CN109495378B - Method, device, server and storage medium for detecting abnormal account - Google Patents

Method, device, server and storage medium for detecting abnormal account Download PDF

Info

Publication number
CN109495378B
CN109495378B CN201811626326.XA CN201811626326A CN109495378B CN 109495378 B CN109495378 B CN 109495378B CN 201811626326 A CN201811626326 A CN 201811626326A CN 109495378 B CN109495378 B CN 109495378B
Authority
CN
China
Prior art keywords
account
users
detected
user
time interval
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201811626326.XA
Other languages
Chinese (zh)
Other versions
CN109495378A (en
Inventor
朱旺南
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangzhou Huaduo Network Technology Co Ltd
Original Assignee
Guangzhou Huaduo Network Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangzhou Huaduo Network Technology Co Ltd filed Critical Guangzhou Huaduo Network Technology Co Ltd
Priority to CN201811626326.XA priority Critical patent/CN109495378B/en
Publication of CN109495378A publication Critical patent/CN109495378A/en
Application granted granted Critical
Publication of CN109495378B publication Critical patent/CN109495378B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/535—Tracking the activity of the user

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The application discloses a method, a device, a server and a storage medium for detecting abnormal accounts, and relates to the technical field of network communication. The method comprises the following steps: acquiring behavior characteristic data of an account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of an incidence relation behavior which is initiated by the account to be detected in the target time interval and is established with other users, and the behavior characteristic data comprises the number of users requesting to establish the incidence relation of the account to be detected in the target time interval; judging whether the behavior characteristic data meets a target condition; and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account. According to the scheme, the behavior characteristic data of the users entering and exiting the live broadcast room are acquired, and the abnormal account is judged and screened out through the background configuration target condition strategy, so that the abnormal account can be found quickly, the users are effectively prevented from being disturbed frequently, and the user friendliness is improved.

