CN106301978A - The recognition methods of gang member account, device and equipment - Google Patents

The recognition methods of gang member account, device and equipment Download PDF

Info

Publication number
CN106301978A
CN106301978A CN201510275577.8A CN201510275577A CN106301978A CN 106301978 A CN106301978 A CN 106301978A CN 201510275577 A CN201510275577 A CN 201510275577A CN 106301978 A CN106301978 A CN 106301978A
Authority
CN
China
Prior art keywords
account
suspicious
target
gang
history
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201510275577.8A
Other languages
Chinese (zh)
Inventor
周刚
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to CN201510275577.8A priority Critical patent/CN106301978A/en
Publication of CN106301978A publication Critical patent/CN106301978A/en
Pending legal-status Critical Current

Links

Landscapes

  • Telephonic Communication Services (AREA)

Abstract

This application discloses the recognition methods of gang member account, device and equipment, described method includes: obtains initial suspicious member's account of target service, and is that described target service selects target members's dimensional relationships table;According to described initial suspicious member's account and described target members's dimensional relationships table, generate the incidence relation between target suspicious member account;By the incidence relation identification target gang member account between described target suspicious member account, between the arbitrary suspicious member's account comprised in each target gang member account and other at least one suspicious member's accounts, there is direct correlation relation.The process of the embodiment of the present application identification gang member account can be automatically performed by identification equipment, and therefore recognition efficiency is higher, and owing to can recognize that the potential suspicious member's account in gang member account, therefore improves the accuracy of recognition result.

