CN108418809B

CN108418809B - Chat data processing method and device, computer equipment and storage medium

Info

Publication number: CN108418809B
Application number: CN201810125078.4A
Authority: CN
Inventors: 张澍滋
Original assignee: Ping An Technology Shenzhen Co Ltd
Current assignee: Ping An Technology Shenzhen Co Ltd
Priority date: 2018-02-07
Filing date: 2018-02-07
Publication date: 2020-09-18
Anticipated expiration: 2038-02-07
Also published as: WO2019153586A1; CN108418809A

Abstract

The application relates to a chat data processing method, a chat data processing device, computer equipment and a storage medium. The method comprises the following steps: and acquiring a login identification, and inquiring an authentication result corresponding to the login identification. And when the authentication result of the login identification is successful, acquiring login data corresponding to the login identification, and acquiring current chat data corresponding to the login data. And acquiring the current suspicious chat data in the current chat data according to the preset query logic. Searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data; and extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address. The method avoids the omission of the query caused by only querying the current suspicious message data, and improves the query efficiency.

Description

Chat data processing method and device, computer equipment and storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a chat data processing method and apparatus, a computer device, and a storage medium.

Background

With the development of internet technology, in life, more and more activities of users can be performed on the network, and more information can be acquired from the network, and some high-risk information is propagated in a network chat mode, for example, activities held on a certain website, some lawbreakers can communicate in a network chat mode, broadcast or acquire corresponding activity information, and further acquire high activity rewards from the website with low payment, so that the information monitoring of the network chat is very important.

Conventionally, monitoring of chat data of a web chat is performed manually, which results in inefficient monitoring of the current web chat.

Disclosure of Invention

Therefore, in order to solve the above technical problems, it is necessary to provide a chat data processing method, device, computer device and storage medium with high monitoring efficiency, which can avoid missing of high-risk information.

A method of chat data processing, the method comprising:

acquiring a login identification, and inquiring an authentication result corresponding to the login identification;

when the login identification is successfully authenticated, acquiring login data corresponding to the login identification, and acquiring current chat data corresponding to the login data;

acquiring current suspicious chat data in the current chat data according to preset query logic;

searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data;

and extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address.

In one embodiment, the step of querying the authentication result of the login identifier includes:

when the login identification is scanned, login terminal information is sent to a scanning terminal which scans the login identification, so that the scanning terminal forwards the login terminal information and login data to a server;

and when the login data sent to the server by the scanning terminal is authenticated by the server, receiving an authentication result returned by the server according to the login terminal information.

In one embodiment, the method further comprises:

when the authentication result returned by the server is not received within a preset time period, outputting failure prompt information;

receiving a re-operation instruction corresponding to the failure prompt message;

and updating the login identification according to the re-operation instruction, and continuing to acquire the login identification.

In one embodiment, the step of obtaining the current chat data corresponding to the login data includes:

receiving an interface address of a parameter acquisition interface returned by a server, and acquiring login confirmation parameters corresponding to the login data through the parameter acquisition interface according to the interface address;

acquiring group basic data corresponding to the login confirmation parameters;

and acquiring group chatting data corresponding to the group basic data as current chatting data.

In one embodiment, the step of obtaining the current suspicious chat data in the current message data according to the query logic includes:

judging whether data with a risk level greater than a preset level exists in the current chatting data through a preset query logic;

when data with a risk level larger than a preset level exists in the current chatting data, extracting keywords in the current chatting data containing the data with the risk level larger than the preset level;

acquiring a category corresponding to the keyword;

and storing the current chat data containing the data with the risk level larger than the preset level into the acquired category.

In one embodiment, the step of searching for an associated source identifier according to the current suspicious chat data, obtaining associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data includes:

extracting a network address of a user terminal identifier corresponding to the current suspicious chat data;

obtaining a chat receiving log corresponding to the network address, and inquiring an associated source identifier corresponding to the user terminal identifier in the chat receiving log;

obtaining associated chatting data corresponding to the associated source identifier;

and judging whether the associated chatting data has data with the risk level larger than the preset level through a preset query logic, and storing the data to the corresponding category according to the keywords of the associated message data when the data with the risk level larger than the preset level is queried.

A chat data processing apparatus, the apparatus comprising:

the first acquisition module is used for acquiring the login identification and inquiring the authentication result corresponding to the login identification;

the second obtaining module is used for obtaining login data corresponding to the login identification and obtaining current chat data corresponding to the login data when the authentication result corresponding to the login identification is successful;

the query module is used for acquiring current suspicious chat data in the current chat data according to preset query logic;

the storage module is used for searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier and storing the associated suspicious chat data;

and the extraction module is used for extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address.

In one embodiment, the first obtaining module includes:

a sending unit, configured to send login terminal information to a scanning terminal that scans the login identifier when the login identifier is scanned, so that the scanning terminal forwards the login terminal information and login data to a server;

and the receiving unit is used for receiving the authentication result returned by the server according to the login terminal information when the login data sent to the server by the scanning terminal is authenticated by the server.

A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the above method when executing the computer program.

A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the above-mentioned method.

The chat data processing method, the device, the computer equipment and the storage medium obtain the login identification and further inquire the authentication result corresponding to the login identification, when the authentication is successful, the server can be communicated with the server to further obtain the login data corresponding to the login identification and obtain the current chat data corresponding to the login number, so that the obtained current chat data is ensured to be reliable and the suspicious chat data is accurately analyzed, when the current suspicious message data in the current chat data is inquired according to the inquiry logic, the associated source identification is inquired according to the current suspicious message data, the associated suspicious chat data is obtained according to the associated source identification, only the current suspicious message data is inquired, the associated source identification can be inquired, the message data in the associated source identification is analyzed to obtain the associated suspicious message data, and the condition that the inquiry is omitted due to the fact that only the current suspicious message data is inquired is avoided, and the associated suspicious information data is associated and inquired, so that the inquiry efficiency is improved. And the first network address carried by the first user terminal corresponding to the current suspicious chat data and the second network address carried by the second user terminal corresponding to the associated suspicious chat data can be monitored, so that the query efficiency is further improved, and the applicability is enhanced.

Drawings

FIG. 1 is a diagram illustrating an exemplary chat data processing method;

FIG. 2 is a flow diagram illustrating a method for chat data processing in one embodiment;

FIG. 3 is a block diagram of a chat data processing apparatus in one embodiment;

FIG. 4 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The chat data processing method provided by the application can be applied to the application environment shown in fig. 1. The login terminal 102 communicates with the server 104 via a network. The login terminal 102 obtains the login identification and queries the corresponding authentication result of the login identification, when the login identification is successfully authenticated, the login terminal 102 may perform data interaction with the server 104, and the login terminal 102 acquires login data corresponding to the login identification, and the login terminal 102 acquires current chat data corresponding to the login data, when the current chatting data is obtained, the current suspicious chatting data in the current chatting data is obtained according to the preset query logic, searching for a related source identifier according to the current suspicious chat data, acquiring related suspicious chat data according to the related source identifier, storing the related suspicious chat data, extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, and extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address. The login terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices, and the server 104 may be implemented by a stand-alone server 104 or a server 104 cluster composed of a plurality of servers 104.

In an embodiment, as shown in fig. 2, a chat data processing method is provided, which is described by taking the example that the method is applied to the login terminal in fig. 1, and includes the following steps:

s202: and acquiring a login identification, and inquiring an authentication result corresponding to the login identification.

Specifically, the login identifier is an identifier which is acquired from the server and carries data to be authenticated, and the login identifier can be verified by the server, so that the login terminal and the server perform data interaction, for example, the login identifier may be a login two-dimensional code or the like. Specifically, the login identification is obtained, whether authentication passes or not is inquired, and when the authentication result is that authentication succeeds, data interaction can be established with the server, so that data interaction is performed. For example, when the login identification acquired by the login terminal is the login two-dimensional code, the login two-dimensional code is sent to the server for verification, and when the authentication result of the login two-dimensional code authenticated by the server is that the authentication is successful, the login terminal can perform data interaction with the server, such as acquiring chat data corresponding to corresponding login data.

S204: and when the authentication result corresponding to the login identification is successful, acquiring login data corresponding to the login identification and acquiring current chat data corresponding to the login data.

Specifically, the login data refers to authentication information for requesting to acquire data stored on the server, the authentication information is stored in the server, the login data may be authentication information for acquiring corresponding chat data stored by the server, the authentication information is stored in the server, and the chat data corresponding to the authentication information is stored, for example, the login data may be a user account or the like. The chat data refers to data for interacting with different login data, and may be text data, picture data, digital data, and the like, for example, the chat data may be a chat record between the current login data and the login data thereof, or the chat data may be a chat record received or transmitted by the current login data in a different chat group. Further, when the login identification is obtained and the login identification is inquired to be successfully verified by the server, login data corresponding to the login identification is obtained, data interaction can be carried out with the server, and chat data corresponding to the current login data are obtained from the server. For example, when the login terminal acquires the login two-dimensional code, and inquires that the current login two-dimensional code is authenticated by the server, and the corresponding authentication result is successful authentication, the corresponding user account is acquired from the server, and further, according to the acquired corresponding user account, the chat data between the user account and other user accounts is acquired, for example, the chat record between the user account and other user accounts can be acquired, and the chat record received or sent in the group chat in which the user account joins can also be acquired.

S206: and acquiring the current suspicious chat data in the current chat data according to the preset query logic.

Specifically, the query logic refers to a preset query rule for identifying whether chat data with a risk level greater than a preset level exists in the chat data; the suspicious chat data refers to data with a risk level higher than a preset level in the current chat data, and the suspicious chat data can be picture data, text data, digital data and the like. Further, when the chat data corresponding to the login data is obtained, the query logic is adopted to match the obtained chat data item by item until all the chat data are traversed, and when at least one chat data in the chat data is successfully matched with the query logic, the chat data with the risk level greater than the preset level exists, that is, the current chat data containing the data with the risk level greater than the preset level is the current suspicious chat data. For example, the query logic is to query whether a "safe bank" and an "activity" exist in the chat data at the same time, match the "safe bank" with the chat data one by one, when the chat data containing the "safe bank" is queried, extract the chat data containing the "safe bank", further match the extracted chat data containing the "safe bank" with the "activity" one by one, when the matching is successful, extract the chat data containing the "safe bank" and the "activity", and if the chat data containing the "safe bank" and the "activity" is the data with the risk level greater than the preset level, the chat data is the current suspicious chat data.

S208: and searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data.

Specifically, the association source identifier refers to an identifier of an entirety having a plurality of different objects associated with corresponding basic information in the current suspicious chat data, and the association source identifier may be an identifier of an entirety having a plurality of different objects associated with corresponding user personal information in the current suspicious chat data, for example, the association source identifier may be a group number of a group associated with a corresponding account in the current suspicious chat data. Specifically, when the current suspicious chat data is found, basic information contained in the current suspicious chat data is inquired, a correlation source identifier is inquired according to the basic information, and then, corresponding correlation chat data in the correlation identifier is obtained according to the correlation identifier, whether the correlation suspicious chat data exists in the correlation chat data is inquired by adopting inquiry logic, whether the correlation suspicious chat data exists in the correlation chat data can be inquired by adopting the inquiry logic to match the correlation chat data one by one, when the matching is successful, the chat data with the risk level larger than the preset level exists in the correlation chat data, the correlation chat data containing the data with the risk level larger than the preset level is the correlation suspicious chat data, and the inquired correlation suspicious chat data is stored.

S210: and extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address.

Specifically, the first network address refers to a network address of a computer in a certain network of the first user terminal corresponding to the current suspicious chat data, the network address may uniquely identify the user terminal in the network, and the network address may be used as a communication identifier when the user terminal communicates with another computer, for example, the network address may be an IP (internet protocol) address. The second network address refers to a network address of a computer in a network, where the second user terminal corresponding to the associated suspicious chat data is located, where the network address may uniquely identify the user terminal in the network, and the network address may be used as a communication identifier when the user terminal communicates with another computer, for example, the network address may be an IP (Internet Protocol) address. Specifically, when the current suspicious chat data and the associated suspicious chat data are found, a first network address carried by a first user terminal corresponding to the current chat data is extracted, a second network address carried by a second user terminal corresponding to the associated suspicious chat data is extracted, the first network address and the second network address are further monitored, the number of account registrations corresponding to the first network address and the number of account registrations corresponding to the second network address can be monitored, other chat data corresponding to the first network address can be monitored, other chat data corresponding to the second network address can be monitored, and the like, so that the monitored first network address and the monitored second network address are further processed, for example, webpage access of other terminals corresponding to the first network address or the second network address is limited, and the like.

In the above embodiment, when the login identifier is successfully authenticated, the server may communicate with the server to obtain login data, obtain current chat data according to the login data, obtain reliable current chat data, further query the current chat data according to the query logic to obtain current suspicious data in the current chat data, and improve the query accuracy, when the current suspicious chat data is obtained, query the associated source identifier according to the current suspicious chat data, and query the associated suspicious chat data according to the associated source identifier, instead of querying only the current suspicious chat data in the current chat data, avoiding query omission, and querying other associated chat suspicious data from the current suspicious chat data, so as to improve the query efficiency, and may query a first network address carried by a first user terminal corresponding to the current suspicious chat data and a second network address carried by a second user terminal corresponding to the associated suspicious chat data And the address is monitored, so that the query efficiency is further improved, and the applicability is enhanced.

In one embodiment, the step S202 of querying the authentication result of the login id may include: when the login identification is scanned, login terminal information is sent to a scanning terminal which scans the login identification, so that the scanning terminal forwards the login terminal information and login data to the server. And when the login data sent to the server by the scanning terminal is authenticated by the server, receiving an authentication result returned by the server according to the login terminal information.

Specifically, the scanning terminal is a device capable of receiving login terminal information corresponding to the login identifier, and the scanning terminal may be a smart phone, a tablet computer, or the like; the login terminal information may be authentication information hidden in a login identifier, the login terminal information may be a network environment identifier corresponding to the current login terminal, the login terminal information may also be device information corresponding to the current login terminal, and the like. Further, when the login terminal is identified to be scanned, login terminal information is sent to the scanning terminal which scans the login identification, and then the scanning terminal forwards the login terminal information and login data to the server. The scanning terminal may send a scanning request to the login terminal when scanning the login identifier, and when receiving the scanning request, the login terminal recognizes that the login terminal is scanned, and then sends login terminal information to the scanning terminal that scans the login identifier, for example, the scanning terminal may send authentication information preset by the server hidden in the login identifier, or may send an IP address of the current login terminal, and when receiving the login terminal authentication information, such as the authentication information preset by the server hidden in the login identifier or the IP address of the current login terminal, the scanning terminal sends the login terminal information and current login data, such as the user account or the user account and the password, to the server together. When the login terminal receives the scan request, the login terminal information transmitted to the scan terminal may be any one of the login terminal information or a combination of a plurality of types of login terminal information.

Specifically, when the login data sent by the scanning terminal to the server is authenticated by the server, and when the login data is authenticated as the pre-stored login data, the login terminal can perform data interaction with the server, that is, other data corresponding to the login data can be obtained from the server, and then the result of passing authentication returned by the server according to the login terminal information is received. The server may match the login data with the pre-stored login data one by one when the scanning terminal server sends the login data, and when the matching is successful, the login data is considered as the pre-stored login data, the login terminal may perform data interaction with the server, that is, may obtain chat data and the like corresponding to the login number from the server, and then the login terminal receives the authentication result returned by the server according to the login terminal information. For example, when the login data sent by the scanning terminal to the server is an account password, the server matches the received account password with account passwords prestored in the server one by one, and when the matching is successful, the login terminal can communicate with the server to perform data interaction, for example, the server can be requested to obtain chat data corresponding to the current account password, and the login terminal receives the result that the server passes the authentication returned according to the login terminal information, for example, the login terminal receives the result that the server returns the authentication to the login terminal according to the IP address corresponding to the login terminal. It should be noted that, when the login data sent by the scanning terminal to the server is authenticated by the server, and when the login data is authenticated and is not the pre-stored login data, the login terminal may not perform data interaction with the server, that is, other data corresponding to the login data cannot be acquired from the server, and then the result of authentication failure returned by the server according to the login terminal information is received.

In this embodiment, when the login identifier is scanned, the login terminal sends login terminal information to the scanning terminal, so that the scanning terminal forwards the login terminal information and login data to the server, and when the login data sent by the scanning terminal to the server is verified by the server, the authentication result returned by the server according to the login terminal information is received, and the login terminal performs data interaction with the server after verification, so that the accuracy of the chat data acquired by the login terminal is ensured, and the chat data is accurately analyzed.

In one embodiment, the method may further include: and outputting failure prompt information when the authentication result returned by the server is not received within a preset time period. And receiving a re-operation instruction corresponding to the failure prompt information. And updating the login identification according to the re-operation instruction, and continuing to acquire the login identification.

Specifically, the failure prompt information refers to prompt information for performing different operations, the failure prompt information may be information displayed on the login terminal, the failure prompt information may be a text prompt or a symbol prompt, and the failure prompt information may be, for example, an information prompt box that is displayed on the login terminal and includes "whether to reacquire the login identifier if the current operation is overtime". Further, within a preset time period, if an authentication result returned by the server is not received, the current login identification is not scanned for a long time, in order to avoid the risk that other data corresponding to the current login data is stolen due to the fact that the scanning terminal which steals the login data scans subsequently, the current login identification is invalid, and then failure prompt information is output, and a new login identification is obtained. For example, within 1 minute, if the login terminal has not received the authentication result returned by the server, the current login identifier is not scanned for a long time, in order to avoid that the scanning terminal that has stolen the login data will scan subsequently to steal the corresponding information, the current login identifier is invalid, and the scanning terminal cannot scan, a new login identifier needs to be obtained, and then corresponding failure prompt information is output, for example, "if the current operation is overtime, whether the login identifier is obtained again? "failure prompt information. It should be noted that the preset time may also be 10 seconds, 50 seconds, 1 minute 20 seconds, and the like.

The re-operation instruction in the step of receiving the re-operation instruction corresponding to the failure prompt information refers to an instruction for the login terminal to select a subsequent operation, for example, the re-operation instruction may be an instruction for acquiring an updated login identifier, and the re-operation instruction may also be an instruction for not acquiring the updated login identifier. Specifically, when the login terminal outputs the failure prompt message, the re-operation instruction corresponding to the failure prompt message is received. When the login terminal outputs the failure prompt information, the user selects subsequent operations according to the failure prompt information, and then the login terminal receives a re-operation instruction generated according to the selection of the user. For example, the login terminal outputs failure prompt information "is the current operation timeout and whether to retrieve the login id? And if the selection is yes, generating a corresponding re-operation instruction for acquiring the new login terminal, and receiving the re-operation instruction for acquiring the new login terminal generated according to the selection of the user by the login terminal.

Specifically, when a login terminal receives a re-operation instruction for re-obtaining a login identifier, a request for obtaining a new login identifier is sent to a server according to the re-operation instruction, the new login identifier is received so as to update a current login identifier, an authentication result corresponding to the login identifier is continuously inquired, when the login identifier is authenticated successfully, login data corresponding to the login identifier is obtained, current chat data corresponding to the login data is obtained, current suspicious chat data in the current chat data is obtained according to preset inquiry logic, an association source identifier is searched according to the current suspicious chat data, association suspicious chat data is obtained according to the association source identifier, and the association suspicious chat data is stored.

In this embodiment, when the authentication result returned by the server is not received within the preset time, the re-operation instruction generated according to the failure prompt information is further received according to the output failure prompt information, the login identifier is updated according to the re-operation instruction, the security is ensured, the obtained chat data is ensured to be safe, and the accuracy of the subsequent identification of the chat data is further ensured.

In one embodiment, the step of obtaining the current chat data corresponding to the login data in step S204 may include: and receiving an interface address of the parameter acquisition interface returned by the server, and acquiring login confirmation parameters corresponding to the login data through the parameter acquisition interface according to the interface address. And acquiring group basic data corresponding to the login confirmation parameters. And acquiring group chatting data corresponding to the group basic data as current chatting data. Specifically, the group chat data refers to chat data in a group to which login data is added, and the login terminal receives the group to which the login data is added. And acquiring group chatting data corresponding to the group basic data as current chatting data.

Specifically, the parameter obtaining interface refers to a port which is arranged on the server and can obtain different parameters, and the parameter obtaining interface can be an authentication parameter for successfully obtaining login, and the like; the interface address refers to an identifier of a port which is arranged on the server and can acquire different parameters, and the interface address can be an interface number of an interface corresponding to the interface and the like; the login confirmation parameter refers to a confirmation identifier of the current login state returned by the server, and the login confirmation parameter may be a pre-stored character string or a pre-stored parameter value. Further, when an interface address of the parameter acquisition interface returned by the server is received, the interface is queried according to the interface address, the login confirmation parameter is acquired from the interface, the login confirmation parameter corresponds to the login data, the login terminal can perform data interaction with the server, and other data corresponding to the login data, such as chat data, can be acquired. For example, the login terminal receives an interface address of a parameter obtaining interface returned by the server, such as an interface number of the parameter obtaining interface, and further queries the parameter obtaining interface corresponding to the interface number, and obtains a corresponding login confirmation parameter through the interface, for example, obtains a confirmation identifier that the login data corresponding to the server passes verification, and further the login terminal and the server can perform data interaction, so that the login terminal can obtain other data corresponding to the login data, such as chat data. For example, when the corresponding server is a QQ chat server, the login terminal receives an interface number of a parameter acquisition interface returned by the server, and acquires a login confirmation parameter corresponding to the account, such as a ptwebqq parameter, according to the interface number.

The group basic data in the step of acquiring the group basic data corresponding to the login confirmation parameter refers to basic information of a group to which the login data is added, and the group basic data may be text data, picture data, digital data, and the like. Further, when the login confirmation parameter is obtained, the corresponding group information parameter is obtained according to the login confirmation parameter, and the corresponding group basic data is read according to the group information parameter. The group basic data corresponding to the login data can be obtained by the login terminal according to the group information parameter, and the group basic data corresponding to the login data can be read according to the group basic data. For example, when the corresponding server is a QQ chat server, when the login terminal acquires the login confirmation parameter, such as the ptwebqq parameter, the corresponding group information parameter, which may be a vfwebqq parameter, is acquired according to the ptwebqq parameter, an acquisition request carrying the vfwebqq parameter is sent to the server, and then group basic data corresponding to the login data, such as a group number of a group added by current zhan, a contact in the group, head portrait data of the contact in the group, and the like, is acquired according to the acquisition request. The group information parameter refers to a parameter that can acquire corresponding group basic information, and for example, the group information parameter may be a vfwebqq parameter or the like.

The step of acquiring the group chat data corresponding to the group basic data as the group chat data in the current chat data step means that the login data is added to the group, and the login terminal receives the chat data added to the group by the login data. Further, when the group basic data is acquired, the message request parameter is acquired, a chat data acquisition request carrying the message request parameter is further sent to the server, and the group chat data corresponding to the group basic data stored on the server is acquired as the current chat data according to the acquisition request. The chat server may further include a chat data obtaining module configured to obtain the chat data obtaining request carrying the chat data obtaining request parameter when the login terminal obtains the group base data, and obtain the group chat data corresponding to the group base data stored in the server when the server verifies that the message request data is legal message request data, and then the login terminal may obtain the group chat data corresponding to the group base data stored in the server, and then use the obtained group chat data as the current chat data. For example, when the login terminal acquires the group number of the group and the contacts in the group, a message request parameter is acquired, the message request parameter may be a uin parameter, the login terminal sends a chat data acquisition request carrying the uin parameter to the server, and when the server receives the chat data acquisition request, the server verifies that the uin parameter is a legal uin parameter, and then the chat data can be sent to the login terminal, so that the login terminal acquires the group chat data, and the group chat data is used as the current chat data. It should be noted that the message request parameter refers to a parameter that can obtain corresponding chat data after being successfully verified by the server, and for example, the message request parameter may be a uin parameter or the like.

In this embodiment, the login terminal receives an interface address of the parameter obtaining interface returned by the server, obtains a login confirmation parameter corresponding to the login data through the parameter obtaining interface according to the interface address, further obtains group basic data corresponding to the login confirmation parameter, obtains group chat data corresponding to the group basic data as current chat data, and ensures that the chat data is reliably queried as suspicious chat data.

In one embodiment, the step S206 of obtaining the current suspicious chat data in the current message data according to the query logic may include: and judging whether the current chatting data has data with the risk level larger than the preset level through the preset query logic. And when the data with the risk level larger than the preset level exists in the current chatting data, extracting keywords in the current chatting data containing the data with the risk level larger than the preset level. And acquiring the category corresponding to the keyword. And storing the current chat data containing the data with the risk level larger than the preset level into the acquired category.

Specifically, the query logic refers to a judgment rule prestored in the server, and the query logic may be a rule for judging whether suspicious chat data exists. The risk level may assess the level of threat to the information in the current chat data. For example, the risk level may be set from low to high, and the higher the risk level is, the higher the risk of the corresponding chat data exists is, for example, the risk level is set to level 1 to level 5, which indicates that the chat data corresponds to higher and higher risk. Further, according to a query logic preset in the login terminal, matching the current chat data with the query logic item by item until all current chat data are traversed, and when the matching is successful, data with a risk level larger than a preset level exists in the current chat data, so that the current chat data are suspicious chat data. The login terminal may obtain a pre-stored query logic, match the current chat data with the query logic one by using the query logic until all current chat data are traversed, and when the match is successful, data with a risk level greater than a preset level exists in the current chat data, that is, data with a high risk level exists in the current chat data, so that the current chat data of the login terminal is suspicious chat data. For example, if the pre-stored query logic acquired by the login terminal is to query whether "safe bank has activity" exists in the current chat data, matching the "safe bank has activity" with the current chat data one by one, and if the matching is successful, the current chat data has data with a risk level greater than a preset level, and the current chat data is the current suspicious chat data.

Specifically, when data with a risk level greater than a preset level exists in the current chat data according to the query logic, the chat data containing the data with the risk level greater than the preset level is threatened, that is, the current chat data is the current suspicious data, and then the keywords in the current chat data are extracted. If the login terminal queries that data with a risk level greater than a preset level exists in the current chat data according to the query logic, the chat data containing the data with the risk level greater than the preset level is threatened, that is, the current chat data is current suspicious data, and the login terminal extracts keywords in the current chat data. For example, when the login terminal queries that the current chat data contains "safe bank has activity", the current chat data containing "safe bank has activity" is threatened, that is, the current chat data is current suspicious data, and the login terminal extracts a keyword in the current chat data, such as "bank".

Specifically, the category to which the keyword belongs is acquired according to the acquired keyword in the current chat data containing data with a risk level greater than a preset level. The login terminal may prestore different data categories, for example, the data category is a "bank category", the data category is a "web page category", and the like, and when the login terminal acquires a category to which a keyword belongs according to the acquired keyword in the current chat data that includes data with a risk level greater than a preset level. For example, the login terminal acquires that the corresponding category is a "bank category" according to the fact that the keyword in the acquired current chat data containing the data with the risk level greater than the preset level is a "bank".

Specifically, when different categories are acquired, the current chat data including the data with the risk level greater than the preset level is stored in the corresponding category. If the login terminal obtains the data with the risk level greater than the preset level, extracting keywords in the current chat data containing the data with the risk level greater than the preset level, and storing the current chat data in the corresponding category according to the keywords. For example, the login terminal acquires that the data with the risk level greater than the preset level is 'safe bank active', further extracts the keyword of the current chat data containing 'safe bank active' as 'bank', and further stores the current chat data containing 'safe bank active' into the corresponding 'bank' category.

In the embodiment, the query logic is adopted to query the current chat data, so that the keywords in the current chat data containing the data with the risk level larger than the preset level are extracted, the current chat data are stored under the category corresponding to the keywords, the query of suspicious chat data is accurate, and the query logic is adopted to perform query, so that the query efficiency is improved.

In one embodiment, the step S208 of searching for the associated source identifier according to the current suspicious chat data, obtaining the associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data may include: and obtaining a chat receiving log corresponding to the network address, and obtaining an associated source identifier corresponding to the user terminal identifier in the chat receiving log. And acquiring the associated chatting data corresponding to the associated source identifier. And judging whether the associated chatting data has data with the risk level larger than the preset level or not through preset inquiry logic, and storing the data to the corresponding category according to the keywords of the associated message data when the data with the risk level larger than the preset level is inquired. And extracting the network address of the user terminal identification corresponding to the current suspicious chat data.

Specifically, the user terminal identifier refers to an identity identifier of a user terminal corresponding to the current suspicious chat data, and the user terminal identifier may be a text identifier, a picture identifier, a digital identifier, or the like, for example, the user terminal identifier may be a user name of the user sending the current suspicious chat data, or a user avatar of the user sending the current suspicious chat data. Further, according to the suspicious chat data acquired by the method, the user terminal identification corresponding to the current suspicious data is extracted, and then the network address corresponding to the user terminal identification is inquired. If the suspicious chat data is extracted by the login terminal, the user identity corresponding to the suspicious chat data and used for sending the suspicious chat data is extracted, for example, the user name of the user is extracted, and the user name is further queried to the IP address to which the terminal corresponding to the user name belongs.

The chat receiving log in the step of obtaining the associated source identifier corresponding to the user terminal identifier in the chat receiving log refers to a record in which data associated with the chat data is stored, and the chat receiving log may store corresponding chat data, user terminal identifiers corresponding to the chat data, and the like. Further, when the network address is acquired, a chat receiving log corresponding to the network address is acquired, and the chat receiving log is queried, so that the associated source identifier corresponding to the acquired user terminal identifier is acquired. For example, when the login terminal acquires the network address, the login terminal acquires a chat receiving log corresponding to the network address, and queries the acquired user terminal identifier, such as other associated source identifiers corresponding to the user name of the user, in the chat receiving log, such as acquiring a group number of other groups corresponding to the user name, that is, acquiring a group number of other groups to which the user corresponding to the user name is added.

The associated chat data in the step of obtaining the associated chat data corresponding to the associated source identifier refers to chat data corresponding to the associated source identifier, and the associated chat data may be text data, picture data, digital data, and the like, for example, the associated chat data may be chat information in a group. And when the associated source identifier is obtained, extracting associated chatting data corresponding to the corresponding associated source identifier. Further, when the login terminal acquires the associated source identifier, whether a user corresponding to the current login data exists in a group corresponding to the current associated source identifier is inquired, and when the user corresponding to the login data exists in the group corresponding to the current source identifier, the associated chat data corresponding to the current source identifier is sent to the server; and when the user corresponding to the current login data does not exist in the group corresponding to the current associated source identifier, the login terminal sends a request to the server to add the request to the group corresponding to the current source identifier, and when the user corresponding to the current login data is added to the group corresponding to the associated source identifier, associated chat data corresponding to the associated source identifier is obtained. For example, the obtained association source identifier is a group number of another chat group added by the user identifier corresponding to the obtained suspicious chat data, and the login terminal queries whether the user corresponding to the login data is added to the group corresponding to the group number, and when the user corresponding to the login data is added to the group corresponding to the group number, the association source identifier in the group is obtained; and when the user corresponding to the login data is added to the group corresponding to the group number, acquiring the associated chat data in the group.

Specifically, according to a query logic preset in a login terminal, matching associated chat data with the query logic item by item until all associated chat data are traversed, wherein when the matching is successful, the risk level of the associated chat data is greater than the preset level, and when the data with the risk level greater than the preset level is inquired, the associated chat data is associated suspicious chat data, extracting keywords in the associated chat data, and storing the associated chat data in a category corresponding to the keywords according to the extracted keywords. For example, the query logic in the login terminal is "safe bank has reward", the associated chat data is matched with the query logic item by item until all the associated chat data are traversed, when the matching is successful, the "safe bank has reward" exists in the associated chat data, the associated chat data is associated suspicious chat data, the keyword "bank" in the associated chat data is extracted, and the associated chat data is stored in the "bank" category corresponding to the keyword according to the extracted keyword.

In this embodiment, the network address of the user terminal identifier corresponding to the current suspicious chat data is queried, and then the associated source identifier corresponding to the user terminal is queried, that is, other associated source identifiers can be queried only through the user terminal identifier, the query is simple, and a large number of other associated source identifiers can be obtained at the same time, the query efficiency is high, and then the corresponding associated chat data is obtained according to the associated source identifier, and it is determined through the preset query logic whether data with a risk level greater than a preset level exists in the associated chat data, and when data with a risk level greater than the preset level is queried, the data is stored into a corresponding category according to the keywords of the associated message data, so that the query omission caused by querying only the current suspicious message data is avoided, and the applicability is enhanced.

In one embodiment, in the method, the step of extracting a first network address carried by a first user terminal corresponding to current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to associated suspicious chat data, and monitoring the first network address and the second network address may include: when a first network address carried by a first user terminal corresponding to the current suspicious chat data and a second network address carried by a second user terminal corresponding to the associated chat data are extracted, inquiring account application numbers corresponding to the first network address and the second network address in a preset time period respectively, when the account application numbers exceed a preset value, adding a monitoring identifier to the suspicious network address, and monitoring the network address according to the monitoring identifier. And the terminal corresponding to the network address is a terminal with a risk level greater than a preset level, so that the terminal corresponding to the network address is limited from performing webpage access and the like. For example, taking a network address carried by a first user terminal corresponding to current suspicious chat data as an example, when a first network address carried by the first user terminal corresponding to the current suspicious chat data is extracted, the number of account applications corresponding to the first network address within 5 minutes is queried, and when the data amount of the account applications exceeds a preset value, for example, exceeds 500, the first network address is the suspicious network address, and then a behavior of maliciously receiving a reward may occur in the terminal corresponding to the first network address, so that the first network address is marked, and subsequent monitoring is performed. The preset time period may be 3 minutes, 10 minutes, or the like. The preset number of account applications may be 100, 200, and the like. The second network address carried by the second terminal corresponding to the associated suspicious chat data may be monitored by the same method, which is not described herein again.

In this embodiment, when suspicious chat data is monitored, further, according to the network address of the user terminal identifier corresponding to the suspicious chat data, whether the network address is a suspicious network address is queried, and when the network address is a suspicious network address, the network address is marked for subsequent monitoring, so that the security is improved, the network address is further monitored, and the applicability is high.

It should be understood that, although the steps in the flowchart of fig. 2 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 2 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

In one embodiment, as shown in fig. 3, there is provided a chat data processing apparatus 300, including: a first obtaining module 310, a second obtaining module 320, a querying module 330, and a storing module 340, wherein:

the first obtaining module 310 is configured to obtain a login identifier, and query an authentication result corresponding to the login identifier.

The second obtaining module 320 is configured to, when the authentication result of the login identifier is that the authentication is successful, obtain login data corresponding to the login identifier, and obtain current chat data corresponding to the login data.

The query module 330 is configured to obtain current suspicious chat data in the current chat data according to a preset query logic.

The storage module 340 is configured to search for the associated source identifier according to the current suspicious chat data, obtain the associated suspicious chat data according to the associated source identifier, and store the associated suspicious chat data.

The extracting module 350 is configured to extract a first network address carried by a first user terminal corresponding to the current suspicious chat data, extract a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitor the first network address and the second network address.

In one embodiment, the first obtaining module 310 may include:

and the sending unit is used for sending the login terminal information to the scanning terminal for scanning the login identification when the login identification is scanned, so that the scanning terminal forwards the login terminal information and the login data to the server.

And the receiving unit is used for receiving the authentication result returned by the server according to the login terminal information when the login data sent by the scanning terminal to the server is authenticated by the server.

In one embodiment, the chat data processing apparatus 300 may further include:

and the output module is used for outputting failure prompt information when the authentication result returned by the server is not received within the preset time period.

And the receiving module is used for receiving the re-operation instruction corresponding to the failure prompt information.

And the updating module is used for updating the login identification according to the re-operation instruction and continuing to acquire the login identification.

In one embodiment, the second obtaining module 320 may include:

and the login confirmation parameter acquisition unit is used for receiving the interface address of the parameter acquisition interface returned by the server and acquiring the login confirmation parameters corresponding to the login data through the parameter acquisition interface according to the interface address.

And the group basic data acquisition unit is used for acquiring the group basic data corresponding to the login confirmation parameters.

And the group chatting data acquiring unit is used for acquiring the group chatting data corresponding to the group basic data as the current chatting data.

In one embodiment, the query module 330 may include:

and the judging unit is used for judging whether the current chatting data has data with the risk level larger than the preset level through the preset query logic.

And the keyword extraction unit is used for extracting keywords in the current chatting data containing the data with the risk level larger than the preset level when the data with the risk level larger than the preset level exists in the current chatting data.

And the category acquisition unit is used for acquiring the category corresponding to the keyword.

And the first storage unit is used for storing the current chat data containing the data with the risk level larger than the preset level to the acquired category.

In one embodiment, the storage module may include:

and the network address extraction unit is used for extracting the network address of the user terminal identifier corresponding to the current suspicious chat data.

And the associated source identifier query unit is used for acquiring the chat receiving log corresponding to the network address and querying the associated source identifier corresponding to the user terminal identifier in the chat receiving log.

And the associated chatting data acquisition unit is used for acquiring associated chatting data corresponding to the associated source identifier.

And the second storage unit is used for judging whether the associated chatting data has data with the risk level larger than the preset level through the preset query logic, and storing the associated chatting data into the corresponding category according to the keywords of the associated message data when the data with the risk level larger than the preset level is queried.

For specific limitations of the chat data processing apparatus, reference may be made to the above limitations of the chat data processing method, which are not described herein again. The respective modules in the chat data processing apparatus can be wholly or partially implemented by software, hardware, and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 3. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a chat data processing method. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.

Those skilled in the art will appreciate that the architecture shown in fig. 3 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program: and acquiring a login identification, and inquiring an authentication result corresponding to the login identification. And when the authentication result of the login identification is successful, acquiring login data corresponding to the login identification, and acquiring current chat data corresponding to the login data. And acquiring the current suspicious chat data in the current chat data according to the preset query logic. And searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data. And extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address.

In one embodiment, the step of querying the authentication result of the login id when the processor executes the computer program may further include: when the login identification is scanned, login terminal information is sent to a scanning terminal which scans the login identification, so that the scanning terminal forwards the login terminal information and login data to the server. And when the login data sent to the server by the scanning terminal is authenticated by the server, receiving an authentication result returned by the server according to the login terminal information.

In one embodiment, the processor, when executing the computer program, further performs the steps of: and outputting failure prompt information when the authentication result returned by the server is not received within a preset time period. And receiving a re-operation instruction corresponding to the failure prompt information. And updating the login identification according to the re-operation instruction, and continuing to acquire the login identification.

In one embodiment, the step of obtaining the current chat data corresponding to the login data when the processor executes the computer program may further include: and receiving an interface address of the parameter acquisition interface returned by the server, and acquiring login confirmation parameters corresponding to the login data through the parameter acquisition interface according to the interface address. And acquiring group basic data corresponding to the login confirmation parameters. And acquiring group chatting data corresponding to the group basic data as current chatting data.

In one embodiment, the processor, when executing the computer program, performs the step of obtaining the current suspicious chat data in the current message data according to the query logic, and may further include: and judging whether the current chatting data has data with the risk level larger than the preset level through the preset query logic. And when the data with the risk level larger than the preset level exists in the current chatting data, extracting keywords in the current chatting data containing the data with the risk level larger than the preset level. And acquiring the category corresponding to the keyword. And storing the current chat data containing the data with the risk level larger than the preset level into the acquired category.

In one embodiment, when executing the computer program, the processor searches for the associated source identifier according to the current suspicious chat data, obtains the associated suspicious chat data according to the associated source identifier, and stores the associated suspicious chat data, including: and extracting the network address of the user terminal identification corresponding to the current suspicious chat data. And acquiring a chat receiving log corresponding to the network address, and inquiring an associated source identifier corresponding to the user terminal identifier in the chat receiving log. And acquiring the associated chatting data corresponding to the associated source identifier. And judging whether the associated chatting data has data with the risk level larger than the preset level through a preset query logic, and storing the associated chatting data into the corresponding category according to the keywords of the associated message data when the data with the risk level larger than the preset level is queried.

In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of: and acquiring a login identification, and inquiring an authentication result corresponding to the login identification. And when the authentication result of the login identification is successful, acquiring login data corresponding to the login identification, and acquiring current chat data corresponding to the login data. And acquiring the current suspicious chat data in the current chat data according to the preset query logic. And searching for an associated source identifier according to the current suspicious chat data, acquiring associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data. And extracting a first network address carried by a first user terminal corresponding to the current suspicious chat data, extracting a second network address carried by a second user terminal corresponding to the associated suspicious chat data, and monitoring the first network address and the second network address.

In one embodiment, the computer program when executed by the processor performs the step of querying the login id for the authentication result, and may further include: when the login identification is scanned, login terminal information is sent to a scanning terminal which scans the login identification, so that the scanning terminal forwards the login terminal information and login data to the server. And when the login data sent to the server by the scanning terminal is authenticated by the server, receiving an authentication result returned by the server according to the login terminal information.

In one embodiment, the computer program when executed by the processor further performs the steps of: and outputting failure prompt information when the authentication result returned by the server is not received within a preset time period. And receiving a re-operation instruction corresponding to the failure prompt information. And updating the login identification according to the re-operation instruction, and continuing to acquire the login identification.

In one embodiment, the computer program when executed by the processor performs the step of obtaining current chat data corresponding to login data, and may further include: and receiving an interface address of the parameter acquisition interface returned by the server, and acquiring login confirmation parameters corresponding to the login data through the parameter acquisition interface according to the interface address. And acquiring group basic data corresponding to the login confirmation parameters. And acquiring group chatting data corresponding to the group basic data as current chatting data.

In one embodiment, the computer program when executed by the processor performs the step of obtaining the current suspicious chat data in the current message data according to the query logic, and may further include: and judging whether the current chatting data has data with the risk level larger than the preset level through the preset query logic. And when the data with the risk level larger than the preset level exists in the current chatting data, extracting keywords in the current chatting data containing the data with the risk level larger than the preset level. And acquiring the category corresponding to the keyword. And storing the current chat data containing the data with the risk level larger than the preset level into the acquired category.

In one embodiment, when executed by a processor, a computer program implements the steps of searching for an associated source identifier according to current suspicious chat data, obtaining associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data, including: and extracting the network address of the user terminal identification corresponding to the current suspicious chat data. And acquiring a chat receiving log corresponding to the network address, and inquiring an associated source identifier corresponding to the user terminal identifier in the chat receiving log. And acquiring the associated chatting data corresponding to the associated source identifier. And judging whether the associated chatting data has data with the risk level larger than the preset level through a preset query logic, and storing the associated chatting data into the corresponding category according to the keywords of the associated message data when the data with the risk level larger than the preset level is queried.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims

1. A method of chat data processing, the method comprising:

when the authentication result corresponding to the login identification is successful, acquiring login data corresponding to the login identification, and acquiring current chat data corresponding to the login data;

2. The method according to claim 1, wherein the step of querying the authentication result of the login id comprises:

3. The method of claim 2, further comprising:

4. The method of claim 1, wherein the step of obtaining current chat data corresponding to the login data comprises:

acquiring group basic data corresponding to the login confirmation parameters;

5. The method of claim 1, wherein the step of obtaining the suspicious current chat data from the current chat data according to the query logic comprises:

acquiring a category corresponding to the keyword;

6. The method according to any one of claims 1 to 5, wherein the step of searching for an associated source identifier according to the current suspicious chat data, obtaining associated suspicious chat data according to the associated source identifier, and storing the associated suspicious chat data comprises:

judging whether the associated chatting data have data with the risk level larger than the preset level or not through preset inquiry logic, when the data with the risk level larger than the preset level are inquired, extracting keywords in the associated chatting data containing the data with the risk level larger than the preset level, acquiring the category corresponding to the keywords, and storing the associated chatting data containing the data with the risk level larger than the preset level to the acquired category.

7. A chat data processing apparatus, the apparatus comprising:

8. The apparatus of claim 7, wherein the first obtaining module comprises:

9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1 to 6 are implemented when the computer program is executed by the processor.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.