CN107341716A - A kind of method, apparatus and electronic equipment of the identification of malice order - Google Patents

A kind of method, apparatus and electronic equipment of the identification of malice order Download PDF

Info

Publication number
CN107341716A
CN107341716A CN201710560874.6A CN201710560874A CN107341716A CN 107341716 A CN107341716 A CN 107341716A CN 201710560874 A CN201710560874 A CN 201710560874A CN 107341716 A CN107341716 A CN 107341716A
Authority
CN
China
Prior art keywords
order
behavior
identified
malice
order behavior
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201710560874.6A
Other languages
Chinese (zh)
Other versions
CN107341716B (en
Inventor
钱春江
余文喆
杜红光
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing QIYI Century Science and Technology Co Ltd
Original Assignee
Beijing QIYI Century Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing QIYI Century Science and Technology Co Ltd filed Critical Beijing QIYI Century Science and Technology Co Ltd
Priority to CN201710560874.6A priority Critical patent/CN107341716B/en
Publication of CN107341716A publication Critical patent/CN107341716A/en
Application granted granted Critical
Publication of CN107341716B publication Critical patent/CN107341716B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0633—Lists, e.g. purchase orders, compilation or processing
    • G06Q30/0635—Processing of requisition or of purchase orders
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The embodiments of the invention provide a kind of method, apparatus of malice order identification and electronic equipment, the above method to include：Obtain the data of order behavior to be identified；The data of the order behavior to be identified are analyzed using analysis model, obtain the malice scoring of the order behavior to be identified, wherein, the analysis model is according to the data of default order behavior, carries out model training acquisition；Judge whether the order behavior to be identified belongs to malice order behavior according to malice scoring.The data of order behavior to be identified are analyzed using analysis model using the embodiment of the present invention, the success rate of malice order identification can be improved and expand the scope of malice order identification.

