CN111461773B

CN111461773B - User detection method and device and electronic equipment

Info

Publication number: CN111461773B
Application number: CN202010229385.4A
Authority: CN
Inventors: 罗晓天
Original assignee: Beijing QIYI Century Science and Technology Co Ltd
Current assignee: Beijing QIYI Century Science and Technology Co Ltd
Priority date: 2020-03-27
Filing date: 2020-03-27
Publication date: 2023-09-08
Anticipated expiration: 2040-03-27
Also published as: CN111461773A

Abstract

The embodiment of the invention provides a user detection method, a device and electronic equipment, wherein the method comprises the following steps: acquiring behavior data generated in the process of participating in activities deduced by an application program by a user; wherein the behavior data comprises: the method comprises the steps of acquiring an activity identifier of an activity participated by a user and time information representing the time of the activity participated by the user, analyzing the activity identifier included in each behavior data and the time interval of two adjacent activities participated by the user according to the sequence, determining the behavior rule of the activity participated by the user participated by the application, and detecting whether the user is an abnormal user according to the behavior rule, wherein the time interval of two adjacent activities participated by the user is determined according to the time information included in each behavior data. By adopting the scheme provided by the embodiment of the invention for user detection, the detection accuracy can be improved.

Description

User detection method and device and electronic equipment

Technical Field

The present invention relates to the field of internet technologies, and in particular, to a user detection method, a device, and an electronic device.

Background

To encourage users to use applications more, applications typically push out various types of activities, which users may be rewarded for engaging in. In practice, many users often participate in these activities for the purpose of obtaining rewards, and not actually use the application program, and such users may be referred to as abnormal users. Since the total rewards for activities are typically limited, many users who actually use the application cannot be rewarded when the rewards for activities are earned by an abnormal user. Therefore, it is necessary to detect the above-described abnormal user so that the abnormal user cannot be rewarded.

In the related art, when detecting an abnormal user, it is usually detected whether the user uses a mobile phone number that is preset, whether the user uses a network protocol (Internet Protocol, abbreviated as IP) address that is an agent IP address, or whether the time of day the user participates in an activity is the same, etc., to detect whether the user is an abnormal user. However, the above method is easily bypassed by an abnormal user, resulting in low detection accuracy.

Disclosure of Invention

The embodiment of the invention aims to provide a user detection method, a user detection device and electronic equipment so as to improve the accuracy of detection results.

The specific technical scheme is as follows:

in a first aspect, an embodiment of the present invention provides a user detection method, where the method includes:

acquiring behavior data generated in the process of participating in activities deduced by an application program by a user; wherein the behavior data comprises: an activity identifier of an activity in which the user participates, and time information indicating a time at which the user participates in the activity;

acquiring the sequence of each activity deduced by the user participating in the application program;

according to the sequence, analyzing the activity identification included in each behavior data and the time interval of two adjacent times of activities of the user, determining the behavior rule of the user participating in the activity deduced by the application program, and detecting whether the user is an abnormal user according to the behavior rule, wherein the time interval of two adjacent times of activities of the user is determined according to the time information included in each behavior data.

Optionally, the analyzing, according to the order, the activity identifier included in each behavior data and the time interval between two adjacent activities of the user, to determine the behavior rule of the user participating in the activity deduced by the application program includes:

for each behavior data, obtaining a behavior vector containing an activity identifier and time information included in the behavior data;

Obtaining behavior sequence data comprising each of the behavior vectors and arranged according to the sequence;

and analyzing the behavior sequence data to determine the behavior rule of the user participating in the activity deduced by the application program.

and carrying out information fusion on an activity identifier and a preset time interval, which are included in first-row data generated in the process of participating in a first activity, of a user by using each information fusion layer included in a pre-trained detection model, wherein the input of the first information fusion layer comprises the following steps: the first row of data comprises an active identifier and the preset time interval, and the input of other information fusion layers comprises: outputting the last information fusion layer;

according to the sequence, using each information fusion layer included in the pre-trained detection model to perform information fusion on an activity identifier included in second behavior data generated in the process that a user participates in other activities and a time interval corresponding to the activity identifier, wherein the input of the first information fusion layer comprises: the second behavior data comprises an activity identifier, a time interval corresponding to the activity identifier and output of information fusion carried out last time on the information fusion layer, and the input of other information fusion layers comprises: the information fusion layer outputs information fusion last time and the information fusion layer outputs last time, and the time interval corresponding to the activity mark represents the time interval between the time of the user participating in the activity corresponding to the activity mark and the time of the user participating in the last activity;

And determining the behavior rule of the user participating in the activity deduced by the application program according to the last information fusion output of each information fusion layer.

