third node point as the proving information of any one second abnormal information in response to the fact that the contribution weight of any one third related node point to any one second abnormal information is greater than the weight threshold value.

For any third phase node, if the contribution weight of the third related node to any second abnormal information is smaller than or equal to a weight threshold, determining that the platform account number or key information corresponding to the third phase node cannot be used as the proving information of any second abnormal information; and if the contribution weight of the third related node to any one of the second abnormal information is greater than the weight threshold, determining that the platform account number or the key information corresponding to the third related node is the proving information of any one of the second abnormal information.

For example, in table 2, the contribution weight of the node corresponding to the resource memory card 2 to the account a is 0.6%, the contribution weight of the node corresponding to the site 1 to the account a is 2.4%, and the contribution weight of the node corresponding to the two-dimensional code 1 to the account a is 0.6%, which are all smaller than the weight threshold value of 5%, so that the resource memory card 2, the site 1, and the two-dimensional code 1 are not proof information of the account a; the contribution weight of the node corresponding to the resource memory card 1 to the account A is 49.9%, the contribution weight of the node corresponding to the site 2 to the account A is 46.5%, and the contribution weight of the node corresponding to the site 2 to the account A is greater than the weight threshold value of 5%, so that the resource memory card 1 and the site 2 are both the proving information of the account A.

In step B22, when the platform account number or the key information corresponding to any one of the third phase nodes is determined as the certification information of any one of the second anomaly information, and the certification information of the second anomaly information is the first anomaly information, it is indicated that the certification information of the second anomaly information is the known anomalous platform account number or the known anomalous key information, and in this case, the backtracking is ended. If the platform account number or the key information corresponding to any one of the third phase nodes is determined as the proof information of any one of the second anomaly information, and the proof information of the second anomaly information is not the first anomaly information, it is indicated that the proof information of the second anomaly information is not the known anomalous platform account number or the known anomalous key information, in this case, the trace back may be continued on the basis of the platform account number or the key information corresponding to the third phase node in the manner of steps B23 to B25.

Optionally, step B23 to step B25 are further included after step B22.

And step B23, determining at least one fourth correlation edge and fourth correlation nodes of each fourth correlation edge based on the target propagation diagram, wherein any fourth correlation edge is an edge of which one end is any third correlation node in the target propagation diagram, and the fourth correlation node of any fourth correlation edge is a node of the other end of any fourth correlation edge.

When the platform account number or the key information corresponding to any one third phase node is the proving information of any one second abnormal information, and the proving information of the second abnormal information is not the first abnormal information, at least one fourth related edge and fourth related nodes of each fourth related edge can be determined based on the target propagation diagram. At least one fourth related edge exists at any third joint point in the target propagation graph, one end of the fourth related edge is any third related node, and the other end of the fourth related edge is a fourth related node, that is, the fourth related node is a neighbor node of any third related node.

Please refer to fig. 9. In fig. 9, both the resource memory card 1 and the site 2 are the certification information of the account a, and neither the resource memory card 1 nor the site 2 is the first abnormality information. In this case, for the resource memory card 1, it may be determined that the fourth related edge is an edge between the node corresponding to the resource memory card 1 and the node corresponding to the account B, and the fourth related node is the node corresponding to the account B; for the site 2, the fourth related edge may be determined to be an edge between the node corresponding to the site 2 and the node corresponding to the account B, and an edge between the node corresponding to the site 2 and the node corresponding to the account C, where the fourth related node is the node corresponding to the account B and the node corresponding to the account C.

And step B24, for any fourth-phase joint point, determining the contribution weight of any fourth relevant node to any second abnormal information based on the contribution weight of any third relevant node to any second abnormal information, the number of times represented by at least one fourth relevant edge and the target abnormal index represented by the fourth relevant node of each fourth relevant edge.

Optionally, step B24 includes: determining a contribution weight of any one fourth correlation node to any one third phase joint point based on the target abnormality index characterized by any one fourth correlation node, the number of times characterized by the fourth correlation edge of any one fourth correlation node, the number of times characterized by at least one fourth correlation edge, and the target abnormality index characterized by the fourth correlation node of each fourth correlation edge; and determining the contribution weight of any fourth relevant node to any second abnormal information based on the contribution weight of any fourth relevant node to any third relevant node and the contribution weight of any third relevant node to any second abnormal information.

For any fourth-phase joint point, on one hand, multiplying the target abnormality index represented by the fourth correlation node by the number of times represented by the fourth correlation edge of the fourth correlation node to obtain a product result corresponding to the fourth-phase joint point, and adding the product results corresponding to the fourth-phase joint points to obtain an addition result. And on the other hand, multiplying the target abnormality index represented by the fourth correlation node by the times represented by the fourth correlation edge of the fourth correlation node to obtain a multiplication result. And calculating the ratio between the multiplication result and the addition result to obtain the contribution weight of the fourth phase joint point to any third phase joint point.

