CN108418809A

CN108418809A - Chat data processing method, device, computer equipment and storage medium

Info

Publication number: CN108418809A
Application number: CN201810125078.4A
Authority: CN
Inventors: 张澍滋
Original assignee: Ping An Technology Shenzhen Co Ltd
Current assignee: Ping An Technology Shenzhen Co Ltd
Priority date: 2018-02-07
Filing date: 2018-02-07
Publication date: 2018-08-17
Anticipated expiration: 2038-02-07
Also published as: WO2019153586A1; CN108418809B

Abstract

This application involves a kind of chat data processing method, device, computer equipment and storage mediums.The method includes：Login banner is obtained, and inquires the corresponding authentication result of login banner.When the authentication result of login banner is certification success, then logon data corresponding with login banner is obtained, and obtain current chat data corresponding with logon data.The current suspicious chat data in current chat data is obtained according to default query logic.Association source identification is searched according to current suspicious chat data, is obtained according to association source identification and is associated with suspicious chat data, suspicious chat data will be associated with and stored；The extraction first network address that currently corresponding first user terminal of suspicious chat data carries, extraction are associated with the second network address that the corresponding second user terminal of suspicious chat data carries, are monitored to first network address and the second network address.It avoids only inquiring current suspect message data so that inquiry has omission, improves search efficiency.

Description

Chat data processing method, device, computer equipment and storage medium

Technical field

This application involves field of computer technology, are set more particularly to a kind of chat data processing method, device, computer Standby and and storage medium.

Background technology

With the development of internet science and technology, in life, the more and more activities of user can carry out on network, and can To get more and more information from network, and some high-risk information are propagated by the mode of Internet chat etc., Such as to the activity that certain website is held, some criminals can be exchanged in a manner of Internet chat etc., disseminate or obtain phase The action message answered, and then from website with the activity reward etc. for paying acquisition great number of low volume, therefore, to the message of Internet chat Monitoring is very important.

Traditionally, to the monitoring of the chat data of Internet chat by manually carrying out, to cause to current The monitoring efficiency of Internet chat is low.

Invention content

Based on this, it is necessary to which in view of the above technical problems, providing one kind can avoid high-risk information from having omission and monitoring effect Rate high chat data processing method, device, computer equipment and storage medium.

A kind of chat data processing method, the method includes：

Login banner is obtained, and inquires the corresponding authentication result of the login banner；

When login banner certification success, then obtain corresponding with login banner logon data, and obtain and The corresponding current chat data of the logon data；

The current suspicious chat data in the current chat data is obtained according to default query logic；

Association source identification is searched according to the current suspicious chat data, is obtained and is associated with according to the association source identification Suspicious chat data stores the suspicious chat data of association；

The first network address that corresponding first user terminal of the currently suspicious chat data carries is extracted, and extracts institute It states and is associated with the second network address that the corresponding second user terminal of suspicious chat data carries, to the first network address and institute The second network address is stated to be monitored.

The step of authentication result of the inquiry login banner in one of the embodiments, including：

When the login banner is scanned, then registration terminal letter is sent to the end of scan for scanning the login banner Breath, so that the registration terminal information and logon data are forwarded to server by the end of scan；

When the logon data that the end of scan is sent to server is completed through server authentication, then server root is received The authentication result returned according to registration terminal information.

The method further includes in one of the embodiments,：

When not receiving the authentication result that the server returns within a preset period of time, then unsuccessfully prompt letter is exported Breath；

It receives and described unsuccessfully prompt message is corresponding re-operates instruction；

The instruction update login banner, and the step of continuing to obtain login banner are re-operated according to described.

The step of acquisition current chat data corresponding with the logon data in one of the embodiments, packet It includes：

The interface IP address for the parameter acquiring interface that server returns is received, and the parameter is passed through according to the interface IP address It obtains interface and obtains login confirmation parameter corresponding with the logon data；

Obtain group's master data corresponding with login confirmation parameter；

Group chatting data corresponding with group's master data are obtained as current chat data.

In one of the embodiments, it is described according to query logic obtain in the current message data it is current it is suspicious chat The step of day data, including：

Judge to be more than predetermined level with the presence or absence of risk class in the current chat data by presetting query logic Data；

When there are when the data that risk class is more than predetermined level, then extraction includes the wind in the current chat data Dangerous grade is more than the keyword in the current chat data of the data of predetermined level；

Obtain the corresponding classification of the keyword；

The current chat data of the data for being more than predetermined level comprising risk class are stored to acquired Under classification.

It is described in one of the embodiments, that association source identification is searched according to the current suspicious chat data, according to The association source identification, which obtains, is associated with suspicious chat data, the step of the suspicious chat data of association is stored, packet It includes：

Extract the network address of the corresponding user terminal identification of the currently suspicious chat data；

Obtain corresponding with network address chat and receive daily record, and inquire in chat reception daily record with it is described The corresponding association source identification of user terminal identification；

Obtain the corresponding association chat data in the association source identification；

Judge to be more than predetermined level with the presence or absence of risk class in the association chat data by presetting query logic Data are then deposited according to the keyword of the association messages data when inquiring data of the risk class more than predetermined level Under storage to corresponding classification.

A kind of chat data processing unit, described device include：

First acquisition module for obtaining login banner, and inquires the corresponding authentication result of the login banner；

Second acquisition module, for when the corresponding authentication result of the login banner is certification success, then obtaining Logon data corresponding with the login banner, and obtain current chat data corresponding with the logon data；

Enquiry module, for obtaining the current suspicious chat number in the current chat data according to default query logic According to；

Memory module, for searching association source identification according to the current suspicious chat data, according to the association come Source mark, which obtains, is associated with suspicious chat data, and the suspicious chat data of association is stored；

Extraction module, the first network carried for extracting corresponding first user terminal of the currently suspicious chat data Address, and extract the second network address that the corresponding second user terminal of the suspicious chat data of the association carries, to described the One network address is monitored with second network address.

First acquisition module includes in one of the embodiments,：

Transmission unit, for when the login banner is scanned, then being sent out to the end of scan for scanning the login banner Registration terminal information is sent, so that the registration terminal information and logon data are forwarded to server by the end of scan；

Receiving unit, when the logon data for being sent to server when the end of scan is completed through server authentication, Then receive the authentication result that server is returned according to registration terminal information.

A kind of computer equipment, including memory, processor and storage can be run on a memory and on a processor The step of computer program, the processor realizes the above method when executing the computer program.

A kind of computer readable storage medium, is stored thereon with computer program, and the computer program is held by processor The step of above-mentioned method is realized when row.

