CN116415233A

CN116415233A - Information detection method, information detection device, computer-readable storage medium, and program product

Info

Publication number: CN116415233A
Application number: CN202111660331.4A
Authority: CN
Inventors: 李轩
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-12-31
Filing date: 2021-12-31
Publication date: 2023-07-11

Abstract

The application provides an information detection method, equipment, a computer readable storage medium and a program product, which are applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation, vehicle-mounted and the like; the abnormality information detection method includes: presenting information to be detected; acquiring behavior data to be detected aiming at information to be detected; when determining that the specified processing flow is executed based on the behavior data to be detected, generating reporting data corresponding to the information to be detected, wherein the specified processing flow is the processing flow of the pointer on the abnormal information; and sending the reported data to the server-side equipment so that the server-side equipment can determine the detection result of the information to be detected based on the received at least one reported data, wherein the detection result refers to whether the information to be detected is abnormal information or not. Through this application, can promote the validity that information detected.

Description

Information detection method, information detection device, computer-readable storage medium, and program product

Technical Field

The present invention relates to information processing technology in the field of computer applications, and in particular, to an information detection method, an information detection device, a computer readable storage medium, and a program product.

Background

With the rapid development of information flow products, there is a black product that propagates abnormal information such as sensitive information in the information flow products to attract users to access and make a profit from the information flow products. Therefore, identifying anomaly information from information stream products is an effective method of identifying black products in order to cleanse the internet environment.

Generally, in order to identify abnormal information, it is generally determined whether an abnormal character string (for example, an abnormal website, a "clustered" character string) is included in the information to be detected, and the information to be detected including the abnormal character string is determined as the abnormal information; however, in the above-mentioned process of detecting information to be detected, since the patterns of the abnormal strings (such as the formats and the abnormal descriptions of various abnormal websites) are continuously changing, the existing detection strategies cannot effectively detect the abnormal information, resulting in poor information detection effectiveness.

Disclosure of Invention

The embodiment of the application provides an information detection method, an information detection device, information detection equipment, a computer readable storage medium and a computer program product, which can improve the effectiveness of information detection.

The technical scheme of the embodiment of the application is realized as follows:

the embodiment of the application provides an information detection method, which comprises the following steps:

Presenting information to be detected;

acquiring behavior data to be detected aiming at the information to be detected;

when determining that a specified processing flow is executed based on the behavior data to be detected, generating reporting data corresponding to the information to be detected, wherein the specified processing flow is a processing flow of abnormal information by a pointer;

and sending the reported data to a server device, so that the server device determines a detection result of the information to be detected based on at least one piece of the received reported data, wherein the detection result refers to whether the information to be detected is the abnormal information or not.

The embodiment of the application provides another information detection method, which comprises the following steps:

receiving at least one piece of reporting data sent by at least one piece of client equipment aiming at information to be detected, wherein each piece of the client equipment is used for determining the execution condition of an appointed processing flow through the behavior data to be detected of the information to be detected, the reporting data is sent by the client equipment when the appointed processing flow is determined to be executed aiming at the information to be detected, and the appointed processing flow is the processing flow of an abnormal information by a pointer;

And determining a detection result of the information to be detected based on at least one piece of reported data, wherein the detection result refers to whether the information to be detected is the abnormal information or not.

In this embodiment of the present application, before the matching the information to be matched in the specified abnormal information base and obtaining the first matching result, the method further includes:

dividing an abnormal character string set into at least one abnormal character string sequence, wherein the abnormal character string set is composed of abnormal character strings;

constructing prefix structure information for each abnormal character string sequence to obtain at least one piece of prefix structure information corresponding to at least one abnormal character string sequence, wherein a node in the prefix structure information and a child node sequence of the node are combined into at least one abnormal character string, and one node is an abnormal character;

determining at least one of the prefix structure information as the specified abnormality information base;

the step of matching the information to be matched in the appointed abnormal information base to obtain a first matching result comprises the following steps:

obtaining a sub-matching result of the information to be matched in each prefix structure information in the appointed abnormal information base, and obtaining at least one sub-matching result corresponding to at least one prefix structure information;

At least one of the sub-match results is determined as the first match result.

In an embodiment of the present application, the dividing the abnormal string set into at least one abnormal string sequence includes:

dividing the abnormal character string set into at least one abnormal character string sequence based on a specified dividing mode, wherein the specified dividing mode comprises at least one of the type of the abnormal character string and the identification index of the abnormal character;

acquiring a category to be matched corresponding to the information to be matched based on the appointed division mode;

determining a set of prefix structure information corresponding to the category to be matched from at least one of the prefix structure information;

obtaining a sub-matching result of the information to be matched in each prefix structure information in the prefix structure information set to obtain a sub-matching result set corresponding to the prefix structure information set, wherein the sub-matching result set is composed of the sub-matching results;

and determining the sub-matching result set as the first matching result.