Description

The recognition methods of gang member account, device and equipment
Technical field
The application relates to network communication technology field, particularly relates to the recognition methods of gang member account, dress Put and equipment.
Background technology
Along with developing rapidly of the Internet, the business carried out based on the Internet gets more and more, and is commencing business Before, user to register corresponding member's account based on business platform.But in magnanimity member's account of registration, There may be the suspicious member's account registered in a large number by malicious third parties, wherein by same malicious third parties Suspicious member's account of registration forms the gang member account of this malicious third parties, is used for carrying out illegal traffic.
In prior art, manual type is generally used to identify gang member account, but artificial cognition side Formula is inefficient, and recognition result is inaccurate.
Summary of the invention
The application provides the recognition methods of gang member account, device and equipment, to solve existing clique The recognition efficiency of member's account is low, the inaccurate problem of recognition result.
First aspect according to the embodiment of the present application, it is provided that the recognition methods of a kind of gang member account, institute The method of stating includes:
Obtain initial suspicious member's account of target service, and be that described target service selects target members's dimension Degree relation table;
According to described initial suspicious member's account and described target members's dimensional relationships table, generate target suspicious Incidence relation between member's account;
By the incidence relation identification target gang member account between described target suspicious member account, often The arbitrary suspicious member's account comprised in individual target gang member account and other at least one suspicious member's accounts There is between number direct correlation relation.
Second aspect according to the embodiment of the present application, it is provided that a kind of gang member account identification device, described Device includes:
Acquiring unit, for obtaining initial suspicious member's account of target service;
Select unit, for selecting target members's dimensional relationships table for described target service;
Signal generating unit, is used for according to described initial suspicious member's account and described target members's dimensional relationships table, Generate the incidence relation between target suspicious member account;
Recognition unit, for by the incidence relation identification target group between described target suspicious member account Partner's member's account, the arbitrary suspicious member's account comprised in each target gang member account is with other at least Between one suspicious member's account, there is direct correlation relation.
The third aspect according to the embodiment of the present application, it is provided that a kind of gang member account identification equipment, including:
Processor;For storing the memorizer of described processor executable;
Wherein, described processor is configured to:
Obtain initial suspicious member's account of target service, and be that described target service selects target members's dimension Degree relation table;
According to described initial suspicious member's account and described target members's dimensional relationships table, generate target suspicious Incidence relation between member's account;
By the incidence relation identification target gang member account between described target suspicious member account, often The arbitrary suspicious member's account comprised in individual target gang member account and other at least one suspicious member's accounts There is between number direct correlation relation.
Application the embodiment of the present application, can by initial suspicious member's account of target service, and be mesh Target members's dimensional relationships table of mark service selection, it is thus achieved that can with initial suspicious the potential of member's account relating Doubt member's account, thus generate the incidence relation between target suspicious member account, and closed by this association System identifies target gang member account.Owing to the process of above-mentioned identification gang member account can be set by identification For being automatically performed, therefore recognition efficiency is higher, and owing to can recognize that in gang member account Potential suspicious member's account, therefore improves the accuracy of recognition result.
It should be appreciated that it is only exemplary and explanatory that above general description and details hereinafter describe , the application can not be limited.
Accompanying drawing explanation
Accompanying drawing herein is merged in description and constitutes the part of this specification, it is shown that meet this Shen Embodiment please, and for explaining the principle of the application together with description.
Fig. 1 is the system architecture schematic diagram that application the embodiment of the present application carries out gang member account identification;
Fig. 2 is an embodiment flow chart of the recognition methods of the application gang member account;
Fig. 3 A is another embodiment flow chart of the recognition methods of the application gang member account;
Fig. 3 B is the connected subgraph schematic diagram in Fig. 3 A in a kind of implementation;
Fig. 4 is a kind of hardware structure diagram identifying device place equipment of the application gang member account;
Fig. 5 is the embodiment block diagram identifying device of the application gang member account;
Fig. 6 is another embodiment block diagram identifying device of the application gang member account.
Detailed description of the invention
It is only merely for describing the purpose of specific embodiment at term used in this application, and is not intended to be limiting The application." a kind of ", " described " of singulative used in the application and appended claims " it is somebody's turn to do " be also intended to include most form, unless context clearly shows that other implications.Also should manage Solving, term "and/or" used herein refers to and comprises one or more project of listing being associated Any or all may combination.
Although should be appreciated that may use term first, second, third, etc. various to describe in the application Information, but these information should not necessarily be limited by these terms.These terms only be used for by same type of information that This distinguishes.Such as, in the case of without departing from the application scope, the first information can also be referred to as Two information, similarly, the second information can also be referred to as the first information.Depend on linguistic context, as in this institute Use word " if " can be construed to " and ... time " or " when ... time " or " response In determining ".
See Fig. 1, carry out the system architecture signal of gang member account identification for application the embodiment of the present application Figure:
System architecture shown in Fig. 1 can be the system processing big data based on business, should System includes: the identification equipment (referred to as identifying equipment in the embodiment of the present application) of gang member account, Monitor supervision platform equipment and some service servers.
Wherein, different service servers can support different business, and can get corresponding business Business datum, such as, financial business server obtains financial transaction data, and authentication business server obtains Authentication business data;Service server is connected with monitor supervision platform equipment respectively, and monitor supervision platform equipment can obtain Take all business datums, these business datums are uniformly processed, it is possible to by different tables of data Preservation processes the corresponding relation obtaining between various data, such as, can preserve business in the embodiment of the present application The corresponding relation of type information and initial suspicious member's account, and preserve comprise registered member's account with Member's dimensional relationships table of corresponding relation between dimension mark;Monitor supervision platform equipment is connected with the equipment of identification, Identification equipment can get initial suspicious member's account of certain target service from monitor supervision platform equipment, And to should target members's dimensional relationships table of target service, thus obtain and initial suspicious member's account Potential suspicious member's account of association, thus generate and comprise initial suspicious member's account and potential suspicious member Account incidence relation between interior target suspicious member account, and automatically identified by this incidence relation Target gang member account, thus improves recognition efficiency and the accuracy of gang member account.Below will knot Close specific embodiment application is described in detail.
See Fig. 2, for an embodiment flow chart of the recognition methods of the application gang member account, be somebody's turn to do Embodiment can be applied on identification equipment:
Step 201: obtain initial suspicious member's account of target service, and select target for target service Member's dimensional relationships table.
In the present embodiment, can be by the unified initial suspicious member's account safeguarding different business of monitor supervision platform equipment Number, and comprise the member's dimensional relationships table of corresponding relation between registered member's account and dimension mark.