Above-mentioned chat data processing method, device, computer equipment and storage medium obtain login banner, and then inquire The corresponding authentication result of login banner can then be communicated when the authentication is successful with server, and then got and logged in mark Know corresponding logon data, and obtain current chat data corresponding with number is logged in, to ensure the current chat number got According to reliable and then analyze and obtain that suspicious chat data is accurate, inquired according to query logic current suspicious in current chat data When message data, source identification is associated with according to current suspect message data query, and obtaining association according to association source identification can Chat data is doubted, and not only only inquires current suspect message data, association source identification can also be found, and then analyze and close Message data in connection source identification gets association suspicious information data, avoid only inquiring current suspect message data and So that inquiry has omission, and is related to query association suspicious information data, search efficiency is improved.And it can be to current suspicious chat The first network address and the corresponding second user of the suspicious chat data of association that corresponding first user terminal of data carries are whole The second network address that end carries is monitored, and further increases search efficiency, enhances applicability.

Description of the drawings

Fig. 1 is the application scenario diagram of chat data processing method in one embodiment；

Fig. 2 is the flow diagram of chat data processing method in one embodiment；

Fig. 3 is the structure diagram of chat data processing unit in one embodiment；

Fig. 4 is the internal structure chart of one embodiment Computer equipment.

Specific implementation mode

It is with reference to the accompanying drawings and embodiments, right in order to make the object, technical solution and advantage of the application be more clearly understood The application is further elaborated.It should be appreciated that specific embodiment described herein is only used to explain the application, not For limiting the application.

Chat data processing method provided by the present application, can be applied in application environment as shown in Figure 1.Wherein, it steps on Record terminal 102 is communicated with server 104 by network by network.Registration terminal 102 obtains login banner, and inquires and step on The corresponding authentication result for recording mark, when login banner certification success, then registration terminal 102 can be carried out with server 104 Data interaction, and then registration terminal 102 obtains logon data corresponding with login banner, and then registration terminal 102 is obtained and is stepped on The corresponding current chat data of data are recorded, when getting current chat data, then query logic acquisition is current to be chatted according to presetting Current suspicious chat data in day data searches association source identification, according to association source according to current suspicious chat data Mark, which obtains, is associated with suspicious chat data, will be associated with suspicious chat data and store, and the current suspicious chat data of extraction corresponds to The first network address that carries of the first user terminal, and extract the corresponding second user terminal of the suspicious chat data of association and carry The second network address, first network address and the second network address are monitored.Registration terminal 102 can be, but not limited to Various personal computers, laptop, smart mobile phone, tablet computer and portable wearable device, server 104 can be used Server 104 cluster that either multiple servers 104 form of independent server 104 is realized.

In one embodiment, as shown in Fig. 2, providing a kind of chat data processing method, it is applied to Fig. 1 in this way In registration terminal for illustrate, include the following steps：

S202：Login banner is obtained, and inquires the corresponding authentication result of login banner.

Specifically, login banner refers to that is got from server carry the mark of data to be certified, and login banner can To pass through server authentication, so that registration terminal and server carry out the mark of data interaction, for example, login banner can be with It is to log in Quick Response Code etc..Specifically, get login banner, and inquire certification whether by as a result, when authentication result be recognize When demonstrate,proving successfully, then data interaction can be established with server, to carry out data interaction.For example, got when registration terminal Login banner is when logging in Quick Response Code, then the login Quick Response Code to be sent to server and verified, when the login Quick Response Code passes through When the authentication result for crossing server authentication is certification success, then the registration terminal can carry out data interaction with server, such as obtain Take corresponding chat data of corresponding logon data etc..

S204：When the corresponding authentication result of login banner is certification success, then obtain corresponding with login banner Logon data simultaneously obtains current chat data corresponding with logon data.

Specifically, logon data refers to the authentication information of the data of acquisition request storage on the server, the identity Verification information stores in the server, and logon data can be the authentication for the corresponding chat data for obtaining server storage Information, which stores in the server, and is stored with the corresponding chat data of the authentication information, for example, Logon data can be user account etc..Chat data refers to the data that different logon datas interact, and chat data can be with It is lteral data, can is image data, can also be numerical data etc., for example, chat data can be current login data With the chat record between its logon data, chat data can also be that current login data receives in different chat groups Or the chat record sent.Further, successful by server authentication when getting login identification and inquiring login banner When, then get logon data corresponding with login banner, and then data interaction can be carried out with server, and then from server Obtain chat data corresponding with current login data.For example, when registration terminal gets login Quick Response Code, and inquire current Quick Response Code is logged in by server authentication, when corresponding authentication result is certification success, then gets corresponding use from server Family account, and then according to the corresponding user account got, obtain the chat between the user account and other users account Data can such as obtain the chat record between the user account and other users account, can also obtain the user account and add The chat record etc. for receiving or sending in the group chatting entered.

S206：The current suspicious chat data in current chat data is obtained according to default query logic.

Specifically, query logic refers to being more than predetermined level with the presence or absence of risk class in preset identification chat data The rule searching of chat data；Suspicious chat data refers to that risk class present in current chat data is more than predetermined level Data, suspicious chat data can be image data, can be lteral data, can also be numerical data etc..Further, when When getting the corresponding chat data of logon data, matched one by one with the chat data got using query logic, until time All chat datas have been gone through, when at least one chat data is with query logic successful match in chat data, then the chat There are the chat datas that risk class is more than predetermined level in data, that is, include the data that risk class is more than predetermined level Current chat data are current suspicious chat data.For example, query logic is whether to exist simultaneously " safety in inquiry chat data Bank " and " activity ", then first match " safety bank " with chat data one by one, when inquiring containing " safety bank " When chat data, then the chat data comprising " safety bank " is extracted, and then will be extracted again comprising " safety silver The chat data of row " is matched one by one with " activity ", then will include " safety bank " and " activity " when successful match Chat data extracts, then the chat data comprising " safety bank " and " activity " is that there are risk class more than default simultaneously The data of grade are then current suspicious chat data.

S208：Association source identification is searched according to current suspicious chat data, obtaining association according to association source identification can Chat data is doubted, suspicious chat data will be associated with and stored.

Specifically, association source identification refers to and currently corresponding essential information is associated in suspicious chat data has The whole mark of multiple and different objects, association source identification can be corresponding individual subscriber letters in current suspicious chat data The associated whole mark with multiple and different objects is ceased, for example, association source identification can be current suspicious chat data In corresponding account relating group group number etc..Specifically, when finding current suspicious chat data, then inquiry is current The essential information for including in suspicious chat data is inquired association source identification according to essential information, and then according to association identification, is obtained Corresponding association chat data in the association identification is taken, is inquired in the association chat data with the presence or absence of association using query logic Suspicious chat data, it can adopt to be inquired in the association chat data using query logic with the presence or absence of suspicious chat data is associated with With query logic be associated with chat data and matched one by one, when successful match, then there are wind in the association chat data Dangerous grade is more than the chat data of predetermined level, then the association chat data for including the data that risk class is more than predetermined level is It is associated with suspicious chat data, and then the suspicious chat data of the association inquired is stored.

S210：The extraction first network address that currently corresponding first user terminal of suspicious chat data carries, and extract It is associated with the second network address that the corresponding second user terminal of suspicious chat data carries, to first network address and the second network Address is monitored.

