CN106549974A - Prediction the social network account whether equipment of malice, method and system - Google Patents

Prediction the social network account whether equipment of malice, method and system Download PDF

Info

Publication number
CN106549974A
CN106549974A CN201611109776.2A CN201611109776A CN106549974A CN 106549974 A CN106549974 A CN 106549974A CN 201611109776 A CN201611109776 A CN 201611109776A CN 106549974 A CN106549974 A CN 106549974A
Authority
CN
China
Prior art keywords
account
social network
malice
data
social
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201611109776.2A
Other languages
Chinese (zh)
Other versions
CN106549974B (en
Inventor
杨旭
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
WUXI PUBLIC SECURITY BUREAU
Beijing Knownsec Information Technology Co Ltd
Original Assignee
WUXI PUBLIC SECURITY BUREAU
Beijing Knownsec Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by WUXI PUBLIC SECURITY BUREAU, Beijing Knownsec Information Technology Co Ltd filed Critical WUXI PUBLIC SECURITY BUREAU
Priority to CN201611109776.2A priority Critical patent/CN106549974B/en
Publication of CN106549974A publication Critical patent/CN106549974A/en
Application granted granted Critical
Publication of CN106549974B publication Critical patent/CN106549974B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a kind of prediction social network account whether equipment of malice, is suitable to be connected with the social network server for providing social networking service, wherein social network server allows user to be operated with social network account, and the equipment includes：Account data acquisition module, is suitable to from social network server obtain the account data of multiple social network accounts；Account features extraction module, is suitable to the account data according to acquired multiple social network accounts, extracts the account features of one of social network account, and account features at least include account purposes and the account malice degree of association；And account malice prediction module, the account features according to a social network account are suitable to, predict the social network account whether maliciously using the disaggregated model for pre-building.The invention also discloses corresponding method and detection the social network account whether equipment of malice, the method for detection social network account malicious act.