In this embodiment of the present application, the obtaining a sub-match result of the information to be matched in each prefix structure information includes:

determining a reference node corresponding to a first character to be matched of the information to be matched in each prefix structure information;

traversing the residual character sequences to be matched in the information to be matched, wherein the residual character sequences to be matched are sequences formed by the characters to be matched except the first character to be matched in the information to be matched;

and carrying out iterative matching on the traversed characters to be matched in a reference sub-node sequence corresponding to the reference node in the prefix structure information to obtain the sub-matching result.

In an embodiment of the present application, the determining, based on at least one of the reported data, a detection result of the information to be detected includes:

acquiring account information triggering the specified processing flow from each piece of reporting data of at least one piece of reporting data to obtain at least one piece of account information corresponding to at least one piece of reporting data;

acquiring a second matching result of at least one account information in a specified abnormal account library;

And when the second matching result is that the account information is matched in the appointed abnormal account library, determining that the information to be detected is the detection result of the abnormal information.

In the embodiment of the present application, the process of obtaining the detection result may be implemented by a detection engine;

the detection engine is obtained by:

acquiring a corresponding relation between the appointed information type and the appointed times;

acquiring a second designated times corresponding to the designated reporting time length;

and constructing the detection engine based on the corresponding relation between the specified information type and the specified times and the second specified times corresponding to the specified reporting time length.

An embodiment of the present application provides an information detection apparatus, including:

the information presentation module is used for presenting information to be detected;

the data acquisition module is used for acquiring behavior data to be detected aiming at the information to be detected;

the data generation module is used for generating reporting data corresponding to the information to be detected when determining that a specified processing flow is executed based on the behavior data to be detected, wherein the specified processing flow is a processing flow of the pointer on the abnormal information;

The data sending module is used for sending the reported data to the server-side equipment so that the server-side equipment can determine the detection result of the information to be detected based on at least one piece of the received reported data, wherein the detection result refers to whether the information to be detected is the abnormal information or not.

In this embodiment of the present application, the specified processing flow includes at least one of a browsing process, an application switching process, a selecting process, a copying process, a pasting process, a searching process, and an interaction process, where the browsing process refers to a process that a browsing time period of information is longer than a specified browsing time period, the application switching process refers to a process of switching from an application corresponding to the information to be detected to another application, the selecting process refers to a process of selecting information, the copying process refers to a process of copying information, the pasting process refers to a process of pasting information, the searching process refers to a process of searching information, and the interaction process refers to a process of interacting information.

In this embodiment of the present application, when the specified processing flow includes browsing processing and application switching processing, the information detection apparatus further includes an execution determining module, configured to obtain, from the behavior data to be detected, an information browsing duration for the information to be detected; when the information browsing time period is longer than the appointed browsing time period, determining that the browsing process is executed; when the behavior data to be detected comprises first application switching behavior data, determining that the application switching processing is executed, wherein the first application switching behavior data refers to behavior data which is switched to the other applications in response to a link operation aiming at the information to be detected; and determining that the specified process flow is executed based on the result of the browsing process being executed and the result of the application switching process being executed.

In this embodiment of the present application, when the specified processing flow includes a selection process, a search process, and an interaction process, the execution determining module is further configured to determine that, when the behavior data to be detected includes selection behavior data, the selection process is executed, where the selection behavior data refers to behavior data that obtains selection information in response to a selection operation for the information to be detected; when the behavior data to be detected comprises first search behavior data, determining that the search processing is executed, wherein the first search behavior data refers to behavior data for searching the selected information; when the behavior data to be detected comprises interactive behavior data, determining that the interactive processing is executed, wherein the interactive behavior data refers to the behavior data of the interaction aiming at the search result corresponding to the search behavior data; and determining that the specified process flow is executed based on the result of the selected process being executed, the result of the search process being executed, and the result of the interaction process being executed.

In this embodiment of the present application, when the specified processing flow includes a replication process, an application switching process, and a search process, the execution determining module is further configured to determine that the replication process is executed when the to-be-detected behavior data includes replication behavior data, where the replication behavior data is behavior data that obtains replication information in response to a replication operation for the to-be-detected information; when the behavior data to be detected comprises second application switching behavior data, determining that the application switching processing is executed, wherein the second application switching behavior data refers to behavior data of running a search application, and the search application belongs to the other applications; determining that the search process is performed when second search behavior data is included in the behavior data to be detected, wherein the second search behavior data refers to behavior data for searching the copy information in the search application; the specified process flow is determined to be executed based on the result of the application switching process being executed, the result of the copying process being executed, and the result of the search process being executed.