Specifically, first network address refers to that corresponding first user terminal of current suspicious chat data is in certain network Computer network address, which can uniquely identify the user terminal in network, the user terminal and its Network address may be used as communication identifier, for example, network address can be IP (Internet in his computer when communicating Protocol, Internet protocol) address etc..Second network address refers to the corresponding second user terminal of the suspicious chat data of association The network address of computer in certain network, the network address can uniquely identify the user terminal in network, should Network address may be used as communication identifier in user terminal when being communicated with other computers, for example, network address can be with It is IP (Internet Protocol, Internet protocol) address etc..Specifically, when find current suspicious chat data and When being associated with suspicious chat data, then the first network address that corresponding first user terminal of current chat data carries is extracted, and Extraction is associated with the second network address that the corresponding second user terminal of suspicious chat data carries, and to first network address and the Two network address are further monitored, with can monitoring the corresponding account number-of-registration in first network address and the second network The corresponding account number-of-registration in location can monitor other corresponding chat datas of first network address, can also monitor the second net Other corresponding chat datas of network address etc., it is further to be carried out to the first network address of monitoring and the second network address Processing, such as limitation first network address or the corresponding other-end of the second network address carry out web page access.

In above-described embodiment, when login banner is certified successfully, then it can be communicated with server, and then get Logon data gets current chat data according to logon data, and acquisition current chat data are reliable, and then according to query logic Current chat data are inquired to obtain the current suspicious data in current chat data, the accuracy rate of inquiry is improved, works as acquisition When to current suspicious chat data, then according to current suspicious chat data inquiry association source identification, and according to association source mark Know inquiry and be associated with suspicious chat data, and not only only inquire the current suspicious chat data in current chat data, avoids looking into Inquiry has omission, and other association chat suspicious datas can be inquired by current suspicious chat data, improves search efficiency, and First network address that can be to the corresponding first user terminal carrying of currently suspicious chat data and the suspicious chat number of association The second network address carried according to corresponding second user terminal is monitored, and further increases search efficiency, enhances applicability.

The step of step S202 in one of the embodiments, the i.e. authentication result of inquiry login banner, may include： When login banner is scanned, then registration terminal information is sent to the end of scan of scanning login banner, so that end of scan will Registration terminal information and logon data are forwarded to server.When the logon data that end of scan is sent to server is recognized through server End of certificate at when, then receive the authentication result that server is returned according to registration terminal information.

Specifically, end of scan refers to the equipment that can receive the corresponding registration terminal information of login banner, end of scan Can be smart mobile phone, tablet computer etc.；Registration terminal information refers to the authentication information of current logging device, which tests Card information can be the authentication information being hidden in login banner, and registration terminal information can be that current registration terminal corresponds to Network environment mark, registration terminal information can also be corresponding facility information of current registration terminal etc., for example, registration terminal Information can be the preset verification information of server hidden in current login banner, and registration terminal information can be current log in The corresponding IP of terminal (Internet Protocol, Internet protocol) address etc..Further, when recognizing registration terminal quilt When scanning, then registration terminal information is sent to the end of scan for scanning the login banner, so that end of scan will log in eventually Client information and logon data are forwarded to server.Can when end of scan scans login banner, then be sent to registration terminal There is scan request, when registration terminal receives scan request, then it is scanned to recognize registration terminal, and then to scanning the login The end of scan transmission of mark has registration terminal information, such as can send the service being hidden in login banner to end of scan The preset verification information of device, can also send the IP address etc. of current registration terminal, and end of scan receives registration terminal verification The IP address of the preset verification information of server or current registration terminal that information is such as hidden in login banner, then step on this Record end message and current logon data such as user account or user account and password etc. are sent to server together.It needs It is noted that when registration terminal receives scan request, then the registration terminal information sent to end of scan can be appointed It anticipates a kind of registration terminal information, can also be the combination of a variety of registration terminal information.

Specifically, the logon data sent to server when end of scan passes through server authentication, when logon data is recognized When card is the logon data to prestore, then the registration terminal can carry out data interaction with server, can also be obtained from server Take other corresponding data of logon data, so receive certification that server is returned according to registration terminal information by knot Fruit.Can be that, when end of scan server sends logon data, server carries out the logon data and the logon data to prestore It matches one by one, when successful match, then the logon data is considered to be the logon data to prestore, then the registration terminal can be with Server carries out data interaction, can also be obtained from server and log in corresponding chat data of number etc., and then registration terminal connects Receive certification that server is returned according to registration terminal information by result.For example, when end of scan is stepped on to what server was sent When to record data be account number cipher, then server by the account number cipher received and the account number cipher that prestores in the server one by one into Row matching, when successful match, then the registration terminal can be communicated with server to carry out data interaction, can such as be asked It asks from server and obtains corresponding chat data of current account number cipher etc., and then registration terminal receives server according to registration terminal The certification that information returns by as a result, being returned to and being stepped on according to the corresponding IP address of registration terminal as registration terminal receives server Record the result of terminal being verified.It should be noted that when the logon data that end of scan is sent to server passes through service Device certification, when it is the logon data to prestore that logon data, which is certified not, then the registration terminal cannot be with server into line number According to interaction, namely other corresponding data of logon data can not be obtained from server, and then receive server according to registration terminal The result for the authentification failure that information is returned.

In the present embodiment, when login banner is scanned, then registration terminal sends registration terminal information to end of scan, makes It obtains end of scan and registration terminal information and logon data is forwarded to server, and then when end of scan is stepped on to what server was sent When record data are completed through server authentication, then the authentication result that server is returned according to registration terminal information, registration terminal are received By verification to carry out data interaction with server, to ensure that the chat data that registration terminal is got is accurate, to right The analysis of chat data is accurate.

The above method can also include in one of the embodiments,：When not receiving service also within a preset period of time When the authentication result that device returns, then prompt message is exported unsuccessfully.It receives and unsuccessfully prompt message is corresponding re-operates instruction.Root Login banner is updated according to instruction is re-operated, and the step of continuing to obtain login banner.

Specifically, failure prompt message refers to carrying out the prompt message of different operations, and failure prompt message can be aobvious Show the information on registration terminal, failure prompt message can be text prompt, can be symbol prompting etc., for example, unsuccessfully carrying Show that information can be shown on registration terminal and include the information of " current operation time-out, if reacquire login banner " and carry Show frame.Further, within a preset period of time, the authentication result for not receiving server return, then when current login banner is long Between be not scanned, after the end of scan in order to avoid having stolen logon data extended meeting be scanned so as to cause current login data There is the risk being stolen in other corresponding data, then current login banner is invalid, and then export failure prompt message, then obtains New login banner.For example, in 1 minute, registration terminal does not receive the authentication result of server return also, then current to log in Mark is not scanned for a long time, after the end of scan in order to avoid having stolen logon data extended meeting be scanned to steal corresponding Information, then current login banner is invalid, and then end of scan can not be scanned, then needs to obtain new login banner, in turn The corresponding failure prompt message of output, such as output " current operation time-out, if reacquire login banner" failure prompt Information.It should be noted that preset time can also be 10 seconds, 50 seconds, 1 point 20 seconds etc..