Description

Method, device, server and storage medium for detecting abnormal account
Technical Field
The present application relates to the field of network communication technologies, and in particular, to a method, an apparatus, a server, and a storage medium for detecting an abnormal account.
Background
With the rapid development of network technologies, users can chat with friends through instant messaging applications or social networks to enhance feelings of the friends. The instant messaging is an internet-based instant messaging service, can provide a multi-user interactive communication mode for users, and can establish public chat spaces such as different channels and the like through an instant messaging tool, such as a live network platform. The network live broadcast platform generally comprises a plurality of live broadcast rooms, each live broadcast room comprises a main broadcast and a user, and the users can interact with the main broadcast through the network live broadcast platform and can add other users as friends. However, more and more malicious molecules frequently add friends by using special means to further transmit junk information, and inevitably harass others.
Disclosure of Invention
In view of the above problems, the present application provides a method, an apparatus, a server, and a storage medium for detecting an abnormal account, so as to improve the above problems.
In a first aspect, an embodiment of the present application provides a method for detecting an abnormal account, where the method includes: acquiring behavior characteristic data of the account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of association relationship behavior between the account to be detected and other users initiated in the target time interval, and the behavior characteristic data comprises the number of users requesting to establish association relationship between the account to be detected and other users in the target time interval; judging whether the behavior characteristic data meets a target condition; and if the behavior characteristic data meets the target condition, judging the account to be detected as an abnormal account.
In a second aspect, an embodiment of the present application provides an apparatus for detecting an abnormal account, where the apparatus includes: the acquisition module is used for acquiring behavior characteristic data of the account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of behavior of the account to be detected, which is initiated in the target time interval and establishes an association relationship with other users, and the behavior characteristic data comprises the number of users requesting to establish the association relationship of the account to be detected in the target time interval; the judging module is used for judging whether the behavior characteristic data meets the target condition; and the processing module is used for judging that the account to be detected is an abnormal account if the behavior characteristic data meets the target condition.
In a third aspect, an embodiment of the present application provides a server, including a memory and one or more processors; one or more programs stored in the memory and configured to be executed by the one or more processors, the one or more programs configured to perform the method of the first aspect described above.
In a fourth aspect, embodiments of the present application provide a computer-readable storage medium having program code stored therein, where the program code, when executed by a processor, performs the method of the first aspect.
According to the method, the device, the server and the storage medium for detecting the abnormal account, the behavior characteristic data of the account to be detected in the target time interval are obtained, the behavior characteristic data represent the characteristics of the behavior of the account to be detected, which is initiated in the target time interval and establishes an association relationship with other users, and the behavior characteristic data comprise the number of users requesting the establishment of the association relationship of the account to be detected in the target time interval; judging whether the behavior characteristic data meets a target condition; and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account. According to the method, the abnormal account is judged and screened out through acquiring the associated behavior data of the users entering and exiting the live broadcast room and through the background configuration target condition strategy, so that the abnormal account can be found quickly, the users are effectively prevented from being disturbed frequently, and the user friendliness is improved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 shows a schematic diagram of an application environment provided by an embodiment of the present application.
Fig. 2 is a flowchart illustrating a method for detecting an abnormal account according to an embodiment of the present application.
Fig. 3 is a flowchart illustrating a method for detecting an abnormal account according to another embodiment of the present application.
Fig. 4 shows a flowchart of the method of step S220 in fig. 3.
Fig. 5 is a flowchart illustrating a method for detecting an abnormal account according to another embodiment of the present application.
Fig. 6 is a flowchart illustrating a method for detecting an abnormal account according to still another embodiment of the present application.
Fig. 7 is a flowchart illustrating a method for detecting an abnormal account according to still another embodiment of the present application.
Fig. 8 shows a block diagram of a device for detecting an abnormal account according to an embodiment of the present application.
Fig. 9 shows a block diagram of a server according to an embodiment of the present application.
Fig. 10 illustrates a storage unit for storing or carrying program code implementing the method for detecting an abnormal account according to an embodiment of the present application.
Detailed Description
In order to make the technical solutions better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.
Instant Messenger (IM for short) is an internet-based Instant messaging service, and Instant messaging is rapidly developed along with rapid development of the internet, and not only can Instant messaging realize timely communication between two people, but also Instant messaging provides multi-person chat communication services for realizing timely communication between multiple people, such as chat rooms, groups or live network platforms, and more users often chat with friends through Instant messaging applications or social networks to improve feelings between friends. However, more and more malicious molecules enter an instant messaging application or a social network platform to send malicious information to a user by adopting a plug-in or protocol software using mode, or the user is frequently added as a friend, for example, the friend is added in batch by entering a certain live broadcast platform through the plug-in, so that different degrees of harassment are generated to the user, and the user experience is reduced.
In view of the above problems, the inventors have found and proposed a method, an apparatus, a server and a storage medium for detecting an abnormal account provided in the embodiments of the present application through long-term research, and by acquiring behavior feature data of users who enter and exit from a live broadcast room and determining and screening the abnormal account through a background configuration target condition policy, the abnormal account can be quickly found, the users are effectively prevented from being disturbed frequently, and user friendliness is improved.
For the convenience of describing the scheme of the present application in detail, an application environment in the embodiment of the present application is described below with reference to the accompanying drawings.
Referring to fig. 1, an application environment schematic diagram of a method for detecting an abnormal account according to an embodiment of the present application is shown in fig. 1, where the application environment may be understood as a network system 10 according to an embodiment of the present application, where the network system 10 includes: a server 11 and a user terminal 12. The server 11 may be a server (network access server), a server cluster (cloud server) composed of a plurality of servers, or a cloud computing center (database server). The user terminal 12 may be any device with communication and storage functions, including but not limited to a PC (Personal Computer), a PDA (tablet Computer), a smart tv, a smart phone, a smart wearable device, or other smart communication devices with network connection functions.
It should be noted that the method in the embodiment of the present application is applied to a live webcast platform, and as a manner, the live webcast platform may operate in one server 11 as shown in fig. 1, or may operate in a server cluster formed by a plurality of servers 11 (only one is shown in the figure).
Optionally, a client of the instant messaging application or the social network application is installed in the user terminal 12, where the client may be an application client (such as a video playing application in the mobile phone APP), or may be a web page client (such as a live webcast platform), which is not limited herein. The server 11 may establish a communication connection with the user terminal 12 through a network, which may be a wireless network or a wired network. The user may log in to a client in the user terminal 12, which may have an information input interface in which the user inputs text information, and the text information is displayed in a chat interface of the client, or the internet, using a registered user account.
Embodiments of the present application will be described in detail below with reference to the accompanying drawings.
Referring to fig. 2, a flowchart of a method for detecting an abnormal account according to an embodiment of the present application is shown, where the embodiment provides a method for detecting an abnormal account, which is applicable to a live webcast platform, and the method includes:
step S110: the method comprises the steps of obtaining behavior characteristic data of an account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of behavior of the account to be detected, which is initiated in the target time interval and establishes an association relationship with other users, and the behavior characteristic data comprises the number of users requesting to establish the association relationship of the account to be detected in the target time interval.
In this embodiment, the behavior of frequently adding friends by the user of the live webcast platform may cause annoyance to other users, and in order to overcome this problem, the live webcast platform may monitor the behavior characteristic data of the account to be detected entering and exiting the live webcast room of the live webcast platform within the target time interval. The target time interval can be any time period, can be set by a machine or can be defined by a person, and different target time intervals can be set according to specific conditions. The behavior characteristics represent the behavior of establishing association relationship between the account to be detected and other users, such as establishing friend relationship; the behavior feature data includes the number of users requesting to establish an association relationship between the account to be detected and the target time interval, for example, the number of users requesting to establish a friend relationship between the account to be detected and other users entering the live broadcast room in the target time interval.