Optionally, the detection model further includes an information association layer;

before the information fusion layer performs information fusion on the activity identifier and the preset time interval included in the first data generated in the first activity process of the user participation by using the information fusion layer included in the pre-trained detection model, the method further includes:

establishing a logic relation between an activity identifier included in first data generated in the process of participating in a first activity by a user and a preset time interval by using an information association layer included in a pre-trained detection model to obtain an information association result corresponding to the activity identifier included in the first data, wherein the input of the information association layer comprises the following steps: the first row of data comprises an activity identifier and the preset time interval;

establishing a logic relation between an activity identifier included in second behavior data generated in the process of participating in other activities by a user and a time interval corresponding to the activity identifier by using an information association layer included in a pre-trained detection model, and obtaining an information association result corresponding to the activity identifier included in the second behavior data, wherein the input of the information association layer comprises the following steps: the second behavior data comprises an activity identifier and a time interval corresponding to the activity identifier;

The information fusion layer performs information fusion on an activity identifier and a preset time interval included in first data generated in the process of participating in a first activity by a user, wherein the information fusion layer includes the following steps:

and carrying out information fusion on information association results corresponding to the activity identifiers included in the first row of data by using each information fusion layer included in the pre-trained detection model, wherein the input of the first information fusion layer comprises the following steps: the first row of data comprises information association results corresponding to the activity identifications;

according to the sequence, using each information fusion layer included in the pre-trained detection model to fuse the activity identifier included in the second behavior data generated in the process of the user participating in other activities and the time interval corresponding to the activity identifier, including:

according to the sequence, information fusion is carried out on information association results corresponding to the activity identifications included in the second behavior data by using each information fusion layer included in the pre-trained detection model, wherein the input of the first information fusion layer comprises the following steps: and outputting information fusion last time by the information fusion layer according to an information association result corresponding to the activity identifier included in the second behavior data.

Optionally, the time information includes: absolute time, time interval or information obtained by normalizing the time interval, wherein the time interval represents an interval between a time when a user participates in a first activity and a time when the user participates in a second activity, and the first activity is: the activity identifier included in the behavior data corresponds to an activity, and the second activity is: an activity proposed by an application that the user last participated in before participating in the first activity.

Optionally, the time information includes: when the absolute time is, before the activity identification included in each behavior data and the time interval between two adjacent activities of the user are analyzed according to the sequence to determine the behavior rule of the user participating in the activity deduced by the application program, the method further comprises:

calculating a time interval corresponding to the activity identifier included in each behavior data according to the absolute time included in each behavior data;

normalizing each time interval to obtain processed information;

according to the sequence, analyzing the activity identifier included in each behavior data and the time interval between two adjacent activities of the user, and determining the behavior rule of the user participating in the activity deduced by the application program, wherein the method comprises the following steps:

And analyzing the activity identifications included in the behavior data and the processed information corresponding to the activity identifications according to the sequence to determine the behavior rules of the user participating in the activities deduced by the application program.

In a second aspect, an embodiment of the present invention further provides a user detection apparatus, where the apparatus includes:

the data acquisition unit is used for acquiring behavior data generated in the process that a user participates in the application program to push out activities; wherein the behavior data comprises: an activity identifier of an activity in which the user participates, and time information indicating a time at which the user participates in the activity;

a sequence acquisition unit for acquiring the sequence of each activity deduced by the user participating in the application program;

and the user detection unit is used for analyzing the activity identifications included in the behavior data and the time intervals of the adjacent two times of activities of the user according to the sequence, determining the behavior rule of the user participating in the activity deduced by the application program, and detecting whether the user is an abnormal user according to the behavior rule, wherein the time intervals of the adjacent two times of activities of the user are determined according to the time information included in the behavior data.

Optionally, the user detection unit includes:

a vector obtaining subunit, configured to obtain, for each behavior data, a behavior vector including an activity identifier and time information included in the behavior data;

a sequence obtaining subunit configured to obtain behavior sequence data that includes each of the behavior vectors and that is arranged in the order of the behavior vectors;

and the first rule determining subunit is used for analyzing the behavior sequence data and determining the behavior rule of the user participating in the activity deduced by the application program.

Optionally, the user detection unit includes:

the first information fusion subunit is configured to use each information fusion layer included in the pre-trained detection model to perform information fusion on an activity identifier and a preset time interval included in first data generated in a first activity process of a user, where input of the first information fusion layer includes: the first row of data comprises an active identifier and the preset time interval, and the input of other information fusion layers comprises: outputting the last information fusion layer;

the first information fusion subunit is configured to perform information fusion on an activity identifier included in second behavior data generated in a process of a user participating in other activities and a time interval corresponding to the activity identifier by using each information fusion layer included in a pre-trained detection model according to the sequence, where input of the first information fusion layer includes: the second behavior data comprises an activity identifier, a time interval corresponding to the activity identifier and output of information fusion carried out last time on the information fusion layer, and the input of other information fusion layers comprises: the information fusion layer outputs information fusion last time and the information fusion layer outputs last time, and the time interval corresponding to the activity mark represents the time interval between the time of the user participating in the activity corresponding to the activity mark and the time of the user participating in the last activity;

And the second rule determining subunit is used for determining the behavior rule of the user participating in the activity deduced by the application program according to the last information fusion output of each information fusion layer.

the user detection unit further includes:

the first information association subunit is configured to establish a logical relationship between an activity identifier included in a first data generated in a first activity process of participation of a user and a preset time interval by using an information association layer included in a pre-trained detection model, and obtain an information association result corresponding to the activity identifier included in the first data, where input of the information association layer includes: the first row of data comprises an activity identifier and the preset time interval;

the second information association subunit is configured to establish a logical relationship between an activity identifier included in second behavior data generated during participation of the user in other activities and a time interval corresponding to the activity identifier by using an information association layer included in a pre-trained detection model, so as to obtain an information association result corresponding to the activity identifier included in the second behavior data, where input of the information association layer includes: the second behavior data comprises an activity identifier and a time interval corresponding to the activity identifier;

The first information fusion subunit is specifically configured to:

the first information fusion subunit is specifically configured to: according to the sequence, information fusion is carried out on information association results corresponding to the activity identifications included in the second behavior data by using each information fusion layer included in the pre-trained detection model, wherein the input of the first information fusion layer comprises the following steps: and outputting information fusion last time by the information fusion layer according to an information association result corresponding to the activity identifier included in the second behavior data.