The instruction that re-operates wherein received in the step of re-operating instruction corresponding with failure prompt message refers to stepping on The instruction of terminal selection subsequent operation is recorded, for example, it can be the instruction for obtaining newer login banner to re-operate instruction, again Operational order can also be the instruction etc. for not obtaining newer login banner.Specifically, registration terminal output failure prompt message When, then receive that the failure prompt message is corresponding to re-operate instruction.Can be, when registration terminal exports failure prompt message, Then user carries out the selection of subsequent operation according to failure prompt message, and then registration terminal is according to the user's choice, receives basis What the selection of the user generated re-operates instruction.For example, " current operation is overtime, is for registration terminal output failure prompt message No reacquisition login banner", user selects according to the failure prompt message, when being selected as "Yes", then generates corresponding The instruction that re-operates of new registration terminal is obtained, it is whole that registration terminal receives the new login of the acquisition generated according to the user's choice End re-operates instruction.

Specifically, when re-operating instruction of login banner is reacquired when registration terminal receives, then basis is grasped again The request for being sent to server and obtaining new login banner is instructed, and then receives new login banner and is stepped on to which update is current Record mark, and then continue the corresponding authentication result of inquiry login banner, when login banner certification success, then obtains and log in mark Know corresponding logon data, and obtain current chat data corresponding with logon data, is obtained according to default query logic current Current suspicious chat data in chat data searches association source identification according to current suspicious chat data, according to association come Source mark, which obtains, is associated with suspicious chat data, will be associated with suspicious chat data and store.

In the present embodiment, when not receiving the authentication result of server return in preset time, according to the mistake of output Prompt message is lost, and then receives and re-operates instruction according to what failure prompt message generated, and is updated according to instruction is re-operated Login banner ensures safety, and ensures that the chat data got is safety, and then ensures that follow-up identification chat data is accurate.

In one of the embodiments, in step S204, that is, obtain the step of current chat data corresponding with logon data Suddenly, may include：The interface IP address for the parameter acquiring interface that server returns is received, and parameter acquiring is passed through according to interface IP address Interface obtains login corresponding with logon data and confirms parameter.Obtain group's master data corresponding with confirmation parameter is logged in.It obtains Take group chatting data corresponding with group's master data as current chat data.Specifically, group chatting data refer to stepping on It records in the group that data are added, registration terminal receives the chat data in the group that logon data is added to.Acquisition and group The corresponding group chatting data of master data are as current chat data.

Specifically, parameter acquiring interface refers to that is be arranged on server can obtain the port of different parameters, parameter acquiring Interface can obtain the certificate parameter etc. logined successfully；Interface IP address refer to be arranged on server can obtain different parameters Port mark, interface IP address can be the interface number etc. of the corresponding interface of interface；It logs in and confirms that parameter refers to that server returns The confirmation mark of the current logged-on status returned, logs in and confirms that parameter can be the character string to prestore, can also be the parameter to prestore Value etc..Further, when receiving the interface IP address for the parameter acquiring interface that server returns, then according to the interface IP address, inquiry It to the interface, obtains to log in from the interface and confirms parameter, which confirms that parameter is corresponding with logon data, then registration terminal can be with Data interaction is carried out with server, and other corresponding data of logon data, such as chat data can be obtained.For example, logging in eventually End receives the interface IP address for the parameter acquiring interface that server returns, and such as gets the interface number of parameter acquiring interface, Jin Ercha The corresponding parameter acquiring interface of the interface number is ask, obtaining corresponding log in by the interface confirms parameter, for example, getting clothes Corresponding logon data of device of being engaged in is identified by the confirmation of verification, and then registration terminal can carry out data interaction with server, To which registration terminal can obtain corresponding other data such as chat data of logon data etc..It should be noted that citing signal, For example, when corresponding server is QQ chat servers, then registration terminal receives the parameter acquiring interface of server return Interface number login confirmation parameter corresponding with account is obtained, such as ptwebqq parameters according to the interface number.

The group's master data obtained in group's master data step corresponding with confirmation parameter is logged in refers to logon data The essential information of the group of addition, group's master data can be lteral data, can be image data, can also be digital number According to etc., for example, group's master data can be the group name for the group that logon data is added, group's master data can be stepped on Group's group number that group is added in data is recorded, group's master data can also be group's head portrait picture that group is added in logon data Deng.Further, when getting login confirmation parameter, then the corresponding group information parameter of parameter acquiring is confirmed according to login, According to group information parameter, corresponding group's master data is read.Can confirm parameter when registration terminal gets login When, then current login data is by being proved to be successful, then registration terminal can carry out data interaction with server, and then according to login Confirm the corresponding group information parameter of parameter acquiring, the corresponding acquisition request of group information parameter carried to server transmission, And then ask to read the corresponding group's master data of logon data according to obtaining.For example, when corresponding server is QQ chat clothes When business device, then parameter is confirmed when registration terminal gets login, when such as ptwebqq parameters, then according to the ptwebqq parameter acquirings Corresponding group information parameter, the group information parameter can be vfwebqq parameters, this is carried to server transmission The corresponding acquisition request of vfwebqq parameters, and then according to the corresponding group's master data of acquisition acquisition request logon data, such as The group number that can be the group when the addition of toe-out writing brush and the contact person in group, the head image data etc. of contact person in group.It needs It is noted that group information parameter refers to that can obtain the parameter of corresponding group's essential information, for example, group information parameter Can be vfwebqq parameters etc..

Group chatting data corresponding with group's master data are obtained as the group chatting in current chat data step Data refer in the group that logon data is added, and registration terminal receives the chat data in the group that logon data is added to. Further, when getting group's master data, then message request parameter is obtained, and then message is carried to server transmission The corresponding chat data of required parameter obtains request, is asked according to the acquisition, obtains the group's master data stored on server Corresponding group chatting data are as current chat data.Can when registration terminal gets group's master data, then obtain Message required parameter is taken, and then carries the corresponding chat data of message request parameter to server transmission and obtains request, service When device verification message requesting data is legal message requesting data, then registration terminal can obtain the group stored on server The corresponding group chatting data of master data, and then registration terminal is using the group chatting data got as current chat number According to.For example, when registration terminal gets the group number of group, when contact person in group, then message request parameter is obtained, the message Required parameter can be uin parameters, and then registration terminal to server send carry uin parameters chat data acquisition ask It asks, when server receives the chat data and obtains request, then when to verify the uin parameters be legal uin parameters, and then can be with Chat data is sent to registration terminal, to which registration terminal gets group chatting data, and the group chatting data are made For current chat data.It should be noted that message request parameter refers to that can successfully obtain corresponding chat through server authentication The parameter of day data, for example, message request parameter can be uin parameters etc..