Wherein, when determining the gang member account needing to identify certain target service, the equipment of identification can To send the traffic type information of target service, business monitoring platform device root to business monitoring platform device Get initial suspicious member's account of target service according to this traffic type information after, return to the equipment of identification Initial suspicious member's account of this target service.
Further, identification equipment can obtain in advance for this target service configuration member's dimension type, such as, This member's dimension type can include the associating of people and PC, the associating of people and mobile phone, people and identity card Associations etc., obtain the member's dimension class with target service from the multiple member's dimensional relationships tables pre-saved Target members's dimensional relationships table that type is corresponding, wherein, preserves registered one-tenth in each member's dimensional relationships table Corresponding relation between member's account and dimension mark, wherein, described dimension mark can include accredited members The device identification of the used equipment of account (such as, PC or mobile phone), the used identity of accredited members' account The identity of card, by member's dimension type behave with as a example by the associating of mobile phone, then member's dimension accordingly Relation table preserves the corresponding relation between registered member's account and mobile phone logo.
Step 202: according to initial suspicious member's account and target members's dimensional relationships table, generating target can Doubt the incidence relation between member's account.
Identification equipment can be searched target members's dimension close with each initial suspicious member's account as keyword It is table, it is thus achieved that the target dimension mark corresponding with each initial suspicious member's account, then from target members Dimensional relationships table obtains other suspicious member accounts corresponding with target dimension mark, the most potential suspicious one-tenth Member's account, above-mentioned initial suspicious member's account forms target suspicious member account with other suspicious member's accounts, Generate the incidence relation between each initial suspicious member's account and other corresponding suspicious member's accounts respectively, As the incidence relation between the target ultimately generated suspicious member account.
Step 203: by the incidence relation identification target gang member account between target suspicious member account Number, the arbitrary suspicious member's account comprised in the most each target gang member account with other at least one Between suspicious member's account, there is direct correlation relation.
Identification equipment can call the association between default connected graph algorithm member suspicious to target account and close System processes, and generates at least one connected subgraph, and each member node in each connected subgraph is corresponding One suspicious member's account, then according to one target gang member account of each connected subgraph identification, its Middle target gang member account comprises suspicious member's account that the multiple member node in connected subgraph are corresponding.
Wherein, when according to one target gang member account of each connected subgraph identification, can be by each Suspicious member's account corresponding to all member node in connected subgraph is identified as a target gang member account Number;Or, it is also possible to calculate the weighted value in connected subgraph of the member node in each connected subgraph, Then suspicious member's account corresponding more than the member node presetting weight threshold for weighted value is identified as one Target gang member account.
As seen from the above-described embodiment, this embodiment can pass through initial suspicious member's account of target service, And the target members's dimensional relationships table for target service selection, it is thus achieved that with initial suspicious member's account relating Potential suspicious member's account, thus generate the incidence relation between target suspicious member account, and pass through This incidence relation identification target gang member account.Owing to the process of above-mentioned identification gang member account is permissible Being automatically performed by identification equipment, therefore recognition efficiency is higher, and owing to can recognize that gang member Potential suspicious member's account in account, therefore improves the accuracy of recognition result.
See Fig. 3 A, for another embodiment flow chart of the recognition methods of the application gang member account, This embodiment can be applied on identification equipment, and the identification process of gang member account is carried out by this embodiment Describe in detail:
Step 301: obtain initial suspicious member's account of target service.
For different types of business, they are different to the index being applied to identify suspicious member's account, Such as, for authentication business, member's account that authentification failure number of times can exceed certification threshold value is known Not Wei suspicious member's account, the most such as, for financial business, can be by number of times of transferring accounts in a day The member's account exceeding threshold value of transferring accounts is identified as suspicious member's account.
Understanding in conjunction with Fig. 1, the embodiment of the present application can be preserved the business of different business by monitor supervision platform equipment Data, and the unified suspicious member's account safeguarding different business, at the beginning of these suspicious member's accounts are properly termed as Begin to doubt member's account.Wherein, each suspicious member's account can comprise: the account name registered by user, And account ID of the unified account name distribution for this registration of service server, each account ID is uniquely known An other account name.
In this step, when determining the gang member account needing to identify certain target service, identification sets The standby traffic type information that can send target service to business monitoring platform device, business monitoring platform sets After the standby initial suspicious member's account getting target service according to this traffic type information, to the equipment of identification Return initial suspicious member's account of this target service, for the target clique of follow-up this target service of identification Member's account.
In one example, it is assumed that the traffic type information of target service is authentication business, authenticating device from Monitor supervision platform equipment gets initial suspicious member's account of authentication business and includes member's account a and member's account Number f.
Step 302: select target members's dimensional relationships table for target service.
Understanding in conjunction with Fig. 1, the present embodiment can also be safeguarded member's dimensional relationships by monitor supervision platform equipment is unified Table, contains the corresponding relation between registered member's account and dimension mark in member's dimensional relationships table, Wherein, dimension mark can include setting of the used equipment of accredited members' account (such as, PC or mobile phone) Standby mark, the identity etc. of the used identity card of accredited members' account.For different business, it digs Pick member's dimension of being paid close attention to of gang member account also differs, and for financial business, needs to excavate Finance clique, for authentication business, needs to excavate certification clique, and as a example by authentication business, it closes Member's dimension type of note can include the associating of people and PC, the associating of people and mobile phone, people and identity card Association etc..
Based on this, the embodiment of the present application can be member's dimension type that every kind of business configuration is corresponding in advance, When determining the gang member account needing to identify certain target service, can be multiple from pre-save Member's dimensional relationships table obtains the target members dimensional relationships corresponding with member's dimension type of target service Table, for the target gang member account of follow-up this target service of identification.
An example in integrating step 301, it is assumed that target members's dimensional relationships table of authentication business includes People and the dimensional relationships table of the dimensional relationships table of PC, people and mobile phone, and the dimension pass of people and identity card It it is table.A kind of example for people Yu the dimensional relationships table of PC as shown in table 1 below:
Table 1
Member's account PC identifies
Account a PC1
Account b PC1
Account c PC1
Account d PC2
A kind of example for people Yu the dimensional relationships table of mobile phone as shown in table 2 below:
Table 2
Member's account Mobile phone logo
Account a Mobile phone 1
Account f Mobile phone 1
A kind of example for people Yu the dimensional relationships table of identity card as shown in table 3 below:
Table 3
Member's account Identity
Account a Identity 1
Account f Identity 2
Account g Identity 2