Optionally, the time information includes: in the case of the said absolute time, the time of day,

the apparatus further comprises:

the interval determining unit is used for calculating the time interval corresponding to the activity identifier included in each behavior data according to the absolute time included in each behavior data;

the interval processing unit is used for carrying out normalization processing on each time interval to obtain processed time information;

the user detection unit is specifically configured to:

and analyzing the activity identifications included in the behavior data and the processed time information corresponding to the activity identifications according to the sequence to determine the behavior rules of the user participating in the activities deduced by the application program.

In a third aspect, an embodiment of the present invention further provides an electronic device, including a processor, a communication interface, a memory, and a communication bus;

wherein the processor, the communication interface and the memory complete the communication with each other through the communication bus,

the memory is used for storing a computer program;

the processor is configured to implement any one of the user detection methods provided in the first aspect when executing the program stored in the memory.

According to the technical scheme provided by the embodiment of the invention, when a user is detected, the behavior data generated in the process of the user participating in the activity deduced by the application program and the sequence of the activities deduced by the user participating in the application program are firstly obtained, then according to the obtained sequence, the activity identification included in the behavior data and the time interval of the user participating in the activity adjacently twice are analyzed, the behavior rule of the activities deduced by the user participating in the application program is determined, and whether the user is an abnormal user is detected according to the behavior rule.

Therefore, the technical scheme provided by the embodiment of the invention is to detect whether the user is an abnormal user according to the behavior rule of the user participating in the activity deduced by the application program. The behavior rules are obtained by analyzing the sequence of the user participating in each activity, the identification of each activity and the time interval of the user participating in the activity twice, the difference between the behavior rules of the abnormal user participating in the activity and the behavior rules of the normal user participating in the activity is usually large, whether the user is the abnormal user or not is detected through the behavior rules of the user participating in the activity, the abnormal user is not easy to bypass the detection, and the detection accuracy is improved.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below.

Fig. 1 is a schematic flow chart of a user detection method according to an embodiment of the present invention;

FIG. 2 is a flow chart of a method for determining behavior rules according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a detection model according to an embodiment of the present invention;

FIG. 4 is a flow chart of user detection using a detection model according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a second flow chart of user detection using a detection model according to an embodiment of the present invention;

FIG. 6 is a schematic flow chart of another user detection method according to an embodiment of the present invention;

fig. 7 is a schematic structural diagram of a user detection device according to an embodiment of the present invention;

fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

In order to improve the accuracy of detecting abnormal users, the embodiment of the invention provides a user detection method, a user detection device and electronic equipment.

The following first describes a user detection method provided by an embodiment of the present invention.

The execution main body of the user detection method provided by the embodiment of the invention can be electronic equipment, and the electronic equipment can be, for example, equipment such as a server, a desktop computer, a notebook computer, a mobile terminal and the like, and can also be other electronic equipment.

The user detection method provided by the embodiment of the invention comprises the following steps:

acquiring behavior data generated in the process of participating in activities deduced by an application program by a user; wherein, the behavior data includes: an activity identifier of an activity in which the user participates, and time information indicating a time at which the user participates in the activity;

according to the sequence, the activity identification included in each behavior data and the time interval between two adjacent activities of the user are analyzed, the behavior rule of the user participating in the activity deduced by the application program is determined, whether the user is an abnormal user is detected according to the behavior rule, wherein the time interval between two adjacent activities of the user is determined according to the time information included in each behavior data.

The user detection method provided by the embodiment of the invention detects whether the user is an abnormal user according to the behavior rule of the activities deduced by the user participation application program, and the behavior rule is obtained by analyzing each activity identifier and the time interval of two adjacent activities of the user according to the sequence of the user participation in each activity, so that the difference between the behavior rule of the abnormal user participation activity and the behavior rule of the normal user participation activity is usually large, whether the user is the abnormal user is detected through the behavior rule of the user participation activity, the abnormal user is not easy to bypass the detection, and the detection accuracy is improved.

The following describes a user detection method provided by the embodiment of the present invention through a specific implementation manner.

As shown in fig. 1, the user detection method provided by the embodiment of the present invention includes the following steps S110 to S130.

S110: and acquiring behavior data generated in the process of participating in the activities deduced by the application program by the user.

The behavior data includes: an activity identity of an activity in which the user participates and time information representing a time at which the user participates in the activity.

The application program may be any one of a video playing application program, an online shopping application program, an information browsing application program, and a navigation application program, or may be another type of application program, and embodiments of the present invention are not particularly limited.

