CN111385247B - User behavior classification method and device, storage medium and server - Google Patents
User behavior classification method and device, storage medium and server Download PDFInfo
- Publication number
- CN111385247B CN111385247B CN201811620525.XA CN201811620525A CN111385247B CN 111385247 B CN111385247 B CN 111385247B CN 201811620525 A CN201811620525 A CN 201811620525A CN 111385247 B CN111385247 B CN 111385247B
- Authority
- CN
- China
- Prior art keywords
- behavior
- user
- characteristic value
- text
- virtual group
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
Abstract
The invention relates to the field of data processing, in particular to a user behavior classification method, a device, a storage medium and a server, wherein the method comprises the following steps: acquiring a text message sent by a user in a virtual group within a preset time length; determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value; acquiring behavior data of a user in a virtual group within a preset time length, and counting a behavior characteristic value of the user according to the behavior data; based on a pre-established behavior monitoring model, determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value; and determining the behavior type of the user according to the malicious behavior characteristic value. The invention can efficiently classify the users in the virtual group and effectively manage the users.
Description
Technical Field
The invention relates to the field of data processing, in particular to a user behavior classification method, a user behavior classification device, a storage medium and a server.
Background
With the development of internet technology, the number of users of a client is increasing, a virtual group can be provided on the client for multi-dimensional users to interact simultaneously, such as a live broadcast room, such as a chat room, while in the operation process of the virtual group, an illegal behavior of the user occurs in the virtual group, at present, manual intervention and prevention are mostly adopted for the illegal behavior, for example, an administrator handles illegal personnel, the manual intervention cannot timely respond to the illegal behavior, so that the normal activity of the virtual group is interfered, a large amount of terminal resources are consumed, including server resources of the virtual group, and terminal resources of each user in the virtual group are consumed, and therefore, how to effectively manage the users in the virtual group is an urgent problem to be solved in the internet industry at present.
Disclosure of Invention
In order to overcome the technical problems, particularly the problem that the prior art cannot efficiently classify the users of the virtual group, the following technical scheme is proposed:
in a first aspect, the present invention provides a user behavior classification method, including:
acquiring a text message sent by a user in a virtual group within a preset time length;
determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value;
acquiring behavior data of a user in a virtual group within a preset time length, and counting a behavior characteristic value of the user according to the behavior data;
based on a pre-established behavior monitoring model, determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value;
and determining the behavior type of the user according to the malicious behavior characteristic value.
Further, the determining the behavior type of the user according to the malicious behavior feature value includes:
if the malicious behavior characteristic value is smaller than a first preset value, determining that the behavior type of the user is a normal behavior type;
if the malicious behavior characteristic value is greater than or equal to a first preset value and smaller than a second preset value, determining that the behavior type of the user is an undetermined behavior type;
and if the malicious behavior characteristic value is larger than or equal to a second preset value, determining that the behavior type of the user is an abnormal behavior type.
Further, after determining the behavior type of the user according to the malicious behavior feature value, the method further includes:
adding the user with the behavior type being the abnormal behavior type to a specified list;
acquiring a user with a behavior type of a preset proportion as an undetermined behavior type, and adding the user to a specified list;
sending the text message of the user in the appointed list to a text detection model, and verifying the accuracy of the behavior type; or sending the behavior data of the users in the specified list to a behavior monitoring model, and verifying the accuracy of the behavior types.
Further, after the sending the text message of the user in the specified list to the text detection model and verifying the accuracy of the behavior type, the method further includes:
when the accuracy is lower than a preset threshold value, adjusting the text detection model according to the accuracy;
after the sending the behavior data of the user in the specified list to a behavior monitoring model and verifying the accuracy of the behavior type, the method further includes:
when the accuracy is below a preset threshold, adjusting the behavior monitoring model according to the accuracy.
Further, after determining the behavior type of the user according to the malicious behavior feature value, the method further includes:
and limiting the text message sent by the user with the abnormal behavior type in the virtual group within a preset time period.
Further, the acquiring behavior data of the user in the virtual group within the preset time length and counting behavior characteristic values of the user according to the behavior data includes:
feedback data of other users obtained by the user in the virtual group within a preset time length is obtained, the feedback data is added to behavior data of the user in the virtual group, and behavior characteristic values of the user are counted according to the behavior data.
Further, before the obtaining of the text message sent by the user in the virtual group within the preset time length, the method further includes:
acquiring access IPs of users, and regarding the users with the same access IPs as the same users;
the acquiring the text message sent by the user in the virtual group within the preset time length comprises the following steps:
acquiring text messages sent by users accessing the IP within the same preset time length in the virtual group;
the acquiring of the behavior data of the user in the virtual group within the preset time includes:
and acquiring behavior data of the users accessing the IP within the preset time length in the virtual group.