Step 303: according to initial suspicious member's account and target members's dimensional relationships table, generating target can Doubt the incidence relation between member's account.
In the present embodiment, identification equipment can use ETL (Extract-Transform-Load, extraction- Transposition-loading) mode processes initial suspicious member's account and target members's dimensional relationships, and finally find out and include The target suspicious member account of initial suspicious member's account and potential suspicious member's account, thus generate target Incidence relation between suspicious member's account, in order to follow-up identification target gang member account.Wherein, ETL Process may include that with each initial suspicious member's account as keyword, searches target members's dimensional relationships Table, it is thus achieved that the target dimension mark corresponding with each initial suspicious member's account, then ties up from target members Degree relation table obtains other suspicious member accounts corresponding with target dimension mark, the most potential suspicious member Account, generates the pass between each initial suspicious member's account and other corresponding suspicious member's accounts respectively Connection relation, as the incidence relation between the target ultimately generated suspicious member account.
In the present embodiment, the incidence relation between target suspicious member account can be specially between account Once relation, once had direct incidence relation between relational representation any two account.Such as front example, Assume that member's account a and member's account f are initial suspicious member's account, search aforementioned with member's account a Table 1 understands, and member's account a is registered by PC1, simultaneously member's account b and member's account c also by PC1 registers, then member's account b and member's account c are potential suspicious member's account, above three member Account has once relation between any two;Understanding with member's account a look-up table 2, member's account a is passed through Mobile phone 1 logs in, and member's account f logs in also by mobile phone 1 simultaneously, then member's account a and member's account There is between f once relation;Understanding with member's account f look-up table 3, member's account f associates with identity 2, Member's account g also associates with identity 2 simultaneously, therefore has one between member's account f and member's account g Degree relation.By above-mentioned analysis, can obtain all targets suspicious member account as shown in table 4 below it Between once relation, table 4 alternatively referred to as adjacency table:
Table 4
Account a Account b
Account a Account c
Account a Account f
Account f Account g
Account b Account c
Step 304: call the incidence relation between default connected graph algorithm member suspicious to target account Process, generate at least one connected subgraph, each member node correspondence one in each connected subgraph Individual suspicious member's account.
After the incidence relation obtained between target suspicious member account, distributed figure can be used to process Mode, is processed this incidence relation by connected graph algorithm, generates at least one UNICOM's subgraph.Knot Close the incidence relation shown in aforementioned table 4, connected subgraph as shown in Figure 3 B can be obtained, Fig. 3 B shows In the connected subgraph gone out, suspicious member's account in each member node is corresponding table 4, Cheng Yuanjie Line between point illustrates the incidence relation between suspicious member's account.
Step 305: according to one target gang member account of each connected subgraph identification, target clique becomes Member's account comprises suspicious member's account that the multiple member node in connected subgraph are corresponding, each target group Have between arbitrary suspicious member's account and other at least one suspicious member's accounts of comprising in partner's member's account There is direct correlation relation.
In the present embodiment, when according to one target gang member account of each connected subgraph identification, permissible Suspicious member's account corresponding for all member node in each connected subgraph is identified as a target clique Member's account, for example, it is possible to by equal for all suspicious member's account in the connected subgraph shown in Fig. 3 B Gang member account as a target clique;Or, it is also possible to calculate the one-tenth in each connected subgraph Member's node weighted value in connected subgraph, then by weighted value more than the member node presetting weight threshold Corresponding suspicious member's account is identified as a target gang member account, such as, can adopt when calculating With pagerank (webpage weight) algorithm, the behavior characteristics in conjunction with each suspicious member's account calculates, The inaccurate suspicious member's account that can initial identification in a connected subgraph be gone out by which is deleted, Accuracy higher suspicious member's account composition target gang member account will be remained.
Step 306: call the history gang member account list pre-saved, history gang member account List comprises the corresponding relation of history suspicious member account and history clique mark.
For the clique no matter using which kind of mode to identify, the embodiment of the present application is referred to as history clique, Owing to containing multiple member in each clique, the most accordingly, the corresponding multiple history of each history clique Suspicious member's account, the embodiment of the present application is preserved history clique mark by the account list of history clique and is gone through Corresponding relation between history suspicious member account.As shown in table 5 below, for the account list of a kind of history clique Example:
Table 5
History clique mark (ID) History suspicious member account
1 Account a
1 Account h
1 Account i
2 Account j
2 Account k
In upper table 5, the history suspicious member account comprised in the history clique 1 identified includes member Account a, member's account h and member's account i, the history comprised in the history clique 2 identified is suspicious Member's account includes member's account j and member's account k.
Step 307: according to history gang member account list, member account suspicious to history and target group Suspicious member's account in partner's member's account merges, and generates and merges gang member account.
In this step, that can search in target gang member account in history suspicious member account is suspicious Member's account, it is thus achieved that the target histories clique mark corresponding with the suspicious member's account found, from history Gang member account list obtains and identifies corresponding target histories suspicious member account with target histories clique, Suspicious for target histories member's account is merged with the suspicious member's account in target gang member account, Generate and merge gang member account.
Understand in conjunction with table 4, it is assumed that the clique of the target gang member account identified is designated 3, should Target gang member account includes: member's account a, member's account b, member's account c, member's account F and member's account g.Then according to member's account a look-up table 5, member's account a belongs to already present Clique is designated the history gang member account of 1, also includes member's account in this history gang member account H and member's account i, therefore can be by the target gang member account belonging to above-mentioned member's account a and history Gang member account merges, and the clique's mark merging gang member account generated can be according in advance First arrange, such as, the maximum identified for the clique of all gang member accounts before merging, or minima, This embodiment of the present application is not limited,
As seen from the above-described embodiment, this embodiment can pass through initial suspicious member's account of target service, And the target members's dimensional relationships table for target service selection, it is thus achieved that with initial suspicious member's account relating Potential suspicious member's account, thus generate the incidence relation between target suspicious member account, and pass through This incidence relation identification target gang member account.Owing to the process of above-mentioned identification gang member account is permissible Being automatically performed by identification equipment, therefore recognition efficiency is higher, and owing to can recognize that gang member Potential suspicious member's account in account, therefore improves the accuracy of recognition result;Further, due to can Merge with already present history gang member account with the target gang member account that will identify that, because of This integrity that improve gang member account and accuracy.
The embodiment identifying device of the application gang member account can apply the knowledge in gang member account On other equipment.Device embodiment can be realized by software, it is also possible to by hardware or software and hardware combining Mode realize.As a example by implemented in software, as the device on a logical meaning, it is by its place Computer program instructions corresponding in nonvolatile memory is read in internal memory and runs by the processor of equipment Formed.For hardware view, as shown in Figure 4, for the identification device of the application gang member account A kind of hardware structure diagram of place equipment, except the processor shown in Fig. 4, internal memory, network interface, with And outside nonvolatile memory, in embodiment, the equipment at device place is generally according to the actual merit of this equipment Can, it is also possible to include other hardware, Fig. 4 illustrates the most one by one.