The contribution weight of any one fourth related node to any one third related node may be determined based on the principle of the formula (2), and the implementation principle of the two is similar, which is not described herein.

Then, the contribution weight of any one fourth correlation node to any one third correlation node is multiplied by the contribution weight of any one third correlation node to any one second anomaly information, so that the contribution weight of any one fourth correlation node to any one second anomaly information is obtained. Optionally, the contribution weight of any one fourth relevant node to any one second anomaly information is determined according to equation (3) shown below.

contrb (j) =contrb (j, i) ×contrb (i) formula (3)

Wherein concrb (j) characterizes a contribution weight of the jth fourth related node to any one of the second anomaly information. concrb (j, i) characterizes the contribution weight of the jth fourth correlation node to the ith third correlation node. confb (i) characterizes a contribution weight of the ith third related node to any one of the second anomaly information.

By the above manner, the contribution weight of each fourth related node to any one of the second abnormality information can be determined. Please refer to the following table 3, wherein the third phase node includes the node corresponding to the resource memory card 1 and the node corresponding to the site 2 in fig. 9. The fourth phase joint point includes a node corresponding to the account B and a node corresponding to the account C in fig. 9.

TABLE 3 Table 3

And step B25, determining the platform account number or the key information corresponding to any fourth phase joint point as the proving information of any second abnormal information in response to the fact that the contribution weight of any fourth related node to any second abnormal information is greater than the weight threshold.

For any fourth-phase joint point, if the contribution weight of the fourth related node to any second abnormal information is smaller than or equal to a weight threshold value, determining that the platform account number or key information corresponding to the fourth-phase joint point cannot be used as the proving information of any second abnormal information; and if the contribution weight of the fourth related node to any one of the second abnormal information is greater than the weight threshold, determining that the platform account number or the key information corresponding to the fourth related node is the proving information of any one of the second abnormal information.

For example, in table 2, the contribution weights of the node corresponding to the account B to the account a are 14.6% and 25.3%, and the contribution weight of the node corresponding to the account C to the account a is 21.2%, both of which are greater than the weight threshold 5%, so that the account B and the account C are the proof information of the account a.

Optionally, at least one contribution weight to any one of the second anomaly information exists for any one of the fourth phase joint points. The contribution weights of any one of the fourth correlation nodes to any one of the second abnormality information may be added to obtain a total contribution weight of the fourth correlation node to any one of the second abnormality information. Optionally, the total contribution weight of any one fourth relevant node to any one second anomaly information is determined according to equation (4) shown below.

contrb_all(j)＝∑ _evidence conconb (j) formula (4)

Wherein concrb_all (j) characterizes a total contribution weight of the j-th fourth related node to any one of the second anomaly information. The evaluation represents a contribution weight set of the j fourth-phase joint point, including each contribution weight of the j fourth-phase joint point to any second abnormal information. concrb (j) characterizes a contribution weight of the jth fourth correlation node to any one of the second anomaly information. Σ characterizes the function sign of the summation function.

Illustratively, the contribution weights of the account number B to the account number a in table 3 are added to obtain the total contribution weight of the account number B to the account number a, thereby obtaining the following table 4.

TABLE 4 Table 4

Fourth phase articulation point	Total contribution weight to account a
		Node corresponding to account B	39.9％
Node corresponding to account number C	21.2％

If the total contribution weight of any fourth related node to any second abnormal information is smaller than or equal to the weight threshold value, determining that the fourth related node is not the proving information of any second abnormal information; and if the total contribution weight of any fourth related node to any second abnormal information is greater than the weight threshold value, determining that the fourth related node is the proving information of any second abnormal information.

When any fourth related node is determined to be the proving information of any second abnormal information, if the platform account number or the key information corresponding to the fourth related node is the first abnormal information, the proving information of the second abnormal information is the platform account number of the known abnormality or the key information of the known abnormality, and in this case, backtracking is ended. If the platform account number or the key information corresponding to the fourth phase joint point is not the first abnormal information, the verification information of the second abnormal information is not the platform account number of the known abnormality or the key information of the known abnormality, in this case, the backtracking may be continued according to the manner from step B23 to step B25 until the verification information of any second abnormal information does not exist, or until the verification information of any second abnormal information is the first abnormal information, and the backtracking may be ended.

For example, the total contribution weight of the node corresponding to the account B to the account a is 39.9%, which is greater than the weight threshold by 5%, and the account B is the proof information of the account a, and because the account B is a known abnormal platform account, at this time, backtracking is ended. And if the total contribution weight of the node corresponding to the account number C to the account number A is 21.2% and is greater than the weight threshold value by 5%, the account number C is the proving information of the account number A, and the account number C is a known abnormal platform account number, so that backtracking is finished.

And step B3, displaying the proving information of each piece of second abnormal information through a display interface.

