CN112269794A

CN112269794A - Method and equipment for violation prediction based on block chain

Info

Publication number: CN112269794A
Application number: CN202010976560.6A
Authority: CN
Inventors: 陈文涛
Original assignee: Lianshang Xinchang Network Technology Co Ltd
Current assignee: Lianshang Xinchang Network Technology Co Ltd
Priority date: 2020-09-16
Filing date: 2020-09-16
Publication date: 2021-01-26

Abstract

The application aims to provide a method and equipment for violation prediction based on a block chain, and the method and equipment comprise the following steps: sending a model acquisition request to a block chain, and receiving a first violation prediction model returned by the block chain in response to the model acquisition request and first data information corresponding to the first violation prediction model; determining second calibration information corresponding to the incremental data information according to the first calibration information; updating the first violation prediction model according to the incremental data information and the second calibration information; and inputting the target behavior provided by the node into the updated first violation prediction model, and then acquiring violation probability information of the target behavior. According to the method and the device, the accuracy of predicting the violation behaviors through the model can be improved, and meanwhile, the cost of training the model is reduced.

Description

Method and equipment for violation prediction based on block chain

Technical Field

The present application relates to the field of communications, and in particular, to a technique for performing violation prediction based on a block chain.

Background

With the rapid development of the internet, social networks have become an important social part of people's daily life. However, the contraband in social networks is endless and its harm is also increasing. Currently, every company with social products generally detects the prohibited behaviors through machine auditing and manual auditing, the existing mode of sending prohibited contents by social software illegal persons is different day by day, the mode of sending the prohibited contents has a lot of change modes, great difficulty is caused to the daily auditing, and the general auditing can only audit the prohibited behaviors of one user, but cannot detect the condition that a plurality of users are actually a real user, and cannot detect the prohibited behaviors of a group. And the amount of users owned by each company is different, in some cases, except that a large company with a large amount of users can obtain a more accurate result under the detection of a large amount of users, the detection accuracy rate obtained by auditing the users by some small companies is lower.

Disclosure of Invention

An object of the present application is to provide a method and an apparatus for violation prediction based on block chains.

According to an aspect of the present application, there is provided a method for violation prediction based on a block chain, the method including:

sending a model acquisition request to a block chain, and receiving a first violation prediction model returned by the block chain in response to the model acquisition request and first data information corresponding to the first violation prediction model, wherein the first data information comprises first calibration information, a plurality of behavior information and a plurality of content information, and the first calibration information is used for calibrating sample information of each behavior information in the plurality of behavior information and calibrating sample information of each content information in the plurality of content information;

determining second calibration information corresponding to incremental data information according to the first calibration information, wherein the incremental data information belongs to a node corresponding to the network device, the incremental data information comprises a plurality of incremental behavior information and a plurality of incremental content information, and the second calibration information is used for calibrating sample information of each behavior information in the plurality of incremental behavior information and calibrating sample information of each content information in the plurality of incremental content information;

updating the first violation prediction model according to the incremental data information and the second calibration information;

and inputting the target behavior provided by the node into the updated first violation prediction model, and then acquiring violation probability information of the target behavior.

According to an aspect of the present application, there is provided a network device for performing violation prediction based on a block chain, the device including:

a module, configured to send a model acquisition request to a block chain, and receive a first violation prediction model returned by the block chain in response to the model acquisition request and first data information corresponding to the first violation prediction model, where the first data information includes first calibration information, multiple pieces of behavior information, and multiple pieces of content information, and the first calibration information is used to calibrate sample information of each piece of behavior information in the multiple pieces of behavior information and calibrate sample information of each piece of content information in the multiple pieces of content information;

a second module, configured to determine second calibration information corresponding to incremental data information according to the first calibration information, where the incremental data information belongs to a node corresponding to the network device, the incremental data information includes multiple pieces of incremental behavior information and multiple pieces of incremental content information, and the second calibration information is used to calibrate sample information of each piece of behavior information in the multiple pieces of incremental behavior information and calibrate sample information of each piece of content information in the multiple pieces of incremental content information;

a third module, configured to update the first violation prediction model according to the incremental data information and the second calibration information;

and the fourth module is used for inputting the target behavior provided by the node into the updated first violation prediction model and then acquiring violation probability information of the target behavior.

According to an aspect of the present application, there is provided an apparatus for violation prediction based on a block chain, the apparatus including:

a processor; and

a memory arranged to store computer executable instructions that, when executed, cause the processor to perform the operations of any of the methods described above.

According to another aspect of the application, there is provided a computer readable medium storing instructions that, when executed, cause a system to perform the operations of any of the methods described above.

Compared with the prior art, the network device can obtain a first violation prediction model for violation prediction from a block chain, update the first violation prediction model according to incremental data information, and input a target behavior into the updated first violation prediction model for prediction, wherein the first violation prediction model can be a model based on co-training and maintenance of multiple companies, and has a huge user behavior data base, so that the accuracy of violation prediction is higher.

Drawings

Other features, objects and advantages of the present application will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:

FIG. 1 illustrates a system topology according to the present application;

FIG. 2 is a flow diagram illustrating a method for violation prediction based on blockchains according to another embodiment of the present disclosure;

fig. 3 is a schematic device diagram of a network device for performing violation prediction based on a block chain according to an embodiment of the present application;

FIG. 4 illustrates an exemplary system that can be used to implement the various embodiments described in this disclosure.

The same or similar reference numbers in the drawings identify the same or similar elements.

Detailed Description

The present application is described in further detail below with reference to the attached figures.

In a typical configuration of the present application, the terminal, the device serving the network, and the trusted party each include one or more processors (e.g., Central Processing Units (CPUs)), input/output interfaces, network interfaces, and memory.

The Memory may include forms of volatile Memory, Random Access Memory (RAM), and/or non-volatile Memory in a computer-readable medium, such as Read Only Memory (ROM) or Flash Memory. Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, Phase-Change Memory (PCM), Programmable Random Access Memory (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), electrically Erasable Programmable Read-Only Memory (EEPROM), flash Memory or other Memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.