In a second aspect, the present invention provides a user behavior classification apparatus, including:
a text acquisition module: the method comprises the steps of obtaining a text message sent by a user in a virtual group within a preset time length;
a text detection module: the text detection module is used for determining a text characteristic value of the text message based on a pre-established text detection model, and the text detection model is used for representing the incidence relation between the text message and the text characteristic value;
a behavior data acquisition module: the method comprises the steps of acquiring behavior data of a user in a virtual group within a preset time length, and counting behavior characteristic values of the user according to the behavior data;
a behavior monitoring module: the behavior monitoring model is used for determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, and the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value;
a behavior classification module; and the method is used for determining the behavior type of the user according to the malicious behavior characteristic value.
In a third aspect, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the user behavior classification method described above.
In a fourth aspect, the present invention also provides a server comprising one or more processors, a memory, and one or more computer programs, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and the one or more computer programs are configured to perform the user behavior classification method described above.
Compared with the prior art, the invention has the following beneficial effects:
the invention provides a method for classifying users in a virtual group, wherein the users in the virtual group can send text messages and trigger other behavior events, the text messages sent by the users in the virtual group in a preset duration are obtained, then a text characteristic value of the text messages is determined based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text messages and the text characteristic value, so as to detect whether the text messages sent by the users contain illegal contents or not, simultaneously, behavior data of the users in the virtual group in the preset duration are obtained, the behavior characteristic value of the users is counted according to the behavior data, in order to judge whether the specific behaviors of the users in the virtual group have the illegal behaviors or not more accurately, the malicious behavior characteristic value of the users is determined according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, the behavior monitoring model is used for representing a text characteristic value and an incidence relation between the behavior characteristic value and a malicious behavior characteristic value, the text characteristic value is obtained through judging the text message, whether the text message sent by a user contains illegal contents can be determined, meanwhile, whether the user has a behavior which interferes with normal activities of a virtual group in the virtual group is determined through combining behavior data of the user, the malicious behavior characteristic value of the user is determined, after the malicious behavior characteristic value of each user is obtained, each user is classified according to the set range of the malicious behavior characteristic value, the behavior type corresponding to the user is determined, the users in the virtual group are effectively classified, and the processing efficiency of user classification is improved.
Drawings
The foregoing and/or additional aspects and advantages of the present invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:
FIG. 1 is a flowchart illustrating a user behavior classification method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of an embodiment of a user behavior classification apparatus according to the present invention;
fig. 3 is a schematic structural diagram of a server according to an embodiment of the present invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are illustrative only and should not be construed as limiting the invention.
As used herein, the singular forms "a", "an", "the" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and/or "comprising," when used in this specification, specify the presence of stated features, integers, steps, or operations, but do not preclude the presence or addition of one or more other features, integers, steps, operations, or groups thereof.
It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
It will be appreciated by those skilled in the art that the terms "application," "computer program" and similar terms used herein refer to the same concepts known to those skilled in the art that refer to computer software electronically-adapted to be organized into a series of computer instructions and associated data sources. Unless otherwise specified, such nomenclature is not itself limited by the programming language class, level, or operating system or platform upon which it depends. Of course, such concepts are not limited to any type of terminal.
An embodiment of the present invention provides a user behavior classification method, as shown in fig. 1, the method includes the following steps:
s10: and acquiring a text message sent by the user in the virtual group within a preset time length.
The technical scheme is applied to the virtual group and used for detecting the user behaviors in the virtual group and then determining the behavior types of the users according to the detected user behavior data so as to classify the users. In this embodiment, the text messages sent by the user in the virtual group within the preset duration are obtained, a preset duration is set for the statistics of the user behavior, the text messages sent by the user in the virtual group within the preset duration are counted, for example, the virtual group is a live broadcast room, the user inputs the information such as characters, expressions, pictures and the like through a text edit box of the live broadcast room, and then click a button such as a "send" button provided in the text edit box to send the information in the form of a text message to the live broadcast room, which, in turn, the text message is displayed in the live broadcast room in the form of a bullet screen, and in this embodiment, the bullet screen sent by the user is counted at the server side, so as to obtain the text message sent by the user in the virtual group, and further, and setting the statistical time length of each time as the preset time length at the server, for example, counting the text messages sent by the users in the virtual group every 30 minutes.
S20: and determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value.
In this step, a text feature value of a text message sent by a user is determined based on a pre-established text detection model, specifically, the text detection model is used to represent an association relationship between the text message and the text feature value, in an implementation manner of this embodiment, the text feature value is determined by whether the text message contains contents such as violation, pornography and the like, for example, 10 text messages sent by the user in a virtual group within a preset duration are obtained, the text message is subjected to semantic parsing and word splitting based on the pre-established text detection model, keyword detection is performed on the obtained words, a detection result shows that 8 text messages contain violation keywords, and then the text feature value of the text message is determined according to the detection result.
S30: and acquiring the behavior data of the user in the virtual group within the preset time length, and counting the behavior characteristic value of the user according to the behavior data.