For any one of the second anomaly information, a evidence chain may be generated based on the respective pieces of evidence information of the second anomaly information, and the evidence chain of the second anomaly information may be presented on the display interface. For example, for table 4, account B and account a have the highest association, both propagating site 2 and resource memory card 1; the association between the account number C and the account number A is inferior, and the account number C and the account number A spread the site 2, so that an evidence chain and an association relationship are formed, the evidence information of the platform account number with the account number A being abnormal is obtained, and the evidence holding capacity is improved.

The evidence chain of any second anomaly information is a link from the first anomaly information to the second anomaly information in the target propagation graph. The evidence and the interpretability of the second abnormal information are enhanced by determining the evidence of the second abnormal information, so that the network security is maintained.

It should be noted that, information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data for analysis, stored data, presented data, etc.), and signals referred to in this application are all authorized by the user or are fully authorized by the parties, and the collection, use, and processing of relevant data is required to comply with relevant laws and regulations and standards of the relevant region. For example, the first propagation information, the first anomaly information, the account number, the resource transfer code, the resource memory card, the site, the two-dimensional code, and the like referred to in the present application are all acquired under the condition of sufficient authorization.

The method comprises the steps of determining a target propagation diagram based on a plurality of first propagation information and initial abnormality indexes of each first abnormality information, wherein one node of the target propagation diagram represents a target abnormality index of a platform account or a target abnormality index of key information. And determining at least one piece of second abnormal information based on the target propagation graph, wherein any piece of second abnormal information is a platform account corresponding to a node of which the target abnormal index of the platform account is greater than the first index threshold value, or key information corresponding to a node of which the target abnormal index of the key information is greater than the second index threshold value. The method and the device have the advantages that abnormal platform account numbers and abnormal key information are mined from the first propagation information, so that network safety is improved.

The foregoing describes the method for detecting abnormal information provided in the embodiments of the present application from the perspective of method steps, and the method is described fully below with reference to fig. 11. Fig. 11 is a schematic diagram of a method for detecting abnormal information according to an embodiment of the present application.

In the embodiment of the application, a plurality of second propagation information may be acquired, a plurality of first propagation information may be extracted from the plurality of second propagation information based on a set time range, and an original propagation map may be determined using the plurality of first propagation information. And initializing an abnormal index of the original propagation map based on the plurality of first abnormal information to obtain the initial propagation map. And updating the nodes corresponding to the key information and the nodes corresponding to the platform account numbers based on the node updating function, and judging whether the updating conditions are met. If the updating condition is not met, continuously updating the nodes corresponding to the key information and the nodes corresponding to the platform account numbers based on the node updating function until the updating condition is met; and if the updating condition is met, obtaining a target propagation diagram.

Next, second anomaly information is determined from the target propagation map. And for any second abnormal information, determining a neighbor node of the second abnormal information based on the target propagation graph, and determining the contribution weight of the neighbor node to the second abnormal information to obtain a contribution weight table. Discarding the neighbor node if the contribution weight of the neighbor node to the second abnormal information is not greater than the weight threshold; and if the contribution weight of the neighbor node to the second abnormal information is greater than the weight threshold, taking the platform account number or the key information corresponding to the neighbor node as the proving information of the second abnormal information.

If the neighbor node corresponds to the first abnormal information on the basis that the platform account number or the key information corresponding to the neighbor node is used as the proving information of the second abnormal information, ending backtracking; if the neighbor node does not correspond to the first abnormal information and does not have the neighbor node, ending backtracking; if the neighbor node does not correspond to the first abnormal information and has the neighbor node, continuing to determine the neighbor node, and determining the contribution weight of the neighbor node to the second abnormal information so as to determine whether to end backtracking or not based on the contribution weight.

When the backtracking is ended, the second abnormality information and at least one piece of certification information of the second abnormality information can be obtained. An evidence chain may be generated based on at least one piece of evidence information of the second abnormality information, and the second abnormality information and the evidence chain may be displayed.

By the method for detecting the abnormal information shown in fig. 11, the potential abnormal platform account number and the abnormal key information can be effectively found. The detection rate of the abnormal platform account number is improved by 24%, the detection rate of the abnormal key information is improved by 18%, and the detection rate of the effective proving information is improved by 12%. By displaying the second abnormal information and the evidence chain, the detection capability of the abnormal information is improved, and the interpretability and the feedback processing efficiency are enhanced.