In the present embodiment, registration terminal receives the interface IP address for the parameter acquiring interface that server returns, according to interface Location obtains login corresponding with logon data by parameter acquiring interface and confirms parameter, and then obtains to log in and confirm that parameter is corresponding Group's master data obtains the corresponding group chatting data of group's master data as current chat data, obtains chat data Mode it is reliable, ensure inquiry current chat data be suspicious chat data it is reliable.

Step S206 in one of the embodiments, i.e., according to query logic obtain current message data in it is current can The step of doubtful chat data, may include：Judge to whether there is risk class in current chat data by default query logic More than the data of predetermined level.When in current chat data there are risk class be more than predetermined level data when, then extract packet The keyword being more than containing risk class in the current chat data of the data of predetermined level.Obtain the corresponding classification of keyword.It will Including the current chat data that risk class is more than the data of predetermined level are stored to acquired classification.

Specifically, query logic refers to pre-stored judgment rule in the server, and query logic can be judged whether There are the rules of suspicious chat data.Risk class can evaluate the information in current chat data, and there are the grades of menace. For example, risk class can be from low to high arranged according to rank, risk class is higher, then it represents that existing for corresponding chat data Risk is higher, and e.g., risk class is set as 1 grade to 5 grades, indicates that the corresponding risk of chat data is higher and higher.Further, it presses According to the query logic being preset in registration terminal, current chat data are matched with query logic one by one, until having traversed All current chat data, when successful match, then there are risk class to be more than predetermined level in the current chat data Data, and then current chat data are suspicious chat data.It can be that registration terminal gets the query logic to prestore, use The query logic matches current chat data with query logic one by one, until all current chat data have been traversed, When successful match, then there are data namely current chat number that risk class is more than predetermined level in the current chat data There are the data that risk class is high in, and then registration terminal current chat data are suspicious chat data.For example, logging in eventually It is that whether there is " there is activity in safety bank " in inquiry current chat data to hold the query logic to prestore got, then will be " flat There is activity in peace bank " it is matched one by one with current chat data, when successful match, then there are wind for this current chat data Dangerous grade is more than the data of predetermined level, and then this current chat data are current suspicious chat data.

Specifically, when being inquired according to query logic in current chat data, there are the numbers that risk class is more than predetermined level According to when, then should comprising risk class be more than predetermined level data chat data have menace namely current chat data For current suspicious data, and then extract the keyword in the current chat data.Can be, when registration terminal is according to query logic It inquires in current chat data there are when the data that risk class is more than predetermined level, then should be more than comprising risk class default It is current suspicious data that the chat data of the data of grade, which has menace namely current chat data, and then registration terminal carries Take the keyword in the current chat data.For example, when registration terminal inquires in current chat data comprising " safety bank has When activity ", then should include the current chat data of " there is activity in safety bank " has menace namely current chat data to work as Preceding suspicious data, and then registration terminal extracts the keyword such as " bank " in the current chat data.

Specifically, according to the pass in the current chat data of the data for being more than predetermined level comprising risk class got Key word gets the classification belonging to the keyword.Can be that registration terminal prestores different data categories, for example, data class Not Wei " bank sort ", data category is " webpage classification " etc., when registration terminal is more than comprising risk class according to getting Keyword in the current chat data of the data of predetermined level, gets the classification belonging to the keyword.For example, registration terminal It is " bank " according to the keyword in the current chat data of the data for being more than predetermined level comprising risk class got, into And it is " bank sort " to obtain corresponding classification.

Specifically, when getting different classes of, then the current of the data for being more than predetermined level comprising risk class is chatted Day data is stored to corresponding classification.Can be, when registration terminal gets data of the risk class more than predetermined level, then Extraction is more than the keyword in the current chat data of the data of predetermined level comprising the risk class, and then according to keyword, The current chat data is stored under corresponding classification.For example, registration terminal gets risk class more than predetermined level Data are " there is activity in safety bank ", and then the keyword for extracting the current chat data comprising " there is activity in safety bank " is " bank ", and then the current chat data comprising " there is activity in safety bank " are stored to corresponding " bank " classification.

In the present embodiment, query logic is taken to inquire current chat data, and then extracted big comprising risk class Current chat data are stored in corresponding according to keyword by the keyword in the current chat data of the data of predetermined level Under classification, it is accurate to inquire suspicious chat data, and is inquired using query logic, and search efficiency is improved.

Step S208 in one of the embodiments, searches association source identification, root according to current suspicious chat data It is obtained according to association source identification and is associated with suspicious chat data, the step of suspicious chat data is stored will be associated with, may include： It obtains chat corresponding with network address and receives daily record, and pass corresponding with user terminal identification is obtained in chat receives daily record Join source identification.Obtain the corresponding association chat data in association source identification.Judge association chat number by default query logic It is more than the data of predetermined level with the presence or absence of risk class in, when inquiring data of the risk class more than predetermined level, Then stored to corresponding classification according to the keyword of association messages data.Extract the corresponding user terminal of current suspicious chat data The network address of mark.

Specifically, user terminal identification refers to the identity of the corresponding user terminal of current suspicious chat data, the use Family terminal iidentification can be words identification, can be picture identification, can also be Digital ID etc., for example, user terminal identification It can be the user name for the user for sending current suspicious chat data, can be the use for the user for sending current suspicious chat data Account picture etc..Further, the suspicious chat data got according to the above method extracts the corresponding user of current suspicious data Terminal iidentification inquires the corresponding network address of the user terminal identification in turn.Can be that registration terminal extracts current suspicious When chat data, then the corresponding User Identity for sending the suspicious chat data of the current suspicious chat data of extraction, such as carries The user name of the user is taken, and then the user name is inquired into the IP address belonging to the corresponding terminal of the user name.

It obtains chat corresponding with network address and receives daily record, and acquisition and user terminal identification in chat receives daily record It refers to the record being stored with the associated data of chat data that chat in corresponding association source identification step, which receives daily record, merely It, which receives daily record, can be stored with corresponding chat data, can be stored with corresponding user terminal identification of chat data etc..Into One step, when getting network address, then obtains chat corresponding with network address and receive daily record, and inquire chat reception Daily record, to obtain association source identification corresponding with the above-mentioned user terminal identification got.For example, when registration terminal obtains When to network address, then registration terminal obtains chat corresponding with network address and receives daily record, and is looked into chat receives daily record The corresponding other association source identifications of user name for asking the user terminal identification such as user got, such as get user name pair The group number etc. for other groups answered, namely get the group number for other groups that the corresponding user of user name is added to Deng.