The activity that the application program is pushing may be determined based on the type of application program. For example, when the application is a video playback type application, the activities deduced by the application may include: at least one of check-in, viewing video, speaking, viewing live, drawing a lottery, and other activities may also be included. When the application is a web shopping application, the activities deduced by the application may include: at least one of checking in, drawing a lottery, browsing specified merchandise, playing a specified mini-game, and other activities may also be included.

In the embodiment of the present invention, each time the user participates in an activity proposed by the application, one behavior data is generated, for example, if the user participates in two lottery activities and one check-in activity, three behavior data are generated.

In one embodiment, the activities deduced by the application may include unknown activities. When the application program pushes out a new activity, if the user detection method is not updated according to the new activity pushed out by the application program, the electronic device may not recognize the activity participated by the user when performing user detection, in this case, if the activity pushed out by the application program includes an unknown activity, the unrecognized activity may be determined as the unknown activity, so that user detection is performed better.

In one embodiment, the behavior data generated during the user's participation in the activity deduced by the application may be obtained from a log of the user.

In one embodiment, behavior data generated during the process of participating in the activity proposed by the application program in a preset time period may be obtained. For example, each behavior data generated during the process of participating in the activities of the application program in a single day may be acquired, and each behavior data generated during the process of participating in the activities of the application program in a week may be acquired. According to the method and the device for detecting the behavior of the user, the behavior data generated in the process that the user participates in the activities deduced by the application program in the preset time period are obtained, the obtained behavior data can be reduced, the behavior rule of the user can be determined more conveniently according to the behavior data, and therefore the efficiency of detecting the user is higher.

The activity identifier of the activity in which the user participates can be represented by any one of numbers, english characters, english character strings and Chinese names. For example, check-in may be represented by the identification "1," 2 "for viewing video," 3 "for speaking," 4 "for viewing live and" 5 "for drawing a lottery; the identification "a" may also be used to indicate check-in, "b" to indicate viewing video, "c" to indicate speaking, "d" to indicate viewing live and "e" to indicate drawing a lottery. Embodiments of the present invention are not limited to a particular form of activity identification.

In one embodiment, the time information may include: absolute time, time interval, or information obtained by normalizing the time interval. Wherein the time interval represents an interval between a time when the user is engaged in a first activity and a time when the user is engaged in a second activity, the first activity being: the activity included in the behavior data identifies a corresponding activity, and the second activity is: the user has recently engaged in an activity that was introduced by the application prior to engaging in the first activity.

The absolute time may be an absolute time represented by a time stamp, or may be an actual time, and the time stamp may be a millisecond time stamp or a second time stamp, or may be a time stamp of another time unit.

For example, the acquired behavior data may include: sign in @1567679287000, watch video @1567679317000, watch video @1567679347000, watch video @1567679377000, lottery @1567679407000; wherein the "@" symbol is preceded by an activity in which the user participates, and the "@" symbol is followed by time information indicating the time in which the user participates, the time information being absolute time indicated by a millisecond time stamp, the individual activities in which the user participates being used "," separated.

S120: the order in which the user participates in each activity deduced by the application is obtained.

In one embodiment, when the time information is absolute time, the electronic device may determine the order of the activities deduced by the user participating in the application according to the order of the time information.

In another embodiment, when the time information is a time interval or information obtained by normalizing the time interval, the electronic device may obtain, from other devices, an order of each activity deduced by the user participating in the application program, or may obtain, from a local storage, an order of each activity deduced by the user participating in the application program, where the order of each activity deduced by the user participating in the application program is stored in the other devices.

S130: according to the sequence of each activity deduced by the user participating application program, analyzing activity identifications included in each behavior data and time intervals of two adjacent activities participated by the user, determining the behavior rule of the activity deduced by the user participating application program, and detecting whether the user is an abnormal user according to the behavior rule.

In step S130, the time interval between two adjacent participation activities of the user is determined according to the time information included in each behavior data.

In one embodiment, when the time information included in each behavior data is absolute time, the time interval between two neighboring participation activities of the user may be determined as follows: and determining the time difference of the time information included in the two behavior data generated in the process of the two adjacent user participation activities as the time interval of the two adjacent user participation activities.

In another embodiment, when the time information included in each behavior data is a time interval or information obtained by normalizing the time interval, the time interval between two adjacent activities of the user may be determined in the following manner: and determining time information included in the behavior data generated in the process of participating in the activity by the user as the time interval of two adjacent times of participating in the activity by the user.

In a specific embodiment, when the time information included in each behavior data is the information obtained after the normalization processing, the determined time interval between two adjacent activities of the user is also the information after the normalization processing.

The user detection method provided by the embodiment of the invention detects whether the user is an abnormal user according to the behavior rule of the activities deduced by the user participation application program, and the behavior rule is obtained by analyzing each activity identifier and the time interval of two adjacent activities of the user according to the sequence of the user participation in each activity, so that the difference between the behavior rule of the abnormal user participation activity and the behavior rule of the normal user participation activity is usually large, whether the user is the abnormal user is detected through the behavior rule of the user participation activity, the abnormal user is not easy to bypass the detection, and the detection accuracy is improved. In addition, the user detection method provided by the embodiment of the invention has strong universality and can be suitable for more application programs.