Description

Prediction the social network account whether equipment of malice, method and system
Technical field
The present invention relates to field of information security technology, more particularly to a kind of prediction social network account malice sets Standby, method and system.
Background technology
As the developing rapidly of the network communications technology, the lasting in-depth of internet, applications, institute's carrying information become increasingly abundant, The Internet has become the important infrastructure of human society, and at the same time, network security problem is also increasingly serious.Wherein, telecommunications Swindle is increasingly becoming a kind of important means of crime of harm public's property safety.
At present, it is that hostile network address and rogue program are downloaded to carry out for the major way administered by telecommunication fraud Administer, although this kind of mode serves containment effect to a certain extent to telecommunication fraud, as which cannot be monitored by society The swindle link that the communication of network is transmitted is handed over, also None- identified goes out the malice social networkies that those are engaged in malice fraud Account, causes still have the case greatly swindled by social networking service.Accordingly, it is determined that social networkies Whether malice is extremely important to the preventing and treating of telecommunication fraud for account.
Therefore, in the urgent need to a kind of to the social network account whether scheme for being maliciously predicted and detecting.
The content of the invention
For this purpose, the present invention provides a kind of to the social network account whether scheme for being maliciously predicted and detecting, with power At least one problem for existing above certainly or is at least alleviated in diagram.
According to an aspect of the invention, there is provided a kind of prediction social network account whether equipment of malice, be suitable to The social network server for providing social networking service is connected, and wherein social network server allows user with social networkies account Family is operated, and equipment includes：Account data acquisition module, is suitable to obtain multiple social network accounts from social network server Account data；Account features extraction module, is suitable to the account data according to acquired multiple social network accounts, extracts which In a social network account account features, account features at least include account purposes and the account malice degree of association；And account Family malice prediction module, is suitable to the account features according to a social network account, using the disaggregated model prediction for pre-building Maliciously whether the social network account.
According to a further aspect in the invention, there is provided a kind of detection social network account whether system of malice, be suitable to The social network server or client for providing social networking service is connected, and wherein social network server allows user with society Network account is handed over to be operated, system includes：Be stored with the malice account storage device of known malice social network account；Deposit Contain the doubtful malice account storage device of doubtful malice social network account；It is of the invention to predict that social network account is The equipment of no malice；Communication monitoring equipment；And the equipment of detection social network account malicious act；Wherein, communication monitoring sets It is standby to reside in social network server or client, it is suitable to monitor the communication of social network server or client, obtains and send out Play communication and receive multiple social network accounts of the communication, and send to the equipment of detection social network account malicious act； The request for obtaining the content for communicating of the equipment in response to carrying out Autonomous test social network account malicious act is further adapted for, by communication Content is sent to the equipment of detection social network account malicious act；The equipment of detection social network account malicious act is suitable to sentence Whether any one social network account that disconnecting is received is located in doubtful malice account storage device；If so, then to communication monitoring Device request obtains the content of the communication；Judge whether the content for communicating includes the network address, if so, then obtain the network address Corresponding Web content；Judge whether the Web content is related to malicious act, if, it is determined that send the social activity of the network address Network account is malice social network account, and is stored into malice account storage device.
According to a further aspect in the invention, there is provided a kind of prediction social network account whether method of malice, it is suitable to Perform in the equipment being connected with the social network server for providing social networking service, wherein social network server allows to use Family is operated with social network account, and method includes step：Multiple social network accounts are obtained from social network server Account data；According to the account data of acquired multiple social network accounts, the account of one of social network account is extracted Family feature, account features at least include account purposes and the account malice degree of association；And according to the account of a social network account Maliciously whether family feature, predict the social network account using the disaggregated model for pre-building.
It is of the invention to also have on one side, there is provided a kind of method of detection social network account malicious act, fit In detection social network account malicious act equipment on perform, detect social network account malicious act equipment respectively with Reside in provide social networking service social network server or client in communication monitoring equipment, be stored with known evil The doubtful malice account of the malice account storage device and the doubtful malice social network account that is stored with of meaning social network account Storage device is mutually coupled, and wherein social network server allows user to be operated with social network account, and method includes step： Receive communication is initiated in the social network server or client of communication monitoring equipment and receive multiple social activities of the communication Network account；Whether any one social network account that judgement is received is located in doubtful malice account storage device；If so, then The content of communication is obtained to communication monitoring device request；Receive the content of the communication from communication monitoring equipment；Judge communication Whether content includes the network address；If so, then obtain the corresponding Web content in the network address；Judge whether the Web content relates to And malicious act；And if, it is determined that the social network account for sending the network address is malice social network account, and is deposited Store up into malice account storage device.
Whether the scheme selection of malice can embody social network account to prediction social network account of the invention is Whether the account features of no malice, be maliciously predicted to social network account using disaggregated model, accurately and effectively.Wherein, Name on account, remarks, the group for adding are grouped respectively by clustering algorithm, can effectively obtain the account of social network account Purposes, while the incidence relation figure by setting up social network account, can effectively obtain the account malice of social network account The degree of association.
In addition, the detection social network account of the invention whether scheme of malice, is predicted to be malice by obtaining The communication initiated of doubtful malice social network account, and judge whether the content of the communication is related to malicious act, one can be entered Step ground determines doubtful malice social network account whether malice social network account, further increases the accuracy of judgement, has Effect avoids erroneous judgement.
Description of the drawings
In order to realize above-mentioned and related purpose, some illustrative sides are described herein in conjunction with explained below and accompanying drawing Face, indicate in terms of these can be to put into practice principles disclosed herein various modes, and all aspects and its equivalent aspect It is intended to fall under in the range of theme required for protection.By being read in conjunction with the accompanying detailed description below, the disclosure it is above-mentioned And other purposes, feature and advantage will be apparent from.Throughout the disclosure, identical reference generally refers to identical Part or element.
Fig. 1 shows the structured flowchart of the social networking system 100 of an illustrative embodiments of the invention；
Fig. 2 shows whether malice is for the detection social network account of an illustrative embodiments of the invention The structured flowchart of system 200；
Fig. 3 shows whether malice sets for the prediction social network account of an illustrative embodiments of the invention Standby 210 structured flowchart；
Fig. 4 shows showing for the incidence relation figure of the social network account of an illustrative embodiments of the invention It is intended to；
Fig. 5 shows the incidence relation figure of the social network account of another illustrative embodiments of the invention Schematic diagram；
Fig. 6 shows the prediction social network account of an illustrative embodiments of the invention whether side of malice The flow chart of method 300；And
Fig. 7 shows the side of the detection social network account malicious act of an illustrative embodiments of the invention The flow chart of method 400.
Specific embodiment
The exemplary embodiment of the disclosure is more fully described below with reference to accompanying drawings.Although the disclosure is shown in accompanying drawing Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure and should not be by embodiments set forth here Limited.On the contrary, there is provided these embodiments are able to be best understood from the disclosure, and can be by the scope of the present disclosure Complete conveys to those skilled in the art.
Fig. 1 shows the structured flowchart of social networking system 100 according to one exemplary embodiment.As schemed Shown in 1, social networking system 100 can provide a user with social networking service, and including at least one social network client 110 and social network server 120.Wherein, social network server 120 allows user to be operated with social network account. It is to be appreciated that user is before being operated with social network account, first need to be input into one on social network server 120 A little basic information (such as pet name, name, mailbox, telephone number etc.), to create the social network account for belonging to the user.Wound The social network account built represents that with account identification account mark can be with the unique mark social network account.
Social network client 110 is connected by the Internet with social network server 120, is creating social networkies account After family, user can utilize these social network clients 110, be operated with the social network account for creating, behaviour here Make including but not limited to socially relevant operation (such as add good friend, add group etc.), and the related operation of finance is (for example Carry out consuming, transfer accounts), and the operation related to communication (for example send group message, send single-point message etc.).Social network Network server 120 can be counted to these operations, generate such as information such as good friend's quantity, group's quantity, consumption number of times.This Outward, social network server 120 can with according to the service condition of social network account generate such as account levels, use when Between, the information such as liveness.
It is to be appreciated that above- mentioned information defines the data of each social network account, and it is stored in social networking service In device 120.
Fig. 2 shows the detection social network account according to one exemplary embodiment whether system of malice 200 structured flowchart.As shown in Fig. 2 the system 200 and social network server 120 of detection social network account whether malice Or client 110 is connected, it is possible to including prediction the social network account whether equipment 210 of malice, communication monitoring equipment 220th, equipment 230, malice social network account storage device 240 and the doubtful malice of social network account malicious act are detected Social network account storage device 250.
Whether the equipment 210 of malice is connected prediction social network account with social network server 120, can obtain social activity The account data of the social network account stored on the webserver 120, according to the account data prediction social network account Whether maliciously.Fig. 3 shows whether malice sets for prediction social network account according to one exemplary embodiment Standby 210 structured flowchart.As shown in figure 3, predicting social network account whether can adopt including account data by the equipment 210 of malice Collection module 211, account features extraction module 212 and account malice prediction module 213.
Account data acquisition module 211 is may reside within social network server 120, from social network server 120 The account data of multiple social network accounts is obtained, account data generally includes those as prediction social network account can be The data of the foundation of no malice, for example, can include at least one of data below type：Account levels, name on account, account Family remarks, account whether real name registration, address name, ID (identity number) card No., telephone number, mailbox, bank card number, log in IP ground Location, log in MAC Address, good friend's quantity, actively good friend's quantity of addition, good friend's quantity of passive addition, add from group Group that the interactive number of times of good friend's quantity and good friend, the number of times of present itself, account are added, consumption number of times, number of times of transferring accounts, connect Number of times that receipts are transferred accounts, the quantity of message, single-point message number and group message and single-point message number are sent in group Ratio.
Wherein it is possible to understand ground, account levels obtain generally according to account use time and liveness, can be used for sentencing Whether the disconnected account is provisional registration.Name on account, can be used for catching the name Habit Preference or account purposes of user.Account Family remarks, indicate the key word of purposes due to would generally wherein be labeled with " customer service ", " assistant " etc., can be used for judging that account is used On the way.Account whether register by real name, as the account for being engaged in malicious act will not generally carry out real name registration, therefore can be used for pre- Account is surveyed whether maliciously.ID (identity number) card No., mailbox, bank card number, login IP address and login MAC Address, due to crime point Son would generally go the different account of batch registration using same identity, therefore these data can be by detecting whether which is repeated Using predicting account whether malice.
In order to reduce the risk blown one's cover, the generally seldom true participation of social network account for being engaged in malicious act is social Social behaviors in network, thus good friend's quantity, actively good friend's quantity of addition, good friend's quantity of passive addition, from group These data of group that the interactive number of times of good friend's quantity of addition and good friend, the number of times of present itself, account are added can be fine Whether maliciously ground be used to distinguish social network account.
Similarly, the social network account for being engaged in malicious act is generally rarely employed payment function, therefore consumption number of times, turns Number of times these data that account number of times, reception are transferred accounts can be used for distinguishing social network account whether malice.