Description

A kind of method, apparatus and electronic equipment of the identification of malice order
Technical field
The present invention relates to network technique field, is set more particularly to the method, apparatus and electronics of a kind of identification of malice order It is standby.
Background technology
With the rise of internet electric business, the safety of shopping online is also increasingly subject to pay attention to.Many malicious users utilize electricity Leak or price difference in business carry out that brush is single, competition for orders, the consumer group and electric business to vast normal demand cause it is unfavorable very To be loss.
However, inventor has found that at least there are the following problems for prior art during the present invention is realized：
Whether existing electric business is taken pointedly is identified in each link, too more frequent than being accessed if any special identification Method, have the whether similar method in the address of special identification consignee.These recognition methods are all independent based on limited Function come judge the behavior of user's order whether malice, and malicious user can bypass limited identification function easily, be disliked Order behavior anticipate without being found.It can be seen that the lifting of the anti-monitoring strategies with malice order person, existing malice order identification The recognition success rate of technology is low, and identification range is narrow.
The content of the invention
The purpose of the embodiment of the present invention is to provide a kind of method, apparatus and electronic equipment of the identification of malice order, to carry The success rate and scope of high malice order identification.Concrete technical scheme is as follows：
A kind of malice order knows method for distinguishing, and methods described includes：
Obtain the data of order behavior to be identified；
The data of the order behavior to be identified are analyzed using analysis model, obtain the order behavior to be identified Malice scoring, wherein, the analysis model is according to the data of default order behavior, carries out model training acquisition；
Judge whether the order behavior to be identified belongs to malice order behavior according to malice scoring.
Optionally, the data of the order behavior to be identified are analyzed using analysis model described, described in acquisition Before the malice scoring of order behavior to be identified, methods described also includes：
Judge whether the user type belonging to the data of the order behavior to be identified is new user, wherein, the user Type includes new user or old user, and the new user is the use that History Order behavior number is less than default first threshold Family, the old user are the user that History Order behavior number is more than or equal to the first threshold；
It is described that the data of the order behavior to be identified are analyzed using analysis model, obtain the order to be identified The malice scoring of behavior, including：
When judging the user type belonging to the data of the order behavior to be identified for new user, calculate and treated described in obtaining The first similarity between the malice order behavior that identification order behavior and the first analysis submodel mark, by first phase Scored like malice of the degree as the order behavior to be identified, wherein, the first analysis submodel is in the analysis model A model, carry out K average K-means cluster analyses for the data of the History Order behavior to sample of users, obtain different The analysis submodel for the class that the class and different grades of malice order behavior that the normal order behavior of grade is formed are formed；
Or when judging the user type belonging to the data of the order behavior to be identified for old user, calculate and obtain The second similarity between the malice order behavior that the order behavior to be identified and the first analysis submodel mark；
The data input of the order behavior to be identified is extremely corresponding with the user belonging to the order behavior to be identified Second analysis submodel, calculates and obtains the order behavior to be identified and the history of the user belonging to the order behavior to be identified Second similarity and the third phase are carried out obtaining subtotaling, by score by the third phase between order behavior like spending like degree Total result scores as the malice of the order behavior to be identified, wherein, the second analysis submodel is the analysis A model in model, for for each sample of users, the data using the case history order behavior of the sample of users are entered The corresponding with the sample of users of row logistic regression training acquisition analyzes submodel.
Optionally, it is described to judge whether the order behavior to be identified belongs to malice order row according to malice scoring For, including：
User type belonging to the data of the order behavior to be identified is new user, and malice scoring is more than default Second Threshold when, determine that the order behavior to be identified belongs to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is new user, and malice scoring is small When the Second Threshold, determine that the order behavior to be identified is not belonging to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is old user, and malice scoring is big When default three threshold value, determine that the order behavior to be identified belongs to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is old user, and malice scoring is small When three threshold value, determine that the order behavior to be identified is not belonging to malice order behavior.
Optionally, the order behavior includes following one or several kinds of combinations：
The IP address that order accesses, the geographical position where IP address, equipment, the kinds of goods of order used in order request Species, the quantity of each order, order time, the means of payment, consignee third-level address, consignee's name and consignee's phone.
A kind of device of malice order identification, described device include：
Data acquisition module, for obtaining the data of order behavior to be identified；
Scoring obtains module, for being analyzed using analysis model the data of the order behavior to be identified, obtains The malice scoring of the order behavior to be identified, wherein, the analysis model is according to the data of default order behavior, is carried out What model training obtained；
Behavior judge module, for judging whether the order behavior to be identified belongs to malice and order according to malice scoring Single act.
Optionally, described device also includes type judging module, and the scoring, which obtains module, to be included：First scoring obtains son Module and the second scoring obtain submodule；
The type judging module, for judge user type belonging to the data of the order behavior to be identified whether be New user, wherein, the user type includes new user or old user, and the new user is that History Order behavior number is less than The user of default first threshold, the old user are the use that History Order behavior number is more than or equal to the first threshold Family；If the user type belonging to the data of the order behavior to be identified is new user, triggering first scoring obtains son Module, if the user type belonging to the data of the order behavior to be identified is old user, triggering second scoring obtains Submodule；
First scoring obtains submodule, and the order behavior to be identified and the first analysis submodel are obtained for calculating The first similarity between the malice order behavior marked, using first similarity as the order behavior to be identified Malice scores, wherein, the first analysis submodel is a model in the analysis model, for the history to sample of users The data of order behavior carry out K average K-means cluster analyses, obtain class that different grades of normal order behavior forms and not The analysis submodel for the class that the malice order behavior of ad eundem is formed；
Second scoring obtains submodule, and the order behavior to be identified and the described first analysis are obtained for calculating The second similarity between the malice order behavior that model marks；
The data input of the order behavior to be identified is extremely corresponding with the user belonging to the order behavior to be identified Second analysis submodel, calculates and obtains the order behavior to be identified and the history of the user belonging to the order behavior to be identified Second similarity and the third phase are carried out obtaining subtotaling, by score by the third phase between order behavior like spending like degree Total result scores as the malice of the order behavior to be identified, wherein, the second analysis submodel is the analysis A model in model, for for each sample of users, the data using the case history order behavior of the sample of users are entered The corresponding with the sample of users of row logistic regression training acquisition analyzes submodel.
Optionally, the behavior judge module includes：First scoring judging submodule, the first behavior determination sub-module, the Two behavior determination sub-modules and the second scoring judging submodule；
The first scoring judging submodule, is new for the user type belonging to the data of the order behavior to be identified User, judges whether the malice scoring is more than default Second Threshold, if malice scoring is more than the Second Threshold, The first behavior determination sub-module is triggered, if malice scoring is less than or equal to the Second Threshold, triggers described the Two behavior determination sub-modules；
The first behavior determination sub-module, for determining that the order behavior to be identified belongs to malice order behavior；
The second behavior determination sub-module, for determining that the order behavior to be identified is not belonging to malice order behavior；
The second scoring judging submodule, is old for the user type belonging to the data of the order behavior to be identified User, judges whether the malice scoring is more than default 3rd threshold value, if malice scoring is more than the 3rd threshold value, The first behavior determination sub-module is triggered, if malice scoring is less than or equal to the 3rd threshold value, triggers described the Two behavior determination sub-modules.
Optionally, the order behavior includes following one or several kinds of combinations：
The IP address that order accesses, the geographical position where IP address, equipment, the kinds of goods of order used in order request Species, the quantity of each order, order time, the means of payment, consignee third-level address, consignee's name and consignee's phone.
At the another aspect that the present invention is implemented, a kind of electronic equipment is additionally provided, the electronic equipment includes processor, led to Believe interface, memory and communication bus, wherein, processor, communication interface, memory is completed mutual logical by communication bus Letter；
Memory, for depositing computer program；
Processor, during for performing the program deposited on memory, realize any of the above-described described malice order identification Method.
At the another aspect that the present invention is implemented, a kind of computer-readable recording medium is additionally provided, it is described computer-readable Instruction is stored with storage medium, when run on a computer so that computer performs any of the above-described described malice and ordered It is single to know method for distinguishing.
At the another aspect that the present invention is implemented, the embodiment of the present invention additionally provides a kind of computer program production comprising instruction Product, when run on a computer so that computer performs any of the above-described described malice order and knows method for distinguishing.
In scheme provided in an embodiment of the present invention, analysis model can be utilized to the number of the order behavior to be identified received According to being analyzed, the malice scoring of order behavior to be identified is obtained, wherein, the analysis model is according to default order behavior Data, carry out model training acquisition, judge whether the order behavior belongs to malice order behavior according to malice scoring.This During the sample application embodiment of the present invention, because analysis model is that the data based on default order behavior train what is obtained, so can To be extended as needed to analysis model so that analysis model has adaptivity and analyst coverage is wide, improves malice and orders The success rate singly identified, expand the scope of malice order identification.Certainly, any product or method for implementing the present invention might not Need to reach all the above advantage simultaneously.
Brief description of the drawings
In order to illustrate more clearly about the embodiment of the present invention or technical scheme of the prior art, below will be to embodiment or existing There is the required accompanying drawing used in technology description to be briefly described.
Fig. 1 is the system block diagram of malice order provided in an embodiment of the present invention identification；
Fig. 2 is the first schematic flow sheet of malice order recognition methods provided in an embodiment of the present invention；
Fig. 3 is second of schematic flow sheet of malice order recognition methods provided in an embodiment of the present invention；
Fig. 4 is a kind of separating resulting schematic diagram provided in an embodiment of the present invention that cluster analysis is carried out using K-means；
Fig. 5 is the third schematic flow sheet of malice order recognition methods provided in an embodiment of the present invention；
Fig. 6 is the first structural representation of malice order identification device provided in an embodiment of the present invention；
Fig. 7 is second of structural representation of malice order identification device provided in an embodiment of the present invention；
Fig. 8 is the third structural representation of malice order identification device provided in an embodiment of the present invention；
Fig. 9 is the structural representation of a kind of electronic equipment provided in an embodiment of the present invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is described.
In the prior art, the identification to malice order is often used and pointedly identified in each link, such as, have for ordering The method that the IP address singly accessed is identified, when detecting that quantity on order of the same IP address within a period of time drastically increase Add, it is possible to these orders are defined as malice order, or these orders are defined as suspicious order, and are further identified. But when malicious user utilizes malicious manner so that the access IP address of every malice order be different from when, the above method These malice orders are gone out with regard to None- identified, it is seen that existing method recognition success rate is low.
Based on this, inventor thinks to contain the order custom of the user in the History Order behavior of user, considers to utilize Statistical learning and machine learning, construction various dimensions, adaptive analysis model calculate order behavior to be identified and History Order The similarity of behavior, and the similarity by being calculated determines whether order behavior to be identified belongs to malice order behavior, To improve the success rate of malice order identification.
