CN111586001A - Abnormal user identification method, device, electronic device and storage medium - Google Patents

Abstract

Embodiments of the present invention provide an abnormal user identification method, device, electronic device, and storage medium; the method includes: an initial grouping step, determining a central user from target users according to the similarity between target users, and The target users are initially grouped according to the similarity between users other than the central user; the grouping adjustment step is to re-determine the central user according to the similarity between the users in the initial grouping, and according to the re-determined central user and the target The similarity between the users except the re-determined central user is to regroup the target users; the grouping step is determined, and the grouping adjustment step is repeated until the users included in each group no longer change; the abnormal user identification step, according to The number of known abnormal users included in each group determines the abnormal group, and the users in the abnormal group are determined as abnormal users.

Description

Abnormal user identification method, device, electronic device and storage medium

technical field

The invention relates to the field of network security, and in particular, to an abnormal user identification method, device, electronic device and storage medium.

Background technique

Abnormal login refers to the login behavior that is significantly different from the user's daily habits. Since abnormal login is a common phenomenon of network intrusion behavior, users with abnormal login behavior are likely to be the perpetrators of network intrusion behavior, so the identification of abnormal login users is of great significance in the field of network security.

In the prior art, an abnormally logged-in user is usually found according to the number of times the user has logged in, the IP address used for logging in, and the device used for logging in. However, when network attackers use scattered IPs or simulated devices to implement login behaviors, it is difficult for the abnormal login user identification methods in the prior art to find abnormal users.

To sum up, the method for identifying abnormal logged-in users in the prior art is difficult to find hidden abnormal users, and the efficiency of finding abnormal users is low.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide an abnormal user identification method, device, electronic device, and storage medium, which are used to solve the problem that the abnormal login user identification method in the prior art is difficult to find hidden abnormal users, and the efficiency of finding abnormal users is low. .

The embodiment of the first aspect of the present invention provides a method for identifying abnormal users, including:

In the initial grouping step, the central user is determined from the target users according to the similarity between the target users, and all the target users are classified according to the similarity between the central user and the target users except the central user. The target users are initially grouped;

The grouping adjustment step is to re-determine the central user according to the similarity between the users in the initial group, and according to the re-determined central user and the target user except the re-determined central user The target users are grouped again according to the similarity between the users;

Determine the grouping step, and repeat the grouping adjustment step until the users included in each group no longer change;

In the abnormal user identification step, an abnormal group is determined according to the number of known abnormal users included in each group, and the users in the abnormal group are determined as abnormal users.

In the above technical solution, the similarity between the target users is the sum of the similarity between any one of the target users and all the target users except the one user.

In the above technical solution, before the initial grouping step, it also includes:

Calculate the similarity between any one of the target users and one of the target users other than the one user, where the similarity includes one or more of the following similarities: Similarity in time dimension, similarity on user login platform and similarity on user login device;

Sum the similarity between any one of the target users and all the target users except the one user, and obtain any one of the target users and the target user The sum of the similarity between all users except the one user in .

In the above technical solution, determining the central user from the target users according to the similarity between the target users includes:

Determine the first user according to the maximum similarity between the target users;

determining the first user as a central user;

Determine the second user according to the minimum similarity between the non-central users among the target users and the central users and a preset first threshold;

Determine the second user as the new central user, and return to determine the second user according to the minimum similarity between the non-central user among the target users and the central user and a preset first threshold The steps are repeated until the number of the central users reaches a preset number threshold.

In the above technical solution, determining the second user according to the minimum similarity between the non-central users of the target user and the central user and a preset first threshold includes:

Calculate the minimum similarity between the non-central users of the target user and the central users;

When the sum of the minimum similarity between the top n non-central users in the target users and the central user is less than the first threshold, and the top n+1 non-central users in the target users and the central user When the sum of the minimum similarity between central users is not less than the first threshold, the n+1th non-central user is determined as the second user;

Wherein, the first threshold is a random value between 0 and the sum of the first similarity, and the sum of the first similarity is the similarity between all non-central users in the target users and the central user Sum of minimum values; n is a natural number.