The user has not only the behavior of sending a text message but also other behaviors such as screen refreshing, giving a virtual item, calling a designated person in the virtual group, and the like in the virtual group, and any specific behavior of the user forms corresponding behavior data in the virtual group, for example, when the user a gives a virtual item S01 to the designated person B in the virtual group, the recorded behavior data such as "Gift: a: b: s01: 2018.12.110: 21 ", each operation within the virtual group being generated; in this embodiment, behavior data of a user in a virtual group within a preset duration is acquired, and then a behavior characteristic value of the user is determined according to the behavior data.
S40: and determining a malicious behavior characteristic value of the user according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value.
In order to more accurately judge whether specific behaviors of a user in a virtual group have violations, particularly, other behaviors are executed by the user to avoid the violations, in the embodiment, a malicious behavior characteristic value of the user is determined according to a text characteristic value and a behavior characteristic value based on a pre-established behavior monitoring model, wherein the behavior monitoring model is used for representing the text characteristic value and an association relation between the behavior characteristic value and the malicious behavior characteristic value, specifically, the text characteristic value is obtained through judgment of a text message, whether the text message sent by the user contains violation content can be determined, and meanwhile, whether the user has behaviors interfering with normal activities of the virtual group is determined by combining behavior data of the user, so that the malicious behavior characteristic value of the user is determined.
S50: and determining the behavior type of the user according to the malicious behavior characteristic value.
After the malicious behavior characteristic value of each user is obtained, classifying each user according to the set range of the malicious behavior characteristic value, so as to determine the behavior type corresponding to the user, for example, if the malicious behavior characteristic value of the user is [0, p ]1) Within the range, determining the behavior type of the user as a first preset type, and if so, determining that the behavior type of the user is a first preset typeThe malicious behavior characteristic value of the user is
Within the range, determining the behavior type of the user as a second preset type, and if the characteristic value of the malicious behavior of the user is in (F)2，1]Within the range, the behavior type of the user is determined to be a third preset type, so that the user in the virtual group is effectively managed, and the subsequent management of the users with different behavior types is facilitated.
The embodiment provides a method for classifying users in a virtual group, wherein a user in a virtual group can send a text message and trigger other behavior events, the text message sent by the user in the virtual group in a preset duration is obtained, and then a text characteristic value of the text message is determined based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value, so as to detect whether the text message sent by the user contains violation content, meanwhile, behavior data of the user in the virtual group in the preset duration is obtained, the behavior characteristic value of the user is counted according to the behavior data, in order to more accurately judge whether the specific behavior of the user in the virtual group has violation, a malicious behavior characteristic value of the user is determined according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, the behavior monitoring model is used for representing a text characteristic value and an incidence relation between the behavior characteristic value and a malicious behavior characteristic value, the text characteristic value is obtained through judging the text message, whether the text message sent by a user contains illegal contents can be determined, meanwhile, whether the user has a behavior which interferes with normal activities of a virtual group in the virtual group is determined through combining behavior data of the user, the malicious behavior characteristic value of the user is determined, after the malicious behavior characteristic value of each user is obtained, each user is classified according to the set range of the malicious behavior characteristic value, the behavior type corresponding to the user is determined, the users in the virtual group are effectively classified, and the processing efficiency of user classification is improved.
In an embodiment of the present invention, the determining a behavior type of a user according to the malicious behavior feature value includes:
if the malicious behavior characteristic value is smaller than a first preset value, determining that the behavior type of the user is a normal behavior type;
if the malicious behavior characteristic value is greater than or equal to a first preset value and smaller than a second preset value, determining that the behavior type of the user is an undetermined behavior type;
and if the malicious behavior characteristic value is larger than or equal to a second preset value, determining that the behavior type of the user is an abnormal behavior type.
In this embodiment, after the malicious behavior feature value of each user is obtained, the behavior types of the users need to be classified according to the malicious behavior feature value, specifically, if the malicious behavior feature value is smaller than a first preset value, the behavior type of the user is determined to be a normal behavior type, if the malicious behavior feature value is greater than or equal to the first preset value and smaller than a second preset value, the behavior type of the user is determined to be an undetermined behavior type, and if the malicious behavior feature value is greater than or equal to the second preset value, the behavior type of the user is determined to be an abnormal behavior type. For example, setting the first preset value as P1, setting the second preset value as P2, if the malicious behavior feature value is less than P1, determining that the behavior type of the user is a normal behavior type, and determining that the user does not perform a behavior in the virtual group that interferes with the normal operation of the virtual group; if the malicious behavior characteristic value is greater than or equal to P1 and less than or equal to P2, determining that the behavior type of the user is a pending behavior type, at the moment, it still cannot be definitely determined whether the user has a behavior in the virtual group that interferes with the normal operation of the virtual group, and further confirmation is needed subsequently; if the malicious behavior characteristic value is greater than P2, determining that the behavior type of the user is an abnormal behavior type, and determining that the user has a behavior in the virtual group that interferes with the normal operation of the virtual group.