Based on above-mentioned consideration, the invention provides a kind of malice order to know method for distinguishing, using based on History Order behavior The analysis model of construction is analyzed order behavior to be identified, the malice scoring of order behavior to be identified is obtained, according to malice Scoring judges whether order behavior to be identified belongs to malice order behavior.Wherein, during structural analysis model, using default The data of order behavior, new data can be voluntarily added as needed or delete unwanted data so that analysis model With various dimensions and adaptivity, avoid that order behavior is identified from single dimension, it is possible to increase the identification of malice order Success rate and the scope for expanding the identification of malice order.
Fig. 1 is the system block diagram of malice order provided in an embodiment of the present invention identification.
After order request behavior is received, judge whether the enough History Order rows of user for having order request For data, if so, then analyzed using individual human body order behavior model and colony's order behavior model, if not provided, Then analyzed using colony's order behavior model；
Wherein, training and analysis include：Personal behavior is trained and analysis, group behavior training and analysis；
Personal behavior is trained and analysis：Model training is carried out using the data of the personal order behavior of a user, is obtained Personal order behavior model, analyzed, can obtained using order behavior to be identified of the personal order behavior model to the user To the similarity of the order behavior to be identified and the user's history order behavior of the user；
Group behavior is trained and analysis：Model training is carried out using the data of all personal order behaviors of sample of users, Colony's order behavior model of different malice order behavior grades is obtained, using colony's order behavior model to order to be identified Behavior is analyzed, and can obtain the malice grade of order behavior to be identified；
Using obtained similarity and malice grade, comprehensive analysis can obtain the scores of order behavior to be identified.
Fig. 2 is the first schematic flow sheet of the malice order recognition methods of the embodiment of the present invention, including：
S201：Obtain the data of order behavior to be identified.
Specifically, in the present embodiment, order behavior includes：The IP address that order accesses, the geographical position where IP address, Equipment, the kinds of goods species of order, the quantity of each order, order time, the means of payment, consignee three used in order request Level address, consignee's name and consignee's phone.
The above- mentioned information included in order behavior is directly related with order behavior, when the above- mentioned information in order behavior is present It is suspicious, it can be determined that this order behavior belongs to malice order behavior, or this order behavior is classified as into suspicious order behavior, And do further identification.Therefore, the order row can be identified according to the situation of change of the above- mentioned information in an order behavior Whether to belong to malice order behavior.
S202：The data of order behavior to be identified are analyzed using analysis model, obtain order behavior to be identified Malice scores.
Wherein, analysis model is according to the data of default order behavior, carries out model training acquisition.
In the present embodiment, default order behavior can include：(student's majority can buy electronics production to the kinds of goods species of order Product, a middle-aged person's majority can buy health products), order time (working clan often at night or weekend places an order) and each order The information such as quantity (for luxury goods, non-malicious person tends not to once make a big purchase in large quantities).
The analysis model trained can be utilized to obtain the probability that order behavior to be identified belongs to malice order behavior, will The probability arrived scores as the malice of order behavior to be identified, the analysis model trained can also be utilized to obtain order to be identified Behavior deviates the distance of normal order behavior, is scored obtained distance as the malice of order behavior to be identified, using obtaining Malice scoring further analysis, it can be determined that whether order behavior to be identified belongs to malice order behavior.
S203：Judge whether order behavior to be identified belongs to malice order behavior according to malice scoring.
It is compared to judge that order behavior to be identified is with default threshold value specifically, obtained malice can score It is no to belong to malice order behavior, when malice scoring is more than the threshold value, determine that order behavior to be identified belongs to malice order behavior, When malice scoring is less than or equal to the threshold value, determine that order behavior to be identified is not belonging to malice order behavior；Can also be when evil When meaning scoring is 1, determine that order behavior to be identified belongs to malice order behavior, when malice scoring is 0, it is determined that judging to be identified Order behavior is not belonging to malice order behavior.
, can be to be identified by this after judging whether order behavior to be identified belongs to malice order behavior using malice scoring Order behavior obtains new analysis model, improves the accuracy of analysis model identification as new training sample.
As seen from the above, in the scheme that the present embodiment provides, according to the data creation analysis model of default order behavior Order behavior to be identified is analyzed, the malice scoring of order behavior to be identified can be obtained, is treated according to malice scoring judgement Whether identification order behavior belongs to malice order behavior.Compared with prior art, in the scheme that the present embodiment provides, can pass through Analyzed using statistical learning and machine learning using order behavior of the analysis model to user, wherein, structural analysis model When, using the data of default order behavior, new data can be voluntarily added as needed or are deleted unwanted Data so that analysis model has various dimensions and adaptivity, avoids that order behavior is identified from single dimension, Neng Gouti The success rate and scope of high malice order identification, can be that the electric business system of company does security monitoring.
In one particular embodiment of the present invention, referring to Fig. 3, there is provided second of flow of malice order recognition methods Schematic diagram, including：
S301：Obtain the data of order behavior to be identified.
This step is consistent with the S201 in above-described embodiment, will not be repeated here.
S302：Judge whether the user type belonging to the data of order behavior to be identified is new user, if to be identified order User type belonging to the data of single act is new user, S3031 is performed, if the use belonging to the data of order behavior to be identified Family type is old user, performs S3032.
Wherein, user type includes new user or old user, and new user is History Order behavior number less than default The user of first threshold, old user are the user that History Order behavior number is more than or equal to default first threshold.
For example, above-mentioned first threshold can be 20, the application is defined not to this.Receiving the to be identified of user A During order behavior, if user A History Order behavior number is less than 20, it is determined that user A is new user；Receiving user B's During order behavior to be identified, if user B History Order behavior number is more than or equal to 20, it is determined that user B is old user.
Judge whether the user type belonging to the data of order behavior to be identified is new user, is in order to for different use Family type, different analyses can be carried out, to obtain more accurate analysis result.
S3031：Between the malice order behavior that calculating obtains order behavior to be identified and the first analysis submodel marks The first similarity, using the first similarity as order behavior to be identified malice score.
Wherein, the first analysis submodel, is a model in above-mentioned analysis model, for the History Order to sample of users The data of behavior carry out K average K-means cluster analyses, obtain class that different grades of normal order behavior forms and different etc. The analysis submodel for the class that the malice order behavior of level is formed；Namely above-mentioned colony's order behavior model, for group of subscribers Order behavior is analyzed.Cluster analysis is carried out by the data of the order behavior to sample of users, can be by malice order row To be separated with normal order behavior, according to the result of handmarking with regard to the different grades of class of malice order behavior can be obtained.
Accessed for example, malice order person would generally use cloud machine simulation browser access to carry out a large amount of frequently orders, Although the user name that order accesses is different, consignee's phone is also different, in the geographical position where IP address, order Can be much like on type of goods and these three dimensions of consignee third-level address, it can identify ordering for malice by these three dimensions It is single.
By cluster analysis, new user's order behavior can also be identified.For example, when malice order person by using When newly-increased machine carries out malice order behavior, the malice order that the malice order behavior of machine also can show and isolate is increased newly The similitude of behavior, is identified.
First analysis submodel, using K-means algorithms to training sample X={ x(1)..., x(m)Carry out cluster analysis, X The History Order behavior of sample of users is contained, wherein having the behavior of malice order and normal order behavior, x(m)Represent training sample In the m articles order behavior, contain the data of default each dimension in the m articles order behavior, m represents order row in training sample For number, m value is the natural number more than 0.For example, during cluster analysis, the History Order of 300 sample of users is collected into Behavior is as training sample, then m=300, and m values are bigger, namely the number of training sample is more, the effect that cluster analysis obtains It is more accurate, but required data volume to be processed is also bigger, in actual applications, can or personal experience different according to scene, M value is adjusted.
K sample is randomly selected in X as cluster center of mass point U={ μ1, μ2…μk, 1 ＜ k≤m.
For each training sample x(i), its class that should belong to is calculated using formula (1).
C(i)=argminj||x(i)-μj||2 (1)
Wherein, x(i)Represent i-th order behavior in training sample, 1≤i≤m, μjJ-th of cluster center of mass point of expression, 1≤ J≤k, C(i)Represent x(i)Belonging class, calculate x(i)With in U it is all cluster center of mass point difference, as training sample x(i)With gathering Class center of mass point μjDifference minimum when, then confirm training sample x(i)Belong to cluster center of mass point μjThe class j at place.
After obtaining belonging to class j all training samples, class j center of mass point is recalculated using formula (2).
Wherein, μjRepresent class j barycenter, x(i)Represent i-th order behavior in training sample, C(i)Represent x(i)Current institute The class belonged to.
The calculating process of recurring formula (1) and formula (2), until the first analysis submodel convergence.
Wherein, the condition of convergence of the first analysis submodel can be：
Difference of all cluster center of mass point before and after recalculating is less than a default threshold value；Or
For each class, all samples in such are with the squared difference of its center of mass point and less than another default threshold Value；
Or other conditions of convergence.
Cluster analysis is carried out by the data of the History Order behavior to sample of users, can using the result of handmarking To draw the different grades of class of normal order behavior and malice order behavior.For example, grade separation as shown in table 1, specifically For the corresponding relation of malice grade and the probability for belonging to malice order, probability of the normal level with being not belonging to malice order it is corresponding Relation.
Table 1
Malice grade Belong to the probability of malice order
Malice grade 0 50%-60%
Malice grade 1 60%-70%
Malice grade 2 70%-80%
Malice grade 3 80%-90%
Malice class 4 90%-100%
Normal level It is not belonging to the probability of malice order
Normal level 0 50%-60%
Normal level 1 60%-70%
Normal level 2 70%-80%
Normal level 3 80%-90%
Normal level 4 90%-100%
The similarity of the center of mass point of the different grades of class of malice order behavior for calculating order behavior to be identified and obtaining, The malice grade of above-mentioned order behavior to be identified is represented with obtained similarity.
Fig. 4 is a kind of separating resulting schematic diagram that cluster analysis is carried out using K-means, the order behavior in training sample Only it is divided into two classes, one kind is represented with round dot, another kind of to use triangular representation, represents the behavior of malice order and normal order respectively Behavior, it can determine to include the class of malice order behavior by the result of handmarking.
In a kind of implementation, the malice order behavior that order behavior to be identified marks with the first analysis submodel is obtained Between the first similarity, the different grades of of order behavior to be identified and the malice order behavior that marks can be calculated respectively The similarity of the center of mass point of class, summation is weighted to the similarity being calculated, using the result of summation as the first similarity. First similarity is bigger, namely order behavior to be identified is more similar to the malice order behavior that the first analysis submodel marks, Show that order behavior to be identified is more likely to belong to malice order behavior, therefore can be scored the first similarity as malice.
Wherein, when calculating similarity, can be calculated using Euclidean distance or Pearson's similarity, can also Calculated with other algorithms.
For example, obtain malice grade 0, malice grade 1 and the different grades of malice order behavior of malice grade 2 three Class, wherein, the center of mass point of the class of malice grade 0 is μo, the center of mass point of the class of malice grade 1 is μp, the center of mass point of the class of malice grade 2 is μq。
Using Pearson's Similarity Measure, order behavior to be identified and center of mass point μ can be obtainedoSimilarity be Ao, with matter Heart point μpSimilarity be Ap, with center of mass point μqSimilarity be Aq。
The malice scoring of the order behavior to be identified of the new user can be calculated using formula (3).
S=0.1Ao+0.3Ap+0.6Aq (3)
Wherein, S represents that malice scores, can be according to scene difference or personal experience, to A in practical applicationo、ApAnd Aq's Weights are adjusted.
The malice scoring of the order behavior to be identified of new user embodies the order behavior to be identified and malice order behavior Between similarity, can accurately judge that out whether the order behavior to be identified belongs to malice order row with the size of similarity For.