Fig. 12 is a schematic structural diagram of a device for detecting abnormal information according to an embodiment of the present application, where, as shown in fig. 12, the device includes:

the acquiring module 1201 is configured to acquire a plurality of first propagation information, where any one of the first propagation information includes one platform account number and one key information propagated through one platform account number, and the plurality of first propagation information includes at least one first anomaly information, where any one of the first anomaly information is an anomalous platform account number or anomalous key information, the anomalous platform account number is a platform account number that propagates the anomalous key information, and the anomalous key information is information that can mislead an object;

a determining module 1202, configured to determine an initial anomaly index of each of the first anomaly information;

the determining module 1202 is further configured to determine, based on the plurality of first propagation information and initial anomaly indexes of each first anomaly information, a target propagation graph, where one node of the target propagation graph represents a target anomaly index of one platform account or a target anomaly index of one key information, and one edge of the target propagation graph represents the number of times that one side of the target propagation graph propagates the key information corresponding to the other side of the platform account corresponding to one node;

the determining module 1202 is further configured to determine at least one second anomaly information based on the target propagation graph, where any one of the second anomaly information is a platform account corresponding to a node in the target propagation graph where a target anomaly index of the platform account is greater than a first index threshold, or any one of the second anomaly information is key information corresponding to a node in the target propagation graph where a target anomaly index of the key information is greater than the second index threshold.

In one possible implementation, the obtaining module 1201 is configured to obtain a plurality of second propagation information and propagation times of the second propagation information, where any one of the second propagation information includes a platform account number and a key information propagated through the platform account number; each first propagation information having a propagation time within a set time range is selected from the plurality of second propagation information.

In one possible implementation manner, the determining module 1202 is configured to construct an initial propagation graph based on the plurality of first propagation information and initial anomaly indexes of each first anomaly information, where one node of the initial propagation graph represents an initial anomaly index of one platform account or an initial anomaly index of one key information, and one edge of the initial propagation graph represents the number of times that the platform account corresponding to one end node propagates key information corresponding to the other end node; and updating the initial propagation diagram to obtain a target propagation diagram.

In a possible implementation manner, the determining module 1202 is configured to update the initial propagation diagram to obtain a first propagation diagram, where one node of the first propagation diagram represents a first abnormal index of a platform account or a first abnormal index of a key information, and one edge of the first propagation diagram represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node; in response to the update condition being met, the first propagation map is taken as a target propagation map.

In one possible implementation manner, the determining module 1202 is configured to determine, for a node corresponding to any one piece of key information in the initial propagation graph, a first anomaly index of the node corresponding to any one piece of key information based on a number of times represented by at least one first relevant edge and initial anomaly indexes represented by first relevant nodes of each first relevant edge, where any one first relevant edge is an edge of the node corresponding to any one piece of key information in the initial propagation graph, and a first relevant node of any one first relevant edge is a node at the other end of any one first relevant edge; for the node corresponding to any platform account in the initial propagation diagram, determining a first abnormality index of the node corresponding to any platform account based on the times represented by at least one second correlation edge and initial abnormality indexes represented by second correlation nodes of each second correlation edge, wherein any second correlation edge is an edge of the node corresponding to any platform account at one end in the initial propagation diagram, and the second correlation node of any second correlation edge is a node at the other end of any second correlation edge; and determining a first propagation graph based on the first abnormal index of the node corresponding to each platform account, the first abnormal index of the node corresponding to each key information and each side in the initial propagation graph.

In a possible implementation manner, the determining module 1202 is further configured to update the first propagation graph to obtain a second propagation graph in response to the update condition not being met, where one node of the second propagation graph represents a second abnormal index of one platform account or a second abnormal index of one key information, and one edge of the second propagation graph represents the number of times that the platform account corresponding to one end node propagates the key information corresponding to the other end node; in response to the update condition being met, the second propagation map is taken as the target propagation map.

In one possible implementation, the apparatus further includes:

the determining module 1202 is further configured to determine, for any one of the second anomaly information, at least one third relevant edge and third relevant nodes of each third relevant edge based on the target propagation graph, where any one third relevant edge is an edge in the target propagation graph, where one end of the edge is a node corresponding to any one of the second anomaly information, and a third relevant node of any one third relevant edge is a node at the other end of any one third relevant edge; determining the proving information of any one second abnormal information based on the times represented by at least one third related edge and the target abnormal index represented by the third related node of each third related edge;

In one possible implementation, the determining module 1202 is configured to determine, for any one third node, a contribution weight of any one third node to any one second anomaly information based on the target anomaly index characterized by any one third correlation node, the number of times characterized by the third correlation edge of any one third correlation node, the number of times characterized by at least one third correlation edge, and the target anomaly index characterized by the third correlation node of each third correlation edge; and in response to the fact that the contribution weight of any one of the third related nodes to any one of the second abnormal information is greater than the weight threshold, determining the platform account number or the key information corresponding to any one of the third related nodes as the proving information of any one of the second abnormal information.