See Fig. 5, for the application gang member account identify device an embodiment block diagram:
This device includes: acquiring unit 510, selection unit 520, signal generating unit 530 and recognition unit 540。
Wherein, acquiring unit 510, for obtaining initial suspicious member's account of target service;
Select unit 520, for selecting target members's dimensional relationships table for described target service;
Signal generating unit 530, for closing according to described initial suspicious member's account and described target members's dimension It is table, generates the incidence relation between target suspicious member account;
Recognition unit 540, for by the incidence relation identification mesh between described target suspicious member account Mark gang member account, the arbitrary suspicious member's account comprised in each target gang member account and other Between at least one suspicious member's account, there is direct correlation relation.
See Fig. 6, for the application gang member account identify device another embodiment block diagram:
This device includes: acquiring unit 610, select unit 620, signal generating unit 630, recognition unit 640, Call unit 650 and combining unit 660.
Wherein, acquiring unit 610, for obtaining initial suspicious member's account of target service;
Select unit 620, for selecting target members's dimensional relationships table for described target service;
Signal generating unit 630, for closing according to described initial suspicious member's account and described target members's dimension It is table, generates the incidence relation between target suspicious member account;
Recognition unit 640, for by the incidence relation identification mesh between described target suspicious member account Mark gang member account, the arbitrary suspicious member's account comprised in each target gang member account and other Between at least one suspicious member's account, there is direct correlation relation;
Call unit 650, for calling the history gang member account list pre-saved, described history Gang member account list comprises the corresponding relation of history suspicious member account and history clique mark;
Combining unit 660 is for according to described history gang member account list, suspicious to described history Member's account merges with the suspicious member's account in described target gang member account, generates and merges group Partner's member's account.
In an optional implementation, described acquiring unit 610 can include (not shown in Fig. 6):
Traffic type information sends subelement, for sending the industry of target service to business monitoring platform device Service type information;
Suspicious member's account receive subelement, for receive described business monitoring platform device return with institute State initial suspicious member's account of described target service corresponding to traffic type information.
In another optional implementation, described selection unit 620 can include (not showing in Fig. 6 Go out):
Member's dimension type obtains subelement, is that the member that described target service configures ties up in advance for obtaining Degree type;
Target members's dimensional relationships table obtains subelement, for from the multiple member's dimensional relationships pre-saved Table obtains the target members dimensional relationships table corresponding with described member's dimension type, wherein, each member Dimensional relationships table preserves the corresponding relation between registered member's account and dimension mark;
Wherein, described dimension mark includes: the device identification of the used equipment of accredited members' account, registration The identity of the used identity card of member's account.
In another optional implementation, described signal generating unit 630 can include (not showing in Fig. 6 Go out):
Subelement searched by target members's dimensional relationships table, for each initial suspicious member's account as key Word, searches described target members's dimensional relationships table, it is thus achieved that corresponding with described each initial suspicious member's account Target dimension mark;
Suspicious member's account obtains subelement, for obtaining and institute from described target members's dimensional relationships table State other suspicious member's accounts that target dimension mark is corresponding, described initial suspicious member's account with described its He forms target suspicious member account at suspicious member's account;
Account relating relation generates subelement, generates each initial suspicious member's account and corresponding its respectively Incidence relation between his suspicious member's account, closes as the association between described target suspicious member account System.
In another optional implementation, described recognition unit 640 can include (not showing in Fig. 6 Go out):
Connected subgraph generates subelement, for calling default connected graph algorithm member suspicious to described target Incidence relation between account processes, and generates at least one connected subgraph, in each connected subgraph The corresponding suspicious member's account of each member node;
Target gang member account identification subelement, for according to one target group of each connected subgraph identification Partner's member's account, comprises the multiple member node in described connected subgraph in described target gang member account Corresponding suspicious member's account.
Wherein, described target gang member account identification subelement, specifically for by each connected subgraph Suspicious member's account corresponding to all member node be identified as a target gang member account.
Described target gang member account identification subelement, specifically for calculating the one-tenth in each connected subgraph Member's node weighted value in described connected subgraph, by weighted value more than the member node presetting weight threshold Corresponding suspicious member's account is identified as a target gang member account.
In another optional implementation, described combining unit 660 can include (not showing in Fig. 6 Go out):
Target histories clique mark obtains subelement, for searching institute in described history suspicious member account State the suspicious member's account in target gang member account, it is thus achieved that corresponding with the suspicious member's account found Target histories clique mark;
Target histories suspicious member account obtains subelement, for from described history gang member account list Middle acquisition identifies corresponding target histories suspicious member account with described target histories clique;
Merge gang member account and generate subelement, for by suspicious for described target histories member's account and institute The suspicious member's account stated in target gang member account merges, and generates and merges gang member account.
In said apparatus, the function of unit and the process that realizes of effect specifically refer in said method corresponding Step realize process, do not repeat them here.
For device embodiment, owing to it corresponds essentially to embodiment of the method, so relevant part ginseng See that the part of embodiment of the method illustrates.Device embodiment described above is only schematically, The wherein said unit illustrated as separating component can be or may not be physically separate, makees The parts shown for unit can be or may not be physical location, i.e. may be located at a place, Or can also be distributed on multiple NE.Can select according to the actual needs part therein or The whole module of person realizes the purpose of the application scheme.Those of ordinary skill in the art are not paying creativeness In the case of work, i.e. it is appreciated that and implements.
As seen from the above-described embodiment, this embodiment can pass through initial suspicious member's account of target service, And the target members's dimensional relationships table for target service selection, it is thus achieved that with initial suspicious member's account relating Potential suspicious member's account, thus generate the incidence relation between target suspicious member account, and pass through This incidence relation identification target gang member account.Owing to the process of above-mentioned identification gang member account is permissible Being automatically performed by identification equipment, therefore recognition efficiency is higher, and owing to can recognize that gang member Potential suspicious member's account in account, therefore improves the accuracy of recognition result.
Those skilled in the art, after considering description and putting into practice invention disclosed herein, will readily occur to this Other embodiment of application.The application is intended to any modification, purposes or the adaptability of the application Change, these modification, purposes or adaptations are followed the general principle of the application and include this Shen Please undocumented common knowledge in the art or conventional techniques means.Description and embodiments only by Being considered as exemplary, the true scope of the application and spirit are pointed out by claim below.
It should be appreciated that the application be not limited to described above and illustrated in the accompanying drawings accurately Structure, and various modifications and changes can carried out without departing from the scope.Scope of the present application is only by institute Attached claim limits.