In the above technical solution, the calculating the similarity between any one of the target users and one user other than the one user in the target users includes:

Calculate the degree of difference between the third user and the fourth user according to the login record of the third user and the login record of the fourth user;

Wherein, the third user is any user among the target users, and the fourth user is a user other than the any user among the target users;

Calculate the similarity between the third user and the fourth user according to the difference between the third user and the fourth user.

In the above technical solution, the following formula is used to calculate the degree of difference between the third user and the fourth user according to the login record of the third user and the login record of the fourth user:

Wherein, d(i,j) represents the degree of difference between the third user and the fourth user;

When the similarity includes the similarity in the time dimension, the parameter H _i represents the records logged in by the third user i in the first time period; H _j represents the records logged in by the fourth user j in the first time period;

When the similarity includes the similarity on the user login platform, the parameter H _i represents the record that the third user i logs in on the first platform; H _j represents the record that the fourth user j logs in on the first platform;

When the similarity includes the similarity on the user's login device, the parameter H _i represents the record of the third user i's login on the first device; H _j represents the record of the fourth user j's login on the first device;

The following formula is used to calculate the similarity between the third user and the fourth user according to the difference between the third user and the fourth user:

Wherein, sim(i,j) represents the similarity between the third user and the fourth user.

The embodiment of the second aspect of the present invention provides an abnormal user identification device, including:

A preliminary grouping module, configured to determine a central user from the target users according to the similarity between the target users, and according to the similarity between the central user and the target users other than the central user initial grouping of the target users;

A grouping adjustment module, configured to re-determine the central user according to the similarity between the users in the initial group, and divide the re-determined central user according to the re-determined central user and the target user The target users are grouped again by the similarity between other users;

determining a grouping module for repeating the grouping adjustment step until the users included in each group no longer change;

The abnormal user identification module is used to determine abnormal groups according to the number of known abnormal users included in each group, and determine the users in the abnormal groups as abnormal users.

An embodiment of a third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the embodiment of the first aspect The steps of the abnormal user identification method.

A fourth aspect of the present invention provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the abnormal user identification method described in the first aspect.

The abnormal user identification method, device, electronic device, and storage medium provided by the embodiments of the present invention realize user clustering through the similarity between users. The user finds out the group in which the abnormal user belongs, so as to discover more hidden abnormal users, which has the advantages of high identification efficiency and strong identification ability.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a flowchart of a method for identifying abnormal users provided by an embodiment of the present invention;

2 is a structural diagram of an abnormal user identification device provided by an embodiment of the present invention;

FIG. 3 illustrates a schematic diagram of the physical structure of an electronic device.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a flowchart of a method for identifying an abnormal user provided by an embodiment of the present invention. As shown in FIG. 1 , the method for identifying an abnormal user provided by an embodiment of the present invention includes:

Step 101: Determine a central user from the target users according to the similarity between the target users, and classify the central user according to the similarity between the central user and the target users other than the central user. Target users are initially grouped.

The basic idea of the method for identifying abnormal users provided by the embodiments of the present invention is based on the fact that abnormal users have similar behavioral trajectories, so that the abnormal users that have been discovered are used to discover more hidden abnormal users. Based on this idea, the data of multiple target users are first collected. Some of the multiple target users have been identified as abnormal users, for example, using the prior art method for identifying abnormal users based on the number of user logins, the IP address used for login, or the device used for login. However, most of these target users failed to identify their identities. They may be normal users or hidden abnormal users.

Before calculating the similarity of target users, the data of target users should be collected first. The collected data of the multiple target users includes the login logs of the target users. The login log generally contains a large number of behavior records of the target user, such as the login time of the target user, the login platform of the target user, and the device used by the target user when logging in. The data of the target user may also include the identity annotation information of the target user. For example, abnormal users who have been identified may be marked in their identity annotation information.