S3032：Calculate the malice order behavior that order behavior to be identified marks with the described first analysis submodel that obtains Between the second similarity；The data input of order behavior to be identified is extremely corresponding with the user belonging to order behavior to be identified Second analysis submodel, calculates and obtains order behavior to be identified and the History Order behavior of the user belonging to order behavior to be identified Between third phase like spending, the second similarity and third phase are subjected to obtaining subtotaling like degree, using subtotaling result as treating Identify the malice scoring of order behavior.
Wherein, calculate obtain malice order behavior that order behavior to be identified marks with the described first analysis submodel it Between the second similarity the step of it is consistent with the step in S3031, will not be repeated here.
Second analysis submodel, is a kind of model in above-mentioned analysis model, for each sample of users, to utilize the sample The data of the case history order behavior of this user carry out analysis corresponding with the sample of users that logistic regression training obtains Model, namely above-mentioned personal order behavior model, each user has each self-corresponding second analysis submodel, for the user Order behavior is analyzed, and judges whether the order behavior of the user meets the conventional order custom of the user.To the user's Order Behavior preference is observed and counted in time, can if order behavior deviate from the conventional order custom of the user Further to be identified to this order behavior.
For example, user's first generally only can at night 10 points or so place an order, and it is some USB flash disks and camera accessory to buy mostly, Substantial amounts of lipstick is have purchased to user's first in time detecting one morning, although the lipstick quantity of each order purchase is few, But quantity on order is more, this just needs the order behavior to user's first purchase lipstick to analyze.
It is using History Order behaviors of the logistic regression Logistic Regression to each user using formula (4) Data are trained, to construct the second analysis submodel corresponding with the user.
F (x)=θTx (4)
Wherein, θ represents that model parameter, that is, regression coefficient, x represent the default each of the user's history order behavior The data of dimension, matrix (5) can be used to represent.
Wherein, x11, x21... xn1The data of default each dimension in one History Order behavior of the user are represented, also It is to represent IP address and means of payment information that such as quantity on order, order access, shares n dimension, n value is more than 0 Natural number.For example, the data of default order behavior include：The IP address and the means of payment that quantity on order, order access, only There are three dimensions, then n=3；If the data of default order behavior include：The IP that quantity on order, the means of payment, order access Geographical position and the dimension of consignee third-level address five where address, IP address, then n=5.J represents analysis of structure second The number of the History Order behavior of the user used during model, j value is the natural number more than 0.For example, using the user 20 History Order behaviors structure the second analysis submodel, then j=20, j values are bigger, namely the history of the user used Order behavior is more, and the effect of the analysis of the second analysis submodel is more accurate corresponding to the obtained user, but required place The data volume of reason is also bigger, in actual applications, j value can be adjusted according to scene difference or personal experience.
Based on the second analysis submodel corresponding to the user, formula (6) can be utilized to try to achieve the order to be identified of the user The behavior probability similar to the user's history order behavior.
Wherein, x represents the data of the order behavior to be identified of the user, and σ represents S-shaped growth curve Sigmoid, θ expression Model parameter, hθ(x) represented with P (y=1 | x) for order behavior corresponding to the data x of the order behavior to be identified, itself and this The similar probability of the History Order behavior of user.Order behavior to be identified and use of the above-mentioned user is represented with the probability tried to achieve The similarity of family History Order behavior.
Matrix (5) can utilize Spark machine learning storehouse (Machine Learnig with dimensionality reduction into distributed system Lib, abbreviation MLib) training of logistic regression can be completed, in the hope of model parameter θ.
By the second analysis submodule corresponding to the data input to the user trained of the order behavior to be identified of the user Type, formula (5) can be utilized to obtain the third phase between user order behavior to be identified and the user's history order behavior seemingly Degree.
Third phase is bigger like spending, namely the order behavior to be identified probability similar to the History Order behavior of the user is got over Greatly, represent that order behavior to be identified is more unlikely to belong to malice order behavior, therefore, by the second similarity and third phase like spend into During capable subtotaling, third phase can be weighted summation like the opposite number spent and the second similarity, obtain maliciously scoring, Third phase can be utilized to try to achieve the order behavior to be identified probability dissimilar with the History Order behavior of the user like degree, by this not Similar probability and the second similarity is weighted summation, obtains malice and scores.
For example, obtain malice grade 0, malice grade 1 and the different grades of malice order behavior of malice grade 2 three Class, wherein, the barycenter shop of the class of malice grade 0 is μo, the center of mass point of the class of malice grade 1 is μp, the center of mass point of the class of malice grade 2 is μq。
Using Pearson's Similarity Measure, order behavior to be known and center of mass point μ can be obtainedoSimilarity be A 'o, with matter Heart point μpSimilarity be A 'p, with center of mass point μqSimilarity be A 'q。
Second similarity can be calculated using formula (7).
S1=0.1A 'o+0.4A′p+0.5A′q (7)
Wherein, S1Represent the second similarity, in practical application, can or personal experience different according to scene, to A 'o、A′p With A 'qWeights be adjusted.
Third phase is tried to achieve like degree using formula (8).
Wherein, S2Represent third phase like degree.
Subtotaling is carried out obtaining like degree to the second similarity and third phase, obtains the malice scoring of the order behavior to be identified.
Specifically, malice scoring can be calculated using formula (9).
S=0.4S1+0.6(1-S2) (9)
Wherein, S represents that malice scores, and in actual applications, weights can be carried out according to scene difference or personal experience Adjustment.
This, which obtains subtotaling, can utilize fractional accumulator, can also use online regulatable polynomial function.
The malice scoring of the order behavior to be identified of old user contains the order behavior to be identified and malice order behavior Between similarity and the order behavior to be identified deviate both degree, summary of personal order custom and be identified, energy Access more accurate recognition result.
As seen from the above, in the scheme that the present embodiment provides, the order behavior to be identified for new user, first point is utilized Analysis submodel directly calculates malice and scored；Order behavior to be identified for old user, calculated using the first analysis submodel Go out the second similarity, third phase is calculated like spending using the second analysis submodel corresponding to the old user, with reference to the second similarity Malice is obtained with three similarities to score.Compared with prior art, in the scheme that the present embodiment provides, for the to be identified of new user Order behavior and the order behavior to be identified of old user carry out different analyses, can obtain more accurate malice and score, and then Improve the success rate of malice order identification.
In one particular embodiment of the present invention, referring to Fig. 5, there is provided the third flow of malice order recognition methods Schematic diagram, including：
S301：Obtain the data of order behavior to be identified.
S302：Judge whether the user type belonging to the data of order behavior to be identified is new user, if to be identified order User type belonging to the data of single act is new user, S3031 is performed, if the use belonging to the data of order behavior to be identified Family type is old user, performs S3032.
S3031：Between the malice order behavior that calculating obtains order behavior to be identified and the first analysis submodel marks The first similarity, using the first similarity as order behavior to be identified malice score.
S3032：Calculate the malice order behavior that order behavior to be identified marks with the described first analysis submodel that obtains Between the second similarity；The data input of order behavior to be identified is extremely corresponding with the user belonging to order behavior to be identified Second analysis submodel, calculates and obtains order behavior to be identified and the History Order behavior of the user belonging to order behavior to be identified Between third phase like spending, the second similarity and third phase are subjected to obtaining subtotaling like degree, using subtotaling result as treating Identify the malice scoring of order behavior.
S301, S302, S3031 and S3032 have been discussed in detail in above-described embodiment, will not be repeated here.
S3041：Order behavior to be identified for new user, judges whether malice scoring is more than default Second Threshold, If malice scoring is more than default Second Threshold, S3042 is performed, if malice scoring is less than or equal to default second threshold Value, perform S3043.
Wherein, the setting of Second Threshold is the malice in order to weigh the scoring of the malice of the order behavior to be identified of new user Scoring is higher, and the order behavior to be identified of new user is more likely to belong to malice order behavior, when the malice scoring is more than second During threshold value, it may be determined that the order behavior to be identified of new user belongs to malice order behavior, when malice scoring is less than or equal to During Second Threshold, it may be determined that the order behavior to be identified of new user is not belonging to malice order behavior.
In a kind of implementation, Pearson's similarity for utilizing, the order behavior to be identified for the new user being calculated Malice scoring is in the range of 0 to 1, and it is 0.5 that can now set Second Threshold, by the evil of the order behavior to be identified of new user Compared with 0.5, whether the order behavior to be identified for judging new user according to comparative result belongs to malice order row for meaning scoring For more accurate judged result can be obtained by carrying out judgement with numerical value result of the comparison.
In actual applications, Second Threshold can be adjusted according to different similarity calculating methods.
S3042：Determine that order behavior to be identified belongs to malice order behavior.
In a kind of implementation, when the malice scoring of the order behavior to be identified of new user is more than Second Threshold, it is determined that The order behavior to be identified of new user belongs to malice order behavior；Or when the malice of the order behavior to be identified of old user is commented When point being more than three threshold values, determine that the order behavior to be identified of old user belongs to malice order behavior.
Determine that order behavior to be identified belongs to malice order behavior, the order behavior replacement analysis to be identified can be utilized Model, the accuracy of analysis model identification is improved, can also targetedly ordering to the user belonging to the order behavior to be identified Single act carries out key monitoring or other subsequent treatments.
S3043：Determine that order behavior to be identified is not belonging to malice order behavior.
In a kind of implementation, when the malice scoring of the order behavior to be identified of new user is less than or equal to Second Threshold When, it is determined that the order behavior to be identified of new user is not belonging to malice order behavior；Or the order behavior to be identified as old user Malice scoring when being less than or equal to three threshold values, determine that the order behavior to be identified of old user is not belonging to malice order behavior.
Determine that order behavior to be identified is not belonging to malice order behavior, the order behavior renewal point to be identified can be utilized Model is analysed, improves the accuracy of analysis model identification.
S3044：Order behavior to be identified for old user, judges whether malice scoring is more than default 3rd threshold value, If malice scoring is more than default 3rd threshold value, S3042 is performed, if malice scoring is less than or equal to default 3rd threshold Value, perform S3043.
Wherein, the setting of the 3rd threshold value is the malice in order to weigh the scoring of the malice of the order behavior to be identified of old user Scoring is higher, and the order behavior to be identified of old user is more likely to belong to malice order behavior, when the malice scoring is more than the 3rd During threshold value, it may be determined that the order behavior to be identified of old user belongs to malice order behavior, when malice scoring is less than or equal to During three threshold values, it may be determined that the order behavior to be identified of old user is not belonging to malice order behavior.
In a kind of implementation, Pearson's similarity for utilizing, the order behavior to be identified for the old user being calculated In the range of 0 to 1, it is 0.5 that can set Second Threshold, and the malice of the order behavior to be identified of old user is commented for malice scoring Divide compared with 0.5, whether the order behavior to be identified for judging old user according to comparative result belongs to malice order behavior, with Numerical value result of the comparison, which carries out judgement, can obtain more accurate judged result.
In actual applications, the 3rd threshold value can be adjusted according to different similarity calculating methods.
As seen from the above, in the scheme that the present embodiment provides, the order behavior to be identified for new user, the evil that will be obtained Meaning scoring is compared with Second Threshold, to judge whether the order behavior to be identified of new user belongs to malice order behavior；It is right In the order behavior to be identified of old user, by the scoring of obtained malice compared with the 3rd threshold value, to judge treating for old user Whether identification order behavior belongs to malice order behavior.Compared with prior art, in the scheme that the present embodiment provides, disliked Meaning scoring is when comparing, for the difference of the user type belonging to order behavior to be identified, by the scoring of obtained malice from it is different Threshold value is compared, and to judge whether order behavior to be identified belongs to malice order behavior, can obtain more accurately comparing As a result, and then the success rate of malice order identification is improved.
When in one particular embodiment of the present invention, using the data creation analysis model of default order behavior, order Single act can include following one or several kinds of combinations：The IP address that order accesses, the geographical position where IP address, order Equipment, the kinds of goods species of order, the quantity of each order, order time, the means of payment, consignee's three-level used in single request Address, consignee's name and consignee's phone.