In this embodiment of the present application, the data generating module is further configured to obtain a type of information to be detected of the information to be detected, an information identifier, triggered target information in the information to be detected, and account information of the information to be detected, where the type of information to be detected is used to determine a specified number of times of reporting corresponding to the information to be detected, the target information is used to determine a first matching result with a specified abnormal information base, the specified abnormal information base is formed by an abnormal character string, the specified account information is used to determine a second matching result with a specified abnormal account base, and the specified abnormal account base is formed by abnormal accounts; and generating the report data corresponding to the information to be detected based on at least one of the information type to be detected, the information identification, the target information and the account information.

An embodiment of the present application provides another information detection apparatus, including:

the data receiving module is used for receiving at least one piece of reporting data sent by at least one piece of client equipment aiming at the information to be detected, wherein each piece of client equipment is used for determining the execution condition of a specified processing flow according to the behavior data to be detected of the information to be detected, the reporting data is sent by the client equipment when the specified processing flow is determined to be executed aiming at the information to be detected, and the specified processing flow is the processing flow of the abnormal information by a pointer;

And the result determining module is used for determining a detection result of the information to be detected based on at least one piece of reported data, wherein the detection result refers to whether the information to be detected is the abnormal information or not.

In this embodiment of the present application, the result determining module is further configured to obtain reporting times of the reporting data corresponding to at least one piece of reporting data; and when the reporting times are greater than the first designated times, determining that the information to be detected is the detection result of the abnormal information.

In this embodiment of the present application, when the number of reporting times is greater than a first specified number of times, the result determining module is further configured to obtain a type of information to be detected corresponding to the information to be detected; and determining the first designated times corresponding to the information type to be detected based on the corresponding relation between the designated information type and the designated times.

In this embodiment of the present application, the result determining module is further configured to obtain a reporting duration corresponding to at least one piece of reporting data when the number of reporting times is less than or equal to the first specified number of times and greater than the second specified number of times; and when the reporting time length is smaller than the appointed reporting time length, determining the information to be detected as the detection result of the abnormal information.

In this embodiment of the present application, the result determining module is further configured to obtain, from each piece of reporting data of at least one piece of reporting data, triggered target information in the information to be detected, to obtain at least one piece of target information corresponding to at least one piece of reporting data; determining at least one of the target information and the information to be detected as information to be matched; matching the information to be matched in a specified abnormal information base to obtain a first matching result; when the first matching result is that the information to be matched is matched in the appointed abnormal information base, determining that the information to be detected is the detection result of the abnormal information.

In an embodiment of the present application, the information detection apparatus further includes a character division module, configured to divide an abnormal character string set into at least one abnormal character string sequence, where the abnormal character string set is formed by abnormal character strings; constructing prefix structure information for each abnormal character string sequence to obtain at least one piece of prefix structure information corresponding to at least one abnormal character string sequence, wherein a node in the prefix structure information and a child node sequence of the node are combined into at least one abnormal character string, and one node is an abnormal character; at least one of the prefix structure information is determined as the specified abnormality information base.

In this embodiment of the present application, the result determining module is further configured to obtain, in the specified abnormal information base, a sub-matching result of the information to be matched in each prefix structure information, and obtain at least one sub-matching result corresponding to at least one prefix structure information; at least one of the sub-match results is determined as the first match result.

In this embodiment of the present application, the character division module is further configured to divide the abnormal string set into at least one abnormal string sequence based on a specified division manner, where the specified division manner includes at least one of a type of the abnormal string and an identification index of the abnormal character.

In this embodiment of the present application, the result determining module is further configured to obtain a category to be matched corresponding to the information to be matched based on the specified division manner; determining a set of prefix structure information corresponding to the category to be matched from at least one of the prefix structure information; obtaining a sub-matching result of the information to be matched in each prefix structure information in the prefix structure information set to obtain a sub-matching result set corresponding to the prefix structure information set, wherein the sub-matching result set is composed of the sub-matching results; and determining the sub-matching result set as the first matching result.

In this embodiment of the present application, the result determining module is further configured to determine, in each prefix structure information, a reference node corresponding to a first character to be matched of the information to be matched; traversing the residual character sequences to be matched in the information to be matched, wherein the residual character sequences to be matched are sequences formed by the characters to be matched except the first character to be matched in the information to be matched; and carrying out iterative matching on the traversed characters to be matched in a reference sub-node sequence corresponding to the reference node in the prefix structure information to obtain the sub-matching result.

In this embodiment of the present application, the result determining module is further configured to obtain, from each piece of reporting data of at least one piece of reporting data, account information that triggers the specified processing procedure, to obtain at least one piece of account information corresponding to at least one piece of reporting data; acquiring a second matching result of at least one account information in a specified abnormal account library; and when the second matching result is that the account information is matched in the appointed abnormal account library, determining that the information to be detected is the detection result of the abnormal information.