These target users can form a user set. Any target user in the set can calculate the similarity with other single target users in the set. Similarity metric between users. The similarity index reflects the overall similarity relationship between one user and multiple other target users. In this embodiment of the present invention, the similarity index is the sum of the similarities. In other embodiments of the present invention, the similarity index may also be other expressions such as the sum of squares of the similarity.

In the embodiment of the present invention, the similarity between a target user and other single target users in the set is added, and the similarity between the target user and all other target users in the set except the target user is obtained. and. In this embodiment of the present invention, the similarity calculation method between users is not limited, and a similarity calculation method known to those skilled in the art may be used, or a similarity calculation method described in another embodiment of the present invention may be used. In this embodiment of the present invention, the time point of similarity calculation is also not limited, and similarity calculation may be completed in advance before the execution of this step, or may be completed in real time during the execution of this step.

Based on the sum of the degrees of similarity between any one of the multiple target users and all other target users, multiple grouped central users may be determined from the multiple target users.

The number of the multiple groups may be determined according to the actual situation, such as the number of target users.

When determining the central users of multiple groups, first select the target user with the highest similarity with other target users among all the target users as the central user C1 of the first group. The resulting C1 can be added to the grouping center set.

Then, the target user with greater similarity with C1 is selected as the center C2 of another group. When selecting C2, if the target user with the greatest similarity to C1 is selected, it may be affected by noise due to outlier users, so the user with greater similarity to C1 is selected as C2. The selection process of the user with high similarity here is: take a random value, which is greater than 0 and less than the sum of the similarity between the central user C1 and all other target users; After the similarity between each single target user other than C1 and C1, these similarities are added. During the addition process, the sum of the similarities of the current n target users is less than the aforementioned random value, and the n+1th The sum of the similarity of the target users is greater than the aforementioned random value, then the n+1th target user is C2. The resulting C2 can be added to the grouping center set. where n is a positive integer.

Next, calculate the sum of the similarity between all target users except C1 and C2 and the grouping center set (when C2 was obtained before, calculating the sum of the similarity between all target users and C1 can be regarded as calculating all targets The sum of the similarity of the user to the grouping center set including only C1). At this time, the grouping center set includes two users, C1 and C2, but the grouping center set is regarded as a whole, and only one value needs to be calculated when calculating the similarity between another target user and the grouping center set. This value takes the minimum value of the similarity between another target user and each grouping center user in the grouping center set, that is: when calculating the similarity between a target user and the grouping center set, calculate the similarity between the target user and C1 and C2 respectively. similarity, and then take the smaller similarity value as the similarity between the target user and the grouping center set.

After calculating the similarity between all target users except C1 and C2 and the grouping center set, another random value can be generated according to the sum of the similarity, the random value is greater than 0 and less than except C1 and C2. The sum of the similarity between all remaining target users and the grouping center set. Then, the similarity between all the remaining target users except C1 and C2 and the grouping center set is added. The sum of the similarity of users is greater than the other random value mentioned above, then the n+1th target user is C3. The resulting C3 can be added to the grouping center set.

According to the above method, new grouping centers are continuously selected until the number of grouping centers reaches K, where K is the number of groups to be grouped.

After obtaining the central users of multiple groups, calculate the similarity between the target users who are not identified as the central users of the grouping and the central users of each group, and assign the target users to the group where the central user of the grouping with the highest similarity is located. . The grouping obtained here is the initial grouping.

Step 102: Re-determine the center user according to the similarity between the users in the initial group, and determine the center user according to the re-determined center user and the target user except the re-determined center user. The similarity between users regroups the target users.

Step 103: Repeat step 102 until the users included in each group no longer change.

After assigning target users to each group, the target users may not be the best match with the group they belong to. Therefore, it is necessary to adjust the users included in the group.

During adjustment, the central users of each group are first re-determined. In this embodiment of the present invention, the sum of the similarities between the target user and all other target users in the group is calculated, and the target user with the largest sum of the similarities is determined as the new central user of the group.

After re-determining the center users of each group, calculate the similarity between the target users who are not identified as group center users and the new center users of each group, and assign the target users to the group center user with the highest similarity. in grouping.