In one embodiment, as shown in fig. 2, in step S130, the following steps S131 to S133 may be used to determine the behavior rules of the user participating in the activity deduced by the application program:

S131: for each behavior data, a behavior vector is obtained that contains an activity identification and time information that the behavior data includes.

For example, when each behavior data acquired in step S110 is: when 1@15676797000, 2@1567679317000, 2@15676793497000, 2@1567679377000,5@1567679407000, wherein 1 represents a check-in, 2 represents a viewing video, 5 represents a lottery, and the action vectors corresponding to the action data can be respectively: (1,1567679287000), (2,1567679317000), (2,1567679347000), (2,1567679377000), (5,1567679407000).

S132: behavior sequence data including behavior vectors arranged in the order in which the user participates in the activities deduced by the application program is obtained.

Since the behavior data are data generated during the respective activities deduced by the user participation application program, each of the behavior data corresponds to one of the activities attended by the user, and each of the behavior vectors corresponds to one of the activities attended by the user, the behavior vectors can be arranged in the order of the respective activities attended by the user when the behavior vectors are ordered.

For each of the behavior vectors listed in step S131, the obtained behavior sequence data may be: (1,1567679287000), (2,1567679317000), (2,1567679347000), (2,1567679377000), (5,1567679407000).

S133: and analyzing the behavior sequence data to determine the behavior rule of the user participating in the activity deduced by the application program.

In one embodiment, the electronic device may analyze an order corresponding to the activity identifier included in each of the behavior vectors in the behavior sequence data, and analyze a relationship between time information included in each of the behavior vectors in the behavior sequence data and time information included in a last one of the behavior vectors in the behavior sequence data, to obtain an analysis result, and determine, according to the obtained analysis result, a behavior rule of the user participating in the activity deduced by the application program.

In one embodiment, the electronic device may fuse each behavior vector in the behavior sequence data according to the above sequence to obtain a fusion vector, and determine, according to the fusion vector, a behavior rule of the user participating in the activity deduced by the application program. In another embodiment, for each behavior vector in the behavior sequence data, the electronic device may establish a logical relationship between elements included in the behavior vector to obtain a logical behavior vector, fuse each logical behavior vector according to the above sequence to obtain a fused vector, and determine, according to the fused vector, a behavior rule of the user participating in the activity deduced by the application program.

In other embodiments, the electronic device may also analyze a difference between an order corresponding to the activity identifier included in each behavior vector in the behavior sequence data and a preset order, and analyze a relationship between time information included in each behavior vector in the behavior sequence data and time information included in a last behavior vector of the behavior vector in the behavior sequence data, to obtain an analysis result, and determine, according to the obtained analysis result, a behavior rule of the user participating in the activity deduced by the application program.

The electronic device may also perform other analysis on the behavior sequence data to determine a behavior rule of the user engaged in the activity deduced by the application.

The behavior rules determined in step S133 may be behavior rules expressed in a vector form.

According to the method and the device, the behavior sequence data are analyzed to determine the behavior rules of the activities deduced by the user participating in the application program, so that the electronic equipment can analyze the behavior rules of the user participating in the activities more conveniently, and the electronic equipment can detect the user more conveniently.

In one embodiment, in step S130, the following steps a to C may be used to determine the behavior rules of the user participating in the activity deduced by the application program:

Step A: and using each information fusion layer included in the pre-trained detection model to fuse the activity identification and the preset time interval included in the first data generated in the first activity process participated by the user.

As shown in fig. 3, the pre-trained detection model may include two information fusion layers. The pre-trained detection model may also include other numbers of information fusion layers, for example, 3 or 4 information fusion layers, and the number of information fusion layers is not specifically limited in the embodiment of the present invention.

As shown in fig. 4, in step a, the input of the first information fusion layer may include: the first row of data includes an activity identifier and a preset time interval, and the input of other information fusion layers may include: and outputting the last information fusion layer.

In fig. 4, (0,1,0,0,0,0,1) is the first row of data, "0,1, 0" represents the active flag, and "1" represents the preset time interval.

The first behavior data is data generated during the first activity of the user, and since the user does not have an activity to participate before participating in the first activity, a time interval corresponding to the first behavior data cannot be determined according to the time of the user participating in the first activity and the time of the user participating in the activity before participating in the first activity, and therefore the time interval corresponding to the first activity identifier may be a preset time interval. The preset time interval may be determined according to the preset time period, for example, when the preset time period is one day, the preset time interval corresponding to the 1 st activity identifier may be 86400000 ms, that is, one day.

The information fusion layer may be a neural network layer, for example, a Long Short-Term Memory (LSTM) layer, and the information fusion layer may also be another network layer for information fusion. The number of hidden nodes of the LSTM layer may be 32, and the number of hidden nodes of the LSTM layer may also be other numbers, which is not specifically limited in the embodiment of the present invention.

And (B) step (B): and according to the sequence of each activity deduced by the user participating in the application program, using each information fusion layer included in the pre-trained detection model to fuse the activity identifier included in the second behavior data generated in the process of the user participating in other activities and the time interval corresponding to the activity identifier.