In a specific application scenario, the live webcast platform can monitor behavior characteristic data of malicious friends added to a studio account. It should be noted that the studio account in this embodiment represents an abnormal user account (in this embodiment, an abnormal account may be understood), that is, a single or multiple user accounts that log in the live broadcast platform by using plug-in or protocol software (malicious software that cracks a background protocol of the live broadcast platform) and add a friend behavior. For example, if there is a behavior that a studio account monitors a channel access of a user through plug-in or protocol software, and when a normal user enters a live broadcast room, one or more studio accounts add the normal user as a friend through searching, the network live broadcast platform may monitor behavior characteristic data that the normal user adds as a friend to one or more studio accounts, for example, the frequency of adding the normal user as a friend, request information, text messages, or adding time, and the like, so that an abnormal account can be quickly found, and malicious addition of friends to the abnormal account is avoided.
Optionally, when the user enters the live broadcast room of the network platform, the background management system of the network platform may configure a channel information for the user, so as to identify the number of the live broadcast room where the user is currently located, so that the account data of the user may carry the channel information (for example, a channel ID) of the live broadcast room, and when the user exits from the live broadcast room or is not located in the live broadcast room, the account data of the user does not carry the channel information of the live broadcast room. Therefore, it can be understood that the account to be detected in this embodiment may include channel information or may not include channel information. That is, when it is detected that the channel information of the account establishing the association with the other user is in a channel state, the account can be used as the account to be detected; when detecting that the channel information of the account establishing the association relation with other users is in a no-channel state, the account can be used as the account to be detected.
In an implementation manner, a background management system of a webcast platform may monitor channel information of a user account in real time, and when it is detected that the channel information of a certain user account is in a no-channel state, the user account may be used as an account to be detected.
As an implementation manner, when the account to be detected includes channel information, the account to be detected may be an account to be added as a friend of a user in the same live broadcast room in the live broadcast room of the network live broadcast platform, and in this case, the account to be detected and the account of the user added as a friend have the same channel information; the account to be detected may also be an account to which the user in a different live broadcast room is a friend, which is added in the live broadcast room of the network live broadcast platform, in which case the account to be detected and the account of the user added as a friend have different channel information.
As another implementation manner, when the account to be detected does not include the channel information, the account to be detected may be an account which is a friend of the user in the live broadcast room in which the network platform is not added in the live broadcast room of the network platform, in this case, the account to be detected has no channel information, and the account of the user which is a friend added in the account to be detected has the channel information.
Step S120: and judging whether the behavior characteristic data meets a target condition.
The target condition may be a critical condition preset by the webcast platform according to the behavior feature data, may also be a critical condition configured in real time by the background management system of the webcast platform, and may also be a critical condition selected from a plurality of preset critical conditions as the target condition, and the specific setting mode of the target condition may refer to the following embodiments. Wherein the critical condition characterizes a set threshold range that may be used to define the behavior feature data.
Step S130: and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account.
As a way, if the behavior feature data satisfies the target condition, it may be determined that the account to be detected is an abnormal account. Optionally, if the behavior feature data does not satisfy the target condition, it may be determined that the account to be detected is not an abnormal account.
Optionally, if the behavior feature data does not satisfy the target condition, the judgment on the current behavior feature data is finished.
The method for detecting the abnormal account number, provided by the embodiment of the application, comprises the steps of acquiring behavior characteristic data of the account number to be detected in a target time interval; then judging whether the behavior characteristic data meets the target condition; if the behavior characteristic data meets the target conditions, the account to be detected is judged to be an abnormal account, so that the abnormal account can be rapidly identified, and the user experience is improved.
Referring to fig. 3, a flowchart of a method for detecting an abnormal account according to another embodiment of the present application is shown, where the embodiment provides a method for detecting an abnormal account, which can be applied to a live webcast platform, and the method includes:
step S210: acquiring a first user number of users of the account to be detected requesting to establish the association relationship in the target time interval.
Optionally, the account to be detected in this embodiment may be an account of a main broadcast (referring to a user who logs in a live webcast platform and can perform live webcast in the live webcast platform) in a live webcast platform, or may be an account of a non-main broadcast (referring to a user who logs in the live webcast platform but cannot perform live webcast in the live webcast platform) in the live webcast platform, and under normal circumstances, users who log in the live webcast platform may pay attention to each other, so if the account to be detected is the main broadcast account, in an implementation manner, the account to be detected may add friends frequently for absorbing numerous fans or improving popularity, and if the account to be detected is the non-main broadcast account, in an implementation manner, the account to be detected may add friends frequently for achieving a certain commercial marketing purpose, but frequent adding of friends inevitably causes disturbance to other users, the friendliness of the network live broadcast platform is damaged.
The network live broadcast platform can acquire a user quantity set of the account to be detected for requesting to establish the association relationship in a target time interval, and as a mode, the user quantity set can be represented by a mapping mode between a request set of the account to be detected for requesting to establish the association relationship and a user set of a user sent by the account to be detected for requesting to establish the association relationship. For example, assume the set "A { A }1，A2，A3,...,AnThe 'represents a request set for establishing an association relation of requests initiated by accounts to be detected in a target time interval, and the set' B { B }1,B2,B3,...,Bm"represents the user set of users requesting to establish an association relationship with the account to be detected within the target time interval, then A { A }1，A2，A3,...,An}→B{B1,B2,B3,...,BmIt may represent a set of user numbers within a target time interval. The target time interval may be a period of time from a current timestamp (i.e., a time when the background management system of the live webcast platform starts recording), for example, one minute, 10 minutes, or 30 minutes, and the specific target time interval may be selected by the background management system of the live webcast platform according to actual needs, which is not limited herein.
As one way, each user quantity in the set of user quantities may be iteratively calculated until each user quantity in the set of user quantities is calculated. In addition, for the set of user numbers A { A }1，A2，A3,...,An}→B{B1,B2,B3,...,BmSet A { A }1，A2，A3,...,AnSome two or more elements in the page may be the same, indicating that two or more requests are to the same user; as one way, set B { B1,B2,B3,...,BmMay be different from one element to another, for example when the set A { A } is1，A2，A3,...,AnThe same or different requests in the set B { B } are sent to the set B { B } respectively1,B2,B3,...,BmEach user in (1); as another way, the set B { B1,B2,B3,...,BmMay also comprise two or more identical elements, e.g. the set A { A }1，A2，A3,...,AnElement A in1To set B { B1,B2,B3,...,BmElement B in1、B2A request is sent, i.e. the set B { B }1,B2,B3,...,BmTwo or more different elements in the set A { A } may be received from the set A { A }1，A2，A3,...,AnThe request sent by the same element in the queue.
Optionally, in order to obtain a more accurate determination result, a de-duplication process may be performed on the request elements in the set a of the obtained user data set, specifically, multiple requests sent to the same user in the set a may be merged, so as to obtain a first number of users that do not include the repeated counting of the same user because the target users who do not include multiple requests are the same user. For example, suppose that the user a wants to add the user B as a friend and sends a friend adding request to the user B three times, because the sending object of the friend request three times is the same user, redundant two repeated requests sent to the user B need to be removed, so that repeated calculation can be avoided, and the determination result is more accurate. Therefore, the first user number is the number obtained after the user requesting to establish the association relationship of the account to be detected in the target time interval is subjected to deduplication processing.
Step S220: and acquiring the second user number of users with the same channel information in the users requesting to establish the association relationship with the account to be detected.
Optionally, for the obtained first user number subjected to deduplication processing, it is required to determine whether users with the same channel information exist therein, and if so, obtaining and counting the number of users with the same channel information to obtain a second user number, specifically, reference is made to the following description of obtaining the second user number:
alternatively, as shown in fig. 4, step S220 may include:
step S221: and acquiring users with the same channel information from the users requesting to establish the association relation of the account to be detected.
The channel information may include a channel number, and may also be understood as an ID number of a live broadcast room of the live broadcast platform, the live broadcast platform includes a plurality of live broadcast rooms, the room ID numbers of the same live broadcast room are the same, and different live broadcast rooms have different room ID numbers, that is, channel IDs. As a mode, the webcast platform may monitor the behavior data of the account to be detected requesting to establish the association relationship, and may further identify the users having the same channel information among the users requesting to establish the association relationship.