The above process of adjusting the target users included in a group needs to be performed iteratively until the users included in each group no longer change.

Step 104: Determine an abnormal group according to the number of known abnormal users included in each group, and determine the users in the abnormal group as abnormal users.

As mentioned above, when acquiring basic information of users, some users have been identified as abnormal users. Therefore, after the users included in each group are finally determined, the number of known abnormal users in each group can be obtained.

Given that abnormal users have similar behavior trajectories, a group whose number of abnormal users in a group is higher than the abnormal judgment threshold can be determined as an abnormal user group, and the users in this abnormal user group are determined as abnormal users. It can be seen from the description of this step that hidden abnormal users in the abnormal user group that have not been identified by other abnormal identification methods can be found by the method provided by the embodiment of the present invention.

In a group, after knowing the number of abnormal users or their proportion in the group, compare the number or proportion with the abnormal judgment threshold. If it is higher than the abnormal judgment threshold, the group is an abnormal group, and the users in the group are abnormal. for abnormal users.

The abnormality determination threshold may be a specific numerical value or a proportional value, and the specific value should be determined according to the actual application.

The abnormal user identification method provided by the embodiment of the present invention realizes the clustering of users through the similarity between target users, and based on the characteristic that abnormal users have similar behavioral trajectories, the abnormal users that have been discovered are used to find out the group where the abnormal users belong. , so as to find more hidden abnormal users, which has the advantages of high recognition efficiency and strong recognition ability.

Based on any of the foregoing embodiments, in this embodiment of the present invention, before step 101, the method further includes:

Calculate the similarity between any one of the target users and one of the target users other than the one user, where the similarity includes one or more of the following similarities: Similarity in time dimension, similarity on user login platform and similarity on user login device;

Sum the similarity between any one of the target users and all the target users except the one user, and obtain any one of the target users and the target user The sum of the similarity between all users except the one user in .

In this embodiment of the present invention, the similarity index is the sum of the similarities. When calculating the similarity between a user and other single users in the user set, the similarity is calculated from the time dimension, platform dimension, and device dimension. The specific description is as follows.

(1) Similarity in the time dimension

The user's login time may correspond to a discrete set of time periods of uniform length; each of the time periods has a fixed length and is equal. The specific length of the time period can be set as required. The smaller the time period, the more accurate, but the data will be more sparse.

In the embodiment of the present invention, the log-in time is divided into 48 consecutive time series with days as the statistical unit, that is, each time period represents half an hour. Thus, a log-in time set of each user is obtained, and a log-in time set S _it corresponding to user i in the time series is: {S _i1 , S _i2 ,...S _i48 }. Among them, S _it is the record of user i logged in during time period t. If the user logs in, the value corresponding to the vector is 1, otherwise it is 0. It should be noted that the login involved in the embodiment of the present invention is not limited to the time point of the login operation, but also includes all the usage time of the user after login and before logout. Similarly, the check-in time set S _jt of user j at the same time can be obtained: {S _j1 , S _j2 ,...S _j48 }. According to this, the similarity simt of user i and user j in the time dimension can be calculated:

Among them, S _it represents the records logged in by the user i in the time period t; S _jt represents the records logged in by the user j in the time period t.

It can be seen from the above formula that when the difference d between user i and user j is smaller, the user similarity is higher.

(2) Similarity in platform dimension

For the platform where the user logs in, use P _i,p to identify the login behavior of user i on the platform p. When user i has a login behavior on the platform p, the value of P _i,p is 1, and if there is no login behavior, it is 0. According to this, the login platform vectors (P _i1 , P _i2 , . . . , P _im ) corresponding to the user i logging in to m platforms can be obtained. Similarly, the login platform vectors (P _j1 , P _j2 , . . . , P _jm ) corresponding to the user j logging in to the same m platforms can be obtained.

According to this, the similarity simp between user i and user j in the platform dimension can be calculated:

Among them, P _ip represents the record of user i logging in on platform p; P _jp represents the record of user j logging in on platform p.