Claims (19)

1. the recognition methods of a gang member account, it is characterised in that described method includes:
Obtain initial suspicious member's account of target service, and be that described target service selects target members's dimension Degree relation table;
According to described initial suspicious member's account and described target members's dimensional relationships table, generate target suspicious Incidence relation between member's account;
By the incidence relation identification target gang member account between described target suspicious member account, often The arbitrary suspicious member's account comprised in individual target gang member account and other at least one suspicious member's accounts There is between number direct correlation relation.
Method the most according to claim 1, it is characterised in that described acquisition target service initial Suspicious member's account, including:
The traffic type information of target service is sent to business monitoring platform device;
Receive the described target corresponding with described traffic type information that described business monitoring platform device returns Initial suspicious member's account of business.
Method the most according to claim 1, it is characterised in that described select for described target service Target members's dimensional relationships table, including:
Acquisition is member's dimension type of described target service configuration in advance;
The mesh corresponding with described member's dimension type is obtained from the multiple member's dimensional relationships tables pre-saved Mark member's dimensional relationships table, wherein, preserves registered member's account and dimension in each member's dimensional relationships table Corresponding relation between scale knowledge.
Method the most according to claim 3, it is characterised in that the initial suspicious member's account of described basis Number and described target members's dimensional relationships table, generate the incidence relation between target suspicious member account, bag Include:
With each initial suspicious member's account as keyword, search described target members's dimensional relationships table, obtain Target dimension that must be corresponding with described each initial suspicious member's account identifies;
Obtain suspicious with described target dimension corresponding other of mark from described target members's dimensional relationships table Member's account, described initial suspicious member's account and other suspicious member's accounts described composition target suspicious become Member's account;
Generate the association between each initial suspicious member's account and other corresponding suspicious member's accounts respectively Relation, as the incidence relation between described target suspicious member account.
Method the most according to claim 1, it is characterised in that described by the suspicious one-tenth of described target Incidence relation identification target gang member account between member's account, including:
Call at the incidence relation between default connected graph algorithm member suspicious to described target account Reason, generates at least one connected subgraph, and each member node correspondence one in each connected subgraph is suspicious Member's account;
According to one target gang member account of each connected subgraph identification, described target gang member account In comprise suspicious member's account that the multiple member node in described connected subgraph are corresponding.
Method the most according to claim 5, it is characterised in that described know according to each connected subgraph An other target gang member account, including:
Suspicious member's account corresponding for all member node in each connected subgraph is identified as a target Gang member account.
Method the most according to claim 5, it is characterised in that described know according to each connected subgraph An other target gang member account, including:
Calculate the weighted value in described connected subgraph of the member node in each connected subgraph;
Suspicious member's account corresponding more than the member node presetting weight threshold for weighted value is identified as one Target gang member account.
8. according to the arbitrary described method of claim 1 to 7, it is characterised in that described method also includes:
Call the history gang member account list pre-saved, in described history gang member account list Comprise the corresponding relation of history suspicious member account and history clique mark;
According to described history gang member account list, member account suspicious to described history and described target Suspicious member's account in gang member account merges, and generates and merges gang member account.
Method the most according to claim 8, it is characterised in that described according to described history clique one-tenth Member account list, member account suspicious to described history with in described target gang member account suspicious become Member's account merges, and generates and merges gang member account, including:
The suspicious member's account in described target gang member account is searched in described history suspicious member account Number, it is thus achieved that the target histories clique mark corresponding with the suspicious member's account found;
Obtain from described history gang member account list and identify corresponding mesh with described target histories clique Mark history suspicious member account;
By suspicious for described target histories member's account and the suspicious member's account in described target gang member account Number merge, generate and merge gang member account.
10. the identification device of a gang member account, it is characterised in that described device includes:
Acquiring unit, for obtaining initial suspicious member's account of target service;
Select unit, for selecting target members's dimensional relationships table for described target service;
Signal generating unit, is used for according to described initial suspicious member's account and described target members's dimensional relationships table, Generate the incidence relation between target suspicious member account;
Recognition unit, for by the incidence relation identification target group between described target suspicious member account Partner's member's account, the arbitrary suspicious member's account comprised in each target gang member account is with other at least Between one suspicious member's account, there is direct correlation relation.
11. devices according to claim 10, it is characterised in that described acquiring unit includes:
Traffic type information sends subelement, for sending the industry of target service to business monitoring platform device Service type information;
Suspicious member's account receive subelement, for receive described business monitoring platform device return with institute State initial suspicious member's account of described target service corresponding to traffic type information.
12. devices according to claim 10, it is characterised in that described selection unit includes:
Member's dimension type obtains subelement, is that the member that described target service configures ties up in advance for obtaining Degree type;
Target members's dimensional relationships table obtains subelement, for from the multiple member's dimensional relationships pre-saved Table obtains the target members dimensional relationships table corresponding with described member's dimension type, wherein, each member Dimensional relationships table preserves the corresponding relation between registered member's account and dimension mark.
13. devices according to claim 12, it is characterised in that described signal generating unit includes:
Subelement searched by target members's dimensional relationships table, for each initial suspicious member's account as key Word, searches described target members's dimensional relationships table, it is thus achieved that corresponding with described each initial suspicious member's account Target dimension mark;
Suspicious member's account obtains subelement, for obtaining and institute from described target members's dimensional relationships table State other suspicious member's accounts that target dimension mark is corresponding, described initial suspicious member's account with described its He forms target suspicious member account at suspicious member's account;
Account relating relation generates subelement, generates each initial suspicious member's account and corresponding its respectively Incidence relation between his suspicious member's account, closes as the association between described target suspicious member account System.
14. devices according to claim 10, it is characterised in that described recognition unit includes:
Connected subgraph generates subelement, for calling default connected graph algorithm member suspicious to described target Incidence relation between account processes, and generates at least one connected subgraph, in each connected subgraph The corresponding suspicious member's account of each member node;
Target gang member account identification subelement, for according to one target group of each connected subgraph identification Partner's member's account, comprises the multiple member node in described connected subgraph in described target gang member account Corresponding suspicious member's account.
15. devices according to claim 14, it is characterised in that
Described target gang member account identification subelement, specifically for by owning in each connected subgraph Suspicious member's account corresponding to member node is identified as a target gang member account.
16. devices according to claim 14, it is characterised in that
Described target gang member account identification subelement, specifically for calculating the one-tenth in each connected subgraph Member's node weighted value in described connected subgraph, by weighted value more than the member node presetting weight threshold Corresponding suspicious member's account is identified as a target gang member account.
17. according to the arbitrary described device of claim 10 to 16, it is characterised in that described device is also Including:
Call unit, for calling the history gang member account list pre-saved, described history clique Member's account list comprises the corresponding relation of history suspicious member account and history clique mark;
Combining unit, for according to described history gang member account list, member suspicious to described history Account merges with the suspicious member's account in described target gang member account, generates and merges clique's one-tenth Member's account.
18. devices according to claim 17, it is characterised in that described combining unit includes:
Target histories clique mark obtains subelement, for searching institute in described history suspicious member account State the suspicious member's account in target gang member account, it is thus achieved that corresponding with the suspicious member's account found Target histories clique mark;
Target histories suspicious member account obtains subelement, for from described history gang member account list Middle acquisition identifies corresponding target histories suspicious member account with described target histories clique;
Merge gang member account and generate subelement, for by suspicious for described target histories member's account and institute The suspicious member's account stated in target gang member account merges, and generates and merges gang member account.
The identification equipment of 19. 1 kinds of gang member accounts, it is characterised in that including:
Processor;For storing the memorizer of described processor executable;
Wherein, described processor is configured to:
Obtain initial suspicious member's account of target service, and be that described target service selects target members's dimension Degree relation table;
According to described initial suspicious member's account and described target members's dimensional relationships table, generate target suspicious Incidence relation between member's account;
By the incidence relation identification target gang member account between described target suspicious member account, often The arbitrary suspicious member's account comprised in individual target gang member account and other at least one suspicious member's accounts There is between number direct correlation relation.
CN201510275577.8A 2015-05-26 2015-05-26 The recognition methods of gang member account, device and equipment Pending CN106301978A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510275577.8A CN106301978A (en) 2015-05-26 2015-05-26 The recognition methods of gang member account, device and equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510275577.8A CN106301978A (en) 2015-05-26 2015-05-26 The recognition methods of gang member account, device and equipment