In one implementation, for example, if the account to be detected requests to establish a friend relationship with other users, when the account to be detected wants to add one or more users as friends in a live broadcast room, the online audience list of the live broadcast room may be clicked to trigger the user avatar of the user who needs to add a friend to enter the personal data (or user information, account information, etc.) interface corresponding to the user, and the "add friend" function button may be triggered to send a corresponding add friend request carrying the room ID of the live broadcast room to the server, the network live broadcast platform checks the data (including the time of adding friends, the text of adding friend requests, or the frequency of adding friends, etc.) in the add friend request stored in the server, and may identify the room ID of the live broadcast room where the friend added to be detected is located, and then the number of users with the same channel information in the friends added to the account to be detected is identified.
Optionally, the users having the same channel information among the users requesting to establish the association relationship with the account to be detected may be users having the same channel information in one live broadcast room, or users having the same channel information in a plurality of live broadcast rooms.
In a specific application scenario, for example, the account a is an account to be detected, if the account a requests to add 100 users from the same live broadcast room (the live broadcast room number is 875632, which is just an example for illustration, the digit number, the form and the live broadcast room number of the specific live broadcast room number may correspond to different contents according to the authority and the corresponding level of the account of the network live broadcast platform, and are not limited herein), the number of the users having the same channel information among the users requesting to establish the association relationship is 100. If the account a requests to add users with different live broadcast rooms (the numbers of the live broadcast rooms are 7814, 7022, 44935, 3451 and 2082 respectively: 10, 20, 1, 8 and 2) as friends, the users with the same channel information in the users requesting to establish the association relationship in the account a are 10 times, 20 times, 1 time, 8 times and 2 times respectively.
Step S222: and taking the users with the same channel information as a user group, and taking the number of the users corresponding to the user group with the largest number of the users as a second number of the users if the number of the user groups with the same channel information is more than or equal to two.
In one implementation, assuming that the user a adds 10 users from the same live broadcast room as friends, since the channel information of the users from the same live broadcast room is the same, the channel information of the 10 users is the same, and then the 10 users with the same channel information can be regarded as a user group. If the user a adds users from different live broadcast rooms as friends in the same time, for example, 10 users added with the live broadcast room 1 as friends, 15 users added with the live broadcast room 2 as friends, and 52 users added with the live broadcast room 8 as friends, in this case, the added users from different live broadcast rooms can be respectively used as a user group, and then the number of the user groups having the same channel information is greater than or equal to two, and in order to improve the calculation accuracy, the number of the users corresponding to the user group with the largest number of users can be used as the second number of users, that is, the 52 users added by the user a from the live broadcast room 8 are used as the second number of users.
As a manner, when there are a plurality of friends added to the account to be detected, and the friends added to the account to be detected are from the same live broadcast room, the channel information of the added friends is the same, in this case, the users having the same channel information can be used as a user group, and then the number of users corresponding to the user group can be used as the number of second users.
As another mode, when there are a plurality of friends added to the account to be detected, and the friends added to the account to be detected are from different live broadcast rooms, there may be a plurality of user groups respectively having the same channel information, and optionally, if the number of the user groups having the same channel information is greater than or equal to two, the number of users corresponding to the user group having the largest number of users may be used as the second number of users.
Step S230: and taking the first user number and the second user number as behavior feature data.
Optionally, the number of the first users and the number of the second users may be combined to serve as behavior feature data, so that the live webcast platform can accurately control the behavior of the account to be detected, and find out an abnormal account in time.
Step S240: and judging whether the behavior characteristic data meets a target condition.
Optionally, the background management system of the webcast platform may preset a reliable target condition according to the historical behavior feature data of the account to be detected, and is configured to determine whether the behavior feature data meets the target condition. As one approach, a first threshold for comparison with the first number of users, a second threshold for comparison with a ratio of the second number of users to the first number of users, and a third threshold for comparison with the second number of users may be configured. Therefore, the target condition may include if the first number of users is greater than a first threshold, and a ratio of the second number of users to the first number of users is greater than a second threshold; or if the first user number is less than or equal to the first threshold (third threshold), and the second user number is greater than the fourth threshold. It should be noted that, since the target time interval is uncertain, the threshold ranges of the same threshold (e.g., the first threshold and the third threshold) in different target time intervals may be different corresponding to different target time intervals.
In one embodiment, if the first threshold, the second threshold, the third threshold and the fourth threshold exist in different target time intervals, determining whether the behavior feature data meets the target condition may include: and judging whether the first user number is greater than a first threshold value or not and whether the ratio of the second user number to the first user number is greater than a second threshold value or not. If the first number of users is greater than a first threshold value, and the ratio of the second number of users to the first number of users is greater than a second threshold value, it may be determined that the behavior feature data satisfies the target condition.
Optionally, the determining whether the behavior feature data meets the target condition may further include: and judging whether the first user number is not larger than a third threshold value and the second user number is larger than a fourth threshold value, wherein the third threshold value is larger than the fourth threshold value. If the first number of users is not greater than the third threshold and the second number of users is greater than the fourth threshold, it may be determined that the behavioral characteristic data satisfies the target condition.
In another embodiment, if the first threshold, the second threshold and the third threshold exist in the same target time interval, determining whether the behavior feature data meets the target condition may include: and judging whether the first user number is greater than a first threshold value or not and whether the ratio of the second user number to the first user number is greater than a second threshold value or not. As one way, if the first number of users is greater than the first threshold and the ratio of the second number of users to the first number of users is greater than the second threshold, it may be determined that the behavior feature data satisfies the target condition. Alternatively, if the first number of users is not greater than a first threshold and the second number of users is greater than a fourth threshold, the behavior feature data may be determined to satisfy the target condition, wherein the first threshold is greater than the fourth threshold.
In a specific application scenario, for example, assuming that the account to be detected is a, the webcast platform intercepts the number of requests for adding friends from account a within one minute and 10 minutes, and the first threshold and the third threshold may not be equal to each other due to data in different target time intervals. Alternatively, the first number of users and the second number of users may be 30 and 20, respectively, and the first threshold, the second threshold, the third threshold, and the fourth threshold may be 20, 0.5, 32, and 15, respectively. Then for the target policy "determine if the first number of users is greater than the first threshold and the ratio of the second number of users to the first number of users is greater than the second threshold", since the first number of users 30 is greater than the first threshold 20 and the ratio of the second number of users 20 to the first number of users 30 is greater than the second threshold 302/3Greater than the second threshold of 0.5, so it can be determined that the behavior feature data satisfies the target condition; for the target policy "determine whether the first number of users is not greater than the third threshold and the second number of users is greater than the fourth threshold", since the first number of users 30 is less than (not greater than) the third threshold 32 and the second number of users 20 is greater than the fourth threshold 15, it may be determined that the behavior feature data satisfies the target condition. It should be noted that when any one of the target policies in the application scenario is satisfied, it can be determined that the behavior feature data satisfies the target condition.
In another specific application scenario, for example, assuming that the account to be detected is a, the webcast platform intercepts the number of requests for adding friends from account a within 30 minutes, and since the requests are data within the same target time interval, the first threshold and the third threshold may be equal. Alternatively, the first user data and the second user data may be 100 and 70, respectively, and the first threshold, the second threshold, the third threshold, and the fourth threshold may be 90, 0.6, 90, and 88, respectively. Then, for the target policy, "determine whether the first user number is greater than the first threshold, and whether the ratio of the second user number to the first user number is greater than the second threshold", since the first user number 100 is greater than the first threshold 90, and the ratio of the second user number to the first user number 0.7 is greater than the second threshold, it may be determined that the behavior feature data satisfies the target condition; it should be noted that, for the above target policy, since the first number of users is greater than the first threshold and the first number of users is not greater than the first threshold, the two target conditions cannot be satisfied simultaneously for the intercepted data in the same target time interval, and in fact, the two conditions are also mutually opposite for the data in any target time interval, that is, for the data in any target time interval, it can be determined that the behavior feature data satisfies the target conditions only by one way of satisfying the above policy.
It should be noted that, in this embodiment, the first threshold, the second threshold, the third threshold, and the fourth threshold may be configured and adjusted according to historical experience values by a background management system of the live webcast platform, so that an abnormal account can be quickly found, and a user is effectively prevented from being disturbed frequently.