In an embodiment of the present invention, after determining the behavior type of the user according to the malicious behavior feature value, the method further includes:
adding the user with the behavior type being the abnormal behavior type to a specified list;
acquiring a user with a behavior type of a preset proportion as an undetermined behavior type, and adding the user to a specified list;
sending the text message of the user in the appointed list to a text detection model, and verifying the accuracy of the behavior type; or sending the behavior data of the users in the specified list to a behavior monitoring model, and verifying the accuracy of the behavior types.
After the behavior type of the user is determined, in order to effectively manage the users with different behavior types, in this embodiment, the user whose behavior type is determined to be an abnormal behavior type is added to an appointed list, and if the user with the abnormal behavior type needs to be managed subsequently, the user with the abnormal behavior type can be obtained from the appointed list; further, in order to further confirm the behavior type of the user with the undetermined behavior type, in this embodiment, a preset proportion of users with the behavior type of the undetermined behavior type is obtained and added to an appointed list, then a text message of the user in the appointed list is sent to a text detection model, and the accuracy of the behavior type is verified, or behavior data of the user in the appointed list is sent to a behavior monitoring model, the accuracy of the behavior type is verified, and whether a condition is established is verified again through a result, so that whether the text detection model or the behavior monitoring model is reasonable is verified, and the accuracy of the behavior type of the user is verified.
In an embodiment of the present invention, after sending the text message of the user in the specified list to the text detection model and verifying the accuracy of the behavior type, the method further includes:
when the accuracy is lower than a preset threshold value, adjusting the text detection model according to the accuracy;
after the sending the behavior data of the user in the specified list to a behavior monitoring model and verifying the accuracy of the behavior type, the method further includes:
when the accuracy is below a preset threshold, adjusting the behavior monitoring model according to the accuracy.
After verifying the accuracy of the behavior type, the text detection model or the behavior monitoring model needs to be adjusted according to the accuracy, and in this embodiment, when the accuracy is lower than the preset threshold, it indicates that there may be some deviation of the model, for example, the data is not screened when processing the input data, the data causing the error is also counted, thereby leading to inaccurate behavior types of the user, when the result is imported into the model for verification again, the accuracy of the obtained behavior type is too low and is lower than a preset threshold, in this embodiment, the text detection model or the behavior monitoring model is adjusted according to the accuracy, in one embodiment, the screening of the data in the text detection model or the behavior monitoring model is narrowed, and the influence of error data on the determination of the corresponding behavior type of the user is reduced.
According to one embodiment of the service architecture, when a user in a virtual group sends a text message and triggers a specific operation to generate behavior data, a background server issues the data of the user to a certain topic of kafka, spark consumes the data in the topic at regular time, a trained text detection model is utilized to calculate the text characteristic value of the text message of the user and calculate the malicious behavior characteristic value of the user by utilizing a trained behavior monitoring model, for the user with a higher malicious behavior characteristic value, an automatic processing service can further process according to a strategy and store related data in mysql, meanwhile, part of the users with the lower malicious behavior characteristic value are extracted and stored in the mysql, and for the user which cannot be completely determined, the users can be stored in the mysql and are displayed to a content security team through web for manual audit. And simultaneously, one copy of data stored in the mysql is synchronously transmitted to the hive, and a new model is regularly trained by utilizing spark, so that the accuracy of behavior type identification is improved, and a closed loop for analyzing feedback is formed.
In an embodiment of the present invention, after determining the behavior type of the user according to the malicious behavior feature value, the method further includes:
and limiting the text message sent by the user with the abnormal behavior type in the virtual group within a preset time period.
After determining the behavior type of the user, it is necessary to limit the behavior affecting the normal operation of the virtual group, in this embodiment, the text message sent by the user whose behavior type is an abnormal behavior type in the virtual group within a preset time period is limited, the user whose behavior type is determined as an abnormal behavior type within the preset time period cannot send the text message, and the users are limited from using the specific function in the virtual group, further, the limitation on the sending of the text message by the users in the virtual group has a certain time limitation, for example, the user whose behavior type is an abnormal behavior type cannot use the function of sending the text message in the virtual group within 1 hour, and at the same time, the limitation function is automatically removed after the limitation time expires, and further, if the counted number of times that the behavior type of the user is an abnormal behavior type reaches the preset number of times, the users are permanently restricted from using the specific function in the virtual group, for example, when the counted number of times that the behavior type of the user a is determined as the abnormal behavior type reaches 5 times, the user a is permanently restricted from using the function of sending the text message in the virtual group.
In an embodiment of the present invention, the acquiring behavior data of a user in a virtual group within a preset time period, and counting a behavior characteristic value of the user according to the behavior data includes:
feedback data of other users obtained by the user in the virtual group within a preset time length is obtained, the feedback data is added to behavior data of the user in the virtual group, and behavior characteristic values of the user are counted according to the behavior data.