The association chat data obtained in the corresponding association chat data step in association source identification refers to and is associated with source Corresponding chat data is identified, association chat data can be lteral data, image data, numerical data etc., for example, association is chatted Day data can be the chat message in group.When getting association source identification, then corresponding association source identification is extracted Corresponding association chat data.Further, when registration terminal gets association source identification, then current login data is inquired Corresponding user whether there is in the currently corresponding group in association source identification, work as when the corresponding user of logon data is present in When in the corresponding group in preceding source identification, is then sent to server and obtain the corresponding association chat data in current source identification；When The corresponding user of current login data is not present in currently being associated in the corresponding group in source identification, then registration terminal is to server It sends request to be added in the corresponding group in current source identification, when being added in the corresponding group in association source identification, then obtain Take the corresponding association chat data in association source identification.For example, the association source identification got is the suspicious chat got The group number of other chat groups of the corresponding user identifier addition of data, in turn, it is corresponding that registration terminal inquires logon data Whether user is added in the corresponding group of the group number, when the corresponding user of logon data is added to the corresponding group of the group number When in group, then the association chat data in the group is obtained；It is corresponded to when the corresponding user of logon data is not added into the group number Group in when, then registration terminal to server send request be added in the corresponding group of the group number, when logon data pair The user answered is added in the corresponding group of the group number, then obtains the association chat data in the group.

Specifically, according to the query logic being preset in registration terminal, one by one will association chat data and query logic into Row matching, until traversed all association chat datas, when successful match, then risk present in the association chat data Grade is more than the data of predetermined level, and when inquiring in association chat data, there are the data that risk class is more than predetermined level When, then the association chat data is to be associated with suspicious chat data, then the keyword in association chat data is extracted, according to extraction The association chat data is stored under the corresponding classification of keyword by keyword.For example, the query logic in registration terminal is Association chat data is matched with query logic, is chatted until having traversed all associations by " there is reward in safety bank " one by one Then there is " there is reward in safety bank " in day data, then the association chat data is when successful match in the association chat data It is associated with suspicious chat data, then the keyword " bank " in association chat data is extracted, according to the keyword of extraction, by the association Chat data is stored under corresponding " bank " classification of keyword.

In the present embodiment, by inquiring the network address of the corresponding user terminal identification of current suspicious chat data, in turn The corresponding association source identification of the user terminal is inquired, i.e., other association source marks only can be inquired by user terminal identification Know, inquiry is simple, and can obtain other a large amount of association source identifications simultaneously, and search efficiency is high, and then according to association source Mark gets corresponding association chat data, is judged in association chat data with the presence or absence of risk etc. by default query logic Grade be more than predetermined level data when inquire risk class be more than predetermined level data when, then according to association messages data Keyword is stored to corresponding classification, avoids only inquiring current suspect message data and inquiry being made to have omission, enhancing to be applicable in Property.

In one of the embodiments, in the above method, corresponding first user terminal of current suspicious chat data is extracted The first network address of carrying, and with extracting the second network for being associated with that the corresponding second user terminal of suspicious chat data carries Location may include the step of being monitored to first network address and the second network address：When the current suspicious chat data of extraction What the first network address and the corresponding second user terminal of association chat data that corresponding first user terminal carries carried When the second network address, then first network address and the corresponding account of the second network address in the preset period are inquired respectively Apply for quantity, is then more than the corresponding network address of account application account of preset value when account application quantity is more than preset value For addition monitoring mark in suspicious network address is monitored network address according to monitoring mark for suspicious network address.And The corresponding terminal of the network address is the terminal that risk class is more than predetermined level, and then limits the corresponding terminal of the network address Carry out web page access etc..For example, by taking the network address that corresponding first user terminal of current suspicious chat data carries as an example into Row explanation then inquires 5 when extracting the first network address that corresponding first user terminal of current suspicious chat data carries The quantity of the corresponding account application in first network address in minute, when the data volume of the account application is more than preset value, such as When more than 500, then first network address be suspicious network address, and then terminal corresponding with first network address it is possible that Malice gets the behavior of reward, to which first network address to be marked, carries out subsequent monitoring.It should be noted that pre- It can be 10 minutes etc. if the period can be 3 minutes.Preset account application quantity can be 100, can be 200 etc..It is right It is associated with the second network address that the corresponding second terminal of suspicious chat data carries same method may be used and be monitored, This is repeated no more.

In the present embodiment, when monitoring suspicious chat data, and then according to the corresponding user terminal mark of suspicious chat data The network address of knowledge inquires whether the network address is suspicious network address, when for suspicious network address, then be marked into The follow-up monitoring of row, improves safety, and further monitor network address, strong applicability.

It should be understood that although each step in the flow chart of Fig. 2 is shown successively according to the instruction of arrow, this A little steps are not that the inevitable sequence indicated according to arrow executes successively.Unless expressly state otherwise herein, these steps It executes there is no the limitation of stringent sequence, these steps can execute in other order.Moreover, at least part in Fig. 2 Step may include that either these sub-steps of multiple stages or stage are executed in synchronization to multiple sub-steps It completes, but can execute at different times, the execution sequence in these sub-steps or stage is also not necessarily to be carried out successively, But it can either the sub-step of other steps or at least part in stage execute in turn or alternately with other steps.

In one embodiment, as shown in figure 3, providing a kind of chat data processing unit 300, including：First obtains Module 310, the second acquisition module 320, enquiry module 330 and memory module 340, wherein：

First acquisition module 310 for obtaining login banner, and inquires the corresponding authentication result of login banner.

Second acquisition module 320 is used for when the authentication result of login banner is certification success, then acquisition and login banner Corresponding logon data, and obtain current chat data corresponding with logon data.

Enquiry module 330, for according to the current suspicious chat data preset in query logic acquisition current chat data.

Memory module 340, for searching association source identification according to current suspicious chat data, according to association source identification It obtains and is associated with suspicious chat data, suspicious chat data will be associated with and stored.

Extraction module 350, the first network carried for extracting corresponding first user terminal of current suspicious chat data Address, and extract and be associated with the second network address that the corresponding second user terminal of suspicious chat data carries, to first network Location is monitored with the second network address.

The first acquisition module 310 may include in one of the embodiments,：

Transmission unit, for when login banner is scanned, then sending and being logged in eventually to the end of scan of scanning login banner Client information, so that registration terminal information and logon data are forwarded to server by end of scan.

Receiving unit then connects when the logon data for being sent to server when end of scan is completed through server authentication Receive the authentication result that server is returned according to registration terminal information.

Chat data processing unit 300 can also include in one of the embodiments,：

Output module, for when not receiving the authentication result of server return within a preset period of time, then exporting mistake Lose prompt message.

Receiving module, for receiving, prompt message is corresponding re-operates instruction with failure.

Update module re-operates instruction update login banner, and the step of continuing to obtain login banner for basis.

Second acquisition module 320 in one of the embodiments, may include：

It logs in and confirms parameter acquiring unit, the interface IP address of the parameter acquiring interface for receiving server return, and root Login corresponding with logon data is obtained by parameter acquiring interface according to interface IP address and confirms parameter.