In a possible implementation manner, the determining module 1202 is further configured to determine, based on the target propagation graph, at least one fourth related edge and fourth related nodes of each fourth related edge, where any fourth related edge is an edge of the target propagation graph with one end being any third related node, and a fourth related node of any fourth related edge is a node with the other end being any fourth related edge; for any fourth-phase joint point, determining the contribution weight of any fourth-phase joint point to any second abnormal information based on the contribution weight of any third-phase joint point to any second abnormal information, the number of times characterized by at least one fourth-phase joint point and the target abnormal index characterized by the fourth-phase joint point of each fourth-phase joint point; and determining the platform account number or the key information corresponding to any one fourth phase joint point as the proving information of any one second abnormal information in response to the fact that the contribution weight of any one fourth relevant node to any one second abnormal information is greater than the weight threshold.

In one possible implementation manner, the determining module 1202 is configured to determine a contribution weight of any fourth relevant node to any third phase node based on the target abnormality index characterized by any fourth relevant node, the number of times characterized by the fourth relevant edge of any fourth relevant node, the number of times characterized by at least one fourth relevant edge, and the target abnormality index characterized by the fourth relevant node of each fourth relevant edge; and determining the contribution weight of any fourth relevant node to any second abnormal information based on the contribution weight of any fourth relevant node to any third relevant node and the contribution weight of any third relevant node to any second abnormal information.

The device determines a target propagation diagram based on a plurality of first propagation information and initial abnormality indexes of each first abnormality information, wherein one node of the target propagation diagram represents a target abnormality index of a platform account or a target abnormality index of key information. And determining at least one piece of second abnormal information based on the target propagation graph, wherein any piece of second abnormal information is a platform account corresponding to a node of which the target abnormal index of the platform account is greater than the first index threshold value, or key information corresponding to a node of which the target abnormal index of the key information is greater than the second index threshold value. The method and the device have the advantages that abnormal platform account numbers and abnormal key information are mined from the first propagation information, so that network safety is improved.

It should be understood that, in implementing the functions of the apparatus provided in fig. 12, only the division of the functional modules is illustrated, and in practical application, the functional modules may be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and the method embodiments provided in the foregoing embodiments belong to the same concept, and specific implementation processes of the apparatus and the method embodiments are detailed in the method embodiments and are not repeated herein.

Fig. 13 shows a block diagram of a terminal device 1300 according to an exemplary embodiment of the present application. The terminal apparatus 1300 includes: a processor 1301, and a memory 1302.

Processor 1301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. Processor 1301 may be implemented in at least one hardware form of DSP (Digital Signal Processing ), FPGA (Field-Programmable Gate Array, field programmable gate array), PLA (Programmable Logic Array ). Processor 1301 may also include a main processor, which is a processor for processing data in an awake state, also called a CPU (Central Processing Unit ), and a coprocessor; a coprocessor is a low-power processor for processing data in a standby state. In some embodiments, processor 1301 may integrate a GPU (Graphics Processing Unit, image processor) for taking care of rendering and rendering of content that the display screen needs to display. In some embodiments, the processor 1301 may also include an AI (Artificial Intelligence ) processor for processing computing operations related to machine learning.

Memory 1302 may include one or more computer-readable storage media, which may be non-transitory. Memory 1302 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in memory 1302 is used to store at least one computer program for execution by processor 1301 to implement the method of detecting anomaly information provided by the method embodiments herein.

In some embodiments, the terminal device 1300 may further optionally include: a peripheral interface 1303 and at least one peripheral. The processor 1301, the memory 1302, and the peripheral interface 1303 may be connected by a bus or signal lines. The respective peripheral devices may be connected to the peripheral device interface 1303 through a bus, a signal line, or a circuit board. Specifically, the peripheral device includes: at least one of radio frequency circuitry 1304, a display screen 1305, a camera assembly 1306, audio circuitry 1307, and a power supply 1308.

A peripheral interface 1303 may be used to connect I/O (Input/Output) related at least one peripheral to the processor 1301 and the memory 1302. In some embodiments, processor 1301, memory 1302, and peripheral interface 1303 are integrated on the same chip or circuit board; in some other embodiments, either or both of the processor 1301, the memory 1302, and the peripheral interface 1303 may be implemented on separate chips or circuit boards, which is not limited in this embodiment.

The Radio Frequency circuit 1304 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 1304 communicates with a communication network and other communication devices via electromagnetic signals. The radio frequency circuit 1304 converts an electrical signal to an electromagnetic signal for transmission, or converts a received electromagnetic signal to an electrical signal. Optionally, the radio frequency circuit 1304 includes: antenna systems, RF transceivers, one or more amplifiers, tuners, oscillators, digital signal processors, codec chipsets, subscriber identity module cards, and so forth. The radio frequency circuit 1304 may communicate with other terminals via at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the world wide web, metropolitan area networks, intranets, generation mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and/or WiFi (Wireless Fidelity ) networks. In some embodiments, the radio frequency circuit 1304 may also include NFC (Near Field Communication ) related circuits, which are not limited in this application.