As shown in fig. 4, in step B, the input of the first information fusion layer includes: the second behavior data comprises an activity identifier, a time interval corresponding to the activity identifier and output of information fusion carried out last time on the information fusion layer, and the input of other information fusion layers comprises: the information fusion layer outputs information fusion last time and the information fusion layer outputs last time, and the time interval corresponding to the activity identifier represents the time interval between the time when the user participates in the activity corresponding to the activity identifier and the time when the user participates in the last activity.

The other activities mentioned above refer to activities other than the first among the activities that the user participates in the respective activities proposed by the application. In fig. 4, (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,0,0,0,1,0.69) are other behavior data, "0,0,1,0,0,0" for (0,0,1,0,0,0,0.69), "0.69" for the activity flag, and "0.69" for (0,0,0,0,0,1,0.69), "0,0,0,0,0,1 for the activity flag. As shown in fig. 4, the four behavior data of (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,0,0,0,1,0.69) are, in order: behavior data generated by a user engaged in a second activity, behavior data generated by a user engaged in a third activity, behavior data generated by a user engaged in a fourth activity, and behavior data generated by a user engaged in a fifth activity. And for the four behavior data, using each information fusion layer included in the pre-trained detection model to sequentially fuse information of the first behavior data, the second behavior data, the third behavior data and the fourth behavior data in the four behavior data.

Step C: and determining the behavior rule of the user participating in the activity deduced by the application program according to the last information fusion output of each information fusion layer.

As shown in fig. 4, the behavior rule of the user participating in the activity deduced by the application program may be determined according to the output of the fusion performed by the first information fusion layer and the second information fusion layer for the fifth time.

According to the method and the device, the behavior rules of the activities deduced by the user participating in the application program are determined by utilizing the information fusion layers included in the pre-trained detection model, and the behavior rules of the activities deduced by the user participating in the application program can be determined more quickly and accurately, so that the accuracy and the efficiency of user detection are higher.

In one embodiment, as shown in fig. 3, the detection model may further include an information association layer.

Before step a, the above method may further include the following steps D to E:

step D: and establishing a logic relationship between an activity identifier included in first data generated in the process of participating in the first activity by the user and a preset time interval by using an information association layer included in a pre-trained detection model, and obtaining an information association result corresponding to the activity identifier included in the first data.

As shown in fig. 5, in step D, the input of the information-associating layer may include: the first row of data includes an activity flag and a preset time interval.

In fig. 5, (0,1,0,0,0,0,1) is the first row of data, "0,1, 0" represents the active flag, and "1" represents the preset time interval. For (0,1,0,0,0,0,1), information association is performed on "0,1, 0" and "1" using an information association layer.

Step E: and establishing a logic relationship between an activity identifier included in second behavior data generated in the process of participating in other activities by the user and a time interval corresponding to the activity identifier by using an information association layer included in a pre-trained detection model, and obtaining an information association result corresponding to the activity identifier included in the second behavior data.

As shown in fig. 5, in step E, the input of the information-associating layer may include: the second behavior data includes an activity identifier and a time interval corresponding to the activity identifier.

In fig. 5, (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,1,0,0,0,0.69), (0,0,0,0,0,1,0.69) are second behavior data, "0,0,1,0,0,0" for (0,0,1,0,0,0,0.69), "0.69" for the activity flag, and "0,0,0,0,0,1" for (0,0,0,0,0,1,0.69), "0.69" for the activity flag. As shown in fig. 4, for each (0,0,1,0,0,0,0.69), the information association layer is used to information associate "0,0,1,0,0,0" with "0.69", and for (0,0,0,0,0,1,0.69), the information association layer is used to information associate "0,0,0,0,0,1" with "0.69".

Step a may be implemented as follows: and carrying out information fusion on the information association results corresponding to the activity identifications included in the first row of data by using each information fusion layer included in the pre-trained detection model.

As shown in fig. 5, the input of the first information fusion layer may include: the first row of data comprises information association results corresponding to the activity identifications. In fig. 5, the input of the first information fusion layer may include: and (5) using an information association layer to associate the information of 0,1,0,0,0,0 and 1 in the information (0,1,0,0,0,0,1).

Step B may be implemented as follows: and according to the sequence of each activity deduced by the user participating in the application program, using each information fusion layer included in the pre-trained detection model to fuse information of the information association results corresponding to the activity identifiers included in the second behavior data.

As shown in fig. 5, the input of the first information fusion layer includes: and outputting information fusion last time by the information fusion layer according to an information association result corresponding to the activity identifier included in the second behavior data. In fig. 5, the second, third and fourth inputs of the first information fusion layer for information fusion may include: the information association layer obtains an information association result after information association is performed on "0,0,1,0,0,0" and "0.69" in the information association layer (0,0,1,0,0,0,0.69), and the input of the information fusion performed by the first information fusion layer for the fifth time may include: information association layer performs information association on "0,0,0,0,0,1" and "0.69" in (0,0,0,0,0,1,0.69) to obtain information association results.

The information-related layer may be a fully-connected neural network layer, for example, the information-related layer may be a dense layer, where the dense layer is a commonly-used fully-connected neural network layer. The information association layer may be another network layer that associates features or information, and the number of hidden layer nodes of the information association layer may be 64 or another number. When the above-mentioned action vector is obtained, the dense layer can change the above-mentioned action vector into dense vector so as to implement the logical relationship between the activity identification and the time interval of two adjacent participations of user.