The device referred to in this application includes, but is not limited to, a user device, a network device, or a device formed by integrating a user device and a network device through a network. The user equipment includes, but is not limited to, any mobile electronic product, such as a smart phone, a tablet computer, etc., capable of performing human-computer interaction with a user (e.g., human-computer interaction through a touch panel), and the mobile electronic product may employ any operating system, such as an Android operating system, an iOS operating system, etc. The network Device includes an electronic Device capable of automatically performing numerical calculation and information processing according to a preset or stored instruction, and the hardware includes, but is not limited to, a microprocessor, an Application Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Digital Signal Processor (DSP), an embedded Device, and the like. The network device includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud of a plurality of servers; here, the Cloud is composed of a large number of computers or web servers based on Cloud Computing (Cloud Computing), which is a kind of distributed Computing, one virtual supercomputer consisting of a collection of loosely coupled computers. Including, but not limited to, the internet, a wide area network, a metropolitan area network, a local area network, a VPN network, a wireless Ad Hoc network (Ad Hoc network), etc. Preferably, the device may also be a program running on the user device, the network device, or a device formed by integrating the user device and the network device, the touch terminal, or the network device and the touch terminal through a network.

Of course, those skilled in the art will appreciate that the foregoing is by way of example only, and that other existing or future devices, which may be suitable for use in the present application, are also encompassed within the scope of the present application and are hereby incorporated by reference.

In the description of the present application, "a plurality" means two or more unless specifically limited otherwise.

Fig. 1 shows a typical scenario of the present application, where company a is a company having a plurality of social application products, each social application has a considerable number of users, and a network device of company a collects user data of all users, where the user data includes social behaviors of each user in the social application and generated social content, and orders the social behaviors and the generated social content according to time. The network equipment generates characteristic information (for example, the social behavior and the social content on each time node) according to a preset modeContent feature information, behavior feature information, and connection relationship feature information), inputting the feature information into a timing model (e.g., LSTM (Long Short-Term Memory, Long Short-Term Memory artificial neural network) for training to generate an illegal prediction model MA, uploading the illegal prediction model MA into a block chain, downloading the illegal prediction model MA from the block chain by companies B, C, and D, respectively, training the illegal prediction model MA to generate the illegal prediction model MA by companies B, C, and D using feature information corresponding to user data collected based on products of the companies_BRule violation prediction model MA_CRule violation prediction model MA_DThen the violation prediction models MA are respectively used_BRule violation prediction model MA_CRule violation prediction model MA_DUploading into a blockchain. The company E and the company F download the violation prediction model MA from the block chain respectively_BRespectively training the violation prediction model MA by using the characteristic information corresponding to the user data collected based on the products of the company_BGeneration of violation prediction model MA_BERule violation prediction model A_BFAnd predicting the violation by model MA_BERule violation prediction model MA_BFUploading to a block chain; g company, H company and I company download violation prediction models MA from block chains respectively_DRespectively training the violation prediction model MA by using the characteristic information corresponding to the user data collected based on the products of the company_DGeneration of violation prediction model MA_DGRule violation prediction model MA_DHRule violation prediction model MA_DIAnd uploaded into the blockchain. By analogy, each company can obtain a violation prediction model, train the violation prediction model again, and upload the violation prediction model to the block chain, wherein each trained violation prediction model is provided with the identifier of the corresponding company. A target company sends a model acquisition request to a block chain and acquires a target violation prediction model, for example, the target violation user determination model is one of violation prediction model templates uploaded to the block chain, a network device corresponding to the company inputs behavior information of a target user into the target violation prediction model according to the behavior information to predict the behavior information as probability information of violation, and if the probability information is greater than a predetermined probability threshold, the network device predicts that the behavior information is probability information of violation behaviorThe device may mark the target user and the behavior information as high risk and input the information (e.g., behavior/content) related to the behavior information at the last time point and the information (e.g., behavior/content) related to the behavior information at the next time point into the model for detection, so as to more fully audit the behavior.

Fig. 2 illustrates a method for performing violation prediction based on a block chain according to an embodiment of the present application, where the method includes steps S101, S102, S103, and S104.

Specifically, in step S101, the network device sends a model acquisition request to a block chain, and receives a first violation prediction model returned by the block chain in response to the model acquisition request and first data information corresponding to the first violation prediction model, where the first data information includes first calibration information, multiple pieces of behavior information, and multiple pieces of content information, and the first calibration information is used to calibrate sample information of each piece of behavior information in the multiple pieces of behavior information and to calibrate sample information of each piece of content information in the multiple pieces of content information. The blockchain is a decentralized distributed database, and is composed of millions of "small servers" and "nodes" without relying on any centralized server, where a node generally refers to a computer that downloads relevant cryptocurrency to participate in a peer-to-peer network, for example, computers in a blockchain network include a mobile phone, a mining machine, and a server. The person operating a node may be a normal wallet user, a miner, and multiple people collaborating, storing, and verifying, and the people may all be nodes of a blockchain. For example, the terminal devices responsible for maintaining the operation of the network may be referred to as nodes, and each node may be capable of obtaining a copy of the complete or partial record. For example, the network device is any node in the blockchain, and the node belongs to a company (for example, the company may upload and download data in the blockchain by the node), and the network device sends a model acquisition request to the blockchain, where the model acquisition request includes a model identifier, where the model identifier is used to determine a source of a model to be acquired by the network device (for example, the model is trained by data information of which company last time). The blockchain returns a corresponding first violation prediction model to the network device based on the model acquisition request, in some embodiments, the blockchain also returns first data information to the network device that trained the first violation prediction model, so that other nodes in the subsequent block chain can perform data sorting according to the rule of the first data information when training the first violation prediction model, and provides a basis for subsequently updating the first violation prediction model based on data provided by other nodes, the first violation prediction model may be a model training result from the beginning (for example, generated by a company inputting user data into a semantic network such as LSTM or BERT (pre-training model)), or may be a model training result generated after iterative update (for example, user data of another company is updated on the basis of the model training from the beginning). For example, the rule of the first data information includes calibrating sample information (e.g., the data information is a positive sample or a negative sample) of each data information (e.g., behavior or content) based on the first calibration information in the first data information. Here, the plurality of behavior information and the plurality of content information in the first data information are described and expressed by respectively corresponding feature information.