(3) Similarity in device dimension

For the device where the user logs in, use E _i,s to identify the login behavior of user i on device s. When user i has login behavior on device s, the value of E _i,s is 1, and the value of no login behavior is 0. Then the vector (E _i1 , E _i2 , . . . , E _iw ) of the user i logging in to the device is obtained. Similarly, the login device vectors (E _j1 , E _j2 , . . . , E _jw ) corresponding to the user j logging in to the same w devices can be obtained.

According to this, the similarity sime between user i and user j in the device dimension can be calculated:

Among them, E _is represents the record that user i logs in on device s; E _js represents the record that user j logs in on device s.

It should be noted that, due to the wide variety of devices, the device values in the device dimension are relatively messy, and in the embodiment of the present invention, the device with a large number of users using the device is mainly selected in the existing network. For users using devices with fewer users, the vector's values are all 0s. For users with all 0s, sime=1.

After calculating the similarity in the time dimension, platform dimension, and device dimension, the similarity between users can be calculated. In the embodiment of the present invention, the similarity sim between users is obtained by averaging the similarity in three dimensions, that is, sim=1/3*(simt+simp+sime). In other embodiments of the present invention, certain weights may be respectively set for the similarity of the three dimensions according to actual needs, so as to calculate the similarity between users.

Through the above description, the similarity between one user and another user can be calculated, and by summing the similarity between one user and all other single users, the sum of the similarity between one user and all other users can be obtained.

The abnormal user identification method provided by the embodiment of the present invention obtains the similarity between users by calculating the similarity between users in the three dimensions of time dimension, device dimension, and platform dimension, and uses the similarity between users to realize the similarity between users. Based on the characteristic that abnormal users have similar behavioral trajectories, the abnormal users that have been discovered are used to find out the group of abnormal users, so as to find more hidden abnormal users, which has the advantages of high identification efficiency and strong identification ability.

Based on any of the foregoing embodiments, in this embodiment of the present invention, between step 101 and step 102, the method further includes:

Dimensionality reduction is performed on the information of target users in the initial group.

In the embodiment of the present invention, the dimensionality reduction of the information of the target users in the initial group is implemented in the time dimension.

Since the target users are sparse in the time dimension, after the initial grouping is obtained, a subset is selected for the time period set of the users in the initial grouping.

When selecting a subset, first calculate the information entropy of all users in the initial group in different time periods. The calculation formula of information entropy is as follows:

Among them, e _ti represents the information entropy of all target users in the initial group in the ith time period t; P(u _j ) represents the probability that the target user u _j logs in in the ith time period t. n is the number of all target users in the initial group. P(u _j ) is calculated as:

Total number of target user check-ins/total number of time periods.

Next, after calculating the entropy value of each time period for all target users in the initial group, the time period with the entropy value greater than the threshold a is selected as the login time period of the initial group.

The number of time dimensions can be effectively reduced by obtaining the login time period of the grouping set, for example, dividing a day into 48 time periods in the previous example and reducing it to 24 time periods.

Dimensionality reduction for target user information helps to reduce the computational load of subsequent operations.

In other embodiments of the present invention, after the login time period of the grouping set is calculated, the similarity between the users in the grouping set is calculated in the new login time period. Users whose similarity is greater than threshold b are retained, and users whose similarity is less than or equal to threshold b are regarded as discrete users and eliminated from the grouping set. The excluded discrete users can be regarded as suspected abnormal login users, and other methods in the prior art are used to detect whether they are abnormal users.

The abnormal user identification method provided by the embodiment of the present invention helps to reduce the calculation amount by reducing the dimension of the user information in the initial grouping, and improves the real-time performance of the identification while ensuring the identification effect of hidden abnormal users.