In the embodiment of the present application, the process of obtaining the detection result may be implemented by a detection engine; the detection engine is obtained by: acquiring a corresponding relation between the appointed information type and the appointed times; acquiring a second designated times corresponding to the designated reporting time length; and constructing the detection engine based on the corresponding relation between the specified information type and the specified times and the second specified times corresponding to the specified reporting time length.

The embodiment of the application provides a client device for information detection, which comprises:

a first memory for storing executable instructions;

and the first processor is used for realizing the information detection method applied to the client device when executing the executable instructions stored in the first memory.

The embodiment of the application provides a server device for information detection, which comprises:

a second memory for storing executable instructions;

and the second processor is used for realizing the information detection method applied to the server equipment when executing the executable instructions stored in the second memory.

The embodiment of the application provides a computer readable storage medium, which stores executable instructions for implementing the information detection method applied to the client device provided by the embodiment of the application when being executed by a first processor; or when the executable instructions are executed by the second processor, the information detection method applied to the server device provided by the embodiment of the application is realized.

The embodiment of the application provides a computer program product, which comprises a computer program or an instruction, wherein the computer program or the instruction realizes the information detection method applied to the client device when being executed by a first processor; or when the computer program or the instructions are executed by the second processor, the information detection method applied to the server device provided by the embodiment of the application is realized.

The embodiment of the application has at least the following beneficial effects: the method comprises the steps of presetting a specified processing flow for abnormal information, determining the execution condition of the specified processing flow based on to-be-detected behavior data of the to-be-detected information, and sending report data for the to-be-detected information to a server device when the specified processing flow is determined to be executed, so that the server device determines whether the to-be-detected information is the abnormal information based on at least one report data for the to-be-detected information received from at least one client device; is a process for detecting whether the information to be detected is abnormal information based on the processing flow of the abnormal information. Because the processing flow of the abnormal information is usually fixed, whether the information to be detected is the abnormal information or not can be effectively detected, and therefore the effectiveness of information detection can be improved.

Drawings

FIG. 1 is a schematic diagram of an exemplary black product content;

FIG. 2 is a schematic diagram of an information detection system according to an embodiment of the present disclosure;

fig. 3 is a schematic structural diagram of a terminal in fig. 2 according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of one server in fig. 2 according to an embodiment of the present application;

fig. 5 is a schematic flow chart of an information detection method according to an embodiment of the present application;

fig. 6 is a second flowchart of an information detection method according to an embodiment of the present application;

fig. 7 is a flowchart of a method for detecting information according to an embodiment of the present application;

FIG. 8 is a schematic diagram of an exemplary execution specification process flow provided by an embodiment of the present application;

fig. 9 is a flowchart of an information detection method according to an embodiment of the present application;

fig. 10 is a flowchart fifth of an information detection method provided in an embodiment of the present application;

FIG. 11 is a schematic diagram of exemplary anomaly information provided by an embodiment of the present application;

FIG. 12 is a flow chart of an exemplary information detection provided in an embodiment of the present application;

FIG. 13 is an exemplary matching diagram provided by embodiments of the present application;

Fig. 14 is a schematic flow chart of information detection based on a detection engine according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the present application will be described in further detail with reference to the accompanying drawings, and the described embodiments should not be construed as limiting the present application, and all other embodiments obtained by those skilled in the art without making any inventive effort are within the scope of the present application.

In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is to be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with one another without conflict.

In the following description, the terms "first", "second", and the like are merely used to distinguish between similar objects and do not represent a particular ordering of the objects, it being understood that the "first", "second", or the like may be interchanged with a particular order or precedence, as permitted, to enable embodiments of the present application described herein to be implemented in an order other than that illustrated or described herein.

Unless defined otherwise, all technical and scientific terms used in the examples of this application have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the embodiments of the application is for the purpose of describing the embodiments of the application only and is not intended to be limiting of the application.

Before further describing embodiments of the present application in detail, the terms and expressions that are referred to in the embodiments of the present application are described, and are suitable for the following explanation.

1) A client, an application program running in the device for providing various services; such as an instant chat client, a browser client, a news client, etc. The client device is the device for running the client; the server device is a background server which interacts with the client device and provides computing services for the client device.

2) Cloud Computing (Cloud Computing), which is a Computing mode, enables various application systems to acquire Computing power, storage space and information service as required by distributing Computing tasks on a resource pool formed by a large number of computers; the network providing resources for the resource pool is called ' cloud ', the resources in the cloud ' can be infinitely expanded in view of users, and can be acquired, used as required, expanded and paid according to the use at any time; in this embodiment, the service end device may be a cloud end device.