In step S102, the network device determines, according to the first calibration information, second calibration information corresponding to incremental data information, where the incremental data information belongs to a node corresponding to the network device, the incremental data information includes multiple pieces of incremental behavior information and multiple pieces of incremental content information, and the second calibration information is used to calibrate sample information of each piece of behavior information in the multiple pieces of incremental behavior information and calibrate sample information of each piece of content information in the multiple pieces of incremental content information. The nodes corresponding to the network devices include but are not limited to: the provider providing the incremental data information, for example, a company providing the incremental data information or an application of the company, and the node is used for characterizing the company or the application. For example, the incremental data information includes user log data of the user in the company or a social application of the company, wherein the user data includes social behaviors and social content generated by the social behaviors. In some embodiments, the provider of the incremental data information is different from the provider of the first data information, for example, the provider of the first data information includes at least one other data provider other than the provider of the incremental data information, so that the provider of the incremental data information can train a violation prediction model based on data of more other providers, the violation prediction model not only has a wider application scope, but also can predict violation behaviors that cannot be recognized by the provider of the incremental data information only, and the accuracy and success rate of violation prediction can be improved.

In some embodiments, the method further comprises, before step S102, step S105 (not shown), in step S105, the network device determining the incremental data information. For example, the update and maintenance of the first violation prediction model may be based on data, provided that incremental data information is obtained for a company to which the network device belongs. In some embodiments, said determining said incremental data information comprises: and determining the incremental data information according to a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the social behaviors. The social applications corresponding to the nodes comprise one or more social applications under the flags of the company corresponding to the nodes, for example, a company to which the network device belongs has multiple applications (for example, multiple categories such as social contact, games, and the like), and taking the social applications as an example, the multiple social applications have a huge user group (for example, each user in the user group installs at least one application in the multiple social applications), and after the multiple social applications are installed in the user device of each user in the user group, the contact list in the social application in each user device can be identified, and the content sent by the user in the social application can be obtained, all behaviors of the user in the social application can be recorded, and then the data can be sent to the network device, and the behavior of the user in the social application and the content generated by the behavior can be used as incremental data information by the network device, wherein the social behavior includes, but is not limited to, friend adding, group building, pull to group, read friend circle, refresh friend circle; the social content comprises social content generated by modifying personal profiles, sending messages in private chat, group chat, sending friend circles and the like. Wherein the social behavior and the social content both correspond to a user that triggered the social behavior. On the premise of acquiring behaviors and contents generated by one or more users, a basis is provided for subsequently providing training data of the first violation prediction model. In some embodiments, the determining the incremental data information according to a plurality of social behaviors of a plurality of users in a social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors includes: sequencing a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors according to occurrence time; determining the incremental data information according to the ordered social behaviors and the social contents. For example, the network device sorts the social behavior of the one or more users in the social application and the content generated by the social behavior according to occurrence time, and combines the social behavior and the content into a mixed context (the context is distinguished by time nodes, for example, the context is before a certain time node and the context is after a certain time node), and the first violation prediction model updated by the incremental data information generated by the time-sorting mode facilitates subsequent monitoring and detection according to the context (for example, the context is determined in time sequence), so that all users related to the violation social behavior and the social content can be detected. The efficiency of detection is improved (e.g., the violations of not only one user are detected, but also the violations of other users related to the user are audited out).

In some embodiments, the determining, according to the first calibration information, second calibration information corresponding to incremental data information includes: determining rule information for determining assignment of the first calibration information in each sample information; and determining second calibration information corresponding to incremental data information according to the rule information, wherein the incremental data information belongs to a node corresponding to the network equipment, the incremental data information comprises a plurality of incremental behavior information and a plurality of incremental content information, and the second calibration information is used for calibrating sample information of each behavior information in the plurality of incremental behavior information and calibrating sample information of each content information in the plurality of incremental content information. For example, the first calibration information is used to assign values to each sample information, for example, the value 1 represents an entire sample, and the value 0 represents a negative sample, for example, after the second calibration information of the incremental data information is determined, it is beneficial to subsequently perform sample classification on the incremental data information so as to be consistent with the sample training rule of the first violation prediction model. In some embodiments, the rule information comprises at least any one of:

1) if at least one behavior information in the plurality of behavior information is manually marked as a violation or at least one content information in the plurality of content information is manually marked as a violation, marking the at least one behavior information or the at least one content information as positive sample information;

2) if at least one behavior information in the plurality of behavior information is manually marked as non-violation or at least one content information in the plurality of content information is manually marked as non-violation, marking the at least one behavior information or the at least one content information as negative sample information; for example, the network device performs positive and negative sample classification on each data information (e.g., social behaviors or social content) in the incremental data information in advance, so as to provide a basis for subsequently inputting the positive and negative samples into the first violation prediction model for model updating, and on this basis, the classification of the positive and negative samples is consistent with the positive and negative sample category used for training the first violation prediction model, so that the subsequently updated first violation prediction model is consistent with the rule of the previously trained first violation prediction model, and the accuracy of prediction of the subsequently updated first violation prediction model is improved. For example, in the process of training and generating the first violation prediction model, a human or a computer may perform preliminary review on each behavior information and each content information in the multiple behavior information or the multiple content information in the first data information to determine whether each behavior information and each content information is a violation, and if there is the violation behavior information and the content information, the reviewer may manually mark the violation information and the content information and mark other behavior information and the content information without violating the violation. The network equipment acquires the marking information of each behavior information and each content information, and marks the behavior information and the content information with illegal marks as positive sample information, otherwise marks the behavior information and the content information without illegal marks as negative sample information, wherein the network equipment is the network equipment which generates a first illegal prediction model in training. On the premise of determining the rule information, the network device calibrates a plurality of incremental behavior information and a plurality of incremental content information in the incremental data information according to the rule information, for example, the incremental behavior information and the incremental content information with violation marks are calibrated as positive samples, and conversely, the incremental behavior information and the incremental content information without violation marks are calibrated as negative samples. Thereby providing a basis for subsequent use of incremental data information in training the first violation prediction model. In some embodiments, the number of samples of the plurality of incremental behavior information and the plurality of incremental content information that are scaled as positive sample information by the second scaling information is smaller than the number of samples of the plurality of incremental behavior information and the plurality of incremental content information that are scaled as negative sample information by the second scaling information. In some embodiments, the number of negative samples is much larger than the number of positive samples in order to simulate normal social behavior in reality and a large proportion of the mathematical distribution of the content. Thereby making the generated model highly predictive.