Step S250: and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account.
It can be understood that if the obtained behavior characteristic data is judged to meet the target condition, the account to be detected can be judged to be an abnormal account.
Optionally, if the behavior feature data does not satisfy the target condition, the judgment on the current behavior feature data is finished.
The method for detecting the abnormal account number, provided by the embodiment of the application, comprises the steps of acquiring the first user number of users requesting to establish an association relation of the account number to be detected in a target time interval; acquiring a second user number of users with the same channel information in the users requesting to establish the association relation of the account to be detected; taking the first user quantity and the second user quantity as behavior feature data; judging whether the behavior characteristic data meets a target condition; and if the behavior characteristic data meets the target condition, judging the account to be detected as an abnormal account. By acquiring the behavior characteristic data of the users entering and exiting the live broadcast room and judging and screening the abnormal account through the background configuration target condition strategy, the abnormal account can be quickly found, and the users are effectively prevented from being disturbed frequently.
Referring to fig. 5, a flowchart of a method for detecting an abnormal account according to another embodiment of the present application is shown, where the embodiment provides a method for detecting an abnormal account, which is applicable to a live webcast platform, and the method includes:
step S310: the method comprises the steps of obtaining behavior characteristic data of an account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of an incidence relation behavior which is initiated by the account to be detected in the target time interval and is established with other users, and the behavior characteristic data comprises the number of users requesting to establish the incidence relation of the account to be detected in the target time interval.
It should be noted that the present embodiment is applicable to the case that the channel information exists and the channel information does not exist in the account to be detected.
Optionally, the target time interval in this embodiment represents different time periods. As an implementation manner, the target time interval may be 1 minute, 10 minutes, 30 minutes, 1 hour, 24 hours, and the like, and then the period in time may be understood as that within 24 hours of a day, behavior feature data may be polled every 1 minute, behavior feature data may be polled every 10 minutes, behavior feature data may be polled every 30 minutes, 1 hour, and 24 hours, so that polling behavior feature data of different time periods may be set according to different requirements, for example, a background management system of a live webcast platform may preset to poll all behavior feature data establishing association relationships in the platform every 30 minutes, and check whether there is an abnormal account. It should be noted that, here, the duration of 10 minutes is greater than 1 minute, and the duration of 30 minutes is greater than 10 minutes, that is, 10 minutes includes 1 minute, 30 minutes includes 10 minutes, and so on, so that the live webcast platform can obtain more accurate behavior feature listening data.
Optionally, the behavior feature data may include a request for establishing an association relationship between the account to be detected and the target time intervalThe number of users, then, for all the requests for establishing the association relationship initiated by the account to be detected, the background management system of the webcast platform can acquire the number of users for establishing the association relationship for the requests for establishing the account to be detected in different cycle time intervals. As one way, the mapping relationship "A" between sets may be used1→B{B1,B2,B3,...,BmThe "indicates the total amount of requests for establishing association relationship of requests initiated by the account to be detected in the target time interval.
Step S320: comparing the request quantity of the users requesting to establish the association relationship of the account to be detected in the target time interval with the interval threshold corresponding to the target time interval, wherein the interval thresholds corresponding to different target time intervals are different, and the interval threshold corresponding to the longer target time interval is larger.
As a mode, the background management system of the live webcast platform may pre-configure thresholds of different target time intervals, compare the request number of the user requesting to establish the association relationship with the account to be detected with the corresponding interval threshold, optionally, the interval thresholds corresponding to different time intervals are different, and the interval threshold corresponding to the longer target time interval is larger.
In a specific application scenario, the "1 minute threshold value is δ", "10 minute threshold value is e", "30 minute threshold value is e" can be configured
Figure BDA0001928074150000101
"," 1 hour threshold γ ", and" 24 hour threshold η ", where δ, ε,
Figure BDA0001928074150000102
gamma and eta represent the representative symbols of specific numerical values, the specific numerical values can be configured and adjusted by a background management system of the live webcast platform according to the actual situation, and optionally,
Figure BDA0001928074150000103
step S330: and if the request quantity is larger than an interval threshold corresponding to the target time interval, judging that the behavior characteristic data meets the target condition.
Optionally, if the number of requests is greater than an interval threshold corresponding to the target time interval, it may be determined that the behavior feature data meets the target condition. In one implementation, referring to the description in step S320 above, if the number of requests is greater than a 1 minute threshold, or greater than a 10 minute threshold, or greater than a 30 minute threshold, or greater than a 1 hour threshold, then it may be determined that the behavior feature data satisfies the target condition. It should be noted that, in an implementation situation, the interval threshold corresponding to different target time intervals may be adjusted according to an actual situation, or more or fewer interval thresholds may be set to compare with the number of users.
Step S340: and judging the account to be detected as an abnormal account.
In the method for detecting an abnormal account, by acquiring the behavior feature data of the account to be detected in the target time interval, comparing the number of users requesting to establish an association relationship of the account to be detected in the target time interval with the interval threshold corresponding to the target time interval, if the number of users is greater than the interval threshold corresponding to the target time interval, determining that the behavior feature data meets the target condition, determining that the account to be detected is an abnormal account, and comparing the behavior feature data of the account to be detected in the target time interval with the interval threshold in the preset target time interval, the abnormal account with malicious friends can be quickly identified.
Referring to fig. 6, a flowchart of a method for detecting an abnormal account according to still another embodiment of the present application is shown, where this embodiment provides a method for detecting an abnormal account, which can be applied to a live webcast platform, and the method includes:
step S410: the method comprises the steps of obtaining behavior characteristic data of an account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of an incidence relation behavior which is initiated by the account to be detected in the target time interval and is established with other users, and the behavior characteristic data comprises the number of users requesting to establish the incidence relation of the account to be detected in the target time interval.
Step S420: and judging whether the behavior characteristic data meets a target condition.
Step S430: and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account.
Optionally, if the behavior feature data does not satisfy the target condition, the judgment on the current behavior feature data is finished.
Step S440: and adding the abnormal account number into a blacklist.
Optionally, after the account to be detected is determined to be an abnormal account, punishing may be performed on the abnormal account, and as a manner, the abnormal account may be added to the blacklist. The abnormal account added into the blacklist cannot execute the action of establishing the association relationship, and if the association relationship is to be established with other users again, identity authentication is required.
The method for detecting an abnormal account, provided by this embodiment, includes obtaining behavior feature data of an account to be detected in a target time interval, then determining whether the behavior feature data meets a target condition, if it is determined that the behavior feature data meets the target condition, determining that the account to be detected is an abnormal account, adding the abnormal account into a blacklist, comparing the behavior feature data of the account to be detected with a preset target condition, and quickly finding the abnormal account and adding the abnormal account into the blacklist, so that a user can be effectively prevented from being disturbed frequently.
Referring to fig. 7, a flowchart of a method for detecting an abnormal account according to a further embodiment of the present application is shown, where the embodiment provides a method for detecting an abnormal account, which can be applied to a live webcast platform, and the method includes:
step S510: the method comprises the steps of obtaining behavior characteristic data of an account to be detected in a target time interval, wherein the behavior characteristic data represents characteristics of an incidence relation behavior which is initiated by the account to be detected in the target time interval and is established with other users, and the behavior characteristic data comprises the number of users requesting to establish the incidence relation of the account to be detected in the target time interval.
Step S520: and judging whether the behavior characteristic data meets a target condition.
Step S530: and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account.
Optionally, if the behavior feature data does not satisfy the target condition, the judgment on the current behavior feature data is finished.
Step S540: and when detecting that the abnormal account establishes the association relationship with other users again, judging whether the association binding information of the abnormal account exists or not.
Optionally, when the account to be detected is identified as an abnormal account, if the abnormal account establishes the association behavior again, and when the abnormal account initiates a request for establishing the association behavior with another user, the background management system of the live webcast platform may intercept the request, and detect whether the abnormal account corresponding to the request has association binding information (e.g., binding a mobile phone number, a mailbox, a WeChat, a QQ, etc.), and as a manner, the association binding information may also be other association binding information, such as other instant messaging accounts, etc.
Step S550: and if the account number exists, indicating the abnormal account number to carry out verification code verification.