In this embodiment, when the behavior data of the user is counted, not only the behavior data generated by the behavior of the user in the virtual group is counted, but also the feedback data of other users in the virtual group is counted, for example, a "report" button is set in the virtual group, the user B, C, D, E, F in the virtual group can report the behavior of the user a through the report button, so as to generate the feedback data to the user a, the data is considered as the behavior data of the user in the virtual group, the behavior characteristic value of the user is counted according to the behavior data, the behavior of the user is judged not only by the system itself, but also by combining the feedback data among the users in the virtual group, so as to obtain the behavior data of the user more accurately and comprehensively, and provide a good data base for subsequently determining the behavior type of the user, thereby maintaining proper operation of the virtual group.
In an embodiment of the present invention, before the obtaining of the text message sent by the user in the virtual group within the preset duration, the method further includes:
acquiring access IPs of users, and regarding the users with the same access IPs as the same users;
the acquiring the text message sent by the user in the virtual group within the preset time length comprises the following steps:
acquiring text messages sent by users accessing the IP within the same preset time length in the virtual group;
the acquiring of the behavior data of the user in the virtual group within the preset time includes:
and acquiring behavior data of the users accessing the IP within the preset time length in the virtual group.
In the embodiment, before acquiring text data and behavior data of a user, the access IP of the user, namely the access IP of the client is acquired, then the users with the same access IP are regarded as the same user, and then in the subsequent acquired text messages, the text messages sent by the users with the same access IP within a preset time duration in the virtual group are collected uniformly; when the behavior data of the users are acquired subsequently, the behavior data of the users accessing the IP with the same visit in the virtual group within the preset time length are collected uniformly, so that the users accessing the IP with the same visit can be effectively processed uniformly, the classification efficiency of the users is improved, and the excessive load of large-scale organized behaviors on the server is avoided.
As shown in fig. 2, in another embodiment, the present invention provides a user behavior classification apparatus, including:
the text acquisition module 10: the method comprises the steps of obtaining a text message sent by a user in a virtual group within a preset time length;
the text detection module 20: the text detection module is used for determining a text characteristic value of the text message based on a pre-established text detection model, and the text detection model is used for representing the incidence relation between the text message and the text characteristic value;
the behavior data acquisition module 30: the method comprises the steps of acquiring behavior data of a user in a virtual group within a preset time length, and counting behavior characteristic values of the user according to the behavior data;
the behavior monitoring module 40: the behavior monitoring model is used for determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, and the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value;
a behavior classification module 50; and the method is used for determining the behavior type of the user according to the malicious behavior characteristic value.
In an embodiment of the present invention, the determining, by the behavior classification module 50, the behavior type of the user according to the malicious behavior feature value includes:
if the malicious behavior characteristic value is smaller than a first preset value, determining that the behavior type of the user is a normal behavior type;
if the malicious behavior characteristic value is greater than or equal to a first preset value and smaller than a second preset value, determining that the behavior type of the user is an undetermined behavior type;
and if the malicious behavior characteristic value is larger than or equal to a second preset value, determining that the behavior type of the user is an abnormal behavior type.
In an embodiment of the invention, the apparatus further comprises:
a verification module: the user used for adding the behavior type to the specified list is the abnormal behavior type; acquiring a user with a behavior type of a preset proportion as an undetermined behavior type, and adding the user to a specified list; sending the text message of the user in the appointed list to a text detection model, and verifying the accuracy of the behavior type; or sending the behavior data of the users in the specified list to a behavior monitoring model, and verifying the accuracy of the behavior types.
In an embodiment of the invention, the apparatus further comprises:
an adjusting module: for adjusting the text detection model according to the accuracy when the accuracy is below a preset threshold or adjusting the behavior monitoring model according to the accuracy when the accuracy is below a preset threshold.
In an embodiment of the invention, the apparatus further comprises:
a limiting module: and the text message is used for limiting the user of which the behavior type is the abnormal behavior type to send in the virtual group within a preset time period.
In an embodiment of the present invention, the behavior data obtaining module 30 performs obtaining behavior data of the user in the virtual group within a preset time, and calculates a behavior characteristic value of the user according to the behavior data, including:
feedback data of other users obtained by the user in the virtual group within a preset time length is obtained, the feedback data is added to behavior data of the user in the virtual group, and behavior characteristic values of the user are counted according to the behavior data.
In another embodiment, the present invention provides a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the user behavior classification method described in the above embodiments. The computer-readable storage medium includes, but is not limited to, any type of disk including floppy disks, hard disks, optical disks, CD-ROMs, and magneto-optical disks, ROMs (Read-Only memories), RAMs (Random AcceSS memories), EPROMs (EraSable Programmable Read-Only memories), EEPROMs (Electrically EraSable Programmable Read-Only memories), flash memories, magnetic cards, or optical cards. That is, a storage device includes any medium that stores or transmits information in a form readable by a device (e.g., a computer, a cellular phone), and may be a read-only memory, a magnetic or optical disk, or the like.