The above-mentioned data that order behavior includes, it can serve as judging whether order behavior to be identified belongs to malice order row For foundation, while can carry out the combination of above-mentioned data according to different scenes, add or delete.
As seen from the above, in the scheme that the present embodiment provides, the important number of malice order identification is contained in order behavior According to can accurately identify malice order behavior according to these data, and then improve the success rate of malice order identification.
Corresponding with above-mentioned malice order recognition methods, the embodiment of the present invention additionally provides a kind of malice order identification dress Put.
Fig. 6 is the first structural representation of malice order identification device provided in an embodiment of the present invention, including：Data obtain Modulus block 601, scoring obtain module 602 and behavior judge module 603.
Wherein, data acquisition module 601, for obtaining the data of order behavior to be identified；
Scoring obtains module 602, for being analyzed using analysis model the data of the order behavior to be identified, obtains The malice scoring of the order behavior to be identified is obtained, wherein, the analysis model is according to the data of default order behavior, is entered What row model training obtained；
Behavior judge module 603, for judging whether the order behavior to be identified belongs to evil according to malice scoring Meaning order behavior.
As seen from the above, in the scheme that the present embodiment provides, according to the data creation analysis model of default order behavior Order behavior to be identified is analyzed, the malice scoring of order behavior to be identified can be obtained, is treated according to malice scoring judgement Whether identification order behavior belongs to malice order behavior.Compared with prior art, in the scheme that the present embodiment provides, can pass through Analyzed using statistical learning and machine learning using order behavior of the analysis model to user, wherein, structural analysis model When, using the data of default order behavior, new data can be voluntarily added as needed or are deleted unwanted Data so that analysis model has various dimensions and adaptivity, avoids that order behavior is identified from single dimension, Neng Gouti The success rate and scope of high malice order identification, can be that the electric business system of company does security monitoring.
In one particular embodiment of the present invention, referring to Fig. 7, there is provided second of structure of malice order identification device Schematic diagram, including：Data acquisition module 701, the scoring of type judging module 702, first obtain the scoring of submodule 7031, second and obtained Obtain submodule 7032 and behavior judge module 704.
Wherein, the data acquisition module 701 is consistent with data acquisition module 601 in above-described embodiment, no longer superfluous herein State.
The type judging submodule 702, for judging the user type belonging to the data of the order behavior to be identified, Wherein, the user type includes new user or old user, and the new user is History Order behavior number less than default The user of first threshold, the old user are the user that History Order behavior number is more than or equal to the first threshold；If User type belonging to the data of the order behavior to be identified is new user, and triggering first scoring obtains submodule 7031, if the user type belonging to the data of the order behavior to be identified is old user, triggering second scoring obtains Submodule 7032；
First scoring obtains submodule 7031, and the order behavior to be identified and the first analysis are obtained for calculating The first similarity between the malice order behavior that model marks, using first similarity as the order row to be identified For malice scoring, wherein, the first analysis submodel is a model in the analysis model, for sample of users The data of History Order behavior carry out K average K-means cluster analyses, obtain normal order behavior and the behavior of malice order not The analysis submodel of the class of ad eundem；
Second scoring obtains submodule 7032, and the order behavior to be identified and described first point are obtained for calculating The second similarity between the malice order behavior that marks of analysis submodel, to be identified ordered using second similarity as described First malice of single act scores；By the data input of the order behavior to be identified to the order behavior to be identified belonging to User corresponding to the second analysis submodel, calculate and obtain belonging to the order behavior to be identified and the order behavior to be identified User History Order behavior between third phase like spending, the order behavior to be identified is generated like spending according to the third phase The second malice score, the described first malice scoring and the described second malice scoring are subjected to obtaining subtotaling, will subtotaling As a result the malice as the order behavior to be identified scores, wherein, the second analysis submodel is in the analysis model A kind of model, for each sample of users, to utilize the data of the case history order behavior of the sample of users to carry out logic The corresponding with the sample of users of regression training acquisition analyzes submodel.
The behavior judge module 704 is consistent with behavior judge module 603 in above-described embodiment, will not be repeated here.
As seen from the above, in the scheme that the present embodiment provides, the order behavior to be identified for new user, first point is utilized Analysis submodel directly calculates malice and scored；Order behavior to be identified for old user, calculated using the first analysis submodel Go out the second similarity, third phase is calculated like spending using the second analysis submodel corresponding to the old user, with reference to the second similarity Malice is obtained with three similarities to score.Compared with prior art, in the scheme that the present embodiment provides, for the to be identified of new user Order behavior and the order behavior to be identified of old user carry out different analyses, can obtain more accurate malice and score, and then Improve the success rate of malice order identification.
In one particular embodiment of the present invention, referring to Fig. 8, there is provided the third structure of malice order identification device Schematic diagram, wherein, behavior judge module 704, including：Including：First scoring judging submodule 7041, the first behavior determine submodule Block 7042, the second behavior determination sub-module 7043 and the second scoring judging submodule 7044.
Wherein, the first scoring judging submodule 7041, for the use belonging to the data of the order behavior to be identified Family type is new user, judges whether the malice scoring is more than default Second Threshold, if malice scoring is more than in advance If Second Threshold, the first behavior determination sub-module 7042 is triggered, if malice scoring is less than or equal to described the Two threshold values, trigger the second behavior determination sub-module 7043；
First behavior determination sub-module 7042, for determining that the order behavior to be identified belongs to malice order behavior；
Second behavior determination sub-module 7043, for determining that the order behavior to be identified is not belonging to malice order behavior；
Second scoring judging submodule 7044, is old for the user type belonging to the data of the order behavior to be identified User, judges whether the malice scoring is more than default 3rd threshold value, if malice scoring is more than the 3rd threshold value, The first behavior determination sub-module 7042 is triggered, if malice scoring is less than or equal to the 3rd threshold value, triggers institute State the second behavior determination sub-module 7043.
As seen from the above, in the scheme that the present embodiment provides, the order behavior to be identified for new user, the evil that will be obtained Meaning scoring is compared with Second Threshold, to judge whether the order behavior to be identified of new user belongs to malice order behavior；It is right In the order behavior to be identified of old user, by the scoring of obtained malice compared with the 3rd threshold value, to judge treating for old user Whether identification order behavior belongs to malice order behavior.Compared with prior art, in the scheme that the present embodiment provides, disliked Meaning scoring is when comparing, for the difference of the user type belonging to order behavior to be identified, by the scoring of obtained malice from it is different Threshold value is compared, and to judge whether order behavior to be identified belongs to malice order behavior, can obtain more accurately comparing As a result, and then the success rate of malice order identification is improved.
When in one particular embodiment of the present invention, using the data creation analysis model of default order behavior, order Single act can include following one or several kinds of combinations：The IP address that order accesses, the geographical position where IP address, order Equipment, the kinds of goods species of order, the quantity of each order, order time, the means of payment, consignee's three-level used in single request Address, consignee's name and consignee's phone.
As seen from the above, in the scheme that the present embodiment provides, the important number of malice order identification is contained in order behavior According to can accurately identify malice order behavior according to these data, and then improve the success rate of malice order identification.
The embodiment of the present invention additionally provides a kind of electronic equipment, as shown in figure 9, including processor 901, communication interface 902, Memory 903 and communication bus 904, wherein, processor 901, communication interface 902, memory 903 is complete by communication bus 904 Into mutual communication,
Memory 903, for depositing computer program；
Processor 901, during for performing the program deposited on memory 903, realize following steps：
Obtain the data of order behavior to be identified；
The data of the order behavior to be identified are analyzed using analysis model, obtain the order behavior to be identified Malice scoring, wherein, the analysis model is according to the data of default order behavior, carries out model training acquisition；
Judge whether the order behavior to be identified belongs to malice order behavior according to malice scoring.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Component Interconnect, abbreviation PCI) bus or EISA (Extended Industry Standard Architecture, abbreviation EISA) bus etc..The communication bus can be divided into address bus, data/address bus, controlling bus etc.. For ease of representing, only represented in figure with a thick line, it is not intended that an only bus or a type of bus.
The communication that communication interface is used between above-mentioned electronic equipment and other equipment.
Memory can include random access memory (Random Access Memory, abbreviation RAM), can also include Nonvolatile memory (non-volatile memory), for example, at least a magnetic disk storage.Optionally, memory may be used also To be at least one storage device for being located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit, Abbreviation CPU), network processing unit (Network Processor, abbreviation NP) etc.；It can also be digital signal processor (Digital Signal Processing, abbreviation DSP), application specific integrated circuit (Application Specific Integrated Circuit, abbreviation ASIC), field programmable gate array (Field-Programmable Gate Array, Abbreviation FPGA) either other PLDs, discrete gate or transistor logic, discrete hardware components.
In another embodiment provided by the invention, a kind of computer-readable recording medium is additionally provided, the computer can Read to be stored with instruction in storage medium, when run on a computer so that computer performs any institute in above-described embodiment The malice order stated knows method for distinguishing.
In another embodiment provided by the invention, a kind of computer program product for including instruction is additionally provided, when it When running on computers so that computer performs any described malice order in above-described embodiment and knows method for distinguishing.
In the above-described embodiments, can come wholly or partly by software, hardware, firmware or its any combination real It is existing.When implemented in software, can realize in the form of a computer program product whole or in part.The computer program Product includes one or more computer instructions.When loading on computers and performing the computer program instructions, all or Partly produce according to the flow or function described in the embodiment of the present invention.The computer can be all-purpose computer, special meter Calculation machine, computer network or other programmable devices.The computer instruction can be stored in computer-readable recording medium In, or the transmission from a computer-readable recording medium to another computer-readable recording medium, for example, the computer Instruction can pass through wired (such as coaxial cable, optical fiber, numeral from a web-site, computer, server or data center User's line (DSL)) or wireless (such as infrared, wireless, microwave etc.) mode to another web-site, computer, server or Data center is transmitted.The computer-readable recording medium can be any usable medium that computer can access or It is the data storage devices such as server, the data center integrated comprising one or more usable mediums.The usable medium can be with It is magnetic medium, (for example, floppy disk, hard disk, tape), optical medium (for example, DVD) or semiconductor medium (such as solid state hard disc Solid State Disk (SSD)) etc..
It should be noted that herein, such as first and second or the like relational terms are used merely to a reality Body or operation make a distinction with another entity or operation, and not necessarily require or imply and deposited between these entities or operation In any this actual relation or order.Moreover, term " comprising ", "comprising" or its any other variant are intended to Nonexcludability includes, so that process, method, article or equipment including a series of elements not only will including those Element, but also the other element including being not expressly set out, or it is this process, method, article or equipment also to include Intrinsic key element.In the absence of more restrictions, the key element limited by sentence "including a ...", it is not excluded that Other identical element also be present in process, method, article or equipment including the key element.
Each embodiment in this specification is described by the way of related, identical similar portion between each embodiment Divide mutually referring to what each embodiment stressed is the difference with other embodiment.It is real especially for system For applying example, because it is substantially similar to embodiment of the method, so description is fairly simple, related part is referring to embodiment of the method Part explanation.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the scope of the present invention.It is all Any modification, equivalent substitution and improvements made within the spirit and principles in the present invention etc., are all contained in protection scope of the present invention It is interior.