Publications (1)

Publication Number Publication Date
CN106301978A true CN106301978A (en) 2017-01-04

Family

ID=57635304

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510275577.8A Pending CN106301978A (en) 2015-05-26 2015-05-26 The recognition methods of gang member account, device and equipment

Country Status (1)

Country Link
CN (1) CN106301978A (en)

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107294974A (en) * 2017-06-26 2017-10-24 阿里巴巴集团控股有限公司 The method and apparatus for recognizing target clique
CN107563885A (en) * 2017-08-08 2018-01-09 阿里巴巴集团控股有限公司 A kind of arbitrage recognition methods and device
CN108295476A (en) * 2018-03-06 2018-07-20 网易(杭州)网络有限公司 The method and apparatus for determining abnormal interactive account
CN109213801A (en) * 2018-08-09 2019-01-15 阿里巴巴集团控股有限公司 Data digging method and device based on incidence relation
CN109271418A (en) * 2018-08-14 2019-01-25 阿里巴巴集团控股有限公司 Suspicious clique's recognition methods, device, equipment and computer readable storage medium
CN109460930A (en) * 2018-11-15 2019-03-12 武汉斗鱼网络科技有限公司 A kind of method and relevant device of determining adventure account
CN109615524A (en) * 2019-01-08 2019-04-12 平安科技(深圳)有限公司 Recognition methods, device, computer equipment and the storage medium of crime of laundering clique
CN110009473A (en) * 2018-12-27 2019-07-12 阿里巴巴集团控股有限公司 Data processing method, device, equipment and storage medium
CN110210883A (en) * 2018-05-09 2019-09-06 腾讯科技(深圳)有限公司 The recognition methods of team control account, device, server and storage medium
CN111026818A (en) * 2019-12-17 2020-04-17 厦门市美亚柏科信息股份有限公司 Multi-object associated view construction method, terminal device and storage medium
CN111552717A (en) * 2020-04-23 2020-08-18 广州市百果园信息技术有限公司 Method, device, server and storage medium for identifying disguised object
CN111651741A (en) * 2020-06-05 2020-09-11 腾讯科技(深圳)有限公司 User identity recognition method and device, computer equipment and storage medium
CN111754338A (en) * 2020-06-30 2020-10-09 上海观安信息技术股份有限公司 Method and system for identifying link loan website group
CN112182520A (en) * 2019-07-03 2021-01-05 腾讯科技(深圳)有限公司 Illegal account identification method and device, readable medium and electronic equipment
WO2021135540A1 (en) * 2020-06-24 2021-07-08 平安科技(深圳)有限公司 Neo4j-based anomalous user processing method and apparatus, computer device, and medium
CN113313505A (en) * 2020-02-25 2021-08-27 中国移动通信集团浙江有限公司 Abnormity positioning method and device and computing equipment
CN113904943A (en) * 2021-09-26 2022-01-07 北京百度网讯科技有限公司 Account detection method and device, electronic equipment and storage medium
CN114116799A (en) * 2021-11-23 2022-03-01 河北航天信息技术有限公司 Abnormal transaction loop identification method, device, terminal and storage medium
CN114676288A (en) * 2022-03-17 2022-06-28 北京悠易网际科技发展有限公司 ID pull-through method and device

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060149674A1 (en) * 2004-12-30 2006-07-06 Mike Cook System and method for identity-based fraud detection for transactions using a plurality of historical identity records
CN103368917A (en) * 2012-04-01 2013-10-23 阿里巴巴集团控股有限公司 Method and system for risk control of network virtual users
CN103581355A (en) * 2012-08-02 2014-02-12 北京千橡网景科技发展有限公司 Method and device for handling abnormal behaviors of user
CN103778151A (en) * 2012-10-23 2014-05-07 阿里巴巴集团控股有限公司 Method and device for identifying characteristic group and search method and device
WO2014110370A2 (en) * 2013-01-11 2014-07-17 Alibaba Group Holding Limited Method and apparatus of identifying a website user
CN104573017A (en) * 2015-01-09 2015-04-29 北京网智天元科技股份有限公司 Network water army group identifying method and system

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060149674A1 (en) * 2004-12-30 2006-07-06 Mike Cook System and method for identity-based fraud detection for transactions using a plurality of historical identity records
CN103368917A (en) * 2012-04-01 2013-10-23 阿里巴巴集团控股有限公司 Method and system for risk control of network virtual users
CN103581355A (en) * 2012-08-02 2014-02-12 北京千橡网景科技发展有限公司 Method and device for handling abnormal behaviors of user
CN103778151A (en) * 2012-10-23 2014-05-07 阿里巴巴集团控股有限公司 Method and device for identifying characteristic group and search method and device
WO2014110370A2 (en) * 2013-01-11 2014-07-17 Alibaba Group Holding Limited Method and apparatus of identifying a website user
CN104573017A (en) * 2015-01-09 2015-04-29 北京网智天元科技股份有限公司 Network water army group identifying method and system