3) Artificial intelligence (Artificial Intelligence, AI), is a theory, method, technique, and application system that utilizes digital computer controlled machines to simulate, extend, and extend human intelligence, sense the environment, acquire knowledge, and use knowledge to obtain optimal results. In embodiments of the present application, information detection may be performed in conjunction with artificial intelligence, such as determining a specified process flow based on artificial intelligence, and so forth.

4) Black production refers to the object of interest by spreading abnormal information such as sensitive information in information stream products such as a point-of-view client, a browser client, a quick report client, a news client and the like to attract users to access; in the embodiment of the application, the abnormal information is black content, such as comment content, article content, reply content of comment content, and the like.

5) The detection strategy refers to a mode and a method for identifying black product content; for example, when the comment content is detected to contain sensitive information, the comment content is determined to be black content.

6) The security processing is the processing of the black product content by the pointer, such as deleting or putting down the black product content.

It should be noted that, with the rapid development of the internet, black products are spread over all corners of the internet; generally, the larger the user volume of the information flow product is, the more the information flow product is attacked by black products; in addition, the occurrence of black products in the information flow products can bring negative influence to the information flow products, so that the detection strategy is utilized to identify the black product content, and the quality of the information flow products can be improved.

In order to identify the blackout content, it is possible to show the blackout content including the web site-related information (see the underlined content in fig. 1) by identifying whether the information to be detected includes the web site-related information (e.g., "http:/", "www", ". Com". And ". Cn"), see pages 1-1 to 1-4 in fig. 1. To identify blackout content, it is also possible to identify whether or not the information to be detected contains a specified character string (e.g., "group …", "instant chat application search … …", "browser search … …", and "friend … …"). However, in the above-mentioned process of identifying the black product content, since the black product content is continuously updated, the patterns of the black product content are various, and the formats of the web sites are also various, the black product content cannot be comprehensively identified; the black product content of the existing style is identified, and the black product content of the new style appears; in addition, the identification or detection can be carried out after the new type of black product content appears, so that the identification of the black product content has hysteresis, the information detection effectiveness is poor, the detection strategy is updated continuously for the detection of the black product content, and the resource consumption is high.

In addition, the black product detection can be performed by identifying the black product behavior; for example, judging whether the account to be detected releases more than 30 pieces of comment content within one minute, or the stay time of each article is not more than three seconds, wherein the comment content is released, or the similarity of all the released comment contents is up to 80%; however, as the number of the black product accounts is large and the difficulty in obtaining the black product accounts is low, a new batch of black product accounts can appear after a batch of black product accounts are detected and safely processed; therefore, the effectiveness of black product detection by identifying black product behaviors is poor.

Based on this, the embodiments of the present application provide an information detection method, apparatus, device, computer readable storage medium, and computer program product, which can improve the validity of information detection, reduce the resource consumption of information detection, and improve the universality of detection policies.

The following describes an exemplary application of the information detection device (including the client device and the server device) provided in the embodiments of the present application, where the information detection device provided in the embodiments of the present application may be implemented as various types of terminals such as a smart phone, a smart watch, a notebook computer, a tablet computer, a desktop computer, an intelligent home appliance, a set-top box, an intelligent vehicle-mounted device, a portable music player, a personal digital assistant, a dedicated messaging device, an intelligent voice interaction device, a portable game device, and an intelligent sound box, and may also be implemented as a server, a detection platform, and so on; that is, the client device and the server device in the embodiments of the present application refer to devices capable of implementing the information detection method provided in the embodiments of the present application, and implementation forms of the client device and the server device are not limited. In the following, an exemplary application when the client device is implemented as a terminal and the server device is implemented as a server will be described.

Referring to fig. 2, fig. 2 is a schematic architecture diagram of an information detection system according to an embodiment of the present application; as shown in fig. 2, to support an information detection application, in the information detection system 100, a terminal 400 (referred to as a client device, two terminals 400 are illustratively shown) is connected to a server 200 (referred to as a server device) through a network 300, and the network 300 may be a wide area network or a local area network, or a combination of both. In addition, the information detection system 100 further includes a database 500 for providing data support to the server 200; also, the database 500 is shown in fig. 2 as a case independent from the server 200, and in addition, the database 500 may be integrated in the server 200, which is not limited in the embodiment of the present application.

A terminal 400 for presenting information to be detected; acquiring behavior data to be detected aiming at information to be detected; when determining that the specified processing flow is executed based on the behavior data to be detected, generating reporting data corresponding to the information to be detected, wherein the specified processing flow is the processing flow of the pointer on the abnormal information; the report data is sent to the server 200 through the network 300, so that the server 200 determines a detection result of the information to be detected based on the received at least one report data, where the detection result refers to whether the information to be detected is abnormal information.