The computer-readable storage medium provided by the embodiment of the invention can be used for acquiring the text message sent by the user in the virtual group within the preset time length; determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value; acquiring behavior data of a user in a virtual group within a preset time length, and counting a behavior characteristic value of the user according to the behavior data; based on a pre-established behavior monitoring model, determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value; and determining the behavior type of the user according to the malicious behavior characteristic value. By providing a method for classifying users in a virtual group, the users in the virtual group can send text messages and trigger other behavior events, the text messages sent by the users in the virtual group in a preset duration are obtained, then a text characteristic value of the text messages is determined based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text messages and the text characteristic value, so as to detect whether the text messages sent by the users contain violation content or not, meanwhile, behavior data of the users in the virtual group in the preset duration are obtained, the behavior characteristic value of the users is counted according to the behavior data, in order to judge whether the specific behaviors of the users in the virtual group are violated or not more accurately, the malicious behavior characteristic value of the users is determined according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, the behavior monitoring model is used for representing a text characteristic value and an incidence relation between the behavior characteristic value and a malicious behavior characteristic value, the text characteristic value is obtained through judging the text message, whether the text message sent by a user contains illegal contents can be determined, meanwhile, whether the user has a behavior which interferes with normal activities of a virtual group in the virtual group is determined through combining behavior data of the user, the malicious behavior characteristic value of the user is determined, after the malicious behavior characteristic value of each user is obtained, each user is classified according to the set range of the malicious behavior characteristic value, the behavior type corresponding to the user is determined, the users in the virtual group are effectively classified, and the processing efficiency of user classification is improved.
The computer-readable storage medium provided in the embodiment of the present invention can implement the embodiment of the user behavior classification method, and for specific function implementation, reference is made to the description in the embodiment of the method, which is not repeated herein.
In addition, in another embodiment, the present invention further provides a server, as shown in fig. 3, including a processor 303, a memory 305, an input unit 307, a display unit 309, and the like. Those skilled in the art will appreciate that the structural elements shown in fig. 3 do not constitute a limitation of all servers and may include more or fewer components than those shown, or some combination of components. The memory 305 may be used to store the computer program 301 and the functional modules, and the processor 303 runs the computer program 301 stored in the memory 305 to perform various functional applications of the device and data processing. The memory 305 may be an internal memory or an external memory, or include both internal and external memories. The memory may comprise read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), flash memory, or random access memory. The external memory may include a hard disk, a floppy disk, a ZIP disk, a usb-disk, a magnetic tape, etc. The disclosed memory includes, but is not limited to, these types of memory. The memory 305 disclosed herein is provided as an example and not a limitation.
The input unit 307 is used for receiving signal input and receiving user input, and the input unit 307 may include a touch panel and other input devices, the touch panel may collect touch operations of a user on or near the touch panel (for example, operations of a user on or near the touch panel using any suitable object or accessory such as a finger, a stylus pen, etc.) and drive a corresponding connection device according to a preset program; other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (e.g., play control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like. The display unit 309 may be used to display information input by a user or information provided to the user and various menus of the computer device. The display unit 309 may take the form of a liquid crystal display, an organic light emitting diode, or the like. The processor 303 is a control center of the computer device, connects various parts of the entire computer using various interfaces and lines, and performs various functions and processes data by operating or executing software programs and/or modules stored in the memory 303 and calling data stored in the memory.
In one embodiment, the server includes one or more processors 303, and one or more memories 305, one or more computer programs 301, wherein the one or more computer programs 301 are stored in the memory 305 and configured to be executed by the one or more processors 303, and the one or more computer programs 301 are configured to perform the user behavior classification method described in the above embodiments. The one or more processors 303 shown in fig. 3 are capable of executing, implementing, or implementing the functions of the text acquisition module 10, the text detection module 20, the behavior data acquisition module 30, the behavior monitoring module 40, and the behavior classification module 50 shown in fig. 2.
The server provided by the embodiment of the invention can acquire the text message sent by the user in the virtual group within the preset duration; determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value; acquiring behavior data of a user in a virtual group within a preset time length, and counting a behavior characteristic value of the user according to the behavior data; based on a pre-established behavior monitoring model, determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value; and determining the behavior type of the user according to the malicious behavior characteristic value. By providing a method for classifying users in a virtual group, the users in the virtual group can send text messages and trigger other behavior events, the text messages sent by the users in the virtual group in a preset duration are obtained, then a text characteristic value of the text messages is determined based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text messages and the text characteristic value, so as to detect whether the text messages sent by the users contain violation content or not, meanwhile, behavior data of the users in the virtual group in the preset duration are obtained, the behavior characteristic value of the users is counted according to the behavior data, in order to judge whether the specific behaviors of the users in the virtual group are violated or not more accurately, the malicious behavior characteristic value of the users is determined according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, the behavior monitoring model is used for representing a text characteristic value and an incidence relation between the behavior characteristic value and a malicious behavior characteristic value, the text characteristic value is obtained through judging the text message, whether the text message sent by a user contains illegal contents can be determined, meanwhile, whether the user has a behavior which interferes with normal activities of a virtual group in the virtual group is determined through combining behavior data of the user, the malicious behavior characteristic value of the user is determined, after the malicious behavior characteristic value of each user is obtained, each user is classified according to the set range of the malicious behavior characteristic value, the behavior type corresponding to the user is determined, the users in the virtual group are effectively classified, and the processing efficiency of user classification is improved.