Although and the social network account for being engaged in malicious act seldom truly participates in the Social behaviors in social networkies, leading to Often can propagate fraud information in group or individually, thus send in group the quantity of message, single-point message number and The ratio of group message and single-point message number can also be used as the prediction social network account whether foundation of malice.
So, by obtaining these data, effectively whether social network account maliciously can be predicted, and improve The accuracy of prediction.
Account features extraction module 212 is connected with account data acquisition module 211, can receive account data collection mould The account data of multiple social network accounts that block 211 is obtained, and according to the account number of acquired multiple social network accounts According to the account features of the one of social network account of extraction.
Account features can include account purposes, an embodiment of the invention, each social network account Account data can include account purposes data, and account purposes data can indicate the purposes of social network account.According to above-mentioned To account can be included as the prediction social network account whether analysis of the data of the foundation of malice, account purposes data The data of at least one data type, account features in these three data types of group that title, account remarks and account are added Extraction module 212 can determine the social networkies account according to the account purposes data in the account data of a social network account The account purposes at family.
Can there are multiple data, account under these three data types of group that name on account, account remarks and account are added Characteristic extracting module 212 can be directed to each data type in account purposes data, obtain account data acquisition module 211 In the account data of accessed multiple social network accounts, these data are adopted clustering algorithm by the data of the data type It is grouped, and the packet according to belonging to each data in the account purposes data of a social network account is determined the social activity The account purposes of network account.Using clustering algorithm can be k-means algorithms, can also be that other can be used for basis The clustering algorithm are grouped by data, the present invention are without limitation.
Below by citing illustrating the original that account features extraction module 212 determines the account purposes of social network account Reason.
Assume that the account purposes data that account data acquisition module 211 is obtained include name on account, account remarks and account The data of these three data types of group that family adds.Account data acquisition module 211 gets social network account A, B, C, D Account data.
Wherein, in the account data of social network account A, data type has " xx sells A ", number for the data of name on account Have " xx sale " according to data of the type for account remarks, data type is that the data of the group that account is added have " xx sells group ". In the account data of social network account B, data type has " xx promotes B " for the data of name on account, and data type is account The data of remarks have " xx popularizations ", and data type is that the data of the group that account is added have " xx promotes group ".Social network account C Account data in, data type has " xx customer service C " for the data of name on account, and data type has for the data of account remarks " xx customer services ", data type are that the data of the group that account is added have " xx customer service groups ".The account data of social network account D In, data type has " xx user D " for the data of name on account, and data type has " xx user " for the data of account remarks, number There is " xx friend groups " according to the data that type is the group that account is added.
Using k-means algorithms, it is the number of the group of name on account, account remarks and account addition respectively to data type According to being grouped.That is, respectively to (xx sells A, and xx promotes B, xx customer service C, xx user D), (xx sale, xx popularizations, xx Customer service, xx user) and (xx sells group, and xx promotes group, xx customer service groups, xx friend groups) these three data sets be grouped.
Here account purposes can include sale, customer service and user, then data set can be divided into sale packet, customer service Packet and user grouping.Using the group result of (xx sells A, and xx promotes B, xx customer service C, xx user D) after k-means algorithms For：Xx sells A and xx and promotes B to sell packet, and xx customer services C is grouped for customer service, and xx user D is user grouping.(xx sells, xx Promote, xx customer services, xx user) group result be：Xx sells and xx is extended to sale packet, and xx customer services are grouped for customer service, xx User is user grouping.The group result of (xx sells group, and xx promotes group, xx customer service groups, xx friend groups) is：Xx sells group and xx Promote group to be grouped for sale, xx customer services group is that customer service is grouped, and xx friend groups are user grouping.Data " the xx of social network account A Sale A ", " xx sale ", " xx sells group " belong to sale packet, then can determine that the account purposes of social network account A is Sale.The data " xx promotes B " of social network account B, " xx popularizations ", " xx promotes group " belong to sale packet, then can be true The account purposes for determining social network account B is sale.The data " xx customer service C " of social network account C, " xx customer services ", " xx customer services Group " belongs to customer service packet, then can determine that the account purposes of social network account C is customer service.The data of social network account D " xx user D ", " xx user ", " xx friend groups " belong to user grouping, then can determine the account purposes of social network account D For user.
Especially, as social network account can add multiple groups, it is possible that a social networkies account occurs Number there are multiple account purposes.An embodiment of the invention, if account features extraction module 212 determines one Individual social network account has multiple account purposes, then account malice prediction module 213 is suitable to according to a social network account Each account purposes and remaining account features predict the social network account whether malice, if any of which result is malice, The social network account is predicted then for malice.
For example, in the account data of above-mentioned social network account A, data type has " xx sale for the data of name on account A ", data type have " xx sale " for the data of account remarks, and data type is that the data of the group that account is added have " xx sale Group " and " xx customer service groups ".It is apparent that the data " xx sell A " of social network account A, " xx sale ", " xx sale groups " are belonged to Sale packet, " xx customer service groups " belong to customer service packet, then can determine that the account purposes of social network account A is sale and visitor Clothes.Now, account malice prediction module 213 can be according to the account features that wherein account purposes is sale, wherein account purposes For the account features of customer service, respectively social network account A is predicted, as long as the result of one of them is malice, then in advance The social network account is surveyed for malice.If two results are non-malicious, predict that the social network account is non-malicious.
Account features can also include the account malice degree of association, the account malice degree of association can indicate social network account with The incidence relation of malice social network account.An embodiment of the invention, account data can include account identity Data, account identity data can indicate account identity.According to above-mentioned to whether disliking as prediction social network account The analysis of the data of the foundation of meaning, account identity data can include the name of user, ID (identity number) card No., telephone number, mailbox, The data of at least one data type in bank card number, IP address and MAC Address these data types.
Whether the equipment 210 of malice can also include account incidence relation memory module 214 to the prediction account, and the account closes Connection relationship storage module 214 is mutually coupled with the malice account storage device 240 of the known malice social network account that is stored with, and Be stored with the incidence relation figure of the social network account for pre-building.
Fig. 4 shows the signal of the incidence relation figure of social network account according to one exemplary embodiment Figure.As shown in figure 4, incidence relation figure can include multiple account nodes with attribute (color of account node i.e. in figure), And the multiple back end linked with account node, wherein one social network account of each account node correspondence, its attribute Indicate that whether the social network account is malice social network account (Lycoperdon polymorphum Vitt is malice, and white is non-malicious), each data section A data in point corresponding account identity data, the link between back end and account node indicate that the back end is corresponding Data belong to the corresponding social network account of account node.
Account incidence relation memory module 214 can be according to the account identity data of acquired multiple social network accounts Update the incidence relation figure of the social network account of its storage, the account being then connected with account incidence relation memory module 214 Characteristic extracting module 212 can calculate one of social networkies according to the incidence relation figure of the social network account after renewal The account malice degree of association of account.
Specifically, account incidence relation memory module 214 can will be each in acquired multiple social network accounts Individual social network account increases to the incidence relation figure of its storage as an account node, according to malice account storage device Malice social network account in 240, it is determined that the attribute of increased account node.Wherein, if increased account node is corresponding Social network account belongs to the malice social network account in malice account storage device 240, then the attribute of account node is indicated Maliciously, otherwise indicate non-malicious.
Additionally, account incidence relation memory module 214 can be with social according to the malice in malice account storage device 214 Network account, is spaced the attribute for updating each account node in incidence relation figure at predetermined time intervals, improves the account malice for calculating The accuracy of the degree of association.
Then, account incidence relation memory module 214 is by the account identity data of acquired multiple social network accounts In each data increase to incidence relation figure as a back end, and by each account node and account node pair The corresponding back end of each data in the account identity data of social network account is answered to enter joining line.
After having updated incidence relation figure, account features extraction module 212 can be calculated in incidence relation figure in the updated, The corresponding account node of one social network account and each attribute be designated as malice social network account account node it Between direct connective number, direct connective number here refers to the link between two account nodes without other account nodes Number.According to the direct connective number for calculating, the account malice degree of association of a social network account can be calculated, for example may be used So that each direct connective number for calculating is added the account malice degree of association for obtaining the social network account.
Illustrate below in conjunction with Fig. 5 and the account of social network account is determined to illustrate account features extraction module 212 The principle of the malice degree of association.
Fig. 5 shows the incidence relation figure of the social network account of another illustrative embodiments of the invention Schematic diagram.As shown in figure 5, account node " social network account A " and back end " using address name A ", " ID (identity number) card No. A ", " email address A ", " bank card number A ", " log in IP address A1 ", " logging in IP address A2 ", " logging in MAC Address A1 " and " step on Recording MAC address A2 " links.Account node " social network account B " and back end " address name A ", " ID (identity number) card No. B ", " telephone number B ", " email address B ", " logging in IP address A1 ", " logging in IP address A2 ", " logging in IP address B1 ", " login MAC Address A1 ", " logging in MAC Address A2 " and " logging in MAC Address B1 " link, and attribute is designated as malice social network account. Account node " social network account C " and back end " ID (identity number) card No. B ", " telephone number B ", " email address C ", " login IP address C " and " logging in MAC Address C " link.Account node " social network account D " and back end " ID (identity number) card No. D ", " bank card number D ", " telephone number D ", " email address C ", " logging in IP address D " and " logging in MAC Address D " link.
Can calculate, account node " social network account A " is designated as the account of malice social network account with attribute The direct connective number of family node " social network account B " is 5, then the account malice degree of association of social network account A is 5.Account The direct connective number of node " social network account C " and account node " social network account B " is 2, then social network account C The account malice degree of association is 2.The direct link of account node " social network account D " and account node " social network account B " Number is 0, then the account malice degree of association of social network account D is 0.
Account features can also include other features, and an embodiment of the invention, account data can also be wrapped Include in data below type at least one data：Whether real name registration, actively good friend's quantity, the addition of account levels, account The interactive number of times of good friend's quantity, good friend's quantity of passive addition, the good friend's quantity added from group and good friend, present itself Number of times, consumption number of times, number of times of transferring accounts, reception transfer accounts number of times, send the quantity of message, single-point message number in group with And the ratio of group message and single-point message number.For these data types, account features extraction module 212 directly can be carried The data of the data type in the account data of a social network account are taken, as corresponding account features.
Finally, the account features for obtaining can be with as shown in the table：
As described above, the present invention can take different modes to extract feature for the data of different types of data.Wherein The data of some data types can be the character string with endless combinations, thus cannot directly calculate its probability statistics, it is impossible to It is applied directly in sorting algorithm (such as account title, account remarks), some data types have multiple data (for example can be with Have multiple login IP address, multiple login MAC Address, the group that multiple accounts are added), they cannot be directly inputted to social network The disaggregated model that network account is predicted.The data of these data types can be converted to disaggregated model and can be used by the present invention Account features (account purposes and the account malice degree of association), while also not lost data carry quantity of information.
Extract after account features from the account data for obtaining, the account malice being connected with account features extraction module 212 Prediction module 213, can be pre- using the disaggregated model for pre-building according to the account features of the social network account for extracting The social network account is surveyed whether maliciously.