The server 200 is configured to receive, through the network 300, at least one report data sent by at least one terminal 400 for information to be detected, where each terminal 400 is configured to determine, according to behavior data to be detected of the information to be detected, an execution condition of a specified processing procedure, and the report data is sent by the terminal 400 when determining that the specified processing procedure is triggered for the information to be detected; and determining a detection result of the information to be detected based on at least one piece of reported data.

In some embodiments, the server 200 may be a stand-alone physical server, a server cluster or a distributed system formed by a plurality of physical servers, or may be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs, content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 400 may be, but is not limited to, a smart phone, a smart watch, a notebook computer, a tablet computer, a desktop computer, a smart television, a set-top box, a smart car device, a portable music player, a personal digital assistant, a dedicated messaging device, a portable game device, a smart speaker, etc. The terminal and the server may be directly or indirectly connected through wired or wireless communication, which is not limited in the embodiments of the present application.

Referring to fig. 3, fig. 3 is a schematic structural diagram of a terminal in fig. 2 according to an embodiment of the present application, and a terminal 400 shown in fig. 3 includes: at least one first processor 410, a first memory 450, at least one first network interface 420, and a first user interface 430. The various components in terminal 400 are coupled together by a first bus system 440. It is appreciated that the first bus system 440 is used to enable connected communication between these components. The first bus system 440 includes a power bus, a control bus, and a status signal bus in addition to a data bus. But for clarity of illustration the various buses are labeled as first bus system 440 in fig. 3.

The first processor 410 may be an integrated circuit chip having signal processing capabilities such as a general purpose processor, a digital signal processor (DSP, digital Signal Processor), or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like, wherein the general purpose processor may be a microprocessor or any conventional processor or the like.

The first user interface 430 includes one or more first output devices 431, including one or more speakers and/or one or more visual displays, that enable presentation of media content. The first user interface 430 also includes one or more first input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

The first memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid state memory, hard drives, optical drives, and the like. The first memory 450 optionally includes one or more storage devices physically remote from the first processor 410.

The first memory 450 includes volatile memory or nonvolatile memory, and may also include both volatile and nonvolatile memory. The nonvolatile Memory may be a Read Only Memory (ROM), and the volatile Memory may be a random access Memory (RAM, random Access Memory). The first memory 450 described in the embodiments herein is intended to comprise any suitable type of memory.

In some embodiments, the first memory 450 is capable of storing data to support various operations, examples of which include programs, modules and data structures, or subsets or supersets thereof, as exemplified below.

A first operating system 451 including system programs, such as a framework layer, a core library layer, a driver layer, etc., for handling various basic system services and performing hardware-related tasks, for implementing various basic services and handling hardware-based tasks;

A first network communication module 452 for reaching other computer devices via one or more (wired or wireless) first network interfaces 420, the exemplary first network interface 420 comprising: bluetooth, wireless compatibility authentication (Wi-Fi), universal serial bus (USB, universal Serial Bus), and the like;

a first presentation module 453 for enabling presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more first output devices 431 (e.g., a display screen, a speaker, etc.) associated with the first user interface 430;

a first input processing module 454 for detecting one or more user inputs or interactions from one of the one or more first input devices 432 and translating the detected inputs or interactions.

In some embodiments, an information detection apparatus provided in the embodiments of the present application may be implemented in a software manner, and fig. 3 shows an information detection apparatus 455 stored in a first memory 450, which may be software in the form of a program and a plug-in, and includes the following software modules: the information presentation module 4551, the data acquisition module 4552, the data generation module 4553, the data transmission module 4554 and the execution determination module 4555 are logical, and thus may be arbitrarily combined or further split according to the functions implemented. The functions of the respective modules will be described hereinafter.

Referring to fig. 4, fig. 4 is a schematic structural diagram of one server in fig. 2 provided in an embodiment of the present application, and the server 200 shown in fig. 4 includes: at least one second processor 210, a second memory 250, at least one second network interface 220, and a second user interface 230. The various components in server 200 are coupled together by a second bus system 240. It is appreciated that the second bus system 240 is used to enable connected communications between these components. The second bus system 240 includes a power bus, a control bus, and a status signal bus in addition to the data bus. But for clarity of illustration the various buses are labeled in fig. 4 as the second bus system 240.

The second processor 210 may be an integrated circuit chip having signal processing capabilities such as a general purpose processor, a digital signal processor, or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc., wherein the general purpose processor may be a microprocessor or any conventional processor, etc.

The second user interface 230 includes one or more second output devices 231, including one or more speakers and/or one or more visual displays, that enable presentation of media content. The second user interface 230 also includes one or more second input devices 232 including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

The second memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid state memory, hard drives, optical drives, and the like. The second memory 250 optionally includes one or more storage devices physically remote from the second processor 210.