In step S103, the network device updates the first violation prediction model according to the incremental data information and the second calibration information. For example, the network device calibrates the sample information corresponding to each data in the incremental data information with the second calibration information, and inputs the calibrated incremental data information into the first violation prediction model to update the first violation prediction model, so that the training data of the first violation prediction model is richer, the prediction result is more accurate, and the updated first violation prediction model better conforms to the usage characteristics of a company to which the network device belongs (e.g., the updated first violation prediction model is trained according to the user data of the company, and the behavior of the user of the company can be more accurately predicted, etc.). In some embodiments, feature information corresponding to each social behavior and feature information corresponding to each social content are respectively generated according to the social behaviors and the social contents; the determining the incremental data information according to the ordered social behaviors and the social content includes: determining the incremental data information according to the social behaviors, the sequencing information of the social contents, the characteristic information corresponding to each social behavior and the characteristic information corresponding to each social content, wherein the incremental behavior information comprises the characteristic information corresponding to each social behavior in the social behaviors, and the incremental content information comprises the characteristic information corresponding to each social content in the social contents. And the feature information is used for representing the corresponding social content and social behavior by using the feature vector. For example, on the premise that the social behaviors of the one or more users in the social application and the contents generated by the social behaviors are ranked according to occurrence times, the network device generates corresponding feature information for each social behavior and the contents generated by each social behavior, so as to generate one or more feature information ranked according to times, wherein the one or more feature information correspond to the corresponding social behaviors or social contents, and on the basis of generating the feature information, a basis is provided for subsequently sending the feature information into the first violation prediction model for training. In some embodiments, the generating, according to the plurality of social behaviors and the plurality of social contents, feature information corresponding to each social behavior and feature information corresponding to each social content respectively includes at least one of:

1) encoding the social behaviors in a preset mode to generate one or more behavior characteristic information, wherein the characteristic information corresponding to the social behaviors comprises at least one behavior characteristic information; for example, the predetermined manner may include a multi-hot encoding manner, and each social behavior may be encoded into a vector, for example [0,1,0,0] in a multi-hot manner.

2) Determining type information of the social content, and generating one or more content characteristic information corresponding to the social content according to a mode corresponding to the type information, wherein the characteristic information corresponding to the social content comprises at least one content characteristic information; for example, in social content generated by actions of modifying personal profiles, sending messages in private chat, group chat, sending friends and the like, each social content corresponds to different category information, wherein the category information includes picture content, text content, voice content and the like. For the picture content, the network device performs feature extraction on the picture content by using resNet, wherein the feature can be represented by a vector, and the vector is used for representing the picture content; for the text content, the network equipment generates sentence vectors for the text content by using a BERT network; for voice content, the network device transcodes the voice content and then text encodes the voice content into a text to generate a vector.

3) Generating one or more pieces of connection relation characteristic information according to one or more social objects corresponding to the social behaviors, wherein the characteristic information corresponding to the social behaviors comprises at least one piece of connection relation characteristic information; for example, there are some social behaviors that may generate interactions with other users, e.g., friend-add, pull-to-group, friend-circle replies, etc. The network device may generate one or more connection relationship feature information based on one or more social objects (e.g., one or more users performing interaction) corresponding to the interaction, for example, a plus a friend B, and B enters a group through a two-dimensional code shared by a; and then, B pulls the user C into the group, and C publishes illegal contents in the group. The network device generates a directed graph connection triplet feature information (e.g., for associating A, B, C and thus for characterizing behavior of the triplets) based on the interaction between A, B, C. On the basis of characterizing and vectorizing the relationship among the social behaviors, the social content and the social objects, a basis is provided for subsequently sending the characteristic information into a first violation prediction model in a vector form for model updating.

In some embodiments, the updating the first violation prediction model according to the one or more feature information sorted by occurrence time and the second calibration information includes: and updating the first violation prediction model according to the one or more pieces of feature information which are sorted according to the occurrence time and the positive and negative sample information of each piece of feature information in the one or more pieces of feature information calibrated by the second calibration information. For example, on the premise that one or more pieces of feature information are sorted according to occurrence time, positive and negative sample information is determined for each piece of feature information, so that a basis is provided for subsequently updating the first violation prediction model based on the positive and negative samples.

In step S104, the network device inputs the target behavior provided by the node into the updated first violation prediction model, and then obtains violation probability information of the target behavior. For example, the network device obtains a target behavior, and predicts violation probability information that the target behavior will cause a violation in the future by using the updated first violation prediction model. In some embodiments, each behavior corresponds to a user who triggered the behavior, and the network device may lock the user according to whether the behavior subsequently violates or not, so as to prevent the user from subsequently continuing to generate the violations, thereby ensuring social experience and social security of other users in the social application.

For example, a node corresponding to company a (e.g., the node is a network device of company a) acquires a first violation prediction model from a block chain, and company a acquires data information of a plurality of owned users in a social application, where the data information includes social behavior information and social content of the plurality of users in the social application, and vectorizes the data information and sends the vectorized data information to the first violation prediction model for model training to acquire an updated first violation prediction model. The network device inputs a target behavior (e.g., B pulls user C into the group) into the updated model, and if the violation probability information after the model is output is greater than a predetermined threshold, in some embodiments, the predetermined threshold may be set lower at an initial stage, so as to determine the violation more extensively. The network device determines that the target behavior is predicted to be an illegal behavior or a target behavior which may cause other behaviors, the network device inputs two behaviors (for example, B scans a two-dimensional code provided by A into a group and C publishes obvious forbidden content in the group) corresponding to a previous time point and a later time point of the target behavior into the updated model for carrying out the illegal prediction, the violation probability information is obtained to be larger than a preset threshold, the behaviors of the three users have an association relationship, the network device can determine that the user A, B, C may be an illegal group-partner relationship (for example, cooperate to carry out illegal operation, and aim to publish the illegal content), and mark risk levels of the three users.