Claims (9)

1. a kind of malice order knows method for distinguishing, it is characterised in that methods described includes：
Obtain the data of order behavior to be identified；
The data of the order behavior to be identified are analyzed using analysis model, obtain the evil of the order behavior to be identified Meaning scoring, wherein, the analysis model is according to the data of default order behavior, carries out model training acquisition；
Judge whether the order behavior to be identified belongs to malice order behavior according to malice scoring.
2. according to the method for claim 1, it is characterised in that utilize analysis model to the order row to be identified described For data analyzed, before the malice scoring for obtaining the order behavior to be identified, methods described also includes：
Judge whether the user type belonging to the data of the order behavior to be identified is new user, wherein, the user type Including new user or old user, the new user is less than the user of default first threshold, institute for History Order behavior number State the user that old user is more than or equal to the first threshold for History Order behavior number；
It is described that the data of the order behavior to be identified are analyzed using analysis model, obtain the order behavior to be identified Malice scoring, including：
When judging the user type belonging to the data of the order behavior to be identified for new user, it is described to be identified to calculate acquisition The first similarity between the malice order behavior that order behavior and the first analysis submodel mark, by first similarity Malice as the order behavior to be identified scores, wherein, the first analysis submodel is one in the analysis model Individual model, K average K-means cluster analyses are carried out for the data of the History Order behavior to sample of users, obtain different brackets Normal order behavior form class and different grades of malice order behavior form class analysis submodel；
Or when judging the user type belonging to the data of the order behavior to be identified for old user, calculate described in obtaining The second similarity between the malice order behavior that order behavior to be identified and the first analysis submodel mark；
By the data input of the order behavior to be identified to the user corresponding second belonging to the order behavior to be identified Submodel is analyzed, calculates and obtains the order behavior to be identified and the History Order of the user belonging to the order behavior to be identified Second similarity and the third phase are carried out obtaining subtotaling like degree, incite somebody to action to obtain subtotaling by the third phase between behavior like spending Result as the order behavior to be identified malice score, wherein, it is described second analysis submodel be the analysis model In a model, for each sample of users, to be patrolled using the data of the case history order behavior of the sample of users Collect the corresponding with the sample of users of regression training acquisition and analyze submodel.
3. according to the method for claim 2, it is characterised in that described that described to be identified order is judged according to malice scoring Whether single act belongs to malice order behavior, including：
User type belonging to the data of the order behavior to be identified is new user, and malice scoring is more than default the During two threshold values, determine that the order behavior to be identified belongs to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is new user, and malice scoring be less than or During equal to the Second Threshold, determine that the order behavior to be identified is not belonging to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is old user, and malice scoring is more than in advance If three threshold values when, determine that the order behavior to be identified belongs to malice order behavior；
Or the user type belonging to the data of the order behavior to be identified is old user, and malice scoring be less than or During equal to three threshold value, determine that the order behavior to be identified is not belonging to malice order behavior.
4. according to the method described in any one of claims 1 to 3, it is characterised in that the order behavior includes following one kind Or several combinations：
The IP address that order accesses, the geographical position where IP address, equipment, the kinds of goods kind of order used in order request Class, the quantity of each order, order time, the means of payment, consignee third-level address, consignee's name and consignee's phone.
5. a kind of device of malice order identification, it is characterised in that described device includes：
Data acquisition module, for obtaining the data of order behavior to be identified；
Scoring obtains module, for being analyzed using analysis model the data of the order behavior to be identified, described in acquisition The malice scoring of order behavior to be identified, wherein, the analysis model is according to the data of default order behavior, carries out model What training obtained；
Behavior judge module, for judging whether the order behavior to be identified belongs to malice order row according to malice scoring For.
6. device according to claim 5, it is characterised in that described device also includes type judging module, the scoring Obtaining module includes：First scoring obtains submodule and the second scoring obtains submodule；
The type judging module, for judging whether the user type belonging to the data of the order behavior to be identified is newly to use Family, wherein, the user type includes new user or old user, and the new user is History Order behavior number less than default First threshold user, the old user be History Order behavior number be more than or equal to the first threshold user；Such as User type described in fruit belonging to the data of order behavior to be identified is new user, and triggering first scoring obtains submodule, If the user type belonging to the data of the order behavior to be identified is old user, triggering second scoring obtains submodule Block；
First scoring obtains submodule, and the order behavior to be identified and the first analysis submodule phenotypic marker are obtained for calculating The first similarity between the malice order behavior gone out, the malice using first similarity as the order behavior to be identified Scoring, wherein, the first analysis submodel is a model in the analysis model, for the History Order to sample of users The data of behavior carry out K average K-means cluster analyses, obtain class that different grades of normal order behavior forms and different etc. The analysis submodel for the class that the malice order behavior of level is formed；
Second scoring obtains submodule, and the order behavior to be identified and the described first analysis submodel are obtained for calculating The second similarity between the malice order behavior marked；
By the data input of the order behavior to be identified to the user corresponding second belonging to the order behavior to be identified Submodel is analyzed, calculates and obtains the order behavior to be identified and the History Order of the user belonging to the order behavior to be identified Second similarity and the third phase are carried out obtaining subtotaling like degree, incite somebody to action to obtain subtotaling by the third phase between behavior like spending Result as the order behavior to be identified malice score, wherein, it is described second analysis submodel be the analysis model In a model, for each sample of users, to be patrolled using the data of the case history order behavior of the sample of users Collect the corresponding with the sample of users of regression training acquisition and analyze submodel.
7. device according to claim 6, it is characterised in that the behavior judge module includes：First scoring judges son Module, the first behavior judging submodule, the second behavior judging submodule and the second scoring judging submodule；
The first scoring judging submodule, used for the user type belonging to the data of the order behavior to be identified to be new Family, judges whether the malice scoring is more than default Second Threshold, if malice scoring is more than the Second Threshold, touches Send out the first behavior determination sub-module described, if malice scoring is less than or equal to the Second Threshold, trigger described second Behavior determination sub-module；
The first behavior determination sub-module, for determining that the order behavior to be identified belongs to malice order behavior；
The second behavior determination sub-module, for determining that the order behavior to be identified is not belonging to malice order behavior；
The second scoring judging submodule, used for the user type belonging to the data of the order behavior to be identified to be old Family, judges whether the malice scoring is more than default 3rd threshold value, if malice scoring is more than the 3rd threshold value, touches Send out the first behavior determination sub-module described, if malice scoring is less than or equal to the 3rd threshold value, trigger described second Behavior determination sub-module.
8. according to the device described in any one of claim 5 to 7, it is characterised in that the order behavior includes following one kind Or several combinations：
The IP address that order accesses, the geographical position where IP address, equipment, the kinds of goods kind of order used in order request Class, the quantity of each order, order time, the means of payment, consignee third-level address, consignee's name and consignee's phone.
9. a kind of electronic equipment, it is characterised in that including processor, communication interface, memory and communication bus, wherein, processing Device, communication interface, memory complete mutual communication by communication bus；
Memory, for depositing computer program；
Processor, during for performing the program deposited on memory, realize any described method and steps of claim 1-4.
CN201710560874.6A 2017-07-11 2017-07-11 Malicious order identification method and device and electronic equipment Active CN107341716B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710560874.6A CN107341716B (en) 2017-07-11 2017-07-11 Malicious order identification method and device and electronic equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710560874.6A CN107341716B (en) 2017-07-11 2017-07-11 Malicious order identification method and device and electronic equipment