Group's master data acquiring unit confirms the corresponding group's master data of parameter for obtaining and logging in.

Group chatting data capture unit, for obtaining group chatting data corresponding with group's master data as current Chat data.

Enquiry module 330 may include in one of the embodiments,：

Judging unit, for judging to be more than in advance with the presence or absence of risk class in current chat data by default query logic If the data of grade.

Keyword extraction unit, for when in current chat data there are risk class be more than predetermined level data when, Then extraction is more than the keyword in the current chat data of the data of predetermined level comprising risk class.

Classification acquiring unit, for obtaining the corresponding classification of keyword.

First storage unit, for will include risk class be more than predetermined level data current chat data store to Under acquired classification.

Memory module may include in one of the embodiments,：

Network address extraction unit, the network for extracting current suspicious chat data corresponding user terminal identification Location.

It is associated with source identification query unit, receives daily record for obtaining chat corresponding with network address, and connect in chat It receives and inquires association corresponding with user terminal identification source identification in daily record.

It is associated with chat data acquiring unit, for obtaining the corresponding association chat data in association source identification.

Second storage unit is big with the presence or absence of risk class in association chat data for being judged by default query logic In predetermined level data when inquire risk class be more than predetermined level data when, then according to the key of association messages data Word is stored to corresponding classification.

Specific about chat data processing unit limits the limit that may refer to above for chat data processing method Fixed, details are not described herein.Modules in above-mentioned chat data processing unit can fully or partially through software, hardware and its It combines to realize.Above-mentioned each module can be embedded in or in the form of hardware independently of in the processor in computer equipment, can also It is stored in a software form in the memory in computer equipment, in order to which processor calls the above modules of execution corresponding Operation.

In one embodiment, a kind of computer equipment is provided, which can be terminal, internal structure Figure can be as shown in Figure 3.The computer equipment includes the processor connected by system bus, memory, network interface, display Screen and input unit.Wherein, the processor of the computer equipment is for providing calculating and control ability.The computer equipment is deposited Reservoir includes non-volatile memory medium, built-in storage.The non-volatile memory medium is stored with operating system and computer journey Sequence.The built-in storage provides environment for the operation of operating system and computer program in non-volatile memory medium.The calculating The network interface of machine equipment is used to communicate by network connection with external terminal.When the computer program is executed by processor with Realize a kind of chat data processing method.The display screen of the computer equipment can be that liquid crystal display or electric ink are shown Screen, the input unit of the computer equipment can be the touch layer covered on display screen, can also be on computer equipment shell Button, trace ball or the Trackpad of setting can also be external keyboard, Trackpad or mouse etc..

It will be understood by those skilled in the art that structure shown in Fig. 3, is only tied with the relevant part of application scheme The block diagram of structure does not constitute the restriction for the computer equipment being applied thereon to application scheme, specific computer equipment May include either combining certain components than more or fewer components as shown in the figure or being arranged with different components.

In one embodiment, a kind of computer equipment is provided, including memory, processor and storage are on a memory And the computer program that can be run on a processor, processor realize following steps when executing computer program：It obtains and logs in mark Know, and inquires the corresponding authentication result of login banner.When the authentication result of login banner is certification success, then obtains and log in Corresponding logon data is identified, and obtains current chat data corresponding with logon data.Worked as according to the acquisition of default query logic Current suspicious chat data in preceding chat data.Association source identification is searched according to current suspicious chat data, according to association Source identification, which obtains, is associated with suspicious chat data, will be associated with suspicious chat data and store.The current suspicious chat data of extraction The first network address that corresponding first user terminal carries, and extract the corresponding second user terminal of the suspicious chat data of association The second network address carried, is monitored first network address and the second network address.

The authentication result of inquiry login banner is realized when processor executes computer program in one of the embodiments, Step can also include：When login banner is scanned, then registration terminal letter is sent to the end of scan of scanning login banner Breath, so that registration terminal information and logon data are forwarded to server by end of scan.It is sent to server when end of scan When logon data is completed through server authentication, then the authentication result that server is returned according to registration terminal information is received.

In one embodiment, following steps are also realized when processor executes computer program：When within a preset period of time When not receiving the authentication result of server return, then prompt message is exported unsuccessfully.It receives corresponding heavy with failure prompt message New operational order.Login banner is updated according to instruction is re-operated, and the step of continuing to obtain login banner.

Realize that acquisition is corresponding with logon data current when processor executes computer program in one of the embodiments, The step of chat data can also include：The interface IP address for the parameter acquiring interface that server returns is received, and according to interface Location obtains login corresponding with logon data by parameter acquiring interface and confirms parameter.Obtain group corresponding with confirmation parameter is logged in Group master data.Group chatting data corresponding with group's master data are obtained as current chat data.

It is realized when processor executes computer program in one of the embodiments, and current message is obtained according to query logic The step of current suspicious chat data in data, can also include：Judged in current chat data by default query logic It is more than the data of predetermined level with the presence or absence of risk class.When there are risk class to be more than predetermined level in current chat data When data, then extraction is more than the keyword in the current chat data of the data of predetermined level comprising risk class.It obtains crucial The corresponding classification of word.The current chat data for the data for being more than predetermined level comprising risk class are stored to acquired classification Under.

It realizes when processor executes computer program in one of the embodiments, and is searched according to current suspicious chat data It is associated with source identification, is obtained according to association source identification and is associated with suspicious chat data, suspicious chat data will be associated with and stored The step of, including：Extract the network address of the corresponding user terminal identification of current suspicious chat data.It obtains and network address pair The chat answered receives daily record, and inquires association corresponding with user terminal identification source identification in chat receives daily record.It obtains It is associated with the corresponding association chat data in source identification.Judge to whether there is risk in association chat data by default query logic Grade be more than predetermined level data when inquire risk class be more than predetermined level data when, then according to association messages data Keyword store to corresponding classification.

In one embodiment, a kind of computer readable storage medium is provided, computer program is stored thereon with, is calculated Machine program realizes following steps when being executed by processor：Login banner is obtained, and inquires the corresponding authentication result of login banner.When When the authentication result of login banner is certification success, then logon data corresponding with login banner is obtained, and obtains and log in number According to corresponding current chat data.The current suspicious chat data in current chat data is obtained according to default query logic.Root Association source identification is searched according to current suspicious chat data, is obtained according to association source identification and is associated with suspicious chat data, will closed Join suspicious chat data to be stored.The extraction first network that currently corresponding first user terminal of suspicious chat data carries Location, and extract and be associated with the second network address that the corresponding second user terminal of suspicious chat data carries, to first network address It is monitored with the second network address.

The authentication result of inquiry login banner is realized when computer program is executed by processor in one of the embodiments, The step of, can also include：When login banner is scanned, then registration terminal letter is sent to the end of scan of scanning login banner Breath, so that registration terminal information and logon data are forwarded to server by end of scan.It is sent to server when end of scan When logon data is completed through server authentication, then the authentication result that server is returned according to registration terminal information is received.