In some embodiments, the method further includes step S107 (not shown), in step S107, if the violation probability information is greater than a predetermined probability threshold, determining a target occurrence time node corresponding to the target behavior; respectively inputting the previous behavior content information and the next behavior content information of the target occurrence time node into the updated first violation prediction model, and then acquiring first violation probability information and second violation probability information, wherein the previous behavior content information comprises a previous behavior and/or a previous content corresponding to the previous occurrence time node of the target occurrence time node, and the next behavior content information comprises a next behavior and/or a next content corresponding to the next occurrence time node of the target occurrence time node; and if the first violation probability information and the second violation probability information are both greater than the probability threshold, marking a first behavior user executing the target behavior as a risk user. For example, if the violation probability information of the target behavior is greater than a predetermined probability threshold, the network device determines that the target behavior is a violation behavior itself or may cause other violation behaviors in the subsequent, highlights (for example, marks the target behavior as a high risk) the target behavior, and sends the target behavior to a manual review channel, and inputs behaviors of time points before and after the time point corresponding to the target behavior into the updated first violation prediction model for prediction. Therefore, the auditing efficiency is improved, meanwhile, the manual auditing burden can be reduced, the auditing process is accelerated, and the critical violation behaviors in the front and back behaviors can be quickly locked by predicting the behaviors of the time nodes before and after, so that the corresponding critical violation users are locked.

In some embodiments, the method further comprises step S108 (not shown), in step S108, the network device determining a second behavior user performing the previous behavior or the previous content and a third behavior user performing the next behavior or the next content; and marking the first behavior user, the second behavior user and the third behavior user as the same risk user or the same risk type user. For example, when a user performs a triggering operation in a social application, each behavior is recorded, and a triggering user and a triggered user corresponding to the behavior are also recorded, on the premise that violation probability information of the target behavior is greater than a predetermined probability threshold, the network device determines that a first behavior user executing the target behavior is a violation behavior candidate triggering user, then, the network device obtains the previous behavior/content and the subsequent behavior/content, inputs the updated first violation prediction model, and then obtains violation probability information, if violation probability information of the previous behavior/content and the subsequent behavior/content is greater than the predetermined probability threshold, the network device determines that behaviors/contents corresponding to the previous behavior/content and the subsequent behavior/content are violating or causing the target behavior, and the network device determines that a second behavior user executing the previous behavior/content and a third behavior user executing the subsequent behavior/content are violation behavior candidates triggering users A user. On the basis that the violation candidate trigger users have been determined, the network device may consider the operators of the multiple violation candidate trigger users to be actually the same user, or consider the multiple violation candidate trigger users to be a violation group. Therefore, the group violation behavior is effectively detected, and the auditing efficiency is improved.

In some embodiments, the method further includes step S109 (not shown), and in step S109, the network device uploads the incremental data information and the updated first violation prediction model to the blockchain. For example, the incremental data information may be used for data analysis of companies in subsequent network devices, and after the updated first violation prediction model is uploaded to the block chain, other nodes in the block chain may obtain the updated first violation prediction model and perform social behavior detection using the updated first violation prediction model, where an obtained detection result is more accurate, or other nodes may continue to update and iterate the model to meet the needs of each company.

In some embodiments, the method further includes step S110 (not shown), in step S110, the network device receives contribution information of the node about the first violation prediction model, which is sent by the block chain, where the contribution information is determined based on the proportion information of the incremental data information in the sum of the first data information and the incremental data information. For example, data sharing of multiple companies exists in the first data information for training and generating the first violation prediction model, and the blockchain determines contribution information available to a provider (e.g., a company that collects incremental data information) of the incremental data information according to a proportion of the incremental data information occupied in the total data for training the updated first violation prediction model, where the contribution information is used for the blockchain to write corresponding blockresources into nodes corresponding to the provider, so as to encourage more companies to perform model updating and data contribution.

Fig. 3 illustrates a network device for performing violation prediction based on a block chain according to an embodiment of the present application, where the network device includes a one-to-one module 101, a two-to-two module 102, a three-to-one module 103, and a four-to-one module 104.

Specifically, the one-to-one module 101 is configured to send a model acquisition request to a block chain, and receive a first violation prediction model returned by the block chain in response to the model acquisition request and first data information corresponding to the first violation prediction model, where the first data information includes first calibration information, multiple pieces of behavior information, and multiple pieces of content information, and the first calibration information is used to calibrate sample information of each piece of behavior information in the multiple pieces of behavior information and calibrate sample information of each piece of content information in the multiple pieces of content information. The blockchain is a decentralized distributed database, and is composed of millions of "small servers" and "nodes" without relying on any centralized server, where a node generally refers to a computer that downloads relevant cryptocurrency to participate in a peer-to-peer network, for example, computers in a blockchain network include a mobile phone, a mining machine, and a server. The person operating a node may be a normal wallet user, a miner, and multiple people collaborating, storing, and verifying, and the people may all be nodes of a blockchain. For example, the terminal devices responsible for maintaining the operation of the network may be referred to as nodes, and each node may be capable of obtaining a copy of the complete or partial record. For example, the network device is any node in the blockchain, and the node belongs to a company (for example, the company may upload and download data in the blockchain by the node), and the network device sends a model acquisition request to the blockchain, where the model acquisition request includes a model identifier, where the model identifier is used to determine a source of a model to be acquired by the network device (for example, the model is trained by data information of which company last time). The blockchain returns a corresponding first violation prediction model to the network device based on the model acquisition request, in some embodiments, the blockchain also returns first data information to the network device that trained the first violation prediction model, so that other nodes in the subsequent block chain can perform data sorting according to the rule of the first data information when training the first violation prediction model, and provides a basis for subsequently updating the first violation prediction model based on data provided by other nodes, the first violation prediction model may be an initial model training result (generated by training a company inputting user data into a semantic network such as LSTM or BERT), or may be an iteratively updated model training result (generated by updating user data of another company based on the initial model training). For example, the rule of the first data information includes calibrating sample information (e.g., the data information is a positive sample or a negative sample) of each data information (e.g., behavior or content) based on the first calibration information in the first data information.