Cited By (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491819A (en) * 2017-06-26 2021-03-12 创新先进技术有限公司 Method and device for identifying target group
CN107294974B (en) * 2017-06-26 2020-10-02 阿里巴巴集团控股有限公司 Method and device for identifying target group
CN112491819B (en) * 2017-06-26 2022-09-20 创新先进技术有限公司 Method and device for identifying target group
CN107294974A (en) * 2017-06-26 2017-10-24 阿里巴巴集团控股有限公司 The method and apparatus for recognizing target clique
CN107563885A (en) * 2017-08-08 2018-01-09 阿里巴巴集团控股有限公司 A kind of arbitrage recognition methods and device
CN108295476A (en) * 2018-03-06 2018-07-20 网易(杭州)网络有限公司 The method and apparatus for determining abnormal interactive account
CN110210883B (en) * 2018-05-09 2023-08-22 腾讯科技(深圳)有限公司 Group control account identification method, device, server and storage medium
CN110210883A (en) * 2018-05-09 2019-09-06 腾讯科技(深圳)有限公司 The recognition methods of team control account, device, server and storage medium
CN109213801A (en) * 2018-08-09 2019-01-15 阿里巴巴集团控股有限公司 Data digging method and device based on incidence relation
CN109271418A (en) * 2018-08-14 2019-01-25 阿里巴巴集团控股有限公司 Suspicious clique's recognition methods, device, equipment and computer readable storage medium
CN109271418B (en) * 2018-08-14 2022-03-04 蚂蚁智安安全技术(上海)有限公司 Suspicious group identification method, device, equipment and computer readable storage medium
CN109460930A (en) * 2018-11-15 2019-03-12 武汉斗鱼网络科技有限公司 A kind of method and relevant device of determining adventure account
CN109460930B (en) * 2018-11-15 2021-11-26 武汉斗鱼网络科技有限公司 Method for determining risk account and related equipment
CN110009473A (en) * 2018-12-27 2019-07-12 阿里巴巴集团控股有限公司 Data processing method, device, equipment and storage medium
CN109615524B (en) * 2019-01-08 2024-04-26 平安科技(深圳)有限公司 Money laundering crime group partner identification method, money laundering crime group partner identification device, computer equipment and storage medium
CN109615524A (en) * 2019-01-08 2019-04-12 平安科技(深圳)有限公司 Recognition methods, device, computer equipment and the storage medium of crime of laundering clique
CN112182520B (en) * 2019-07-03 2024-01-26 腾讯科技(深圳)有限公司 Identification method and device of illegal account number, readable medium and electronic equipment
CN112182520A (en) * 2019-07-03 2021-01-05 腾讯科技(深圳)有限公司 Illegal account identification method and device, readable medium and electronic equipment
CN111026818A (en) * 2019-12-17 2020-04-17 厦门市美亚柏科信息股份有限公司 Multi-object associated view construction method, terminal device and storage medium
CN113313505A (en) * 2020-02-25 2021-08-27 中国移动通信集团浙江有限公司 Abnormity positioning method and device and computing equipment
CN111552717B (en) * 2020-04-23 2023-04-18 广州市百果园信息技术有限公司 Method, device, server and storage medium for identifying disguised object
CN111552717A (en) * 2020-04-23 2020-08-18 广州市百果园信息技术有限公司 Method, device, server and storage medium for identifying disguised object
CN111651741A (en) * 2020-06-05 2020-09-11 腾讯科技(深圳)有限公司 User identity recognition method and device, computer equipment and storage medium
CN111651741B (en) * 2020-06-05 2024-05-07 腾讯科技(深圳)有限公司 User identity recognition method, device, computer equipment and storage medium
WO2021135540A1 (en) * 2020-06-24 2021-07-08 平安科技(深圳)有限公司 Neo4j-based anomalous user processing method and apparatus, computer device, and medium
CN111754338B (en) * 2020-06-30 2024-02-23 上海观安信息技术股份有限公司 Method and system for identifying partner of trepanning loan website
CN111754338A (en) * 2020-06-30 2020-10-09 上海观安信息技术股份有限公司 Method and system for identifying link loan website group
CN113904943A (en) * 2021-09-26 2022-01-07 北京百度网讯科技有限公司 Account detection method and device, electronic equipment and storage medium
CN113904943B (en) * 2021-09-26 2024-04-05 北京百度网讯科技有限公司 Account detection method and device, electronic equipment and storage medium
CN114116799A (en) * 2021-11-23 2022-03-01 河北航天信息技术有限公司 Abnormal transaction loop identification method, device, terminal and storage medium
CN114676288A (en) * 2022-03-17 2022-06-28 北京悠易网际科技发展有限公司 ID pull-through method and device

Similar Documents

Publication Publication Date Title
CN106301978A (en) The recognition methods of gang member account, device and equipment
US11388198B2 (en) Collaborative database and reputation management in adversarial information environments
US11263344B2 (en) Data management method and registration method for an anonymous data sharing system, as well as data manager and anonymous data sharing system
US11256683B2 (en) Method and apparatus for integrating multi-data source user information
US9785989B2 (en) Determining a characteristic group
US20160246981A1 (en) Data secrecy statistical processing system, server device for presenting statistical processing result, data input device, and program and method therefor
US11669549B2 (en) Identity mapping for cloud migrations
TW201905733A (en) Multi-source data fusion method and device
KR102227593B1 (en) System and method for learning-based group tagging
CN110099059A (en) A kind of domain name recognition methods, device and storage medium
US20210263927A1 (en) Efficient access of chainable records
Tourani et al. Multiple observation processes in spatial capture–recapture models: How much do we gain?
US11250166B2 (en) Fingerprint-based configuration typing and classification
CN104618304B (en) Data processing method and data handling system
CN106251114B (en) Method and device for realizing approval in application
CN109740129B (en) Report generation method, device and equipment based on blockchain and readable storage medium
US20130179421A1 (en) System and Method for Collecting URL Information Using Retrieval Service of Social Network Service
CN110046155B (en) Method, device and equipment for updating feature database and determining data features
US10929389B2 (en) Data provenance using distributed ledgers
US8839449B1 (en) Assessing risk of information leakage
CN105447148B (en) A kind of Cookie mark correlating method and device
CN113641742A (en) Data extraction method, device, equipment and storage medium
CN109344173A (en) Data managing method and device, data structure
CN110297948B (en) Relational network construction method and device
CN109962907B (en) User identity recognition method based on big data and terminal equipment

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20170104