Based on any of the above embodiments, FIG. 2 is a structural diagram of an abnormal user identification device provided by an embodiment of the present invention. As shown in FIG. 2 , the abnormal user identification device provided by the embodiment of the present invention includes:

A preliminary grouping module 201 is configured to determine a central user from the target users according to the similarity between the target users, and according to the similarity between the central user and the target users other than the central user degree to initially group the target users;

The grouping adjustment module 202 is configured to re-determine the center user according to the similarity between the users in the initial group, and divide the re-determined center according to the re-determined center user and the target user The target users are grouped again by the similarity between users other than the users;

determining a grouping module 203, configured to repeatedly execute the grouping adjustment step until the users included in each group no longer change;

The abnormal user identification module 204 is configured to determine abnormal groups according to the number of known abnormal users included in each group, and determine the users in the abnormal groups as abnormal users.

The abnormal user identification device provided by the embodiment of the present invention realizes the clustering of users through the similarity between target users, and based on the characteristic that abnormal users have similar behavioral trajectories, the abnormal users that have been discovered are used to find out the group where the abnormal users belong. , so as to find more hidden abnormal users, which has the advantages of high recognition efficiency and strong recognition ability.

FIG. 3 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 3 , the electronic device may include: a processor (processor) 310, a communication interface (Communications Interface) 320, a memory (memory) 330 and a communication bus 340, The processor 310 , the communication interface 320 , and the memory 330 communicate with each other through the communication bus 340 . The processor 310 may invoke the logic instructions in the memory 330 to perform the following method: an initial grouping step, determining a central user from the target users according to the similarity between the target users, and determining a central user from the target users according to the similarity between the target users, and The target users are initially grouped according to the similarity between the users other than the central user; the grouping adjustment step is to re-determine the central user according to the similarity between the users in the initial grouping, and The target users are grouped again according to the similarity between the re-determined central user and the target users other than the re-determined central user; the grouping step is determined, and the grouping adjustment is performed repeatedly The steps are until the users included in each group do not change; the abnormal user identification step is to determine abnormal groups according to the number of known abnormal users included in each group, and determine the users in the abnormal groups as abnormal users.

It should be noted that the electronic device in this embodiment may be a server, a PC, or other devices during specific implementation, as long as its structure includes the processor 310 and the communication interface 320 as shown in FIG. 3 . , a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340, and the processor 310 can call the logic instructions in the memory 330 to execute the above method. This embodiment does not limit the specific implementation form of the electronic device.

In addition, the above-mentioned logic instructions in the memory 330 may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Further, an embodiment of the present invention discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer During execution, the computer can execute the methods provided by the above method embodiments, for example, including: an initial grouping step, determining a central user from the target users according to the similarity between target users, and The target users are initially grouped according to the similarity between users other than the central user among the target users; the grouping adjustment step is to re-determine the central user according to the similarity between the users in the initial grouping , and group the target users again according to the similarity between the re-determined central user and the target users except the re-determined central user; The grouping adjustment step is performed until the users included in each group do not change; the abnormal user identification step is to determine an abnormal group according to the number of known abnormal users included in each group, and determine the users in the abnormal group as abnormal users.

On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program is implemented when executed by a processor to execute the methods provided by the foregoing embodiments, for example, including: In the initial grouping step, the central user is determined from the target users according to the similarity between the target users, and all the target users are classified according to the similarity between the central user and the target users except the central user. The target users are initially grouped; in the grouping adjustment step, the central user is re-determined according to the similarity between the users in the initial group, and the central user is re-determined according to the difference between the re-determined central user and the target user. The target users are grouped again according to the similarity between users other than the central user; the grouping step is determined, and the grouping adjustment step is repeatedly performed until the users included in each group no longer change; the abnormal user identification step, An abnormal group is determined according to the number of known abnormal users included in each group, and the users in the abnormal group are determined as abnormal users.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. An abnormal user identification method is characterized by comprising the following steps:

an initial grouping step, namely determining a central user from target users according to the similarity between the target users, and performing initial grouping on the target users according to the similarity between the central user and users except the central user in the target users;

a grouping adjustment step, namely re-determining the central user according to the similarity between the users in the initial grouping, and re-grouping the target users according to the similarity between the re-determined central user and the users except the re-determined central user in the target users;

determining grouping, and repeatedly executing the grouping adjustment step until the users contained in each group do not change any more;

and an abnormal user identification step, namely determining abnormal groups according to the number of the known abnormal users contained in each group, and determining the users in the abnormal groups as the abnormal users.