Wherein, the disaggregated model for pre-building can have one or more, when the disaggregated model for pre-building has multiple, Whether maliciously account malice prediction module 213 can be respectively adopted each of which disaggregated model prediction social network account, if Any of which result is malice, then predict the social network account for malice.Here disaggregated model can include svm classifier Model and logistic regression disaggregated model.
Account malice prediction module 213 can be deposited with the doubtful malice account with the doubtful malice social network account that is stored with Storage equipment 250 is mutually coupled, and is predicted as the social network account of malice and is stored to doubting as doubtful malice social network account In like malice account storage device 250, it is easy to the use of the equipment 230 of subsequent detection social network account malicious act.
So, realize to the social network account whether prediction of malice, that is, the whether judgement of doubtful malice.Connect down Come, the present invention can also further determine by monitoring malicious act whether the doubtful social network account is that malice is social Network account, is described below the process.
Communication monitoring equipment 220 is generally resided in social network server 120 or client 110, monitors social networkies The communication of server 120 or client 110, obtains and wherein initiate communication and receive multiple social network accounts of the communication, and These social network accounts are sent into setting to the detection social network account malicious act being connected with communication monitoring equipment 220 Standby 230.
The equipment 230 of detection social network account malicious act is also mutually coupled with doubtful malice account storage device 250, can To receive these social network accounts from communication monitoring equipment 220, and whether judge any of which social network account In doubtful malice account storage device 250.If it is determined that the social network account for receiving is not located at doubtful malice account In storage device 250, then the communication that the social network account is initiated can be no longer monitored to communication monitoring device request 220.
If it is determined that any of which social network account is located in doubtful malice account storage device 250, then detect social The equipment 230 of network account malicious act can be to the content of the 220 acquisition request communication of communication monitoring equipment.
Communication monitoring equipment 220 can be in response to the request of the equipment 230 of detection social network account malicious act, should The content of communication is sent to the equipment 230 of detection social network account malicious act.
After the equipment 230 of detection social network account malicious act receives the content of the communication, it can be determined that the communication Content whether include the network address.If so, then obtain the corresponding Web content in the network address.If not including the network address, Then ignore the communication.
After obtaining the corresponding Web content in the network address, the equipment 230 of social network account malicious act is detected also May determine that whether the Web content is related to malicious act.Specifically, detect that the equipment 230 of social network account malicious act can To judge whether the corresponding Web content in the network address includes in virtual goodses, Quick Response Code, transfer information and payment information It is individual, if, it is determined that the Web content is related to malicious act.Wherein, virtual goodses can be such as card of game points, phonecard and The commodity of Gift Voucher etc.
If it is determined that Web content is related to malicious act, then detect that the equipment 230 of social network account malicious act can be true Surely the social network account for sending the network address is malice social network account, while can be with via communication monitoring equipment 220 pairs of social network accounts for receiving the network address are reminded.
Additionally, the equipment 230 of detection social network account malicious act is also mutually coupled with malice account storage device 240, The malice social network account of determination can be stored into malice account storage device 240.
Meanwhile, whether the equipment 210 of malice can also be obtained in malice account storage device 240 prediction social network account The account data of the malice social network account of increase, is trained to its disaggregated model, improves the accuracy of prediction.
So far, the prediction and determination to social network account whether malice is realized, reliability is very high.
Fig. 6 shows the prediction social network account according to one exemplary embodiment whether method of malice 300 flow chart.The method 300 is suitable in the equipment being connected with the social network server 120 for providing social networking service Perform in 210, wherein social network server 120 allows user to be operated with social network account.Method 300 starts from step S310, in step S310, obtains the account data of multiple social network accounts from social network server 120.
Afterwards in step s 320, the account data according to acquired multiple social network accounts, extracts one of them The account features of social network account, account feature can at least include account purposes and the account malice degree of association.
An embodiment of the invention, account data can include account purposes data, can be according to a society The account purposes data of friendship network account determine the account purposes of the social network account.Account purposes data can include following The data of at least one data type：The group that name on account, account remarks and account are added.Specifically, account can be directed to Each data type in purposes data, using the data type of clustering algorithm to acquired multiple social network accounts Data be grouped, and packet according to belonging to each data in the account purposes data of a social network account determines The account purposes of the social network account.Wherein clustering algorithm can be k-means algorithms.
According to another implementation of the invention, account data can include account identity data, the equipment 210 with deposit The malice account storage device 240 for containing known malice social network account is mutually coupled, and the social activity for pre-building that is stored with The incidence relation figure of network account, the incidence relation figure are included multiple account nodes with attribute and are connected with account node Multiple back end of knot, wherein each account node one social network account of correspondence, its attribute indicate the social networkies account Whether family is malice social network account, a data in each back end corresponding account identity data, back end with Link between account node indicates that the corresponding data of the back end belong to the corresponding social network account of account node, step Rapid S320 can also include：
The social network account of its storage is updated according to the account identity data of acquired multiple social network accounts Incidence relation figure, according to the incidence relation figure of the social network account after renewal, the account for calculating a social network account is disliked The meaning degree of association.
Wherein, account identity data can include the data of following at least one data type：The name of user, identity card Number, telephone number, mailbox, bank card number, login IP address and login MAC Address.Specifically, according to acquired multiple The step of account identity data of social network account updates the incidence relation figure of the social network account of its storage can include： Each social network account in acquired multiple social network accounts is increased to association as an account node to close System's figure, according to the malice social network account in malice account storage device 240, it is determined that the attribute of increased account node, will Each data in the account identity data of acquired multiple social network accounts increase to close as a back end Connection graph of a relation, finally will be each in the account identity data of social network account each account node corresponding with account node The corresponding back end of individual data enters joining line.Wherein, method 300 can also include step：According to malice account storage device Malice social network account in 240, is spaced the attribute for updating each account node in incidence relation figure at predetermined time intervals.
Update incidence relation figure after, calculate a social network account the account malice degree of association the step of can include： Calculate in incidence relation figure in the updated, a corresponding account node of social network account and each attribute are designated as disliking Meaning social network account account node between direct connective number, the direct connective number be two account nodes between without The number of the link of other account nodes.According to the direct connective number for calculating, the account for calculating a social network account is disliked The meaning degree of association, for example, each direct connective number for calculating can be added the account malice degree of association for obtaining the social network account.
One of the invention special embodiment, account data can also include whether real name is noted for account levels, account Volume, good friend's quantity, actively good friend's quantity of addition, good friend's quantity of passive addition, the good friend's quantity added from group, become reconciled Number of times that friendly interactive number of times, the number of times of present itself, consumption number of times, number of times of transferring accounts, reception are transferred accounts, message is sent in group Number of times, single-point message number and group message and single-point message number ratio at least one data type data, Step S320 can also include：The data of the data above type of a social network account are extracted, it is special as corresponding account Levy.
After so extracting the account features of a social network account, in step S330, according to a social network Maliciously whether the account features of network account, predict the social network account using the disaggregated model for pre-building.
An embodiment of the invention, step S330 can also include：If it is determined that a social network account tool There are multiple account purposes, then the social activity can be predicted according to each account purposes of the social network account and remaining account features Whether maliciously network account, if any of which result is malice, predicts the social network account for malice.
In addition, step S330 can also include：Using at least one disaggregated model prediction social networkies account for pre-building Whether maliciously, if any of which result is malice, the social network account is predicted for malice in family.Wherein disaggregated model can be wrapped Include svm classifier model and logistic regression disaggregated model.
Yet another embodiment of the invention, equipment 210 are mutually coupled with doubtful malice account storage device 250, Method 300 can also include step：The social network account for being predicted as malice is stored as doubtful malice social network account To doubtful malice account storage device 250.
The method that Fig. 7 shows detection social network account malicious act according to one exemplary embodiment 400, the method is suitable to perform on the equipment 230 of detection social network account malicious act, detection social network account malice The equipment 230 of behavior respectively with reside in it is logical in social network server 120 or client 110 that social networking service is provided Letter monitoring device 220, the malice account storage device 240 of the known malice social network account that is stored with, and it is stored with doubtful Mutually couple like the doubtful malice account storage device 250 of malice social network account, wherein social network server 120 allows to use Family is operated with social network account.
Method 400 starts from step S410, in step S410, receives the social networkies clothes from communication monitoring equipment 220 Communication is initiated in business device 120 or client 110 and multiple social network accounts of the communication are received.
Then in the step s 420, judge whether any one social network account for receiving is deposited positioned at doubtful malice account In storage equipment 250.If so, then in step S430 to the content communicated described in 220 acquisition request of communication monitoring equipment, however, it is determined that The social network account for receiving is not located in doubtful malice account storage device 250, then ask to communication monitoring equipment 220 The communication that the social network account is initiated is monitored no longer.
Then in step S440, the content of the communication from communication monitoring equipment 220 is received, and in step S450 In, judge whether the content of the communication includes the network address.
If so, then in step S460, obtain the corresponding Web content in the network address.Then in step S470, sentence Whether the disconnected Web content is related to malicious act.
Specifically, it can be determined that whether the corresponding Web content in the network address includes virtual goodses, Quick Response Code, letter of transferring accounts One in breath and payment information, if, it is determined that the Web content is related to malicious act, is otherwise not related to malicious act.Its Middle virtual goodses are the commodity of such as card of game points, phonecard and Gift Voucher etc.
If it is determined that whether the Web content is related to malicious act, then can be in step S480, it is determined that sending the network ground The social network account of location is malice social network account, and is stored into malice account storage device 240.If it is determined that the network Content is not related to malicious act, then can ignore the communication.
Finally, yet another embodiment of the invention, however, it is determined that send the social network account of the network address For malice, can be reminding via 220 pairs of social network accounts for receiving the network address of communication monitoring equipment.
Illustrating whether the principle of the system 200 of malice is specifically retouched for detection social network account with reference to Fig. 1～Fig. 5 above State and the respective handling of each step in method 300 and 400 is explained in detail, no longer duplicate contents are carried out here Repeat.
It should be appreciated that in order to simplify the disclosure and help understand one or more in each inventive aspect, it is right above The present invention exemplary embodiment description in, the present invention each feature be grouped together into sometimes single embodiment, figure or In person's descriptions thereof.However, should the method for the disclosure be construed to reflect following intention：I.e. required for protection is sent out The bright feature more features required than being expressly recited in each claim.More precisely, as the following claims As book is reflected, inventive aspect is less than all features of single embodiment disclosed above.Therefore, it then follows concrete real Thus the claims for applying mode are expressly incorporated in the specific embodiment, and wherein each claim itself is used as this Bright separate embodiments.
Those skilled in the art should be understood the module or unit or group of the equipment in example disclosed herein Part can be arranged in equipment as depicted in this embodiment, or alternatively can be positioned at and the equipment in the example In one or more different equipment.Module in aforementioned exemplary can be combined as a module or be segmented in addition multiple Submodule.