The second memory 250 includes volatile memory or nonvolatile memory, and may also include both volatile and nonvolatile memory. The non-volatile memory may be a read only memory and the volatile memory may be a random access memory. The second memory 250 described in embodiments of the present application is intended to comprise any suitable type of memory.

In some embodiments, the secondary memory 250 is capable of storing data to support various operations, examples of which include programs, modules and data structures, or subsets or supersets thereof, as exemplified below.

A second operating system 251 including system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

a second network communication module 252 for reaching other computer devices via one or more (wired or wireless) second network interfaces 220, the exemplary second network interface 220 comprising: bluetooth, wireless compatibility authentication, universal serial bus, etc.;

A second rendering module 253 for enabling the rendering of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more second output devices 231 (e.g., a display screen, a speaker, etc.) associated with the second user interface 230;

a second input processing module 254 for detecting one or more user inputs or interactions from one of the one or more second input devices 232 and translating the detected inputs or interactions.

In some embodiments, an information detecting apparatus provided in the embodiments of the present application may be implemented in a software manner, and fig. 4 shows an information detecting apparatus 255 stored in a second memory 250, which may be software in the form of a program and a plug-in, and includes the following software modules: the data receiving module 2551, the result determining module 2552 and the character dividing module 2553 are logical, so that any combination or further splitting may be performed according to the implemented functions. The functions of the respective modules will be described hereinafter.

In some embodiments, the information detecting apparatus provided in the embodiments of the present application may be implemented in hardware, and by way of example, the information detecting apparatus provided in the embodiments of the present application may be a processor in the form of a hardware decoding processor that is programmed to perform the information detecting method provided in the embodiments of the present application, for example, the processor in the form of a hardware decoding processor may employ one or more application specific integrated circuits (ASIC, application Specific Integrated Circuit), DSP, programmable logic device (PLD, programmable Logic Device), complex programmable logic device (CPLD, complex Programmable Logic Device), field programmable gate array (FPGA, field-Programmable Gate Array), or other electronic component.

In some embodiments, the terminal and the server may implement the information detection method provided in the embodiments of the present application by running a computer program. For example, the computer program may be a native program or a software module in an operating system; a local (Native) Application program (APP), i.e. a program that needs to be installed in an operating system to run, such as an information detection APP; the method can also be an applet, namely a program which can be run only by being downloaded into a browser environment; but also an applet that can be embedded in any APP. In general, the computer programs described above may be any form of application, module or plug-in.

Next, an information detection method provided in the embodiment of the present application will be described in conjunction with exemplary applications and implementations of the client device and the server device provided in the embodiment of the present application. In addition, the information detection method provided by the embodiment of the application is applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and vehicle-mounted.

Referring to fig. 5, fig. 5 is a flowchart illustrating a method for detecting information according to an embodiment of the present application, and the steps illustrated in fig. 5 will be described.

S501, the client device presents information to be detected.

In the embodiment of the application, the client device runs the application to be detected, and in the running process of the application to be detected, the information to be detected is presented in response to the browsing operation on the information to be detected.

It should be noted that the information to be detected may be at least one of comment content, reply content of comment content and article content, and is information whether the content to be detected is black content (i.e. abnormal information). The application to be detected is an application corresponding to the information to be detected; for example, when the information to be detected is comment content, the application to be detected may be a forum application; when the information to be detected is article information, the application to be detected may be a news application, or the like.

S502, the client device acquires behavior data to be detected aiming at information to be detected.

In the embodiment of the application, the client device and the server device detect the information to be detected based on the behavior information of the information to be detected, so that the client device acquires the behavior data aiming at the information to be detected, namely, the data corresponding to the processing of the information to be detected is collected, and the behavior data to be detected is acquired.

It should be noted that, the behavior data to be detected characterizes the data corresponding to the processing performed on the information to be detected; for example, browsing the data of the information to be detected, copying the data of the information to be detected, clicking the data of the information to be detected, interacting with the information to be detected (comment, attention, etc.), selecting the data of the information to be detected, searching the data of the information to be detected, and the like.

S503, when it is determined that the specified processing flow is executed based on the behavior data to be detected, the client device generates report data corresponding to the information to be detected.

In the embodiment of the application, a specified processing flow is set in the client device, or the client device can acquire the specified processing flow from other devices, where the specified processing flow is a processing flow performed on abnormal information by a pointer; thus, after the client device obtains the behavior data to be detected, it is determined whether or not a specified processing flow is performed with respect to the information to be detected based on the behavior data to be detected. When the client device determines that the specified processing flow is not executed for the information to be detected, the specified processing flow is determined not to be executed, and at this time, the information to be detected is not abnormal, so the client device continues to acquire new behavior data to be detected for the information to be detected, and determines whether the specified processing flow is triggered or not based on the new behavior data to be detected. When the client device determines that the specified processing flow is executed for the information to be detected, the specified processing flow is executed, and at this time, the information to be detected is indicated to be possibly abnormal information, so the client device generates reporting data for reporting to the server device for the information to be detected.