A second module 102, configured to determine second calibration information corresponding to incremental data information according to the first calibration information, where the incremental data information belongs to a node corresponding to the network device, the incremental data information includes multiple incremental behavior information and multiple incremental content information, and the second calibration information is used to calibrate sample information of each behavior information in the multiple incremental behavior information and calibrate sample information of each content information in the multiple incremental content information. The incremental data information includes user data of a user in a social application, which is collected by a company to which the network device belongs, where the user data includes social behaviors and social content generated by the social behaviors, and in some embodiments, the social behaviors do not necessarily generate corresponding social content. In some embodiments, the network device further comprises a five module 105 (not shown) before the two module 102, the five module 105 for determining the incremental data information. For example, the update and maintenance of the first violation prediction model may be based on data, provided that incremental data information is obtained for a company to which the network device belongs. In some embodiments, said determining said incremental data information comprises: and determining the incremental data information according to a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the social behaviors. The specific implementation manner of the fifth module 105 is the same as or similar to the embodiment of the step S105, and therefore, the detailed description is omitted, and the detailed implementation manner is included herein by reference. In some embodiments, the determining the incremental data information according to a plurality of social behaviors of a plurality of users in a social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors includes: sequencing a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors according to occurrence time; determining the incremental data information according to the ordered social behaviors and the social contents. The operation of determining the incremental data information according to the social behavior of one or more users in the social application and the content generated by the social behavior is the same as or similar to that of the embodiment shown in fig. 2, and therefore, the operation is not repeated here, and is included herein by reference.

In some embodiments, the determining, according to the first calibration information, second calibration information corresponding to incremental data information includes: determining rule information for determining assignment of the first calibration information in each sample information; and determining second calibration information corresponding to incremental data information according to the rule information, wherein the incremental data information belongs to a node corresponding to the network equipment, the incremental data information comprises a plurality of incremental behavior information and a plurality of incremental content information, and the second calibration information is used for calibrating sample information of each behavior information in the plurality of incremental behavior information and calibrating sample information of each content information in the plurality of incremental content information. The operation of determining the second calibration information corresponding to the incremental data information according to the first calibration information is the same as or similar to that of the embodiment shown in fig. 2, and therefore, the description is omitted, and the operation is incorporated herein by reference. In some embodiments, the rule information comprises at least any one of:

2) if at least one behavior information in the plurality of behavior information is manually marked as non-violation or at least one content information in the plurality of content information is manually marked as non-violation, marking the at least one behavior information or the at least one content information as negative sample information; the operation of the related rule information is the same as or similar to that of the embodiment shown in fig. 2, and therefore, the description thereof is omitted, and the description thereof is incorporated herein by reference. In some embodiments, the number of samples of the plurality of incremental behavior information and the plurality of incremental content information that are scaled as positive sample information by the second scaling information is smaller than the number of samples of the plurality of incremental behavior information and the plurality of incremental content information that are scaled as negative sample information by the second scaling information. The operation of the correlation between the sample number information marked as positive sample information by the second marking information and the sample number information marked as negative sample information by the second marking information is the same as or similar to the embodiment shown in fig. 2, and therefore, the operation is not repeated and is included herein by reference.

A third module 103, configured to update the first violation prediction model according to the incremental data information and the second calibration information. For example, the network device calibrates the sample information corresponding to each data in the incremental data information with the second calibration information, and inputs the calibrated incremental data information into the first violation prediction model to update the first violation prediction model, so that the training data of the first violation prediction model is richer, the prediction result is more accurate, and the updated first violation prediction model better conforms to the usage characteristics of a company to which the network device belongs (e.g., the updated first violation prediction model is trained according to the user data of the company, and the behavior of the user of the company can be more accurately predicted, etc.). In some embodiments, the network device further includes a sixth module 106 (not shown), and the sixth module 106 is configured to generate feature information corresponding to each social behavior and feature information corresponding to each social content according to the social behaviors and the social contents, respectively; the determining the incremental data information according to the ordered social behaviors and the social content includes: determining the incremental data information according to the social behaviors, the sequencing information of the social contents, the characteristic information corresponding to each social behavior and the characteristic information corresponding to each social content, wherein the incremental behavior information comprises the characteristic information corresponding to each social behavior in the social behaviors, and the incremental content information comprises the characteristic information corresponding to each social content in the social contents. The specific implementation manner of the sixth module 106 is the same as or similar to the embodiment of the step S106, and therefore, the detailed description is omitted, and the detailed implementation manner is included herein by reference. In some embodiments, the generating, according to the plurality of social behaviors and the plurality of social contents, feature information corresponding to each social behavior and feature information corresponding to each social content respectively includes at least one of:

1) encoding the social behaviors in a preset mode to generate one or more behavior characteristic information, wherein the characteristic information corresponding to the social behaviors comprises at least one behavior characteristic information;

2) determining type information of the social content, and generating one or more content characteristic information corresponding to the social content according to a mode corresponding to the type information, wherein the characteristic information corresponding to the social content comprises at least one content characteristic information;

3) generating one or more pieces of connection relation characteristic information according to one or more social objects corresponding to the social behaviors, wherein the characteristic information corresponding to the social behaviors comprises at least one piece of connection relation characteristic information; the operation of generating the feature information corresponding to each social behavior and the feature information corresponding to each social content according to the social behaviors and the social contents is the same as or similar to that in the embodiment shown in fig. 2, and thus, the detailed description is omitted, and the operation is included herein by reference.

A fourth module 104, configured to input the target behavior provided by the node into the updated first violation prediction model, and then obtain violation probability information of the target behavior. For example, the network device obtains a target behavior, and predicts violation probability information that the target behavior will cause a violation in the future by using the updated first violation prediction model. In some embodiments, each behavior corresponds to a user who triggered the behavior, and the network device may lock the user according to whether the behavior subsequently violates or not, so as to prevent the user from subsequently continuing to generate the violations, thereby ensuring social experience and social security of other users in the social application. In some embodiments, the network device further includes a seventh module 107 (not shown), and the seventh module 107 is configured to determine a target occurrence time node corresponding to the target behavior if the violation probability information is greater than a predetermined probability threshold; respectively inputting the previous behavior content information and the next behavior content information of the target occurrence time node into the updated first violation prediction model, and then acquiring first violation probability information and second violation probability information, wherein the previous behavior content information comprises a previous behavior and/or a previous content corresponding to the previous occurrence time node of the target occurrence time node, and the next behavior content information comprises a next behavior and/or a next content corresponding to the next occurrence time node of the target occurrence time node; and if the first violation probability information and the second violation probability information are both greater than the probability threshold, marking a first behavior user executing the target behavior as a risk user. The specific implementation manner of the seventh module 107 is the same as or similar to the embodiment of the step S107, and therefore, the detailed description is omitted, and the detailed implementation manner is incorporated herein by reference.