Those skilled in the art are appreciated that can be carried out adaptively to the module in the equipment in embodiment Change and they are arranged in one or more different from embodiment equipment.Can be the module or list in embodiment Unit or component are combined into a module or unit or component, and can be divided in addition multiple submodule or subelement or Sub-component.In addition at least some in such feature and/or process or unit is excluded each other, can adopt any Combine to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so disclosed Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (includes adjoint power Profit is required, summary and accompanying drawing) disclosed in each feature can it is identical by offers, be equal to or the alternative features of similar purpose carry out generation Replace.
The present invention can also include：A4, the equipment as described in A3, wherein, if the account features extraction module determines institute State a social network account and there are multiple account purposes, then the account malice prediction module is suitable to according to one social activity Whether maliciously each account purposes and remaining account features of network account predict the social network account, if any of which result For malice, then the social network account is predicted for malice.A5, the equipment as described in A3 or 4, wherein, the clustering algorithm is k- Means algorithms.A6, the equipment as any one of A1-5, wherein, the account data includes account identity data, described Equipment also includes account incidence relation memory module, and the account incidence relation memory module is social with the known malice that is stored with The malice account storage device of network account is mutually coupled, and the incidence relation figure of the social network account for pre-building that is stored with, Multiple back end that the incidence relation figure is included multiple account nodes with attribute and linked with account node, its In each account node one social network account of correspondence, its attribute indicates whether described social network account is malice social network Network account, a data in each back end corresponding account identity data, the link between back end and account node Indicate that the corresponding data of the back end belong to the corresponding social network account of account node；The account incidence relation storage Module is suitable to update its social network account for storing according to the account identity data of acquired multiple social network accounts Incidence relation figure, and the incidence relation figure of the social network account after the account features extraction module is suitable to according to renewal, Calculate the account malice degree of association of one social network account.A7, the equipment as described in A6, wherein, the account association Relationship storage module is further adapted for each social network account in acquired multiple social network accounts as an account Family node increases to incidence relation figure；According to the malice social network account in the malice account storage device, it is determined that increasing Account node attribute；Using each data in the account identity data of acquired multiple social network accounts as one Individual back end increases to incidence relation figure；By the account body of social network account each account node corresponding with account node Each data corresponding back end of the number according in enters joining line.A8, the equipment as described in A7, wherein, the account is closed Connection relationship storage module is further adapted for according to the malice social network account in the malice account storage device, at predetermined time intervals Interval updates the attribute of each account node in the incidence relation figure.A9, the equipment as described in A8, wherein, the account features Extraction module is suitable to calculate in incidence relation figure in the updated, the corresponding account node of one social network account with it is every One attribute is designated as the direct connective number between the account node of malice social network account, and the direct connective number is two Between account node without other account nodes link number；According to the direct connective number for calculating, calculate one The account malice degree of association of social network account.A10, the equipment as described in A9, wherein, the account features extraction module is suitable to The each direct connective number for calculating is added the account malice degree of association for obtaining the social network account.It is arbitrary in A11, such as A1-10 Equipment described in, wherein, the account malice prediction module is suitable for use with least one disaggregated model prediction for pre-building Whether maliciously social network account, if any of which result is malice, predicts the social network account for malice.A12, such as Equipment any one of A1-11, wherein, the disaggregated model includes svm classifier model and logistic regression disaggregated model. A13, the equipment as any one of A1-12, wherein, the account malice prediction module and doubtful malice account storage device Mutually couple, and be suitable to be predicted as the social network account of malice and store to described as doubtful malice social network account doubt Like malice account storage device.A14, the equipment as any one of A2-13, wherein, the account purposes data include with Under an at least data type data：The group that name on account, account remarks and account are added.It is arbitrary in A15, such as A6-14 Equipment described in, wherein, the account identity data includes the data of following at least one data type：The name of user, ID (identity number) card No., telephone number, mailbox, bank card number, login IP address and login MAC Address.It is arbitrary in A16, such as A1-15 Equipment described in, wherein, the account data also include account levels, account whether real name registration, good friend's quantity, actively add Plus good friend's quantity, the interactive number of times of good friend's quantity of passive addition, the good friend's quantity added from group and good friend, itself Number of times that the number of times of displaying, consumption number of times, number of times of transferring accounts, reception are transferred accounts, quantity, single-point message count that message is sent in group The data of at least one data type in the ratio of amount and group message and single-point message number；The account features extract mould Block is further adapted for the data of the data above type for extracting one social network account, used as corresponding account features.
B18, the system as described in B17, wherein, if the equipment of the detection social network account malicious act is further adapted for really Surely the social network account for sending the network address is malice, then receive the network address via the communication monitoring equipment interconnection Social network account is reminded.B19, the system as described in B17 or 18, wherein, the detection social network account malice row For equipment be further adapted for if it is determined that the social network account that receives is not located in the doubtful malice account storage device, then The communication that the social network account is initiated is monitored no longer to the communication monitoring device request.B20, such as any one of B17-19 institutes The system stated, wherein, the equipment of the detection social network account malicious act is further adapted for judging that the network address is corresponding Whether Web content includes in virtual goodses, Quick Response Code, transfer information and payment information, if, it is determined that the network Content is related to malicious act.
C24, the method as described in C23, wherein, described prediction social network account whether malice the step of include：If Determine that a social network account has multiple account purposes, then according to each account purposes of the social network account and remaining Account features predict that whether maliciously the social network account, if any of which result is malice, predicts the social network account For malice.C25, the method as described in C23 or 24, wherein, the clustering algorithm is k-means algorithms.In C26, such as C21-25 Method described in any one, wherein, the account data includes account identity data, the equipment and the known malice that is stored with The malice account storage device of social network account is mutually coupled, and the incidence relation of the social network account for pre-building that is stored with Figure, multiple back end that the incidence relation figure is included multiple account nodes with attribute and linked with account node, Wherein each account node corresponds to a social network account, and its attribute indicates whether described social network account is that malice is social Network account, a data in each back end corresponding account identity data, the company between back end and account node Knot indicates that the corresponding data of the back end belong to the corresponding social network account of account node, the one of society of the extraction The step of account features for handing over network account, includes：Updated according to the account identity data of acquired multiple social network accounts The incidence relation figure of the social network account of its storage；According to the incidence relation figure of the social network account after renewal, institute is calculated State the account malice degree of association of a social network account.C27, the method as described in C26, wherein, acquired in the basis The step of account identity data of multiple social network accounts updates the incidence relation figure of the social network account of its storage includes： Each social network account in acquired multiple social network accounts is increased to association as an account node to close System's figure；According to the malice social network account in the malice account storage device, it is determined that the attribute of increased account node；Will Each data in the account identity data of acquired multiple social network accounts increase to close as a back end Connection graph of a relation；By each number in the account identity data of social network account each account node corresponding with account node Enter joining line according to corresponding back end.C28, the method as described in C27, wherein, methods described also includes step：According to described Malice social network account in malice account storage device, is spaced at predetermined time intervals and updates each account in the incidence relation figure The attribute of family node.C29, the method as described in C28, wherein, the account malice for calculating a social network account is associated The step of spending includes：Calculate in incidence relation figure in the updated, the corresponding account node of one social network account with Each attribute is designated as the direct connective number between the account node of malice social network account, and the direct connective number is two Between individual account node without other account nodes link number；According to the direct connective number for calculating, described one is calculated The account malice degree of association of individual social network account.C30, the method as described in C29, wherein, it is described directly to be connected according to what is calculated The step of knot number calculates the account malice degree of association of a social network account includes：The each direct connective number for calculating is added To the account malice degree of association of the social network account.C31, the method as any one of C21-30, wherein, the prediction The social network account whether malice the step of include：Using at least one disaggregated model prediction social networkies account for pre-building Whether maliciously, if any of which result is malice, the social network account is predicted for malice in family.C32, such as claim 21- Method any one of 31, wherein, the disaggregated model includes svm classifier model and logistic regression disaggregated model.C33、 Method as any one of C21-32, wherein, the equipment is mutually coupled with doubtful malice account storage device, methods described Also include step：The social network account for being predicted as malice is stored to the doubtful evil as doubtful malice social network account Meaning account storage device.C34, the method as any one of C22-33, wherein, the account purposes data include it is following extremely The data of a few data type：The group that name on account, account remarks and account are added.C35, such as any one of C26-34 institutes The method stated, wherein, the account identity data includes the data of following at least one data type：The name of user, identity Card number, telephone number, mailbox, bank card number, login IP address and login MAC Address.C36, such as any one of C21-35 Described method, wherein, the account data also includes account levels, account whether real name registration, actively good friend's quantity, addition Good friend's quantity, the interactive number of times of good friend's quantity of passive addition, the good friend's quantity added from group and good friend, itself exhibition Number of times that the number of times that shows, consumption number of times, number of times of transferring accounts, reception are transferred accounts, number of times, single-point message number that message is sent in group And in the ratio of group message and single-point message number at least one data type data；It is described to extract one of social The step of account features of network account, includes：The data of the data above type of one social network account are extracted, is made For corresponding account features.
D40, the method as any one of D37-39, wherein, it is described to judge whether the Web content is related to malice row For the step of include：Judge the corresponding Web content in the network address whether include virtual goodses, Quick Response Code, transfer information and One in payment information, if, it is determined that the Web content is related to malicious act.
Although additionally, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments In some included features rather than further feature, but the combination of the feature of different embodiments means in of the invention Within the scope of and form different embodiments.For example, in the following claims, embodiment required for protection appoint One of meaning can in any combination mode using.
Additionally, some heres in the embodiment be described as can be by the processor of computer system or by performing The combination of method or method element that other devices of the function are implemented.Therefore, with for implementing methods described or method The processor of the necessary instruction of element is formed for implementing the device of the method or method element.Additionally, device embodiment Element described in this is the example of following device：The device is used to implementing by order to performed by implementing the element of the purpose of the invention Function.
As used in this, unless specifically stated so, come using ordinal number " first ", " second ", " the 3rd " etc. Description plain objects are merely representative of the different instances for being related to similar object, and are not intended to imply that the object being so described must There must be the given order that the time is upper, spatially, in terms of sequence or in any other manner.
Although the present invention is described according to the embodiment of limited quantity, benefit from above description, the art It is interior it is clear for the skilled person that in the scope of the present invention for thus describing, it can be envisaged that other embodiments.Additionally, it should be noted that Language used in this specification primarily to the purpose of readable and teaching and select, rather than in order to explain or limit Determine subject of the present invention and select.Therefore, in the case of without departing from the scope of the appended claims and spirit, for this For the those of ordinary skill of technical field, many modifications and changes will be apparent from.For the scope of the present invention, to this The done disclosure of invention is illustrative and not restrictive, and it is intended that the scope of the present invention be defined by the claims appended hereto.