The display screen 1305 is used to display a UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When the display 1305 is a touch display, the display 1305 also has the ability to capture touch signals at or above the surface of the display 1305. The touch signal may be input to the processor 1301 as a control signal for processing. At this point, the display 1305 may also be used to provide virtual buttons and/or a virtual keyboard, also referred to as soft buttons and/or a soft keyboard. In some embodiments, the display screen 1305 may be one and disposed on the front panel of the terminal apparatus 1300; in other embodiments, the display 1305 may be at least two, disposed on different surfaces of the terminal apparatus 1300 or in a folded design; in other embodiments, the display 1305 may be a flexible display disposed on a curved surface or a folded surface of the terminal apparatus 1300. Even more, the display screen 1305 may be arranged in a non-rectangular irregular pattern, i.e., a shaped screen. The display screen 1305 may be made of LCD (Liquid Crystal Display ), OLED (Organic Light-Emitting Diode) or other materials.

The camera assembly 1306 is used to capture images or video. Optionally, camera assembly 1306 includes a front camera and a rear camera. Typically, the front camera is disposed on the front panel of the terminal and the rear camera is disposed on the rear surface of the terminal. In some embodiments, the at least two rear cameras are any one of a main camera, a depth camera, a wide-angle camera and a tele camera, so as to realize that the main camera and the depth camera are fused to realize a background blurring function, and the main camera and the wide-angle camera are fused to realize a panoramic shooting and Virtual Reality (VR) shooting function or other fusion shooting functions. In some embodiments, camera assembly 1306 may also include a flash. The flash lamp can be a single-color temperature flash lamp or a double-color temperature flash lamp. The dual-color temperature flash lamp refers to a combination of a warm light flash lamp and a cold light flash lamp, and can be used for light compensation under different color temperatures.

The audio circuit 1307 may include a microphone and a speaker. The microphone is used for collecting sound waves of users and environments, converting the sound waves into electric signals, and inputting the electric signals to the processor 1301 for processing, or inputting the electric signals to the radio frequency circuit 1304 for voice communication. For purposes of stereo acquisition or noise reduction, a plurality of microphones may be respectively disposed at different portions of the terminal apparatus 1300. The microphone may also be an array microphone or an omni-directional pickup microphone. The speaker is then used to convert electrical signals from the processor 1301 or the radio frequency circuit 1304 into sound waves. The speaker may be a conventional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, not only the electric signal can be converted into a sound wave audible to humans, but also the electric signal can be converted into a sound wave inaudible to humans for ranging and other purposes. In some embodiments, the audio circuit 1307 may also comprise a headphone jack.

A power supply 1308 is used to power the various components in the terminal device 1300. The power source 1308 may be alternating current, direct current, a disposable battery, or a rechargeable battery. When the power source 1308 comprises a rechargeable battery, the rechargeable battery may be a wired rechargeable battery or a wireless rechargeable battery. The wired rechargeable battery is a battery charged through a wired line, and the wireless rechargeable battery is a battery charged through a wireless coil. The rechargeable battery may also be used to support fast charge technology.

In some embodiments, the terminal device 1300 also includes one or more sensors 1309. The one or more sensors 1309 include, but are not limited to: acceleration sensor 1311, gyroscope sensor 1312, pressure sensor 1313, optical sensor 1314, and proximity sensor 1315.

The acceleration sensor 1311 can detect the magnitudes of accelerations on three coordinate axes of the coordinate system established with the terminal apparatus 1300. For example, the acceleration sensor 1311 may be used to detect components of gravitational acceleration in three coordinate axes. Processor 1301 may control display screen 1305 to display a user interface in either a landscape view or a portrait view based on gravitational acceleration signals acquired by acceleration sensor 1311. The acceleration sensor 1311 may also be used for the acquisition of motion data of a game or user.

The gyro sensor 1312 may detect a body direction and a rotation angle of the terminal device 1300, and the gyro sensor 1312 may collect a 3D motion of the user on the terminal device 1300 in cooperation with the acceleration sensor 1311. Processor 1301 can implement the following functions based on the data collected by gyro sensor 1312: motion sensing (e.g., changing UI according to a tilting operation by a user), image stabilization at shooting, game control, and inertial navigation.

The pressure sensor 1313 may be disposed on a side frame of the terminal device 1300 and/or on a lower layer of the display screen 1305. When the pressure sensor 1313 is provided at a side frame of the terminal apparatus 1300, a grip signal of the terminal apparatus 1300 by a user may be detected, and the processor 1301 performs left-right hand recognition or quick operation according to the grip signal collected by the pressure sensor 1313. When the pressure sensor 1313 is disposed at the lower layer of the display screen 1305, the processor 1301 realizes control of the operability control on the UI interface according to the pressure operation of the user on the display screen 1305. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

The optical sensor 1314 is used to collect ambient light intensity. In one embodiment, processor 1301 may control the display brightness of display screen 1305 based on the intensity of ambient light collected by optical sensor 1314. Specifically, when the intensity of the ambient light is high, the display brightness of the display screen 1305 is turned up; when the ambient light intensity is low, the display brightness of the display screen 1305 is turned down. In another embodiment, processor 1301 may also dynamically adjust the shooting parameters of camera assembly 1306 based on the intensity of ambient light collected by optical sensor 1314.