Here, the specific implementation of the above-mentioned one-to-one module 101, two-to-one module 102, one-to-three module 103, and one-to-four module 104 is the same as or similar to the embodiment of step S101, step S102, step S103, and step S104 in fig. 2, and therefore, the detailed description thereof is omitted, and the detailed implementation is incorporated herein by reference.

In some embodiments, the network device further includes an eight module 108 (not shown), an eight module 108 for determining a second behavior user performing the previous behavior or the previous content and a third behavior user performing the next behavior or the next content; and marking the first behavior user, the second behavior user and the third behavior user as the same risk user or the same risk type user. The specific implementation manner of the eight module 108 is the same as or similar to the embodiment of the step S108, and therefore, the detailed description is omitted, and the detailed implementation manner is incorporated herein by reference.

In some embodiments, the network device further includes a nine module 109 (not shown), and the nine module 109 is configured to upload the incremental data information and the updated first violation prediction model to the blockchain. The specific implementation manner of the nine module 109 is the same as or similar to the embodiment of the step S109, and therefore, the detailed description is omitted, and the detailed implementation manner is included herein by reference.

In some embodiments, the network device further includes a one-to-zero module 110 (not shown), and the one-to-zero module 110 is configured to receive contribution information of the node about the first violation prediction model, where the contribution information is determined based on the proportion information of the incremental data information in the sum of the first data information and the incremental data information, and the contribution information is sent by the block chain. The specific implementation manner of the zero module 110 is the same as or similar to the embodiment of the step S110, and therefore, the detailed description is omitted, and the detailed implementation manner is included herein by reference.

In addition to the methods and apparatus described in the embodiments above, the present application also provides a computer readable storage medium storing computer code that, when executed, performs the method as described in any of the preceding claims.

The present application also provides a computer program product, which when executed by a computer device, performs the method of any of the preceding claims.

The present application further provides a computer device, comprising:

one or more processors;

a memory for storing one or more computer programs;

the one or more computer programs, when executed by the one or more processors, cause the one or more processors to implement the method of any preceding claim.

FIG. 4 illustrates an exemplary system that can be used to implement the various embodiments described herein;

in some embodiments, as shown in FIG. 4, the system 300 can be implemented as any of the devices in the various embodiments described. In some embodiments, system 300 may include one or more computer-readable media (e.g., system memory or NVM/storage 320) having instructions and one or more processors (e.g., processor(s) 305) coupled with the one or more computer-readable media and configured to execute the instructions to implement modules to perform the actions described herein.

For one embodiment, system control module 310 may include any suitable interface controllers to provide any suitable interface to at least one of processor(s) 305 and/or any suitable device or component in communication with system control module 310.

The system control module 310 may include a memory controller module 330 to provide an interface to the system memory 315. Memory controller module 330 may be a hardware module, a software module, and/or a firmware module.

System memory 315 may be used, for example, to load and store data and/or instructions for system 300. For one embodiment, system memory 315 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, the system memory 315 may include a double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

For one embodiment, system control module 310 may include one or more input/output (I/O) controllers to provide an interface to NVM/storage 320 and communication interface(s) 325.

For example, NVM/storage 320 may be used to store data and/or instructions. NVM/storage 320 may include any suitable non-volatile memory (e.g., flash memory) and/or may include any suitable non-volatile storage device(s) (e.g., one or more Hard Disk Drives (HDDs), one or more Compact Disc (CD) drives, and/or one or more Digital Versatile Disc (DVD) drives).

NVM/storage 320 may include storage resources that are physically part of the device on which system 300 is installed or may be accessed by the device and not necessarily part of the device. For example, NVM/storage 320 may be accessible over a network via communication interface(s) 325.

Communication interface(s) 325 may provide an interface for system 300 to communicate over one or more networks and/or with any other suitable device. System 300 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and/or protocols.

For one embodiment, at least one of the processor(s) 305 may be packaged together with logic for one or more controller(s) (e.g., memory controller module 330) of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be packaged together with logic for one or more controller(s) of the system control module 310 to form a System In Package (SiP). For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with logic for one or more controller(s) of the system control module 310. For one embodiment, at least one of the processor(s) 305 may be integrated on the same die with logic for one or more controller(s) of the system control module 310 to form a system on a chip (SoC).

In various embodiments, system 300 may be, but is not limited to being: a server, a workstation, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet, a netbook, etc.). In various embodiments, system 300 may have more or fewer components and/or different architectures. For example, in some embodiments, system 300 includes one or more cameras, a keyboard, a Liquid Crystal Display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an Application Specific Integrated Circuit (ASIC), and speakers.

It should be noted that the present application may be implemented in software and/or a combination of software and hardware, for example, implemented using Application Specific Integrated Circuits (ASICs), general purpose computers or any other similar hardware devices. In one embodiment, the software programs of the present application may be executed by a processor to implement the steps or functions described above. Likewise, the software programs (including associated data structures) of the present application may be stored in a computer readable recording medium, such as RAM memory, magnetic or optical drive or diskette and the like. Additionally, some of the steps or functions of the present application may be implemented in hardware, for example, as circuitry that cooperates with the processor to perform various steps or functions.

In addition, some of the present application may be implemented as a computer program product, such as computer program instructions, which when executed by a computer, may invoke or provide methods and/or techniques in accordance with the present application through the operation of the computer. Those skilled in the art will appreciate that the form in which the computer program instructions reside on a computer-readable medium includes, but is not limited to, source files, executable files, installation package files, and the like, and that the manner in which the computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Computer-readable media herein can be any available computer-readable storage media or communication media that can be accessed by a computer.