2. The abnormal user identification method according to claim 1, wherein the similarity between the target users is a sum of similarities between any one of the target users and all users except the any one of the target users.

3. The abnormal user identification method according to claim 2, further comprising, before the initial grouping step:

calculating a similarity between any one of the target users and one of the target users other than the any user, the similarity including one or more of the following similarities: similarity in time dimension, similarity on user login platform and similarity on user login device;

summing the similarity between any user in the target users and all users except any user in the target users to obtain the sum of the similarity between any user in the target users and all users except any user in the target users.

4. The abnormal user identification method according to claim 2, wherein the determining a center user from the target users according to the similarity between the target users comprises:

determining a first user according to the maximum similarity between the target users;

determining the first user as a central user;

determining a second user according to a minimum similarity between a non-central user and the central user in the target users and a preset first threshold;

and determining the second user as a new central user, and returning to the step of determining the second user according to the minimum value of the similarity between the non-central user and the central user in the target users and a preset first threshold value, and repeating the steps until the number of the central users reaches a preset number threshold value.

5. The abnormal user identification method according to claim 4, wherein the determining the second user according to the minimum value of the similarity between the non-central user of the target user and the central user and a preset first threshold value comprises:

calculating the minimum similarity between the non-central user of the target user and the central user;

when the sum of the minimum similarity values between the first n non-central users of the target users and the central user is smaller than a first threshold value, and the sum of the minimum similarity values between the first n +1 non-central users of the target users and the central user is not smaller than the first threshold value, determining the n +1 non-central user as the second user;

wherein the first threshold is a random value between 0 and a first similarity sum, and the first similarity sum is a similarity minimum sum between all non-central users in the target users and the central user; n is a positive integer.

6. The abnormal user identification method according to claim 3, wherein the calculating the similarity between any one of the target users and one of the target users other than the any user comprises:

calculating the difference degree between a third user and a fourth user according to the login record of the third user and the login record of the fourth user;

the third user is any user in the target users, and the fourth user is one user except any user in the target users;

and calculating the similarity between the third user and the fourth user according to the difference between the third user and the fourth user.

7. The method for identifying an abnormal user according to claim 6, wherein the calculating the degree of difference between the third user and the fourth user according to the log-in record of the third user and the log-in record of the fourth user adopts the following formula:

wherein d (i, j) represents a degree of difference between the third user and the fourth user;

when the similarity includes a similarity in a time dimension, a parameter H_iA record representing that a third user i logged in within a first time period; h_jA record representing that a fourth user j logged in within a first time period;

when the similarity includes a similarity on a user login platform, a parameter H_iA record representing a third user i logged in on the first platform; h_jA record representing a fourth user j logged in on the first platform;

when the similarity includes a similarity on a user login device, a parameter H_iA record representing that a third user i is logged in on the first device; h_jA record representing a fourth user j logged in on the first device;

the calculating the similarity between the third user and the fourth user according to the difference between the third user and the fourth user adopts the following formula:

wherein sim (i, j) represents a similarity between the third user and the fourth user.

8. An abnormal user identification apparatus, comprising:

the preliminary grouping module is used for determining a central user from the target users according to the similarity between the target users and initially grouping the target users according to the similarity between the central user and the users except the central user in the target users;

a grouping adjustment module, configured to re-determine the central user according to a similarity between users in the initial grouping, and re-group the target users according to a similarity between the re-determined central user and a user other than the re-determined central user among the target users;

a grouping determining module for repeatedly executing the grouping adjusting step until the users contained in each group do not change any more;

and the abnormal user identification module is used for determining abnormal groups according to the number of the known abnormal users contained in each group and determining the users in the abnormal groups as the abnormal users.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor when executing the program performs the steps of the method for abnormal user identification according to any of claims 1 to 7.

10. A non-transitory computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method for abnormal user identification according to any one of claims 1 to 7.

Images