The proximity sensor 1315, also referred to as a distance sensor, is typically provided on the front panel of the terminal device 1300. The proximity sensor 1315 is used to collect the distance between the user and the front face of the terminal device 1300. In one embodiment, when proximity sensor 1315 detects a gradual decrease in the distance between the user and the front face of terminal device 1300, processor 1301 controls display screen 1305 to switch from a bright screen state to a inactive screen state; when the proximity sensor 1315 detects that the distance between the user and the front surface of the terminal apparatus 1300 gradually increases, the processor 1301 controls the display screen 1305 to switch from the off-screen state to the on-screen state.

It will be appreciated by those skilled in the art that the structure shown in fig. 13 is not limiting and that more or fewer components than shown may be included or certain components may be combined or a different arrangement of components may be employed.

Fig. 14 is a schematic structural diagram of a server provided in the embodiment of the present application, where the server 1400 may have a relatively large difference due to different configurations or performances, and may include one or more processors 1401 and one or more memories 1402, where the one or more memories 1402 store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 1401 to implement the method for detecting abnormal information provided in each method embodiment described above, and the processor 1401 is a CPU. Of course, the server 1400 may also have a wired or wireless network interface, a keyboard, and an input/output interface, so as to perform input/output, and the server 1400 may also include other components for implementing the functions of the device, which are not described herein.

In an exemplary embodiment, there is also provided a computer-readable storage medium having stored therein at least one computer program loaded and executed by a processor to cause an electronic device to implement any one of the above-described abnormality information detection methods.

Alternatively, the above-mentioned computer readable storage medium may be a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a Read-Only optical disk (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and the like.

In an exemplary embodiment, there is also provided a computer program or a computer program product, in which at least one computer program is stored, the at least one computer program being loaded and executed by a processor to cause an electronic device to implement a method of detecting any of the above-mentioned anomaly information.

It should be understood that references herein to "a plurality" are to two or more. "and/or", describes an association relationship of an association object, and indicates that there may be three relationships, for example, a and/or B, and may indicate: a exists alone, A and B exist together, and B exists alone. The character "/" generally indicates that the context-dependent object is an "or" relationship.

The foregoing embodiment numbers of the present application are merely for describing, and do not represent advantages or disadvantages of the embodiments.

The foregoing description of the exemplary embodiments of the present application is not intended to limit the invention to the particular embodiments of the present application, but to limit the scope of the invention to any modification, equivalents, or improvements made within the principles of the present application.

Claims

1. A method for detecting anomaly information, the method comprising:

determining initial abnormality indexes of the first abnormality information;

2. The method of claim 1, wherein the obtaining a plurality of first propagation information comprises:

acquiring a plurality of second propagation information and propagation time of each second propagation information, wherein any one of the second propagation information comprises a platform account number and key information propagated through the platform account number;

and selecting each first propagation information with the propagation time within a set time range from the plurality of second propagation information.

3. The method of claim 1, wherein the determining a target propagation map based on the plurality of first propagation information and the initial anomaly metrics for the respective first anomaly information comprises:

constructing an initial propagation diagram based on the plurality of first propagation information and initial abnormality indexes of the first abnormality information, wherein one node of the initial propagation diagram represents the initial abnormality index of one platform account or the initial abnormality index of one key information, and one side of the initial propagation diagram represents the number of times that one end node corresponds to the platform account propagates key information corresponding to the other end node;

And updating the initial propagation diagram to obtain a target propagation diagram.

4. A method according to claim 3, wherein updating the initial propagation map to obtain a target propagation map comprises:

updating the initial propagation graph to obtain a first propagation graph, wherein one node of the first propagation graph represents a first abnormal index of a platform account or a first abnormal index of key information, and one side of the first propagation graph represents the number of times of propagation of key information corresponding to a node at one end of the platform account and the node at the other end of the platform account;

and responding to the condition of meeting the update, and taking the first propagation diagram as the target propagation diagram.