The server provided by the embodiment of the present invention can implement the embodiment of the user behavior classification method provided above, and for specific function implementation, reference is made to the description in the method embodiment, which is not described herein again.
The foregoing is only a partial embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and decorations can be made without departing from the principle of the present invention, and these modifications and decorations should also be regarded as the protection scope of the present invention.
Claims (9)
1. A user behavior classification method is characterized by comprising the following steps:
acquiring a text message sent by a user in a virtual group within a preset time length;
determining a text characteristic value of the text message based on a pre-established text detection model, wherein the text detection model is used for representing the incidence relation between the text message and the text characteristic value;
the method comprises the steps of obtaining behavior data of a user in a virtual group within a preset time length, and counting behavior characteristic values of the user according to the behavior data, wherein the behavior data comprises the following steps: acquiring feedback data of other users acquired by a user in a virtual group within a preset time length, adding the feedback data to behavior data of the user in the virtual group, and counting behavior characteristic values of the user according to the behavior data;
based on a pre-established behavior monitoring model, determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value, wherein the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value;
and determining the behavior type of the user according to the malicious behavior characteristic value.
2. The method of claim 1, wherein determining the behavior type of the user according to the malicious behavior feature value comprises:
if the malicious behavior characteristic value is smaller than a first preset value, determining that the behavior type of the user is a normal behavior type;
if the malicious behavior characteristic value is greater than or equal to a first preset value and smaller than a second preset value, determining that the behavior type of the user is an undetermined behavior type;
and if the malicious behavior characteristic value is larger than or equal to a second preset value, determining that the behavior type of the user is an abnormal behavior type.
3. The method of claim 2, wherein after determining the behavior type of the user according to the malicious behavior feature value, the method further comprises:
adding the user with the behavior type being the abnormal behavior type to a specified list;
acquiring a user with a behavior type of a preset proportion as an undetermined behavior type, and adding the user to a specified list;
sending the text message of the user in the appointed list to a text detection model, and verifying the accuracy of the behavior type; or sending the behavior data of the users in the specified list to a behavior monitoring model, and verifying the accuracy of the behavior types.
4. The method of claim 3, wherein sending text messages of the users in the specified list to a text detection model, after verifying the accuracy of the behavior types, further comprises:
when the accuracy is lower than a preset threshold value, adjusting the text detection model according to the accuracy;
after the sending the behavior data of the user in the specified list to a behavior monitoring model and verifying the accuracy of the behavior type, the method further includes:
when the accuracy is below a preset threshold, adjusting the behavior monitoring model according to the accuracy.
5. The method of claim 2, wherein after determining the behavior type of the user according to the malicious behavior feature value, the method further comprises:
and limiting the text message sent by the user with the abnormal behavior type in the virtual group within a preset time period.
6. The method of claim 1, wherein the obtaining the text message sent by the user in the virtual group within the preset duration further comprises:
acquiring access IPs of users, and regarding the users with the same access IPs as the same users;
the acquiring the text message sent by the user in the virtual group within the preset duration includes:
acquiring text messages sent by users accessing the IP within the same preset time length in the virtual group;
the acquiring of the behavior data of the user in the virtual group within the preset time includes:
and acquiring behavior data of the users accessing the IP within the preset time length in the virtual group.
7. A user behavior classification apparatus, comprising:
a text acquisition module: the method comprises the steps of obtaining a text message sent by a user in a virtual group within a preset time length;
a text detection module: the text detection module is used for determining a text characteristic value of the text message based on a pre-established text detection model, and the text detection model is used for representing the incidence relation between the text message and the text characteristic value;
a behavior data acquisition module: the method is used for acquiring the behavior data of the user in the virtual group within the preset time length and counting the behavior characteristic value of the user according to the behavior data, and comprises the following steps: acquiring feedback data of other users acquired by a user in a virtual group within a preset time length, adding the feedback data to behavior data of the user in the virtual group, and counting behavior characteristic values of the user according to the behavior data;
a behavior monitoring module: the behavior monitoring model is used for determining a malicious behavior characteristic value of a user according to the text characteristic value and the behavior characteristic value based on a pre-established behavior monitoring model, and the behavior monitoring model is used for representing the text characteristic value and the incidence relation between the behavior characteristic value and the malicious behavior characteristic value;
a behavior classification module; and the method is used for determining the behavior type of the user according to the malicious behavior characteristic value.
8. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, implements the user behavior classification method of any one of claims 1 to 6.