Optionally, if the associated binding information exists, a popup window containing the verification information may be identified and popped up through the user terminal, and the abnormal account is indicated for verification. As a mode, the abnormal account can be instructed to perform verification code verification, the background management system of the live webcast platform can send the verification code to the application where the associated binding information of the abnormal account is located, and the user corresponding to the abnormal account is instructed to perform identity verification according to the received verification code. Optionally, if the verification passes, the abnormal account may establish the friend association behavior again.
Step S560: and if not, indicating the abnormal account to perform identity binding.
Optionally, if the association binding information does not exist, the background management system of the live webcast platform indicates the abnormal account to perform identity binding. As a mode, the abnormal account may be instructed to perform identity authentication such as mobile phone binding or mailbox binding.
The method for detecting the abnormal account, provided by the embodiment of the application, includes the steps of judging whether behavior characteristic data meet target conditions or not by acquiring behavior characteristic data of the account to be detected in a target time interval, judging whether the behavior characteristic data meet the target conditions or not if the behavior characteristic data meet the target conditions or not, judging the account to be detected to be the abnormal account, judging whether association binding information of the abnormal account exists or not when detecting that the abnormal account establishes association relation behaviors with other users again, indicating the abnormal account to carry out verification code verification if the association binding information exists, and indicating the abnormal account to carry out identity binding if the association binding information does not exist. The abnormal account can be found quickly, the behavior characteristics of the abnormal account are monitored, other users can be effectively prevented from being disturbed frequently by the abnormal account, and the safety performance is improved.
Referring to fig. 8, which is a block diagram illustrating a structure of an apparatus for detecting an abnormal account according to an embodiment of the present disclosure, in this embodiment, an apparatus 600 for detecting an abnormal account is provided, where the apparatus 600 includes: the obtaining module 610, the determining module 620 and the processing module 630:
the obtaining module 610 is configured to obtain behavior feature data of the account to be detected in a target time interval, where the behavior feature data represents a feature of a behavior of the account to be detected that is initiated in the target time interval and establishes an association relationship with other users, and the behavior feature data includes the number of users requesting to establish an association relationship of the account to be detected in the target time interval.
The obtaining module 610 may include: the first acquisition unit is used for acquiring the first user number of users requesting to establish the association relation of the account to be detected in the target time interval; the second acquisition unit is used for acquiring the second user number of users with the same channel information in the users requesting to establish the association relation with the account to be detected; and the processing unit is used for taking the first user quantity and the second user quantity as behavior characteristic data. It should be noted that the first user number is a number obtained after deduplication processing is performed on users requesting to establish an association relationship in a target time interval for an account to be detected.
Optionally, the second obtaining unit may be configured to obtain users with the same channel information from among users requesting to establish an association relationship with the account to be detected; and taking the users with the same channel information as a user group, and taking the number of the users corresponding to the user group with the largest number of the users as a second number of the users if the number of the user groups with the same channel information is more than or equal to two.
As a manner, the obtaining module 610 may be configured to, when it is detected that channel information of an account that establishes an association behavior with another user is in a no-channel state, use the account as an account to be detected; and acquiring the behavior characteristic data of the account to be detected in the target time interval.
A determining module 620, configured to determine whether the behavior feature data meets a target condition.
Optionally, in a specific implementation scenario, as a manner, the determining module 620 may be configured to determine whether the first number of users is greater than a first threshold, and whether a ratio of the second number of users to the first number of users is greater than a second threshold; and if the first user number is larger than a first threshold value and the ratio of the second user number to the first user number is larger than a second threshold value, judging that the behavior characteristic data meets the target condition.
Alternatively, the determining module 620 may be configured to determine whether the first number of users is not greater than a third threshold and the second number of users is greater than a fourth threshold, where the third threshold is greater than the fourth threshold; and if the first user number is not larger than the third threshold value and the second user number is larger than the fourth threshold value, judging that the behavior characteristic data meets the target condition.
As another way, the determining module 620 may be configured to determine whether the first number of users is greater than a first threshold, and whether a ratio of the second number of users to the first number of users is greater than a second threshold; if the first user number is larger than a first threshold value and the ratio of the second user number to the first user number is larger than a second threshold value, judging that the behavior characteristic data meets the target condition; and if the first user number is not larger than the first threshold value and the second user number is larger than a fourth threshold value, judging that the behavior characteristic data meets the target condition, wherein the first threshold value is larger than the fourth threshold value.
Optionally, in another specific implementation scenario, the determining module 620 may be configured to compare the number of requests of the users requesting to establish the association relationship of the account to be detected in the target time interval with an interval threshold corresponding to the target time interval, where the interval thresholds corresponding to different target time intervals are different, and the interval threshold corresponding to the longer target time interval is larger; if the number of requests is greater than the interval threshold corresponding to the target time interval, it can be determined that the behavior feature data meets the target condition.
And the processing module 630 is configured to determine that the account to be detected is an abnormal account if it is determined that the behavior feature data meets the target condition.
Optionally, the processing module 630 further includes a processing unit: and the method is used for adding the abnormal account number into the blacklist.
Optionally, the processing module 630 may be configured to, when it is detected that the abnormal account establishes an association relationship behavior with another user again, determine whether association binding information of the abnormal account exists, where the association binding information represents communication information that the user has bound and is used for verifying an identity; if yes, indicating the abnormal account number to carry out verification code verification; and if not, indicating the abnormal account to perform identity binding.
It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described apparatuses and modules may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, the coupling or direct coupling or communication connection between the modules shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or modules may be in an electrical, mechanical or other form.
In addition, functional modules in the embodiments of the present application may be integrated into one processing module, or each of the modules may exist alone physically, or two or more modules are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode.
Referring to fig. 9, based on the above method and apparatus for detecting an abnormal account, the embodiment of the present application further provides a server 11 capable of executing the above method for detecting an abnormal account. The server 11 includes a memory 112 and one or more processors 114 (only one is shown) coupled to each other, and the memory 112 and the processors 114 are connected by communication lines. The memory 112 stores therein a program that can execute the contents of the foregoing embodiments, and the processor 114 executes the program stored in the memory 112.
Among other things, the processor 114 may include one or more processing cores. The processor 114 interfaces with various components throughout the server 11 using various interfaces and lines to perform various functions of the server 11 and process data by executing or executing instructions, programs, code sets, or instruction sets stored in the memory 112 and invoking data stored in the memory 112. Alternatively, the processor 114 may be implemented in hardware using at least one of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 114 may integrate one or more of a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a modem, and the like. Wherein, the CPU mainly processes an operating system, a user interface, an application program and the like; the GPU is used for rendering and drawing display content; the modem is used to handle wireless communications. It is understood that the modem may not be integrated into the processor 114, but may be implemented by a communication chip.
The Memory 112 may include a Random Access Memory (RAM) or a Read-Only Memory (Read-Only Memory). The memory 112 may be used to store instructions, programs, code sets, or instruction sets. The memory 112 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing the foregoing embodiments, and the like. The storage data area may also store data created by the server 11 in use (such as a phonebook, audiovisual data, chat log data) and the like.
Referring to fig. 10, a block diagram of a computer-readable storage medium according to an embodiment of the present application is shown. The computer-readable storage medium 700 has stored therein program code that can be called by a processor to execute the methods described in the above-described method embodiments.
The computer-readable storage medium 700 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 700 includes a non-transitory computer-readable storage medium. The computer readable storage medium 700 has storage space for program code 710 to perform any of the method steps of the method described above. The program code can be read from or written to one or more computer program products. The program code 710 may be compressed, for example, in a suitable form.
In the description herein, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit the same; although the present application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not necessarily depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.

Claims (10)

1. A method for detecting abnormal account numbers, which is characterized in that the method comprises the following steps:
when detecting that the channel information of an account establishing an association relation behavior with other users is in a no-channel state, taking the account as an account to be detected, wherein the channel information represents an ID number of a live broadcast room of a network live broadcast platform;
acquiring a first user number of users requesting to establish an association relationship of the account to be detected in a target time interval, wherein the first user number characterizes a user number set requesting to establish the association relationship of the account to be detected in the target time interval, and the user number set is represented by a mapping mode between a request set requesting to establish the association relationship, initiated by the account to be detected in the target time interval, and a user set requesting to establish the association relationship, initiated by the account to be detected in the target time interval;
acquiring a second user number of users with the same channel information in the users requesting to establish the association relation of the account to be detected;
taking the combination of the first user quantity and the second user quantity as behavior feature data, wherein the behavior feature data represents the features of the behavior of establishing association relationship with other users initiated by the account to be detected in the target time interval, and the behavior feature data comprises the user quantity of requesting the account to be detected to establish the association relationship in the target time interval;
judging whether the behavior characteristic data meets a target condition;
and if the behavior characteristic data is judged to meet the target condition, judging that the account to be detected is an abnormal account.
2. The method according to claim 1, wherein the step of obtaining the second number of users having the same channel information among the users requesting to establish the association relationship with the account to be detected comprises:
acquiring users with the same channel information from the users requesting to establish the association relation of the account to be detected;
and taking the users with the same channel information as a user group, and taking the number of the users corresponding to the user group with the largest number of the users as a second number of the users if the number of the user groups with the same channel information is more than or equal to two.
3. The method of claim 1 or 2, wherein the step of determining whether the behavior feature data satisfies a target condition comprises:
judging whether the first user number is larger than a first threshold value or not, and whether the ratio of the second user number to the first user number is larger than a second threshold value or not;
and if the first user quantity is larger than a first threshold value and the ratio of the second user quantity to the first user quantity is larger than a second threshold value, judging that the behavior characteristic data meets the target condition.
4. The method of claim 1 or 2, wherein the step of determining whether the behavior feature data satisfies a target condition comprises:
judging whether the first user number is not larger than a third threshold value and the second user number is larger than a fourth threshold value, wherein the third threshold value is larger than the fourth threshold value;
and if the first user number is not larger than a third threshold value and the second user number is larger than a fourth threshold value, judging that the behavior characteristic data meets the target condition.
5. The method of claim 1, wherein the step of determining whether the behavior feature data satisfies a target condition comprises:
judging whether the first user number is larger than a first threshold value or not, and whether the ratio of the second user number to the first user number is larger than a second threshold value or not;
if the first user number is larger than a first threshold value and the ratio of the second user number to the first user number is larger than a second threshold value, judging that the behavior characteristic data meets the target condition;
and if the first user number is not larger than a first threshold value and the second user number is larger than a fourth threshold value, judging that the behavior characteristic data meets the target condition, wherein the first threshold value is larger than the fourth threshold value.
6. The method of claim 1, wherein the first number of users is obtained after deduplication processing is performed on users requesting to establish an association relationship in a target time interval for the account to be detected.
7. The method according to claim 1, wherein the behavior feature data includes a requested number of users requesting to establish an association relationship for the account to be detected in a target time interval, and the step of determining whether the behavior feature data satisfies a target condition includes:
comparing the request quantity of the users requesting to establish the association relationship of the account to be detected in a target time interval with an interval threshold corresponding to the target time interval, wherein the interval thresholds corresponding to different target time intervals are different, and the interval threshold corresponding to the longer target time interval is larger;
and if the request quantity is larger than an interval threshold corresponding to the target time interval, judging that the behavior characteristic data meets the target condition.
8. An apparatus for detecting an abnormal account, the apparatus comprising:
the acquisition module is used for taking the account as the account to be detected when detecting that the channel information of the account establishing the association relation behavior with other users is in a no-channel state, wherein the channel information represents the ID number of a live broadcast room of the network live broadcast platform; acquiring a first user number of users requesting to establish an association relationship of the account to be detected in a target time interval, wherein the first user number characterizes a user number set requesting to establish the association relationship of the account to be detected in the target time interval, and the user number set is represented by a mapping mode between a request set requesting to establish the association relationship, initiated by the account to be detected in the target time interval, and a user set requesting to establish the association relationship, initiated by the account to be detected in the target time interval; acquiring a second user number of users with the same channel information in the users requesting to establish the association relation of the account to be detected; taking the first user quantity and the second user quantity as behavior feature data, wherein the behavior feature data represent features of association relationship behavior which is initiated by the account to be detected in the target time interval and is established with other users, and the behavior feature data comprise the number of users requesting to establish association relationship of the account to be detected in the target time interval;
the judging module is used for judging whether the behavior characteristic data meets a target condition;
and the processing module is used for judging that the account to be detected is an abnormal account if the behavior characteristic data meets the target condition.
9. A server, comprising a memory;
one or more processors;
one or more programs stored in the memory and configured to be executed by the one or more processors, the one or more programs configured to perform the method of any of claims 1-7.
10. A computer-readable storage medium, having program code stored therein, wherein the program code when executed by a processor performs the method of any of claims 1-7.
CN201811626326.XA 2018-12-28 2018-12-28 Method, device, server and storage medium for detecting abnormal account Active CN109495378B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811626326.XA CN109495378B (en) 2018-12-28 2018-12-28 Method, device, server and storage medium for detecting abnormal account

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811626326.XA CN109495378B (en) 2018-12-28 2018-12-28 Method, device, server and storage medium for detecting abnormal account

Publications (2)

Publication Number Publication Date
CN109495378A CN109495378A (en) 2019-03-19
CN109495378B true CN109495378B (en) 2021-03-12

Family

ID=65713115

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811626326.XA Active CN109495378B (en) 2018-12-28 2018-12-28 Method, device, server and storage medium for detecting abnormal account

Country Status (1)

Country Link
CN (1) CN109495378B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110232473B (en) * 2019-05-22 2022-12-27 重庆邮电大学 Black product user prediction method based on big data finance
CN110418173B (en) * 2019-07-18 2021-10-08 北京达佳互联信息技术有限公司 Method, device, server and storage medium for determining abnormal account
CN111339436B (en) * 2020-02-11 2021-05-28 腾讯科技（深圳）有限公司 Data identification method, device, equipment and readable storage medium
CN113938455A (en) * 2021-10-13 2022-01-14 平安银行股份有限公司 User monitoring method and device of group chat system, electronic equipment and storage medium
CN115987579B (en) * 2022-12-07 2023-09-15 南京鼎山信息科技有限公司 Data processing method and data processing system based on big data and Internet of things communication

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101212419A (en) * 2006-12-25 2008-07-02 阿里巴巴公司 Junk message handling method in instant messaging system
CN104636453A (en) * 2015-01-29 2015-05-20 小米科技有限责任公司 Illegal user data identification method and device

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7657935B2 (en) * 2001-08-16 2010-02-02 The Trustees Of Columbia University In The City Of New York System and methods for detecting malicious email transmission
CN201985891U (en) * 2010-12-03 2011-09-21 北京开心人信息技术有限公司 System for preventing harassment of strangers in social network
US10033684B2 (en) * 2013-08-16 2018-07-24 Nexgate, Inc. Classifying social entities and applying unique policies on social entities based on crowd sourced data
CN105592008A (en) * 2014-10-23 2016-05-18 腾讯科技（深圳）有限公司 Method and device for processing user network behavior
CN106549974B (en) * 2016-12-06 2020-06-02 北京知道创宇信息技术股份有限公司 Device, method and system for predicting whether social network account is malicious or not
CN108280346B (en) * 2017-01-05 2022-05-31 腾讯科技（深圳）有限公司 Application protection monitoring method, device and system
CN108718271A (en) * 2018-04-20 2018-10-30 Oppo广东移动通信有限公司 Processing method, device, storage medium and the terminal of good friend's request

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101212419A (en) * 2006-12-25 2008-07-02 阿里巴巴公司 Junk message handling method in instant messaging system
CN104636453A (en) * 2015-01-29 2015-05-20 小米科技有限责任公司 Illegal user data identification method and device

Also Published As

Publication number Publication date
CN109495378A (en) 2019-03-19

Similar Documents

Publication Publication Date Title
CN109495378B (en) Method, device, server and storage medium for detecting abnormal account
US11405350B2 (en) Multi-media processing and displaying method, terminal, and computer storage medium in a social networking application based on interaction information by multiple user accounts
US10985853B2 (en) Method and system for real-time broadcast audience engagement
CN105530175B (en) Message processing method, device and system
US20170063757A1 (en) Spam detection and prevention in a social networking system
CN109617852B (en) Method and device for preventing network addiction based on flow analysis
CN107040494B (en) User account abnormity prevention method and system
CN102523195B (en) Invitation abuse prevents
US8868439B2 (en) Content activity feedback into a reputation system
TW201523487A (en) Message push method, device and system thereof
CN110149270B (en) Apparatus and method for instant messaging
JP2018528544A (en) Method, apparatus and system for pushing information
CN106993202B (en) Method and device for recommending home page
US20200257749A1 (en) Method and a device for friend recommendation
US10516644B2 (en) Near real time relevance ranker for notifications
US9942255B1 (en) Method and system for detecting abusive behavior in hosted services
CN113127723B (en) User portrait processing method, device, server and storage medium
CN110996180B (en) Network live broadcast chatting method, system and server
CN109831417B (en) Method, device, server and storage medium for processing account number for preventing harassment
CN109688099B (en) Server-side database collision identification method, device, equipment and readable storage medium
WO2019165683A1 (en) Summoning method and summoning system
US20180139160A1 (en) Method, system and server for removing alerts
CN106487653B (en) Message processing method and server
CN111246293B (en) Method, apparatus and computer storage medium for monitoring user behavior
CN109190342B (en) Owner identity verification method of smart community and community server

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20190319

Assignee: GUANGZHOU CUBESILI INFORMATION TECHNOLOGY Co.,Ltd.

Assignor: GUANGZHOU HUADUO NETWORK TECHNOLOGY Co.,Ltd.

Contract record no.: X2021440000032

Denomination of invention: Method, device, server and storage medium for detecting abnormal account number

License type: Common License

Record date: 20210125

GR01 Patent grant
GR01 Patent grant