Claims (10)

1. a kind of prediction social network account whether equipment of malice, is suitable to and provides the social networking service of social networking service Device is connected, wherein the social network server allows user to be operated with social network account, the equipment includes：
Account data acquisition module, is suitable to from the social network server obtain the account data of multiple social network accounts；
Account features extraction module, is suitable to the account data according to acquired multiple social network accounts, extracts one of them The account features of social network account, the account features at least include account purposes and the account malice degree of association；And
Account malice prediction module, is suitable to the account features according to one social network account, using dividing for pre-building Maliciously whether class model predict the social network account.
2. equipment as claimed in claim 1, wherein, the account data of each social network account includes account purposes data, The account features extraction module is suitable to determine the social networkies according to the account purposes data of one social network account The account purposes of account.
3. equipment as claimed in claim 2, wherein, the account features extraction module is suitable to in account purposes data The data of the data type of acquired multiple social network accounts are carried out point by each data type using clustering algorithm Group, and the packet according to belonging to each data in the account purposes data of one social network account determines the social networkies The account purposes of account.
4. a kind of detection social network account whether system of malice, is suitable to and provides the social networking service of social networking service Device or client are connected, wherein the social network server allows user to be operated with social network account, the system System includes：
Be stored with the malice account storage device of known malice social network account；
Be stored with the doubtful malice account storage device of doubtful malice social network account；
Prediction social network account as any one of the claim 1-3 whether equipment of malice；
Communication monitoring equipment；And the equipment of detection social network account malicious act；
Wherein, the communication monitoring equipment is resided in the social network server or client, is suitable to monitor the social activity The communication of the webserver or client, obtains and initiates communication and receive multiple social network accounts of the communication, and send to The equipment of the detection social network account malicious act；It is further adapted in response to from the detection social network account malice row For equipment acquisition communication content request, by the content of the communication send to it is described detection social network account malice The equipment of behavior；
The equipment of the detection social network account malicious act is suitable to judge any one social network account for receiving whether In the doubtful malice account storage device；If so, then obtain in the communication to the communication monitoring device request Hold；Judge whether the content of the communication includes the network address, if so, then obtain the corresponding Web content in the network address；Sentence Whether the disconnected Web content is related to malicious act, if, it is determined that the social network account for sending the network address is malice society Network account is handed over, and is stored into malice account storage device.
5. a kind of prediction social network account whether method of malice, be suitable to the social networkies clothes that social networking service is provided Perform in the equipment that business device is connected, wherein the social network server allows user to be operated with social network account, Methods described includes step：
The account data of multiple social network accounts is obtained from the social network server；
According to the account data of acquired multiple social network accounts, the account for extracting one of social network account is special Levy, the account features at least include account purposes and the account malice degree of association；And
According to the account features of one social network account, the social networkies account is predicted using the disaggregated model for pre-building Maliciously whether family.
6. method as claimed in claim 5, wherein, the account data includes account purposes data, the extraction wherein The step of account features of individual social network account, includes：
The account purposes of the social network account is determined according to the account purposes data of one social network account.
7. method as claimed in claim 6, wherein, it is described that determined according to the account purposes data of a social network account should The step of account purposes of social network account, includes：
For each data type in account purposes data, using clustering algorithm to acquired multiple social network accounts The data of the data type be grouped, and according to each data in the account purposes data of one social network account Affiliated packet determines the account purposes of the social network account.
8. a kind of method of detection social network account malicious act, is suitable to the equipment in detection social network account malicious act Upper execution, the equipment of the detection social network account malicious act respectively with reside in social network that social networking service is provided Communication monitoring equipment, the malice account storage of the known malice social network account that is stored with network server or client sets It is standby, and the doubtful malice account storage device of the doubtful malice social network account that is stored with mutually couple, wherein the social network Network server allows user to be operated with social network account, and methods described includes step：
Receive and communication is initiated in the social network server or client of communication monitoring equipment and the communication is received Multiple social network accounts；
Whether any one social network account that judgement is received is located in the doubtful malice account storage device；
If so, the content of the communication is then obtained to the communication monitoring device request；
Receive the content of the communication from communication monitoring equipment；
Judge whether the content of the communication includes the network address；
If so, then obtain the corresponding Web content in the network address；
Judge whether the Web content is related to malicious act；And
If, it is determined that the social network account for sending the network address is malice social network account, and is stored to malice account In the storage device of family.
9. method as claimed in claim 8, wherein, methods described also includes step：
If it is determined that the social network account for sending the network address is malice, then the net is received via the communication monitoring equipment interconnection The social network account of network address is reminded.
10. method as claimed in claim 8 or 9, wherein, methods described also includes step：
If it is determined that the social network account for receiving is not located in the doubtful malice account storage device, then to the communication The communication that the social network account is initiated no longer is monitored in monitoring device request.
CN201611109776.2A 2016-12-06 2016-12-06 Device, method and system for predicting whether social network account is malicious or not Active CN106549974B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201611109776.2A CN106549974B (en) 2016-12-06 2016-12-06 Device, method and system for predicting whether social network account is malicious or not