In one embodiment, following steps are also realized when computer program is executed by processor：When in preset time period When not receiving the authentication result of server return inside, then prompt message is exported unsuccessfully.It receives corresponding with failure prompt message Re-operate instruction.Login banner is updated according to instruction is re-operated, and the step of continuing to obtain login banner.

It is realized when computer program is executed by processor in one of the embodiments, and obtains work as corresponding with logon data The step of preceding chat data can also include：The interface IP address for the parameter acquiring interface that server returns is received, and according to interface Address obtains login corresponding with logon data by parameter acquiring interface and confirms parameter.It obtains corresponding with confirmation parameter is logged in Group's master data.Group chatting data corresponding with group's master data are obtained as current chat data.

It realizes when computer program is executed by processor in one of the embodiments, and is currently disappeared according to query logic acquisition Cease data in current suspicious chat data the step of, can also include：Judge current chat data by default query logic In with the presence or absence of risk class be more than predetermined level data.When there are risk class to be more than predetermined level in current chat data Data when, then extraction comprising risk class be more than predetermined level data current chat data in keyword.It obtains and closes The corresponding classification of key word.The current chat data for the data for being more than predetermined level comprising risk class are stored to acquired class Under other.

It realizes when computer program is executed by processor in one of the embodiments, and is looked into according to current suspicious chat data Association source identification is looked for, is obtained according to association source identification and is associated with suspicious chat data, suspicious chat data will be associated with and deposited The step of storage, including：Extract the network address of the corresponding user terminal identification of current suspicious chat data.Acquisition and network address Corresponding chat receives daily record, and inquires association corresponding with user terminal identification source identification in chat receives daily record.It obtains Take the corresponding association chat data in association source identification.Judge to whether there is wind in association chat data by default query logic Dangerous grade be more than predetermined level data when inquire risk class be more than predetermined level data when, then according to association messages number According to keyword store to corresponding classification.

One of ordinary skill in the art will appreciate that realizing all or part of flow in above-described embodiment method, being can be with Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer In read/write memory medium, the computer program is when being executed, it may include such as the flow of the embodiment of above-mentioned each method.Wherein, Any reference to memory, storage, database or other media used in each embodiment provided herein, Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms, Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double data rate sdram (DDRSDRAM), enhancing Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..

Each technical characteristic of above example can be combined arbitrarily, to keep description succinct, not to above-described embodiment In each technical characteristic it is all possible combination be all described, as long as however, the combination of these technical characteristics be not present lance Shield is all considered to be the range of this specification record.

The several embodiments of the application above described embodiment only expresses, the description thereof is more specific and detailed, but simultaneously It cannot therefore be construed as limiting the scope of the patent.It should be pointed out that coming for those of ordinary skill in the art It says, under the premise of not departing from the application design, various modifications and improvements can be made, these belong to the protection of the application Range.Therefore, the protection domain of the application patent should be determined by the appended claims.

Claims

1. a kind of chat data processing method, the method includes：

When the corresponding authentication result of the login banner is certification success, then step on corresponding with the login banner is obtained Data are recorded, and obtain current chat data corresponding with the logon data；

Association source identification is searched according to the current suspicious chat data, it is suspicious to obtain association according to the association source identification Chat data stores the suspicious chat data of association；

The first network address that corresponding first user terminal of the currently suspicious chat data carries is extracted, and extracts the pass Join the second network address that the corresponding second user terminal of suspicious chat data carries, to the first network address and described the Two network address are monitored.

2. according to the method described in claim 1, it is characterized in that, the step of the authentication result of the inquiry login banner Suddenly, including：

When the login banner is scanned, then registration terminal information is sent to the end of scan for scanning the login banner, with Make the end of scan that the registration terminal information and logon data are forwarded to server；

When the logon data that the end of scan is sent to server is completed through server authentication, then server is received according to stepping on Record the authentication result that end message returns.

3. according to the method described in claim 2, it is characterized in that, the method further includes：

When not receiving the authentication result that the server returns within a preset period of time, then prompt message is exported unsuccessfully；

4. according to the method described in claim 1, it is characterized in that, described obtain current chat corresponding with the logon data The step of data, including：

The interface IP address for the parameter acquiring interface that server returns is received, and the parameter acquiring is passed through according to the interface IP address Interface obtains login corresponding with the logon data and confirms parameter；

Obtain group's master data corresponding with login confirmation parameter；

5. according to the method described in claim 1, it is characterized in that, described obtain the current message data according to query logic In current suspicious chat data the step of, including：

Judge the data for being more than predetermined level in the current chat data with the presence or absence of risk class by presetting query logic；

When there are when the data that risk class is more than predetermined level, then extraction includes described risk etc. in the current chat data Grade is more than the keyword in the current chat data of the data of predetermined level；

Obtain the corresponding classification of the keyword；

The current chat data of the data for being more than predetermined level comprising risk class are stored to acquired classification Under.

6. method according to any one of claims 1 to 5, which is characterized in that described according to the current suspicious chat number It is investigated that looking for association source identification, is obtained according to the association source identification and be associated with suspicious chat data, the association is suspicious merely The step of day data is stored, including：

It obtains chat corresponding with the network address and receives daily record, and inquiry and the user in the chat receives daily record The corresponding association source identification of terminal iidentification；

Judge the data for being more than predetermined level in the association chat data with the presence or absence of risk class by presetting query logic When inquire the risk class be more than predetermined level data when, then according to the keyword of the association messages data store to Under corresponding classification.

7. a kind of chat data processing unit, which is characterized in that described device includes：

Second acquisition module is used for when the corresponding authentication result of the login banner is certification success, then acquisition and institute The corresponding logon data of login banner is stated, and obtains current chat data corresponding with the logon data；

Enquiry module, for obtaining the current suspicious chat data in the current chat data according to default query logic；

Memory module is marked for searching association source identification according to the current suspicious chat data according to the association source Know to obtain and be associated with suspicious chat data, the suspicious chat data of association is stored；

Extraction module, for extracting first network that corresponding first user terminal of the current suspicious chat data carries Location, and the second network address that the corresponding second user terminal of the suspicious chat data of association carries is extracted, to described first Network address is monitored with second network address.

8. the method according to the description of claim 7 is characterized in that first acquisition module includes：

Transmission unit, for when the login banner is scanned, then being stepped on to the end of scan transmission for scanning the login banner End message is recorded, so that the registration terminal information and logon data are forwarded to server by the end of scan；

Receiving unit then connects when the logon data for being sent to server when the end of scan is completed through server authentication Receive the authentication result that server is returned according to registration terminal information.

9. a kind of computer equipment, including memory, processor and storage are on a memory and the meter that can run on a processor Calculation machine program, which is characterized in that the processor realizes any one of claim 1 to 6 institute when executing the computer program The step of stating method.

10. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program The step of method according to any one of claims 1 to 6 is realized when being executed by processor.