Communication media includes media by which communication signals, including, for example, computer readable instructions, data structures, program modules, or other data, are transmitted from one system to another. Communication media may include conductive transmission media such as cables and wires (e.g., fiber optics, coaxial, etc.) and wireless (non-conductive transmission) media capable of propagating energy waves such as acoustic, electromagnetic, RF, microwave, and infrared. Computer readable instructions, data structures, program modules, or other data may be embodied in a modulated data signal, for example, in a wireless medium such as a carrier wave or similar mechanism such as is embodied as part of spread spectrum techniques. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. The modulation may be analog, digital or hybrid modulation techniques.

By way of example, and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. For example, computer-readable storage media include, but are not limited to, volatile memory such as random access memory (RAM, DRAM, SRAM); and non-volatile memory such as flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic/ferroelectric memories (MRAM, FeRAM); and magnetic and optical storage devices (hard disk, tape, CD, DVD); or other now known media or later developed that can store computer-readable information/data for use by a computer system.

An embodiment according to the present application comprises an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein the computer program instructions, when executed by the processor, trigger the apparatus to perform a method and/or a solution according to the aforementioned embodiments of the present application.

It will be evident to those skilled in the art that the present application is not limited to the details of the foregoing illustrative embodiments, and that the present application may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the application being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned. Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the apparatus claims may also be implemented by one unit or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.

Claims

1. A method for violation prediction based on a block chain is applied to a network device, wherein the method comprises the following steps:

2. The method of claim 1, wherein the determining second calibration information corresponding to incremental data information from the first calibration information comprises:

determining rule information for determining assignment of the first calibration information in each sample information;

and determining second calibration information corresponding to incremental data information according to the rule information, wherein the incremental data information belongs to a node corresponding to the network equipment, the incremental data information comprises a plurality of incremental behavior information and a plurality of incremental content information, and the second calibration information is used for calibrating sample information of each behavior information in the plurality of incremental behavior information and calibrating sample information of each content information in the plurality of incremental content information.

3. The method of claim 2, wherein the rule information comprises at least any one of:

if at least one behavior information in the plurality of behavior information is manually marked as a violation or at least one content information in the plurality of content information is manually marked as a violation, marking the at least one behavior information or the at least one content information as positive sample information;

and if at least one behavior information in the plurality of behavior information is manually marked as non-violation or at least one content information in the plurality of content information is manually marked as non-violation, marking the at least one behavior information or the at least one content information as negative sample information.

4. The method according to any of claims 1 to 3, wherein the number of samples of the plurality of incremental behavior information and the plurality of incremental content information that are scaled as positive sample information by the second scaling information is smaller than the number of samples that are scaled as negative sample information by the second scaling information.

5. The method according to any one of claims 1 to 4, wherein the method further includes, before determining second calibration information corresponding to incremental data information according to the first calibration information, wherein the incremental data information belongs to a node corresponding to the network device, the incremental data information includes a plurality of incremental behavior information and a plurality of incremental content information, and the second calibration information is used for calibrating sample information of each behavior information in the plurality of incremental behavior information and calibrating sample information of each content information in the plurality of incremental content information:

determining the incremental data information.

6. The method of claim 5, wherein the determining the incremental data information comprises:

and determining the incremental data information according to a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the social behaviors.

7. The method of claim 6, wherein the determining the incremental data information according to a plurality of social behaviors of a plurality of users in a social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors comprises:

sequencing a plurality of social behaviors of a plurality of users in the social application corresponding to the node and a plurality of social contents generated by the plurality of social behaviors according to occurrence time; determining the incremental data information according to the ordered social behaviors and the social contents.

8. The method of claim 7, wherein the method further comprises:

respectively generating characteristic information corresponding to each social behavior and characteristic information corresponding to each social content according to the social behaviors and the social contents;

the determining the incremental data information according to the ordered social behaviors and the social content includes:

determining the incremental data information according to the social behaviors, the sequencing information of the social contents, the characteristic information corresponding to each social behavior and the characteristic information corresponding to each social content, wherein the incremental behavior information comprises the characteristic information corresponding to each social behavior in the social behaviors, and the incremental content information comprises the characteristic information corresponding to each social content in the social contents.

9. The method of claim 8, wherein the generating feature information corresponding to each social behavior and feature information corresponding to each social content according to the social behaviors and the social content comprises at least one of:

encoding the social behaviors in a preset mode to generate one or more behavior characteristic information, wherein the characteristic information corresponding to the social behaviors comprises at least one behavior characteristic information;

determining type information of the social content, and generating one or more content characteristic information corresponding to the social content according to a mode corresponding to the type information, wherein the characteristic information corresponding to the social content comprises at least one content characteristic information;

and generating one or more pieces of connection relation characteristic information according to one or more social objects corresponding to the social behaviors, wherein the characteristic information corresponding to the social behaviors comprises at least one piece of connection relation characteristic information.

10. The method of claim 1, wherein the method further comprises:

if the violation probability information is larger than a preset probability threshold, determining a target occurrence time node corresponding to the target behavior;

respectively inputting the previous behavior content information and the next behavior content information of the target occurrence time node into the updated first violation prediction model, and then acquiring first violation probability information and second violation probability information, wherein the previous behavior content information comprises a previous behavior and/or a previous content corresponding to the previous occurrence time node of the target occurrence time node, and the next behavior content information comprises a next behavior and/or a next content corresponding to the next occurrence time node of the target occurrence time node;

and if the first violation probability information and the second violation probability information are both greater than the probability threshold, marking a first behavior user executing the target behavior as a risk user.

11. The method of claim 10, wherein the method further comprises:

determining a second behavior user performing the previous behavior or the previous content and a third behavior user performing the next behavior or the next content;

and marking the first behavior user, the second behavior user and the third behavior user as the same risk user or the same risk type user.

12. The method of claim 1, wherein the method further comprises:

uploading the incremental data information and the updated first violation prediction model to the blockchain.

13. The method of claim 12, wherein the method further comprises:

receiving contribution information of the node about the first violation prediction model sent by the blockchain, wherein the contribution information is determined based on the proportion information of the incremental data information in the sum of the first data information and the incremental data information.

14. An apparatus for violation prediction based on blockchains, the apparatus comprising:

a processor; and

a memory arranged to store computer executable instructions that, when executed, cause the processor to perform the method of any of claims 1 to 13.

15. A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform operations of any of the methods of claims 1-13.