9. A server, comprising:
one or more processors;
a memory;
one or more computer programs, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, the one or more computer programs configured to perform the user behavior classification method of any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811620525.XA CN111385247B (en) | 2018-12-28 | 2018-12-28 | User behavior classification method and device, storage medium and server |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811620525.XA CN111385247B (en) | 2018-12-28 | 2018-12-28 | User behavior classification method and device, storage medium and server |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111385247A CN111385247A (en) | 2020-07-07 |
| CN111385247B true CN111385247B (en) | 2022-07-08 |
Family
ID=71220236
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811620525.XA Active CN111385247B (en) | 2018-12-28 | 2018-12-28 | User behavior classification method and device, storage medium and server |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111385247B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103853841A (en) * | 2014-03-19 | 2014-06-11 | 北京邮电大学 | Method for analyzing abnormal behavior of user in social networking site |
| CN106296422A (en) * | 2016-07-29 | 2017-01-04 | 重庆邮电大学 | A kind of social networks junk user detection method merging many algorithms |
| CN106777024A (en) * | 2016-12-08 | 2017-05-31 | 北京小米移动软件有限公司 | Recognize the method and device of malicious user |
| CN107181745A (en) * | 2017-05-16 | 2017-09-19 | 阿里巴巴集团控股有限公司 | Malicious messages recognition methods, device, equipment and computer-readable storage medium |
| CN113704328A (en) * | 2021-08-31 | 2021-11-26 | 陈靓 | User behavior big data mining method and system based on artificial intelligence |
-
2018
- 2018-12-28 CN CN201811620525.XA patent/CN111385247B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103853841A (en) * | 2014-03-19 | 2014-06-11 | 北京邮电大学 | Method for analyzing abnormal behavior of user in social networking site |
| CN106296422A (en) * | 2016-07-29 | 2017-01-04 | 重庆邮电大学 | A kind of social networks junk user detection method merging many algorithms |
| CN106777024A (en) * | 2016-12-08 | 2017-05-31 | 北京小米移动软件有限公司 | Recognize the method and device of malicious user |
| CN107181745A (en) * | 2017-05-16 | 2017-09-19 | 阿里巴巴集团控股有限公司 | Malicious messages recognition methods, device, equipment and computer-readable storage medium |
| CN113704328A (en) * | 2021-08-31 | 2021-11-26 | 陈靓 | User behavior big data mining method and system based on artificial intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111385247A (en) | 2020-07-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110399925B (en) | Account risk identification method, device and storage medium | |
| CN107291911B (en) | Anomaly detection method and device | |
| US7636919B2 (en) | User-centric policy creation and enforcement to manage visually notified state changes of disparate applications | |
| US10192051B2 (en) | Data acceleration | |
| US10496815B1 (en) | System, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on the classifications | |
| US9679131B2 (en) | Method and apparatus for computer intrusion detection | |
| CN109492952B (en) | Auditing data processing method and device, electronic equipment and storage medium | |
| WO2019136282A1 (en) | Control maturity assessment in security operations environments | |
| US20080148398A1 (en) | System and Method for Definition and Automated Analysis of Computer Security Threat Models | |
| US10528892B2 (en) | Intelligent ranking of notifications on a user device | |
| US20150356489A1 (en) | Behavior-Based Evaluation Of Crowd Worker Quality | |
| US20200012990A1 (en) | Systems and methods of network-based intelligent cyber-security | |
| KR20170035892A (en) | Recognition of behavioural changes of online services | |
| CN110222504B (en) | User operation monitoring method, device, terminal equipment and medium | |
| CN105022815A (en) | Information interception method and device | |
| CN110933115A (en) | Analysis object behavior abnormity detection method and device based on dynamic session | |
| CN114553596B (en) | Multi-dimensional security condition real-time display method and system suitable for network security | |
| CN110417751B (en) | Network security early warning method, device and storage medium | |
| CN116112194A (en) | User behavior analysis method and device, electronic equipment and computer storage medium | |
| CN109478219A (en) | For showing the user interface of network analysis | |
| EP3479279A1 (en) | Dynamic ranking and presentation of endpoints based on age of symptoms and importance of the endpoint in the environment | |
| Pannell et al. | Anomaly detection over user profiles for intrusion detection | |
| CN111385247B (en) | User behavior classification method and device, storage medium and server | |
| RU2669172C2 (en) | Method and monitoring system of web-site consistency | |
| CN115146263A (en) | User account collapse detection method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20221118 Address after: 31a, 15 / F, building 30, maple mall, bangrang Road, Brazil, Singapore Patentee after: Baiguoyuan Technology (Singapore) Co.,Ltd. Address before: Building B-1, North District, Wanda Commercial Plaza, Wanbo business district, No. 79, Wanbo 2nd Road, Nancun Town, Panyu District, Guangzhou City, Guangdong Province Patentee before: GUANGZHOU BAIGUOYUAN INFORMATION TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right |