In one embodiment, the training process of the detection model may include the following steps F to J:

step F: sample behavior data of a sample user carrying detection results is obtained.

The sample behavior data includes: an activity identity of the sample user engaged in the activity and time information representing the sample user engaged in the activity.

Step G: the order in which the sample user participates in each activity deduced by the application is obtained.

Step H: and D, inputting the sequence acquired in the step J, the activity identification included in the data of each sample row and the time interval of the sample user for participating in the activity twice adjacently into a model to be trained, and obtaining a prediction result of the sample user.

The time interval between two adjacent participation activities of the sample user is determined according to the time information included in the data of each sample row.

Step I: and adjusting parameters of the model to be trained according to the difference between the prediction result and the detection result and based on the principle of reducing the difference.

Step J: and when the prediction accuracy of the model to be trained after the parameters are adjusted is higher than the preset accuracy, determining the model to be trained after the parameters are adjusted as a detection model.

In one embodiment, when the time information is: when the user participates in the absolute time of the activity, as shown in fig. 6, the above method may further include the following steps S140 to S150 before step S130.

S140: and calculating the time interval corresponding to the activity identifier included in each behavior data according to the absolute time included in each behavior data.

For example, for five pieces of behavior data (1,1567679287000), (2,1567679317000), (2,1567679347000), (2, 1567679377000), (5,1567679407000), among the pieces of behavior data, "preceding the activity identifier," succeeding the time information, "the time interval corresponding to each activity identifier is 86400000, 30000, 3000, 30000, respectively, and the units of the time information and the time interval are milliseconds. Wherein 86400000 indicates that the behavior data corresponding to the time interval is behavior data generated when the user participates in the first activity among the activities proposed by the application.

S150: and carrying out normalization processing on each time interval to obtain processed information.

In a specific embodiment, step S150 may be implemented as follows:

substituting each time interval into a normalization formula, and determining the output result of the normalization formula as processed information. Wherein the normalization formula is the following expression:

in the above, X _scale The processed information is represented, and X represents a time interval in which normalization processing is not performed.

In step S130, the following behavior rules of the activities deduced by the user participating in the application may be determined according to step S134:

s134: and analyzing the activity identifications included in the behavior data and the processed information corresponding to the activity identifications according to the sequence of the activities deduced by the user participating in the application program, and determining the behavior rules of the activities deduced by the user participating in the application program.

Since the calculated time interval value is usually larger, after normalization processing is performed on the time interval, the processed information can be located in the interval of [0,1], so that the behavior rule of the user can be determined more quickly, and user detection can be performed more quickly and efficiently.

In one embodiment, the activity identifier may be a digital number.

Prior to step S130, the above method may further include the steps of: and carrying out single-heat coding treatment on the movable mark to obtain a coded mark.

For example, the coded identifiers obtained by performing the single-heat coding treatment on the active identifiers "1", "2" and "5" are respectively: "0,1,0,0,0,0", "0,0,1,0,0,0", "0,0,0,0,0,1".

Step S130 may be implemented as follows:

and analyzing each coded identifier and the time interval between two adjacent activities of the user according to the sequence of each activity deduced by the user participating in the application program, and determining the behavior rule of the user participating in the activity deduced by the application program.

After the activity identification is subjected to the single-heat coding treatment, the detection of the user is facilitated.

In one embodiment, in step S130, whether the user is an abnormal user may be detected as follows:

and carrying out numerical processing on the behavior rules of the activities deduced by the user participating in the application program by using a numerical function included in the pre-trained detection model to obtain a predicted value, and determining whether the user is an abnormal user according to the obtained predicted value.

The numerical processing function can be a normalized exponential function, namely a Softmax function, and the behavior rule is processed by the Softmax function to obtain a predicted value of 0-1, so that the user can be more conveniently detected according to the predicted value.

After the behavior rules are subjected to numerical processing, the method is more convenient for detecting the user.

The embodiment of the invention also provides a user detection device, as shown in fig. 7, which comprises:

a data acquisition unit 710, configured to acquire behavior data generated during an event deduced by the user participating in the application program; wherein the behavior data comprises: an activity identifier of an activity in which the user participates, and time information indicating a time at which the user participates in the activity;

a sequence acquiring unit 720, configured to acquire a sequence of each activity deduced by the user participating in the application program;

and the user detection unit 730 is configured to analyze, according to the sequence, an activity identifier included in each behavior data and a time interval between two adjacent activities of the user, determine a behavior rule of the user participating in the activity deduced by the application program, and detect whether the user is an abnormal user according to the behavior rule, where the time interval between two adjacent activities of the user is determined according to time information included in each behavior data.

The user detection device provided by the embodiment of the invention detects whether the user is an abnormal user according to the behavior rule of the activities deduced by the user participation application program, and the behavior rule is obtained by analyzing each activity identifier and the time interval of two adjacent activities of the user according to the sequence of the user participation in each activity, so that the difference between the behavior rule of the abnormal user participation activity and the behavior rule of the normal user participation activity is usually large, whether the user is the abnormal user is detected through the behavior rule of the user participation activity, the abnormal user is not easy to bypass the detection, and the detection accuracy is improved. In addition, the user detection method provided by the embodiment of the invention has strong universality and can be suitable for more application programs.