Publications (2)

Publication Number Publication Date
CN107341716A true CN107341716A (en) 2017-11-10
CN107341716B CN107341716B (en) 2020-12-25

Family

ID=60219596

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710560874.6A Active CN107341716B (en) 2017-07-11 2017-07-11 Malicious order identification method and device and electronic equipment

Country Status (1)

Country Link
CN (1) CN107341716B (en)

Cited By (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107944976A (en) * 2017-12-15 2018-04-20 康成投资（中国）有限公司 Online order checking method
CN108550069A (en) * 2018-04-19 2018-09-18 上海携程商务有限公司 Travelling requirement report method for pushing, device, electronic equipment, storage medium
CN108564448A (en) * 2018-04-23 2018-09-21 广东奥园奥买家电子商务有限公司 A kind of implementation method of the anti-brush of order
CN108564423A (en) * 2017-12-28 2018-09-21 携程旅游网络技术（上海）有限公司 Malice occupy-place recognition methods, system, equipment and the storage medium of ticketing service order
CN108876545A (en) * 2018-06-22 2018-11-23 北京小米移动软件有限公司 Order recognition methods, device and readable storage medium storing program for executing
CN110335115A (en) * 2019-07-01 2019-10-15 阿里巴巴集团控股有限公司 A kind of service order processing method and processing device
CN110348967A (en) * 2019-07-12 2019-10-18 携程旅游信息技术（上海）有限公司 Analysis method, system and the storage medium of user behavior tracking data
CN110738506A (en) * 2019-10-22 2020-01-31 杭州蓝诗网络科技有限公司 Malicious bad comment intercepting system of shopping platform
CN110874778A (en) * 2018-08-31 2020-03-10 阿里巴巴集团控股有限公司 Abnormal order detection method and device
CN110910197A (en) * 2019-10-16 2020-03-24 青岛合聚富电子商务有限公司 Order processing method
CN110955890A (en) * 2018-09-26 2020-04-03 瑞数信息技术（上海）有限公司 Method and device for detecting malicious batch access behaviors and computer storage medium
CN111047417A (en) * 2019-12-24 2020-04-21 北京每日优鲜电子商务有限公司 Service monitoring method, device, equipment and storage medium
CN111311150A (en) * 2020-02-10 2020-06-19 拉扎斯网络科技（上海）有限公司 Distribution task grouping method, platform, electronic equipment and storage medium
CN111612197A (en) * 2019-02-25 2020-09-01 北京嘀嘀无限科技发展有限公司 Security event order detection method and device and electronic equipment
CN111768258A (en) * 2019-06-05 2020-10-13 北京京东尚科信息技术有限公司 Method, device, electronic equipment and medium for identifying abnormal order
CN112116284A (en) * 2020-03-27 2020-12-22 上海寻梦信息技术有限公司 False waybill identification method, false waybill identification system, electronic equipment and storage medium
CN112765502A (en) * 2021-01-13 2021-05-07 上海派拉软件股份有限公司 Malicious access detection method and device, electronic equipment and storage medium
CN112950298A (en) * 2019-11-26 2021-06-11 北京沃东天骏信息技术有限公司 Malicious order identification method and device and storage medium
CN112989295A (en) * 2019-12-16 2021-06-18 北京沃东天骏信息技术有限公司 User identification method and device
CN113298642A (en) * 2021-05-26 2021-08-24 上海晓途网络科技有限公司 Order detection method and device, electronic equipment and storage medium
CN113763077A (en) * 2020-07-24 2021-12-07 北京沃东天骏信息技术有限公司 Method and apparatus for detecting false trade orders
CN113781156A (en) * 2021-05-13 2021-12-10 北京沃东天骏信息技术有限公司 Malicious order recognition method, malicious order model training method, malicious order recognition equipment and malicious order model training storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104081385A (en) * 2011-04-29 2014-10-01 汤姆森路透社全球资源公司 Representing information from documents
CN105069626A (en) * 2015-07-23 2015-11-18 北京京东尚科信息技术有限公司 Detection method and detection system for shopping abnormity
CN105468742A (en) * 2015-11-25 2016-04-06 小米科技有限责任公司 Malicious order recognition method and device
US20170093863A1 (en) * 2015-09-30 2017-03-30 Dell Software, Inc. Combining a set of risk factors to produce a total risk score within a risk engine
CN106557955A (en) * 2016-11-29 2017-04-05 流量海科技成都有限公司 Net about car exception order recognition methodss and system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104081385A (en) * 2011-04-29 2014-10-01 汤姆森路透社全球资源公司 Representing information from documents
CN105069626A (en) * 2015-07-23 2015-11-18 北京京东尚科信息技术有限公司 Detection method and detection system for shopping abnormity
US20170093863A1 (en) * 2015-09-30 2017-03-30 Dell Software, Inc. Combining a set of risk factors to produce a total risk score within a risk engine
CN105468742A (en) * 2015-11-25 2016-04-06 小米科技有限责任公司 Malicious order recognition method and device
CN106557955A (en) * 2016-11-29 2017-04-05 流量海科技成都有限公司 Net about car exception order recognition methodss and system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
王忠群等: "基于模板用户信息搜索行为和统计分析的共谋销量欺诈识别", 《现代图书情报技术》 *