5. The method of claim 4, wherein updating the initial propagation map to obtain a first propagation map comprises:

for the node corresponding to any one piece of key information in the initial propagation diagram, determining a first abnormality index of the node corresponding to any one piece of key information based on the times represented by at least one first correlation edge and initial abnormality indexes represented by first correlation nodes of all first correlation edges, wherein one end of any one first correlation edge is an edge of the node corresponding to any one piece of key information in the initial propagation diagram, and the first correlation node of any one first correlation edge is a node at the other end of any one first correlation edge;

For the node corresponding to any platform account in the initial propagation diagram, determining a first abnormality index of the node corresponding to any platform account based on the times represented by at least one second correlation edge and initial abnormality indexes represented by second correlation nodes of each second correlation edge, wherein one end of any second correlation edge is an edge of the node corresponding to any platform account in the initial propagation diagram, and the second correlation node of any second correlation edge is a node at the other end of any second correlation edge;

and determining a first propagation graph based on the first abnormal index of the node corresponding to each platform account, the first abnormal index of the node corresponding to each key information and each side in the initial propagation graph.

6. The method according to claim 4, wherein the method further comprises:

in response to the update condition not being met, updating the first propagation graph to obtain a second propagation graph, wherein one node of the second propagation graph represents a second abnormal index of a platform account or a second abnormal index of key information, and one side of the second propagation graph represents the number of times that the platform account corresponding to one end node propagates key information corresponding to the other end node;

And responding to the condition of the update, and taking the second propagation diagram as the target propagation diagram.

7. The method according to claim 1, wherein the method further comprises:

for any one of the second anomaly information, determining at least one third related edge and third related nodes of each third related edge based on the target propagation graph, wherein any one third related edge is an edge of which one end of the target propagation graph is a node corresponding to any one of the second anomaly information, and the third related node of any one third related edge is a node at the other end of any one third related edge;

determining the proving information of any one of the second anomaly information based on the times characterized by the at least one third correlation edge and the target anomaly indexes characterized by the third correlation nodes of the respective third correlation edges;

and displaying the proving information of each second abnormal information through the display interface.

8. The method of claim 7, wherein the determining the attestation information of any of the second anomaly information based on the number of times the at least one third correlation edge is characterized and the target anomaly metrics characterized by the third correlation nodes of the respective third correlation edge comprises:

Determining, for any one of the third-phase joint points, a contribution weight of the any one of the third-phase joint points to the any one of the second anomaly information based on the target anomaly index characterized by the any one of the third-phase joint points, the number of times characterized by the third-phase edge of the any one of the third-phase joint points, the number of times characterized by the at least one third-phase edge, and the target anomaly index characterized by the third-phase node of the respective third-phase edge;

and determining the platform account number or the key information corresponding to any one of the third phase nodes as the proving information of any one of the second abnormal information in response to the fact that the contribution weight of any one of the third phase nodes to any one of the second abnormal information is greater than a weight threshold.

9. The method according to claim 8, wherein after determining the platform account number or the key information corresponding to the any one third phase point as the proof information of the any one second anomaly information, further comprises:

determining at least one fourth correlation edge and fourth correlation nodes of each fourth correlation edge based on the target propagation graph, wherein any one fourth correlation edge is an edge of which one end is any one third correlation node in the target propagation graph, and the fourth correlation node of any one fourth correlation edge is a node of the other end of any one fourth correlation edge;

For any fourth-phase joint point, determining the contribution weight of the any fourth-phase joint point to the any second anomaly information based on the contribution weight of the any third correlation node to the any second anomaly information, the number of times characterized by the at least one fourth correlation edge and the target anomaly index characterized by the fourth correlation node of each fourth correlation edge;

and determining the platform account number or key information corresponding to any one fourth-phase joint point as the proving information of any one second abnormal information in response to the fact that the contribution weight of any one fourth-phase joint point to any one second abnormal information is greater than a weight threshold.

10. The method of claim 9, wherein the determining the contribution weight of the any one fourth phase joint point to the any one second anomaly information based on the contribution weight of the any one third correlation node to the any one second anomaly information, the number of times characterized by the at least one fourth correlation edge, and the target anomaly index characterized by the fourth correlation node of the respective fourth correlation edge comprises:

determining a contribution weight of the any fourth phase joint point to the any third phase joint point based on the target abnormality index characterized by the any fourth correlation node, the number of times characterized by the fourth correlation edge of the any fourth correlation node, the number of times characterized by the at least one fourth correlation edge, and the target abnormality index characterized by the fourth correlation node of each fourth correlation edge;

And determining the contribution weight of the fourth-phase joint point to the second abnormal information based on the contribution weight of the fourth-phase joint point to the third-phase joint point and the contribution weight of the third-phase joint point to the second abnormal information.

11. An abnormality information detection apparatus, characterized by comprising:

12. An electronic device, characterized in that it comprises a processor and a memory, in which at least one computer program is stored, which is loaded and executed by the processor, so that the electronic device implements the method for detecting abnormal information according to any one of claims 1 to 10.

13. A computer-readable storage medium, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor, so as to cause an electronic device to implement the method for detecting abnormal information according to any one of claims 1 to 10.

14. A computer program product, characterized in that at least one computer program is stored in the computer program product, which is loaded and executed by a processor to cause an electronic device to implement the method for detecting anomaly information according to any one of claims 1 to 10.