In one embodiment, the user detection unit 730 may include:

In one embodiment, the detection model may further include an information correlation layer;

the user detection unit 730 may further include:

The first information fusion subunit is specifically configured to:

In one embodiment, the time information may include: absolute time, time interval or information obtained by normalizing the time interval, wherein the time interval represents an interval between a time when a user participates in a first activity and a time when the user participates in a second activity, and the first activity is: the activity identifier included in the behavior data corresponds to an activity, and the second activity is: an activity proposed by an application that the user last participated in before participating in the first activity.

In one embodiment, the time information includes: in the case of the said absolute time, the time of day,

the apparatus further comprises:

the user detection unit is specifically configured to:

The embodiment of the invention also provides an electronic device, as shown in fig. 8, comprising a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802 and the memory 803 complete communication with each other through the communication bus 804,

a memory 803 for storing a computer program;

the processor 801 is configured to implement the user detection method provided in any one of the above when executing the program stored in the memory 803.

The communication bus mentioned in the above-mentioned electronic device may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, or the like. The communication bus may be classified as an address bus, a data bus, a control bus, or the like. For ease of illustration, the figures are shown with only one bold line, but not with only one bus or one type of bus.

The communication interface is used for communication between the electronic device and other devices.

The Memory may include random access Memory (Random Access Memory, RAM) or may include Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.

The processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but also digital signal processors (Digital Signal Processing, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

When the electronic equipment provided by the embodiment of the invention is used for detecting the user, whether the user is an abnormal user is detected according to the behavior rule of the activities deduced by the user participation application program, and the behavior rule is obtained by analyzing each activity identifier and the time interval of two adjacent activities of the user according to the sequence of the user participation in each activity, so that the difference between the behavior rule of the abnormal user participation in the activities and the behavior rule of the normal user participation in the activities is usually larger, the behavior rule of the user participation in the activities is used for detecting whether the user is the abnormal user, the abnormal user is not easy to bypass the detection, and the detection accuracy is improved. In addition, the user detection method provided by the embodiment of the invention has strong universality and can be suitable for more application programs.

An embodiment of the present invention provides a computer-readable storage medium having stored therein a computer program which, when executed by a processor, implements the user detection method provided in any one of the above.

Embodiments of the present invention also provide a computer program product comprising instructions which, when run on a computer, cause the computer to perform the user detection method provided in any one of the above.

For the apparatus/electronic device/storage medium/program product embodiments, the description is relatively simple as it is substantially similar to the method embodiments, and reference is made to the description of the method embodiments for relevant points.

It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The foregoing description is only of the preferred embodiments of the present invention and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method of user detection, the method comprising:

according to the sequence, analyzing an activity identifier included in each behavior data and time intervals of two adjacent times of activities of a user, determining a behavior rule of the user participating in the activity deduced by the application program, and detecting whether the user is an abnormal user according to the behavior rule, wherein the time intervals of two adjacent times of activities of the user are determined according to time information included in each behavior data;

2. The method of claim 1, wherein the detection model further comprises an information correlation layer;

3. The method according to any one of claims 1 to 2, wherein the time information comprises: absolute time, time interval or information obtained by normalizing the time interval, wherein the time interval represents an interval between a time when a user participates in a first activity and a time when the user participates in a second activity, and the first activity is: the activity identifier included in the behavior data corresponds to an activity, and the second activity is: an activity proposed by an application that the user last participated in before participating in the first activity.

4. A method according to claim 3, wherein the time information comprises: when the absolute time is, before the activity identification included in each behavior data and the time interval between two adjacent activities of the user are analyzed according to the sequence to determine the behavior rule of the user participating in the activity deduced by the application program, the method further comprises:

normalizing each time interval to obtain processed information;

5. A user detection device, the device comprising:

the user detection unit is used for analyzing the activity identifications included in the behavior data and the time intervals of the adjacent two activities of the user according to the sequence, determining the behavior rule of the user participating in the activity deduced by the application program, and detecting whether the user is an abnormal user according to the behavior rule, wherein the time intervals of the adjacent two activities of the user are determined according to the time information included in the behavior data;

The user detection unit includes:

6. The apparatus of claim 5, wherein the detection model further comprises an information correlation layer;

the user detection unit further includes:

The first information fusion subunit is specifically configured to:

7. The apparatus according to any one of claims 5 to 6, wherein the time information comprises: absolute time, time interval or information obtained by normalizing the time interval, wherein the time interval represents an interval between a time when a user participates in a first activity and a time when the user participates in a second activity, and the first activity is: the activity identifier included in the behavior data corresponds to an activity, and the second activity is: an activity proposed by an application that the user last participated in before participating in the first activity.

8. The apparatus of claim 7, wherein the time information comprises: in the case of the said absolute time, the time of day,

the apparatus further comprises:

the user detection unit is specifically configured to:

9. An electronic device comprising a processor, a communication interface, a memory, and a communication bus;

the memory is used for storing a computer program;

the processor, when configured to execute the program stored in the memory, implements the user detection method according to any one of claims 1 to 4.