Cited By (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107944976A (en) * 2017-12-15 2018-04-20 康成投资（中国）有限公司 Online order checking method
CN108564423A (en) * 2017-12-28 2018-09-21 携程旅游网络技术（上海）有限公司 Malice occupy-place recognition methods, system, equipment and the storage medium of ticketing service order
CN108550069A (en) * 2018-04-19 2018-09-18 上海携程商务有限公司 Travelling requirement report method for pushing, device, electronic equipment, storage medium
CN108564448A (en) * 2018-04-23 2018-09-21 广东奥园奥买家电子商务有限公司 A kind of implementation method of the anti-brush of order
CN108876545A (en) * 2018-06-22 2018-11-23 北京小米移动软件有限公司 Order recognition methods, device and readable storage medium storing program for executing
CN110874778A (en) * 2018-08-31 2020-03-10 阿里巴巴集团控股有限公司 Abnormal order detection method and device
CN110874778B (en) * 2018-08-31 2023-04-25 阿里巴巴集团控股有限公司 Abnormal order detection method and device
CN110955890B (en) * 2018-09-26 2021-08-17 瑞数信息技术（上海）有限公司 Method and device for detecting malicious batch access behaviors and computer storage medium
CN110955890A (en) * 2018-09-26 2020-04-03 瑞数信息技术（上海）有限公司 Method and device for detecting malicious batch access behaviors and computer storage medium
CN111612197A (en) * 2019-02-25 2020-09-01 北京嘀嘀无限科技发展有限公司 Security event order detection method and device and electronic equipment
CN111768258A (en) * 2019-06-05 2020-10-13 北京京东尚科信息技术有限公司 Method, device, electronic equipment and medium for identifying abnormal order
CN110335115A (en) * 2019-07-01 2019-10-15 阿里巴巴集团控股有限公司 A kind of service order processing method and processing device
CN110348967A (en) * 2019-07-12 2019-10-18 携程旅游信息技术（上海）有限公司 Analysis method, system and the storage medium of user behavior tracking data
CN110910197A (en) * 2019-10-16 2020-03-24 青岛合聚富电子商务有限公司 Order processing method
CN110738506A (en) * 2019-10-22 2020-01-31 杭州蓝诗网络科技有限公司 Malicious bad comment intercepting system of shopping platform
CN112950298A (en) * 2019-11-26 2021-06-11 北京沃东天骏信息技术有限公司 Malicious order identification method and device and storage medium
CN112989295A (en) * 2019-12-16 2021-06-18 北京沃东天骏信息技术有限公司 User identification method and device
CN111047417A (en) * 2019-12-24 2020-04-21 北京每日优鲜电子商务有限公司 Service monitoring method, device, equipment and storage medium
CN111311150A (en) * 2020-02-10 2020-06-19 拉扎斯网络科技（上海）有限公司 Distribution task grouping method, platform, electronic equipment and storage medium
CN112116284B (en) * 2020-03-27 2021-04-13 上海寻梦信息技术有限公司 False waybill identification method, false waybill identification system, electronic equipment and storage medium
CN112116284A (en) * 2020-03-27 2020-12-22 上海寻梦信息技术有限公司 False waybill identification method, false waybill identification system, electronic equipment and storage medium
CN113763077A (en) * 2020-07-24 2021-12-07 北京沃东天骏信息技术有限公司 Method and apparatus for detecting false trade orders
CN112765502A (en) * 2021-01-13 2021-05-07 上海派拉软件股份有限公司 Malicious access detection method and device, electronic equipment and storage medium
CN112765502B (en) * 2021-01-13 2024-03-19 上海派拉软件股份有限公司 Malicious access detection method, device, electronic equipment and storage medium
CN113781156A (en) * 2021-05-13 2021-12-10 北京沃东天骏信息技术有限公司 Malicious order recognition method, malicious order model training method, malicious order recognition equipment and malicious order model training storage medium
CN113298642A (en) * 2021-05-26 2021-08-24 上海晓途网络科技有限公司 Order detection method and device, electronic equipment and storage medium
CN113298642B (en) * 2021-05-26 2024-02-23 上海晓途网络科技有限公司 Order detection method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN107341716B (en) 2020-12-25

Similar Documents

Publication Publication Date Title
CN107341716A (en) A kind of method, apparatus and electronic equipment of the identification of malice order
CN107563429A (en) A kind of sorting technique and device of network user colony
CN110163647B (en) Data processing method and device
WO2018014610A1 (en) C4.5 decision tree algorithm-based specific user mining system and method therefor
WO2019200782A1 (en) Sample data classification method, model training method, electronic device and storage medium
US10637826B1 (en) Policy compliance verification using semantic distance and nearest neighbor search of labeled content
CN106095939B (en) The acquisition methods and device of account authority
CN108256568A (en) A kind of plant species identification method and device
CN108416616A (en) The sort method and device of complaints and denunciation classification
CN109840413B (en) Phishing website detection method and device
WO2019019348A1 (en) Product information pushing method and apparatus, storage medium, and computer device
US11409770B2 (en) Multi-distance similarity analysis with tri-point arbitration
CN110135681A (en) Risk subscribers recognition methods, device, readable storage medium storing program for executing and terminal device
CN107153656A (en) A kind of information search method and device
CN109933648B (en) Real user comment distinguishing method and device
CN111159481B (en) Edge prediction method and device for graph data and terminal equipment
CN111415167B (en) Network fraud transaction detection method and device, computer storage medium and terminal
WO2020024444A1 (en) Group performance grade recognition method and apparatus, and storage medium and computer device
WO2023024408A1 (en) Method for determining feature vector of user, and related device and medium
CN111209929A (en) Access data processing method and device, computer equipment and storage medium
CN108647986B (en) Target user determination method and device and electronic equipment
CN108021713B (en) Document clustering method and device
CN106469182A (en) A kind of information recommendation method based on mapping relations and device
JP7015927B2 (en) Learning model application system, learning model application method, and program
JP2007249600A5 (en)

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant