CN109255024A - A kind of searching method of abnormal user ally, device and system - Google Patents
A kind of searching method of abnormal user ally, device and system Download PDFInfo
- Publication number
- CN109255024A CN109255024A CN201710566597.XA CN201710566597A CN109255024A CN 109255024 A CN109255024 A CN 109255024A CN 201710566597 A CN201710566597 A CN 201710566597A CN 109255024 A CN109255024 A CN 109255024A
- Authority
- CN
- China
- Prior art keywords
- user
- target members
- ally
- abnormal
- abnormal user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Abstract
The embodiment of the present application discloses a kind of searching method of abnormal user ally, device, and system, searching method shown in the embodiment of the present application, one side is by the combination of " collection " and " cluster " mode by disorder foundation data conformity at the ordered data as unit of user, without traversing multiple lists in search process, the access times between terminal and application platform server are reduced；Further, searching method shown in the embodiment of the present application, first, the target members with direct incidence relation between abnormal user are searched out in numerous users, then pass through the dispatch content of target members, determine abnormal user ally, it can be seen that the method shown in the embodiment of the present application, only need the dispatch content of analysis target members, greatly reduce the data volume of application platform server processing, further, the waiting time for shortening application platform server improves the utilization rate of the resources such as system bandwidth, database.
Description
Technical field
The present invention relates to information search technique field, in particular to a kind of searching method of abnormal user ally, device, and
System.
Background technique
With the development of internet technology, application service system Internet-based is also more and more.It is typical to be based on mutually
The application service system of networking as shown in Figure 1, this system generally has an application platform server 1, and, it is connected to it
Data storage server 2, the data storage server 2 setting is in 1 inside of Platform Server or is independently arranged, and, with application
The terminal 4 that Platform Server 1 is connected by internet 3 or mobile Internet 3, in general, application platform server 1 is that terminal 4 mentions
For application service.
User's abnormal behaviour monitoring system is exactly a system as shown in Figure 1.In this specific application system, user
Behavioural information be stored in storage server 2；Terminal 4 is the user APP for being mounted with to have information issuing function
(Application, application program)；Application platform server 1 by the monitoring of user behavior, and, to the Zhen of user behavior
Not, abnormal user ally is found out.Specifically, application platform server 1 monitors each end in real time firstly, user starts terminal 4
User behavior information on end 1, application platform server 1 determine the user in a terminal 1 by the examination to user behavior
For abnormal behaviour user；Application platform server 1 determines the IP that posts of the abnormal user first, then, traverses IP column of posting
Table filters out the identical IP user that posts, and forms identical IP collection of posting, the identical IP user that posts is post IP and abnormal user
The identical user of the IP that posts, it is identical post IP concentration, traversal registration IP list, filter out identical registration IP user, the phase
With IP user is registered as registration IP user identical with the registration IP of abnormal user, other lists are successively traversed, then will be had
The user of same subscriber behavior screens, and finally finds out abnormal user ally.
But inventor find the prior art provide in the search process of abnormal user ally, there are search operations
Low efficiency and, the problem of search operation excessive occupying system resources.For example, application platform server 1 is needed through analysis 4
User behavior finally finds out abnormal user ally, and in the process, application platform server 1 needs to be traversed for 4 list relateds
The user that there is same subscriber behavior with abnormal behaviour user is searched out, abnormal user ally is finally found out.Application platform service
During traversing 4 list relateds, user's abnormal behaviour monitoring 1 long-time of systematic difference Platform Server is in device 1
Wait state reduces the utilization rate of the resources such as system bandwidth, database.
Summary of the invention
Goal of the invention of the invention is to provide a kind of searching method of abnormal user ally, device and system, to solve
Existing user's abnormal behaviour monitoring system, and, the excessive occupying system resources of search operation are asked there are search operation low efficiency
Topic.
According to an embodiment of the invention, providing a kind of searching method of abnormal user ally, comprising:
Obtain the basic data in user data table；
As unit of user, the basic data is clustered, generates user's dimension statistical form；
Filter out the target members in user's dimension statistical form, having between the target members and abnormal user
Direct incidence relation；According to the dispatch content of the target members, abnormal user ally is determined.
A kind of searcher of abnormal user ally shown in the embodiment of the present application second aspect, comprising:
Data capture unit, for obtaining the basic data in user data table；
Cluster cell generates user's dimension statistical form for as unit of user, the basic data to be clustered；
First screening unit, for filtering out the target members in user's dimension statistical form；
Second screening unit determines abnormal user ally for the dispatch content according to the target members.
A kind of search system of abnormal user ally shown in the embodiment of the present application third aspect, including, application platform clothes
Business device, the data storage server connecting with the application platform server, the data storage server setting are answered described
With Platform Server inside or it is independently arranged, and, it is connect with application platform server by internet or mobile Internet
Terminal；
The terminal, for receiving the basic data of user data table, and will be in the basic data of the user data table
Reach application platform server；
The application platform server, for obtaining the basic data in user data table；
As unit of user, the basic data is clustered, generates user's dimension statistical form；
Filter out the target members in user's dimension statistical form, having between the target members and abnormal user
Direct incidence relation；
According to the dispatch content of the target members, abnormal user ally is determined；
The data storage server, the storage for related data.
From the above technical scheme, the searching method of the abnormal user ally shown in the embodiment of the present application, device, and be
System, obtains the basic data in user data table by a script in real time, then as unit of user, by the basic number
According to being clustered, user's dimension statistical form is generated；The target members with abnormal user account relating are obtained, analyze target members'
Send the documents content, and then determining abnormal user ally.Due to the method shown in the embodiment of the present application, firstly, collecting user data table
In basic data then basic data is clustered, during search operation, it is only necessary to traversal cluster after basic number
According to, it can identify the target members with direct incidence relation between abnormal user, then by target members
Dispatch content, determines abnormal user ally.
Searching method shown in the embodiment of the present application, on the one hand will be in disorder by the combination of " collection " and " cluster " mode
Foundation data conformity, without traversing multiple lists in search process, reduces terminal at the ordered data as unit of user
Access times between application platform server shorten the waiting time of application platform server, improve system bandwidth,
The utilization rate of the resources such as database.
Further, the searching method shown in the embodiment of the present application, firstly, being searched out between abnormal user in numerous users
The target members with direct incidence relation determine abnormal user ally then by the dispatch content of target members, can
See the method shown in the embodiment of the present application, it is only necessary to which the dispatch content for analyzing target members greatly reduces application platform server
The data volume of processing further shortens the waiting time of application platform server, improves the money such as system bandwidth, database
The utilization rate in source.
Detailed description of the invention
It in order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, below will be to institute in embodiment
Attached drawing to be used is needed to be briefly described, it should be apparent that, the accompanying drawings in the following description is only some implementations of the invention
Example, for those of ordinary skill in the art, without creative efforts, can also obtain according to these attached drawings
Obtain other attached drawings.
Fig. 1 is the schematic diagram of a scenario of application service system Internet-based；
Fig. 2 is the flow chart for the searching method that a kind of abnormal user ally exemplified is preferably implemented according to one；
Fig. 3 is to be preferably implemented to exemplify the display interface of user's dimension statistical form according to one；
Fig. 4 is to be preferably implemented to exemplify the detail flowchart of step S101 according to one；
Fig. 5 is to be preferably implemented to exemplify the detail flowchart of step S104 according to one；
Fig. 6 is the detail flowchart that step S104 is shown according to another preferred embodiment；
Fig. 7 is the detail flowchart that step S104 is shown according to further embodiment；
Fig. 8 is the structural block diagram for the searcher that a kind of abnormal user ally exemplified is preferably implemented according to one；
Fig. 9-1 is the structural block diagram for the search system that a kind of abnormal user ally exemplified is preferably implemented according to one；
Fig. 9-2 is the structural block diagram according to a kind of search system of abnormal user ally shown in another preferred embodiment.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Whole description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
It is only to be not intended to be limiting the application merely for for the purpose of describing particular embodiments in term used in this application.
It is also intended in the application and the "an" of singular used in the attached claims, " described " and "the" including majority
Form, unless the context clearly indicates other meaning.It is also understood that term "and/or" used in the embodiment of the present application
Refer to and includes that one or more associated any or all of project listed may combine.
It will be appreciated that though various information, but this may be described using term first, second, third, etc. in the application
A little information should not necessarily be limited by these terms.These terms are only used to for same type of information being distinguished from each other out.For example, not departing from
In the case where the application range, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as
One information.Depending on context, word as used in this " if " can be construed to " ... when " or " when ...
When " or " in response to determination "
Referring to Fig. 1, the embodiment of the present application shows a kind of searching method of abnormal user ally, which comprises
S101 obtains the basic data in user data table；
Wherein, the application platform server of different business can support different business, and can get corresponding business
User data table, for example, financial business application platform server obtains the user data table of financial business, authentication business server
Obtain authentication business user data table；
The embodiment of the present application passes through the basic data of all terminals of script collection, and the basic data is stored in
In user data table, application platform server obtains the basic data in user data table, and the basic data is clustered.
S102 is clustered the basic data as unit of user, generates user's dimension statistical form；
Referring to Fig. 3, the embodiment of the present application shows the display interface of user's dimension statistical form as shown in figure 3, the application is real
It applies example to cluster the basic data in user data table again, and is shown with the display form of Fig. 3.
S103 filters out the target members in user's dimension statistical form, between the target members and abnormal user
With direct incidence relation；
Wherein, for different types of business, the index of corresponding abnormal user for identification is different, for example,
For authentication business, can by authentification failure number be more than certification threshold value user be identified as abnormal user in another example,
For financial business, user of the number more than threshold value of transferring accounts that can will transfer accounts in one day is identified as abnormal user, right
In the business of some comment property, such as: the malicious comment or some " waterborne troops " on microblogging, the determination process of abnormal user
Are as follows: firstly, terminal sends the dispatch content of suspicious user to application platform server, application platform server passes through to suspicious use
The dispatch content at family, and, the history dispatch content of the suspicious user determines whether the user is abnormal use by analysis
Family.When determining that the user is abnormal user, application platform server obtains the behavioural information of abnormal user.
In the present embodiment, identification equipment can use ETL (Extract-Transform-Load, extraction-transposition-load)
Mode processes abnormal user and target members' dimensional relationships, finally find out include: initial suspicious member's account and it is potential it is suspicious at
The target members of member's account.
The target members are as follows: the user with direct incidence relation between abnormal user；Such as: with abnormal use
Family has the user of identical registration IP, has the user of the identical IP that posts with abnormal user；There is identical post with abnormal user
The user of IP；There is the user of identical device number with abnormal user.
S104 determines abnormal user ally according to the dispatch content of the target members.
After filtering out target members, the dispatch content of target members is successively analyzed, determines the target based on the analysis results
Whether member is abnormal user ally.
There are some associations for dispatch content between usual abnormal user ally, for example, the comment to a certain piece article, or
Person goes to evaluate a certain individual or a certain part thing with too drastic language, then alternatively, the commendation etc. excessive to a people or things
Deng.Application platform server determines abnormal user ally according to the dispatch content of the target members.
Embodiment 1:
Firstly, terminal records user when registration, logging in, delivering content, comment in real time, relevant IP and equipment
Number etc. basic datas.Application platform server persistently monitors registration user data table, the login user of user by timing script
Tables of data, the basic data for delivering the user data lists such as content user tables of data, comment data user list.
It is worth noting that, the basic data in the embodiment of the present application includes the behavioural information of user and the dispatch letter of user
Breath, comment information of user etc..
Application platform manager is clustered the basic data as unit of user, generates user's dimension statistical form.
It shows the registion time of each user, registration IP, finally logs in IP, finally logs in area, the IP that finally posts, equipment of finally posting
Number, the comment number delivered, reply the basic datas such as comment number.
Then, with the registion time of abnormal user, and/or, IP is registered, and/or, IP is finally logged in, and/or, finally step on
Record area, and/or, finally post IP, and/or, the behavioural informations such as device number of finally posting are keyword, search and the exception
The associated target members of user.
The target members include: the user for having identical registration IP with abnormal user, have identical hair with abnormal user
The user of note IP；There is the user of the identical IP that posts with abnormal user；There is the user etc. of identical device number with abnormal user.
After filtering out target members, the dispatch content of target members is successively analyzed, determines the target based on the analysis results
Whether member is abnormal user ally.
Searching method shown in the embodiment of the present application, on the one hand will be in disorder by the combination of " collection " and " cluster " mode
Foundation data conformity, without traversing multiple lists in search process, reduces terminal at the ordered data as unit of user
Access times between application platform server shorten the waiting time of application platform server, improve system bandwidth,
The utilization rate of the resources such as database.
Further, the searching method shown in the embodiment of the present application, firstly, being searched out between abnormal user in numerous users
The target members with direct incidence relation determine abnormal user ally then by the dispatch content of target members, can
See the method shown in the embodiment of the present application, it is only necessary to which the dispatch content for analyzing target members greatly reduces application platform server
The data volume of processing further shortens the waiting time of application platform server, improves the money such as system bandwidth, database
The utilization rate in source.
Selectable, in order to further increase search efficiency, the embodiment of the present application shows one kind, basic data acquisition side
The detailed step of method:
Referring to Fig. 4, step S101 step includes: in method shown in embodiment 1
S1011 is at interval of preset time period, run-down user data table；
Method shown in the embodiment of the present application obtains basic data using the method for " incremental update " in real time.
Specifically, the embodiment of the present application obtains base using the method for " incremental update " in the acquisition process of basic data
Plinth data are exactly the only basic data that changes within current preset time period of scanning user data table, thus need according to
The changed preset time of every basic data goes to scan and filter out the basic data of variation in user data table.
S1012 obtains user data table increased basic data within the preset time period.
Method shown in the embodiment of the present application only obtains increased basic data in preset time period, within preset time period
Target members are searched out in increased basic data, it is seen that the method shown in the embodiment of the present application greatly reduces application platform clothes
The data volume of business device processing further shortens the waiting time of application platform server, improves system bandwidth, database
Etc. resources utilization rate.
Embodiment 2:
Firstly, terminal records user when registration, logging in, delivering content, comment in real time, relevant IP and equipment
Number etc. behavioural informations.Application platform server is scanned one time by timing script every preset time period, the registration user of user
Tables of data, login user tables of data deliver the user data lists such as content user tables of data, comment data user list, and will
The record of increased basic data in preset time period.
Application platform manager is clustered increased basic data in the preset time period as unit of user,
User's dimension statistical form is generated, and shows the registion time of each user, registration IP, finally logs in IP, finally log in area, is last
Post IP, device number of finally posting, the comment number delivered, reply the comment basic datas such as number.
Then, with the registion time of abnormal user, and/or, IP is registered, and/or, IP is finally logged in, and/or, finally step on
Record area, and/or, finally post IP, and/or, the behavioural informations such as device number of finally posting are keyword, search and the exception
The associated target members of user.
Method shown in the embodiment of the present application 2 only obtains increased basic data in preset time period, in preset time period
Target members are searched out in interior increased basic data, it is seen that the method shown in the embodiment of the present application greatly reduces application platform
The data volume of server process further shortens the waiting time of application platform server, improves system bandwidth, data
The utilization rate of the resources such as library.
Under normal conditions, the similarity between target members and abnormal user is higher, and target members are abnormal user allies
A possibility that it is bigger, with this condition, if preferentially carried out to the dispatch content of the target members high with abnormal user similarity
Analysis, it will abnormal user ally earlier further increases search efficiency.
In order to further increase search efficiency, the embodiment of the present application shows the analysis of a kind of pair of target members' dispatch content
The detailed step of sequence:
Referring to Fig. 5, step S104 step includes: in method shown in embodiment 1
S10411 calculates separately out the similarity between the dimension of the target members and the dimension of the abnormal user；
With the registion time of abnormal user, and/or, IP is registered, and/or, IP is finally logged in, and/or, finally log in ground
Area, and/or, finally post IP, and/or, the behavioural informations such as device number of finally posting are keyword, search and the abnormal user
Associated target members calculate separately out similar between the dimension of the target members and the dimension of the abnormal user
Degree；The dimension includes: registration IP, logins IP, and post IP, and, device number four dimensions.
Sequence S10412 descending according to the similarity successively identifies the dispatch content of the target members, really
Determine abnormal user ally.
Wherein, the descending sequence of similarity are as follows: the registration IP of target members logins IP, and post IP, and, equipment
Number with the registration IP of abnormal user, IP is logined, post IP, and, device number is identical, similarity 100%.
The registration IP of target members, logins IP, and post IP, and, 3 dimensions in device number with the note of abnormal user
Volume IP, logins IP, and post IP, and, 3 dimensions in device number are identical, similarity 75%.
The registration IP of target members, logins IP, and post IP, and, 2 dimensions in device number with the note of abnormal user
Volume IP, logins IP, and post IP, and, 2 dimensions in device number are identical, similarity 50%.
The registration IP of target members, logins IP, and post IP, and, 1 dimension in device number with the note of abnormal user
Volume IP, logins IP, and post IP, and, 1 dimension in device number is identical, similarity 25%.
Embodiment 3:
Firstly, terminal records user when registration, logging in, delivering content, comment in real time, relevant IP and equipment
Number etc. behavioural informations.Application platform server persistently monitors registration user data table, the login user of user by timing script
Tables of data, the basic data for delivering the user data lists such as content user tables of data, comment data user list.
Application platform manager is clustered the basic data as unit of user, generates user's dimension statistical form.
It shows the registion time of each user, registration IP, finally logs in IP, finally logs in area, the IP that finally posts, equipment of finally posting
Number, the comment number delivered, reply the basic datas such as comment number.
Then, with the registration IP of abnormal user, and/or, IP is logined, and/or, post IP and/or device number is keys
Word searches for target members associated with the abnormal user, searches out target members 1, and target members 2, and target members 3, with
And target members 4；
Target members 1 are calculated, target members 2, and target members 3, and, it is similar between target members 4 and abnormal user
Degree.
Wherein, the similarity between target members 1 and abnormal user is 100%；
Similarity between target members 2 and abnormal user is 75%；
Similarity between target members 3 and abnormal user is 50%；
Similarity between target members 4 and abnormal user is 25%；
Application platform server successively analyzes the target members 1, and target members 2, and target members 3, and, target members
4 dispatch content, then filters out target members 1 and target members 2 are abnormal user ally.
It can be seen that the embodiment of the present application 3 is according to the similarity between target members and abnormal user, to determine that application platform takes
Business device analyzes the sequence of dispatch content, and target members 1 and target members 2 are abnormal user ally in the present embodiment.Using this
Apply for the method shown in embodiment 3, the dispatch content of target members 1 is analyzed first, determines that target members 1 use to be abnormal
Then family is analyzed the dispatch content of target members 2, determine target members 2 be abnormal user, then successively to target at
Member 3, and, the dispatch content of target members 4 is analyzed, then determine target members 3, and, target members 4 are positive common
Family.It can be seen that the method shown in embodiment 2 can search out abnormal user ally in a relatively short period of time, improve to a certain extent
The efficiency of search.
To sum up, the similarity between target members and abnormal user is higher, and target members are the possibility of abnormal user ally
Property is bigger, with this condition, if preferentially the dispatch content of the target members high to abnormal user similarity is analyzed, it will
Earlier search out abnormal user ally, further increase search efficiency.
There are some associations for dispatch content between usual abnormal user ally.Usual abnormal user ally can be to a same piece
Article is commented on, and the number of same piece article review is more, and there are abnormal user allies in the user of participation this article comment
Probability it is higher.With this condition, the dispatch content of the target members preferentially article participated in more than comment number commented on into
Row analysis, it will abnormal user ally earlier further increases search efficiency.
Selectable, in order to further increase search efficiency, the application further embodiment shows a kind of couple of target members
The detailed step of the analysis sequence for content of sending the documents:
Referring to Fig. 6, step S104 step includes: in method shown in embodiment 1
S10421 counts the number that every article participates in the target members of comment；
Sequence S10422 descending according to the number successively identifies the dispatch content of the target members, determines
Abnormal user ally.
Embodiment 4:
Firstly, terminal records user when registration, logging in, delivering content, comment in real time, relevant IP and equipment
Number etc. behavioural informations.Application platform server persistently monitors registration user data table, the login user of user by timing script
Tables of data, the basic data for delivering the user data lists such as content user tables of data, comment data user list.
Application platform manager is clustered the basic data as unit of user, generates user's dimension statistical form.
It shows the registion time of each user, registration IP, finally logs in IP, finally logs in area, the IP that finally posts, equipment of finally posting
Number, the comment number delivered, reply the basic datas such as comment number.
Then, with the registration IP of abnormal user, and/or, IP is logined, and/or, post IP and/or device number is keys
Word searches for target members associated with the abnormal user；
Then the comment that the target members take part in 4 works altogether is counted, wherein being 100 to the comment number of works 1
People, the comment number to works 2 are 75 people, and the comment number to works 3 is 50 people, and the comment number to works 4 is 25 people.
Application platform server successively identifies the dispatch content of the target members according to the sequence that number is descending,
Determine that there are 80 people in 100 people of comment number of works 1 be abnormal user ally.
To have in 75 people of comment number of works 2 50 people be abnormal user ally；
To have in 50 people of comment number of works 3 20 people be abnormal user ally；
To have in 25 people of comment number of works 35 people be abnormal user ally；
It can be seen that comment number of the embodiment of the present application 4 according to the same piece article of participation, to determine application platform server point
The sequence of dispatch content is analysed, there are 80 people in the target members for the comment for participating in works 1 in the embodiment of the present application 4, wherein abnormal use
Family ally accounts for 80%.Participate in there are 50 people in the target members of the comment of works 2, wherein abnormal user ally accounts for 66.7%.It participates in
There are 20 people in the target members of the comment of works 3, wherein abnormal user ally accounts for 40%.Participate in works 4 comment target at
There are 5 people in member, wherein abnormal user ally accounts for 20%.
The number for participating in same piece commentary is more, exists in the target members for participating in same piece commentary
A possibility that abnormal user ally, is bigger, with this condition, if preferentially to the mesh for participating in the works more than same piece commentary
Mark member dispatch content analyze, it will earlier search out abnormal user ally, further increase search efficiency.
Further, data processing amount of the application platform server in search process is reduced, the embodiment of the present application is divided in advance
The hair content of text of target members is analysed, the keyword for extracting the dispatch content generates corresponding label, in application platform service
During device analyzes the dispatch content of target user, it is only necessary to analyze the content of label.Pass through the dispatch content of user
With the similarity of the label, the abnormal user ally in target members is filtered out.
Specifically, referring to Fig. 7, step S104 step includes: in method shown in embodiment 1
S10431 analyzes the dispatch content of each target members, generates corresponding label based on the analysis results, by the mark
Label are established with target members and are contacted；
S10432 filters out the exception in target members according to the dispatch content of abnormal user and the similarity of the label
User ally.
Embodiment 5:
Firstly, terminal records user relevant IP and equipment when registration, logging in, delivering content, comment in real time
Number etc. behavioural informations.Application platform server persistently monitors registration user data table, the login user of user by timing script
Tables of data, the basic data for delivering the user data lists such as content user tables of data, comment data user list.
Application platform manager is clustered the basic data as unit of user, generates user's dimension statistical form.
It shows the registion time of each user, registration IP, finally logs in IP, finally logs in area, the IP that finally posts, equipment of finally posting
Number, the comment number delivered, reply the basic datas such as comment number.
Then, with the registration IP of abnormal user, and/or, IP is logined, and/or, post IP and/or device number is keys
Word searches for target members associated with the abnormal user, searches out target members 1, and target members 2, and target members 3, with
And target members 4；
Then the keyword 1 of the dispatch of target members 1 content is extracted；
Extract the keyword 2 of the dispatch of target members 2 content；
Extract the keyword 3 of the dispatch of target members 3 content；
Extract the keyword 4 of the dispatch of target members 4 content；
Application platform server successively calculates the keyword 1, keyword 2, keyword 3, and, keyword 4 and abnormal
Similarity between the dispatch content of user, if fruit similarity is greater than preset threshold value, which is abnormal user ally.
It can be seen that the embodiment of the present application 5, extracts the keyword of target user's dispatch content first, generates corresponding mark
Label, application platform server is during determining abnormal user ally, it is only necessary to calculate the dispatch content of abnormal user with it is described
Similarity between label determines that the target is used according to the similarity between the dispatch content and the label of abnormal user
Whether family is abnormal user ally.
It can be seen that the method shown in the embodiment of the present application 5 is in search process, without whole dispatch information to target user
It is analyzed, reduces the data processing amount of application platform server.Method shown in the embodiment of the present application 5 analyze in advance target at
The hair content of text of member, the keyword for extracting the dispatch content generate corresponding label, analyze mesh in application platform server
During the dispatch content for marking user, it is only necessary to analyze the content of label.Dispatch content and the mark by user
The similarity of label filters out the abnormal user ally in target members.Further increase search efficiency.
Referring to Fig. 8, the embodiment of the present application second aspect shows a kind of searcher of abnormal user ally, comprising:
Data capture unit 21, for obtaining the basic data in user data table；
Cluster cell 22 generates user's dimension statistics for as unit of user, the basic data to be clustered
Table；
First screening unit 23, for filtering out the target members in user's dimension statistical form；
Second screening unit 24 determines abnormal user ally for the dispatch content according to the target members.
Searcher shown in the embodiment of the present application, on the one hand will be in disorder by the combination of " collection " and " cluster " mode
Foundation data conformity, without traversing multiple lists in search process, reduces terminal at the ordered data as unit of user
Access times between application platform server shorten the waiting time of application platform server, improve system bandwidth,
The utilization rate of the resources such as database.
Further, the searcher shown in the embodiment of the present application, firstly, being searched out between abnormal user in numerous users
The target members with direct incidence relation determine abnormal user ally then by the dispatch content of target members, can
See the device shown in the embodiment of the present application, it is only necessary to which the dispatch content for analyzing target members greatly reduces application platform server
The data volume of processing further shortens the waiting time of application platform server, improves the money such as system bandwidth, database
The utilization rate in source.
Fig. 9-1 is please referred to, and, 9-2, the embodiment of the present application third aspect shows a kind of search system of abnormal user ally
System, comprising:
Application platform server 31, the data storage server 32 being connect with the application platform server 31, the number
It in 31 inside of application platform server or is independently arranged according to the setting of storage server 32, and, with application platform server
31 terminals 33 connected by internet or mobile Internet；
The terminal 33, for receiving the basic data of user data table, and by the basic data of the user data table
It is uploaded to application platform server；
The application platform server 31, for obtaining the basic data in user data table；
As unit of user, the basic data is clustered, generates user's dimension statistical form；
Filter out the target members in user's dimension statistical form, having between the target members and abnormal user
Direct incidence relation；
According to the dispatch content of the target members, abnormal user ally is determined；
The data storage server 32, the storage for related data.
Search system shown in the embodiment of the present application, on the one hand will be in disorder by the combination of " collection " and " cluster " mode
Foundation data conformity, without traversing multiple lists in search process, reduces terminal at the ordered data as unit of user
Access times between application platform server shorten the waiting time of application platform server, improve system bandwidth,
The utilization rate of the resources such as database.
Further, the search system shown in the embodiment of the present application, firstly, being searched out between abnormal user in numerous users
The target members with direct incidence relation determine abnormal user ally then by the dispatch content of target members, can
See the system shown in the embodiment of the present application, it is only necessary to which the dispatch content for analyzing target members greatly reduces application platform server
The data volume of processing further shortens the waiting time of application platform server, improves the money such as system bandwidth, database
The utilization rate in source.
From the above technical scheme, the searching method of the abnormal user ally exemplified, device are implemented in application, and are
System, obtains the basic data in user data table by a script in real time, then as unit of user, by the basic number
According to being clustered, user's dimension statistical form is generated；The target members with abnormal user account relating are obtained, analyze target members'
Send the documents content, and then determining abnormal user ally.Due to the method shown in the embodiment of the present application, firstly, collecting user data table
In basic data then basic data is clustered, during search operation, it is only necessary to traversal cluster after basic number
According to, it can identify the target members with direct incidence relation between abnormal user, then by target members
Dispatch content, determines abnormal user ally.
Searching method shown in the embodiment of the present application, on the one hand will be in disorder by the combination of " collection " and " cluster " mode
Foundation data conformity, without traversing multiple lists in search process, reduces terminal at the ordered data as unit of user
Access times between application platform server shorten the waiting time of application platform server, improve system bandwidth,
The utilization rate of the resources such as database.
Further, the searching method shown in the embodiment of the present application, firstly, being searched out between abnormal user in numerous users
The target members with direct incidence relation determine abnormal user ally then by the dispatch content of target members, can
See the method shown in the embodiment of the present application, it is only necessary to which the dispatch content for analyzing target members greatly reduces application platform server
The data volume of processing further shortens the waiting time of application platform server, improves the money such as system bandwidth, database
The utilization rate in source.
The present invention can be used in numerous general or special purpose computing system environments or configuration, such as: personal computer, service
Device computer, handheld device or portable device, laptop device, multicomputer system, microprocessor-based system, top set
Box, programmable consumer-elcetronics devices, network PC, minicomputer, mainframe computer, including any of the above system or equipment
Distributed computing environment etc..
The present invention can describe in the general context of computer-executable instructions executed by a computer, such as program
Module.Generally, program module includes routines performing specific tasks or implementing specific abstract data types, programs, objects, group
Part, data structure etc..The present invention can also be practiced in a distributed computing environment, in these distributed computing environments, by
Task is executed by the connected remote processing devices of communication network.In a distributed computing environment, program module can be with
In the local and remote computer storage media including storage equipment.
Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to of the invention its
Its embodiment.This application is intended to cover any variations, uses, or adaptations of the invention, these modifications, purposes or
Person's adaptive change follows general principle of the invention and including the undocumented common knowledge in the art of the present invention
Or conventional techniques.The description and examples are only to be considered as illustrative, and true scope and spirit of the invention are by following
Claim is pointed out.
It should be understood that the present invention is not limited to the precise structure already described above and shown in the accompanying drawings, and
And various modifications and changes may be made without departing from the scope thereof.The scope of the present invention is limited only by the attached claims.
Claims (10)
1. a kind of searching method of abnormal user ally characterized by comprising
Obtain the basic data in user data table；
As unit of user, the basic data is clustered, generates user's dimension statistical form；
The target members in user's dimension statistical form are filtered out, having between the target members and abnormal user is direct
Incidence relation；
According to the dispatch content of the target members, abnormal user ally is determined.
2. searching method according to claim 1, which is characterized in that the basic data obtained in user data table
Step includes:
At interval of preset time period run-down user data table；
Obtain the user data table increased basic data within the preset time period.
3. searching method according to claim 1, which is characterized in that the dispatch content according to target members determines
The step of abnormal user ally includes:
Calculate separately out the similarity between the dimension of the target members and the dimension of the abnormal user；
According to the sequence that the similarity is descending, successively identifies the dispatch content of the target members, determine abnormal user
Ally.
4. searching method according to claim 1, which is characterized in that the dispatch content according to target members determines
The step of abnormal user ally includes:
Count the number that every article participates in the target members of comment；
According to the sequence that the number is descending, successively identifies the dispatch content of the target members, determine that abnormal user is same
Party.
5. searching method according to claim 1, which is characterized in that the dispatch content according to target members determines
The step of abnormal user ally includes:
Count the number that the same author participates in the target members of comment；
According to the sequence that the number is descending, successively identifies the dispatch content of the target members, determine that abnormal user is same
Party.
6. searching method according to claim 1, which is characterized in that the dispatch content according to target members determines
The step of abnormal user ally includes:
The dispatch content for analyzing each target members, generates corresponding label based on the analysis results, by the label and target at
Member establishes connection；
According to the similarity of the dispatch content of abnormal user and the label, the abnormal user ally in target members is filtered out.
7. searching method according to claim 1, which is characterized in that user's dimension statistical form includes: registration IP, is stepped on
Enter IP, post IP, and, device number four dimensions.
8. searching method according to claim 1, which is characterized in that the user data table includes: registration user list,
Login user list, user list of sending the documents, and, comment data user list.
9. a kind of searcher of abnormal user ally characterized by comprising
Data capture unit, for obtaining the basic data in user data table；
Cluster cell generates user's dimension statistical form for as unit of user, the basic data to be clustered；
First screening unit, for filtering out the target members in user's dimension statistical form；
Second screening unit determines abnormal user ally for the dispatch content according to the target members.
10. a kind of search system of abnormal user ally, which is characterized in that including application platform server is flat with the application
The data storage server of platform server connection, the data storage server be arranged inside the application platform server or
It is independently arranged, and, the terminal being connect with application platform server by internet or mobile Internet；
The terminal is uploaded to for receiving the basic data of user data table, and by the basic data of the user data table
Application platform server；
The application platform server, for obtaining the basic data in user data table；
As unit of user, the basic data is clustered, generates user's dimension statistical form；
The target members in user's dimension statistical form are filtered out, having between the target members and abnormal user is direct
Incidence relation；
According to the dispatch content of the target members, abnormal user ally is determined；
The data storage server, the storage for related data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710566597.XA CN109255024A (en) | 2017-07-12 | 2017-07-12 | A kind of searching method of abnormal user ally, device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710566597.XA CN109255024A (en) | 2017-07-12 | 2017-07-12 | A kind of searching method of abnormal user ally, device and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109255024A true CN109255024A (en) | 2019-01-22 |
Family
ID=65051518
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710566597.XA Pending CN109255024A (en) | 2017-07-12 | 2017-07-12 | A kind of searching method of abnormal user ally, device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109255024A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110059725A (en) * | 2019-03-21 | 2019-07-26 | 中国科学院计算技术研究所 | A kind of detection malicious searches system and method based on search key |
| WO2021143270A1 (en) * | 2020-01-14 | 2021-07-22 | 腾讯科技（深圳）有限公司 | Data processing method and apparatus, storage medium, and device |
| WO2021159766A1 (en) * | 2020-02-11 | 2021-08-19 | 腾讯科技（深圳）有限公司 | Data identification method and apparatus, and device, and readable storage medium |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102571484A (en) * | 2011-12-14 | 2012-07-11 | 上海交通大学 | Method for detecting and finding online water army |
| CN102629904A (en) * | 2012-02-24 | 2012-08-08 | 安徽博约信息科技有限责任公司 | Detection and determination method of network navy |
| CN103581355A (en) * | 2012-08-02 | 2014-02-12 | 北京千橡网景科技发展有限公司 | Method and device for handling abnormal behaviors of user |
| CN103746901A (en) * | 2013-12-26 | 2014-04-23 | 中国联合网络通信集团有限公司 | Information processing method and system |
| CN104572646A (en) * | 2013-10-11 | 2015-04-29 | 富士通株式会社 | Abnormal information determining device and method, as well as electronic device |
| CN105630904A (en) * | 2015-12-21 | 2016-06-01 | 中国电子科技集团公司第十五研究所 | Internet account information mining method and device |
| CN105634906A (en) * | 2014-10-27 | 2016-06-01 | 青岛金讯网络工程有限公司 | Information processing method and system |
| US20160253328A1 (en) * | 2013-10-21 | 2016-09-01 | Zte Corporation | Information collection method and device |
-
2017
- 2017-07-12 CN CN201710566597.XA patent/CN109255024A/en active Pending
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102571484A (en) * | 2011-12-14 | 2012-07-11 | 上海交通大学 | Method for detecting and finding online water army |
| CN102629904A (en) * | 2012-02-24 | 2012-08-08 | 安徽博约信息科技有限责任公司 | Detection and determination method of network navy |
| CN103581355A (en) * | 2012-08-02 | 2014-02-12 | 北京千橡网景科技发展有限公司 | Method and device for handling abnormal behaviors of user |
| CN104572646A (en) * | 2013-10-11 | 2015-04-29 | 富士通株式会社 | Abnormal information determining device and method, as well as electronic device |
| US20160253328A1 (en) * | 2013-10-21 | 2016-09-01 | Zte Corporation | Information collection method and device |
| CN103746901A (en) * | 2013-12-26 | 2014-04-23 | 中国联合网络通信集团有限公司 | Information processing method and system |
| CN105634906A (en) * | 2014-10-27 | 2016-06-01 | 青岛金讯网络工程有限公司 | Information processing method and system |
| CN105630904A (en) * | 2015-12-21 | 2016-06-01 | 中国电子科技集团公司第十五研究所 | Internet account information mining method and device |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110059725A (en) * | 2019-03-21 | 2019-07-26 | 中国科学院计算技术研究所 | A kind of detection malicious searches system and method based on search key |
| CN110059725B (en) * | 2019-03-21 | 2021-07-09 | 中国科学院计算技术研究所 | Malicious search detection system and method based on search keywords |
| WO2021143270A1 (en) * | 2020-01-14 | 2021-07-22 | 腾讯科技（深圳）有限公司 | Data processing method and apparatus, storage medium, and device |
| WO2021159766A1 (en) * | 2020-02-11 | 2021-08-19 | 腾讯科技（深圳）有限公司 | Data identification method and apparatus, and device, and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9424319B2 (en) | Social media based content selection system | |
| Nahon et al. | Fifteen minutes of fame: The power of blogs in the lifecycle of viral political information | |
| US20180234447A1 (en) | System and methods for detecting bots real-time | |
| EP2506522B1 (en) | Method and device for pushing data | |
| CN107040863B (en) | Real-time service recommendation method and system | |
| CN103218431B (en) | A kind ofly can identify the system that info web gathers automatically | |
| CN110337059B (en) | Analysis algorithm, server and network system for family relationship of user | |
| US20150046458A1 (en) | Method for recommending users in social network and the system thereof | |
| CN104834668A (en) | Position recommendation system based on knowledge base | |
| CN103200262A (en) | Method, device and system for advertisement scheduling based on mobile network | |
| CN104317804B (en) | The method and apparatus for issuing vote information | |
| CN107918618B (en) | Data processing method and device | |
| KR20150096295A (en) | System and method for buinding q&as database, and search system and method using the same | |
| Annamoradnejad et al. | A comprehensive analysis of twitter trending topics | |
| CN109255024A (en) | A kind of searching method of abnormal user ally, device and system | |
| CN103577593A (en) | Method and system for video aggregation based on microblog hot topics | |
| Agreste et al. | An empirical comparison of algorithms to find communities in directed graphs and their application in web data analytics | |
| Chavoshi et al. | On-demand bot detection and archival system | |
| CN112104642A (en) | Abnormal account number determination method and related device | |
| CN107766234A (en) | A kind of assessment method, the apparatus and system of the webpage health degree based on mobile device | |
| CN106713950A (en) | Video service system based on prediction and analysis of user behaviors | |
| CN111198806A (en) | Service call data statistical analysis method and system based on service open platform | |
| CN110944290B (en) | Companion relationship analysis method and apparatus | |
| Wu et al. | Towards better understanding of app transitions in mobile search | |
| CN110335382B (en) | Intelligent cloud lock control method and system based on GPS positioning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190122 |
|
| RJ01 | Rejection of invention patent application after publication |