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201611109776.2A CN106549974B (en) 2016-12-06 2016-12-06 Device, method and system for predicting whether social network account is malicious or not

Publications (2)

Publication Number Publication Date
CN106549974A true CN106549974A (en) 2017-03-29
CN106549974B CN106549974B (en) 2020-06-02

Family

ID=58396915

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201611109776.2A Active CN106549974B (en) 2016-12-06 2016-12-06 Device, method and system for predicting whether social network account is malicious or not

Country Status (1)

Country Link
CN (1) CN106549974B (en)

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107229951A (en) * 2017-05-31 2017-10-03 北京知道创宇信息技术有限公司 Predict method and computing device of the user with the presence or absence of malicious act
CN107682187A (en) * 2017-09-29 2018-02-09 中科聚信信息技术（北京）有限公司 A kind of anti-fraud method based on social network analysis model
CN108197795A (en) * 2017-12-28 2018-06-22 杭州优行科技有限公司 The account recognition methods of malice group, device, terminal and storage medium
CN108536776A (en) * 2018-03-28 2018-09-14 广州厚云信息科技有限公司 Unification user malicious act detection method and system in a kind of social networks
CN109034661A (en) * 2018-08-28 2018-12-18 腾讯科技（深圳）有限公司 User identification method, device, server and storage medium
CN109039827A (en) * 2018-08-30 2018-12-18 河南信安通信技术股份有限公司 Location-based social software hot spot acquisition system and its method
CN109145050A (en) * 2018-09-29 2019-01-04 智器云南京信息科技有限公司 A kind of calculating equipment
CN109146664A (en) * 2018-07-20 2019-01-04 上海新储集成电路有限公司 A kind of classification storage method for finance account
CN109495378A (en) * 2018-12-28 2019-03-19 广州华多网络科技有限公司 Detect method, apparatus, server and the storage medium of abnormal account number
CN109561050A (en) * 2017-09-26 2019-04-02 武汉斗鱼网络科技有限公司 A kind of method and apparatus identifying batch account
CN109636656A (en) * 2018-10-31 2019-04-16 张建强 A kind of dating system
CN109936525A (en) * 2017-12-15 2019-06-25 阿里巴巴集团控股有限公司 A kind of abnormal account preventing control method, device and equipment based on graph structure model
CN110555301A (en) * 2018-05-31 2019-12-10 阿里巴巴集团控股有限公司 Account permission adjusting method, device and equipment and account permission processing method
CN110689422A (en) * 2018-07-05 2020-01-14 北京嘀嘀无限科技发展有限公司 Financial service management method and device
CN111861483A (en) * 2019-04-26 2020-10-30 阿里巴巴集团控股有限公司 Communication method, computer equipment and storage medium
CN113344621A (en) * 2021-05-31 2021-09-03 北京百度网讯科技有限公司 Abnormal account determination method and device and electronic equipment
CN113468528A (en) * 2021-06-29 2021-10-01 平安普惠企业管理有限公司 Malicious device identification method and device, server and storage medium
CN114301864A (en) * 2020-08-14 2022-04-08 腾讯科技（深圳）有限公司 Object identification method, device, storage medium and server

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105354249A (en) * 2015-10-16 2016-02-24 晶赞广告（上海）有限公司 Multi-account relevance method and device, and electronic equipment
CN105791255A (en) * 2014-12-23 2016-07-20 阿里巴巴集团控股有限公司 Method and system for identifying computer risks based on account clustering
CN106034149A (en) * 2015-03-13 2016-10-19 阿里巴巴集团控股有限公司 Account identification method and device
CN106156341A (en) * 2016-07-14 2016-11-23 微额速达（上海）金融信息服务有限公司 The identification method of the Internet labeled data

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105791255A (en) * 2014-12-23 2016-07-20 阿里巴巴集团控股有限公司 Method and system for identifying computer risks based on account clustering
CN106034149A (en) * 2015-03-13 2016-10-19 阿里巴巴集团控股有限公司 Account identification method and device
CN105354249A (en) * 2015-10-16 2016-02-24 晶赞广告（上海）有限公司 Multi-account relevance method and device, and electronic equipment
CN106156341A (en) * 2016-07-14 2016-11-23 微额速达（上海）金融信息服务有限公司 The identification method of the Internet labeled data

Cited By (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107229951B (en) * 2017-05-31 2020-12-29 北京知道创宇信息技术股份有限公司 Method and computing device for predicting whether malicious behaviors exist in user
CN107229951A (en) * 2017-05-31 2017-10-03 北京知道创宇信息技术有限公司 Predict method and computing device of the user with the presence or absence of malicious act
CN109561050B (en) * 2017-09-26 2021-11-09 武汉斗鱼网络科技有限公司 Method and device for identifying batch account numbers
CN109561050A (en) * 2017-09-26 2019-04-02 武汉斗鱼网络科技有限公司 A kind of method and apparatus identifying batch account
CN107682187A (en) * 2017-09-29 2018-02-09 中科聚信信息技术（北京）有限公司 A kind of anti-fraud method based on social network analysis model
US11223644B2 (en) 2017-12-15 2022-01-11 Advanced New Technologies Co., Ltd. Graphical structure model-based prevention and control of abnormal accounts
US11102230B2 (en) 2017-12-15 2021-08-24 Advanced New Technologies Co., Ltd. Graphical structure model-based prevention and control of abnormal accounts
CN109936525A (en) * 2017-12-15 2019-06-25 阿里巴巴集团控股有限公司 A kind of abnormal account preventing control method, device and equipment based on graph structure model
CN108197795A (en) * 2017-12-28 2018-06-22 杭州优行科技有限公司 The account recognition methods of malice group, device, terminal and storage medium
CN108536776A (en) * 2018-03-28 2018-09-14 广州厚云信息科技有限公司 Unification user malicious act detection method and system in a kind of social networks
CN110555301A (en) * 2018-05-31 2019-12-10 阿里巴巴集团控股有限公司 Account permission adjusting method, device and equipment and account permission processing method
CN110555301B (en) * 2018-05-31 2023-05-09 阿里巴巴集团控股有限公司 Account authority adjustment method, device and equipment and account authority processing method
CN110689422A (en) * 2018-07-05 2020-01-14 北京嘀嘀无限科技发展有限公司 Financial service management method and device
CN109146664A (en) * 2018-07-20 2019-01-04 上海新储集成电路有限公司 A kind of classification storage method for finance account
CN109034661A (en) * 2018-08-28 2018-12-18 腾讯科技（深圳）有限公司 User identification method, device, server and storage medium
CN109039827B (en) * 2018-08-30 2020-09-22 河南信安通信技术股份有限公司 Social software hotspot acquisition system and method based on positions
CN109039827A (en) * 2018-08-30 2018-12-18 河南信安通信技术股份有限公司 Location-based social software hot spot acquisition system and its method
CN109145050A (en) * 2018-09-29 2019-01-04 智器云南京信息科技有限公司 A kind of calculating equipment
CN109145050B (en) * 2018-09-29 2022-04-01 智器云南京信息科技有限公司 Computing device
CN109636656A (en) * 2018-10-31 2019-04-16 张建强 A kind of dating system
CN109495378A (en) * 2018-12-28 2019-03-19 广州华多网络科技有限公司 Detect method, apparatus, server and the storage medium of abnormal account number
CN111861483A (en) * 2019-04-26 2020-10-30 阿里巴巴集团控股有限公司 Communication method, computer equipment and storage medium
CN114301864A (en) * 2020-08-14 2022-04-08 腾讯科技（深圳）有限公司 Object identification method, device, storage medium and server
CN114301864B (en) * 2020-08-14 2024-02-02 腾讯科技（深圳）有限公司 Object identification method, device, storage medium and server
CN113344621A (en) * 2021-05-31 2021-09-03 北京百度网讯科技有限公司 Abnormal account determination method and device and electronic equipment
CN113344621B (en) * 2021-05-31 2023-08-04 北京百度网讯科技有限公司 Determination method and device for abnormal account and electronic equipment
CN113468528A (en) * 2021-06-29 2021-10-01 平安普惠企业管理有限公司 Malicious device identification method and device, server and storage medium

Also Published As

Publication number Publication date
CN106549974B (en) 2020-06-02

Similar Documents

Publication Publication Date Title
CN106549974A (en) Prediction the social network account whether equipment of malice, method and system
CN103685307B (en) The method and system of feature based storehouse detection fishing fraud webpage, client, server
Shen et al. Discovering social spammers from multiple views
CN109559192A (en) Risk checking method, device, equipment and storage medium based on association map
CN108833186A (en) A kind of network attack prediction technique and device
CN111435507A (en) Advertisement anti-cheating method and device, electronic equipment and readable storage medium
CN110400219B (en) Service processing method and system, and transaction monitoring method and system
CN106681849A (en) Data processing method and device
CN106384273A (en) Malicious order scalping detection system and method
CN106230867A (en) Prediction domain name whether method, system and the model training method thereof of malice, system
CN108881263A (en) A kind of network attack result detection method and system
CN106127505A (en) The single recognition methods of a kind of brush and device
CN110851872B (en) Risk assessment method and device for private data leakage
CN107181745A (en) Malicious messages recognition methods, device, equipment and computer-readable storage medium
CN107357790A (en) A kind of unexpected message detection method, apparatus and system
CN102315952A (en) Method and device for detecting junk posts in community network
CN110457601B (en) Social account identification method and device, storage medium and electronic device
CN112132676A (en) Method and device for determining contribution degree of joint training target model and terminal equipment
CN108280459A (en) The processing method of picture, apparatus and system
CN109670933A (en) Identify method, user equipment, storage medium and the device of user role
US20210158356A1 (en) Fraud Mitigation Using One or More Enhanced Spatial Features
CN107241292A (en) Leak detection method and device
Salau et al. Data cooperatives for neighborhood watch
CN112347457A (en) Abnormal account detection method and device, computer equipment and storage medium
CN101661575A (en) System and method for evaluating service quality

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information

Address after: Room 311501, Unit 1, Building 5, Courtyard 1, Futong East Street, Chaoyang District, Beijing 100102

Applicant after: Beijing Zhichuangyu Information Technology Co., Ltd.

Applicant after: Wuxi Public Security Bureau

Address before: 100097 Jinwei Building 803, 55 Lanindichang South Road, Haidian District, Beijing

Applicant before: Beijing Knows Chuangyu Information Technology Co.,Ltd.

Applicant before: Wuxi Public Security Bureau

CB02 Change of applicant information
GR01 Patent grant
GR01 Patent grant