It should be noted that, the reported data is used for characterizing that the processing of the information to be detected triggers a specified processing flow, so that the information to be detected can be estimated as abnormal information according to the reported data; here, the client device transmits the report data to the server device, so that the server device detects whether the information to be detected is abnormal information based on the report data.

In the embodiment of the application, when the server device can receive the behavior data to be detected sent by each client device, the obtaining of the execution condition of the specified processing flow can be achieved through the server device.

S504, the server side equipment receives at least one report data sent by at least one client side equipment aiming at the information to be detected.

In the embodiment of the application, the number of the client devices for realizing information detection is at least one; each client device presents information to be detected on the client device, collects behavior data to be detected aiming at the information to be detected, and sends report data to the server device when determining that a specified processing flow is executed on the information to be detected on the client device based on the behavior data to be detected; at this time, the server device also receives a report data sent by a client device; when at least one client device sends reporting data to the server device aiming at the information to be detected, the server device also receives at least one reporting data sent by the at least one client device aiming at the information to be detected. Here, each client device transmits the report data to the server device, so that the server device determines a detection result of the information to be detected based on the received at least one report data.

It should be noted that, each client device is configured to determine, according to behavior data to be detected of the information to be detected, an execution condition of the specified processing procedure, and the reported data is sent by the client device when determining that the specified processing procedure is executed for the information to be detected.

S505, the server equipment determines a detection result of the information to be detected based on at least one piece of reported data.

In the embodiment of the application, after the server device obtains at least one piece of report data for the information to be detected, the information to be detected can be directly determined as the abnormal information based on the at least one piece of report data, so as to obtain a detection result that the information to be detected is the abnormal information; the detection can be further carried out based on at least one piece of reported data so as to obtain a detection result of whether the information to be detected is abnormal information or not; etc., and the embodiments of the present application are not limited thereto.

It can be understood that by presetting a specified processing flow for the abnormal information, determining an execution condition of the specified processing flow based on the behavior data to be detected of the information to be detected, and sending report data for the information to be detected to the server device when the specified processing flow is determined to be executed, so that the server device determines whether the information to be detected is the abnormal information based on at least one report data for the information to be detected received from at least one client device; the method is a process for detecting whether the information to be detected is the abnormal information based on the processing flow of the abnormal information, and because the processing flow of the abnormal information is usually fixed, whether the information to be detected is the abnormal information can be effectively detected, so that the effectiveness of information detection can be improved.

In the embodiment of the application, the specified processing flow includes at least one of browsing processing, application switching processing, selecting processing, copying processing, pasting processing, searching processing, and interaction processing; the browsing processing refers to processing that the browsing time length of the information is longer than the designated browsing time length, wherein the designated browsing time length is determined based on the browsing time length of the normal information, for example, the time length exceeding the browsing time length of the normal information, and the time length being lower than the browsing time length of the normal information; the application switching process refers to a process of switching from an application corresponding to the information to be detected to other applications, where the other applications are different from the application corresponding to the information to be detected, and the other applications are, for example, an instant chat application or a browser application; the selection processing refers to processing of selecting information, for example, selecting a certain word or phrase or all information in the information to be detected; the copy processing refers to processing of copy information; the paste processing refers to the processing of paste information; the search processing refers to processing of searching information, may be performed in an application corresponding to information to be detected, may be performed in an application different from the application corresponding to information to be detected and used for searching, and the like; the interaction processing refers to processing of interaction information, such as adding friends, paying attention to become group members, and so on.

Referring to fig. 6, fig. 6 is a second flowchart of the information detection method provided in the embodiment of the present application; as shown in fig. 6, in the embodiment of the present application, when the specified processing flow includes the browsing processing and the application switching processing, S506 to S509 are further included before S503; that is, when it is determined that the specified processing flow is executed based on the behavior data to be detected, the information detection method further includes S506 to S509 before the client device generates the report data corresponding to the information to be detected, and each step is described below.

S506, the client device acquires information browsing duration aiming at the information to be detected from the behavior data to be detected.

In the embodiment of the application, when the client device determines that the behavior data to be detected includes behavior data for browsing the information to be detected, the browsing duration of the information to be detected is obtained based on the behavior data for browsing the information to be detected by the user, and the information browsing duration is obtained.

S507, when the information browsing time period is longer than the appointed browsing time period, the client device determines that the browsing process is executed.

It should be noted that, because the browsing duration of the normal information by the user is generally smaller than the browsing duration of the abnormal information, the client device determines the designated browsing duration based on the browsing duration of the normal information by the user, and determines whether the information browsing duration exceeds the designated browsing duration; if the information browsing duration does not exceed the specified browsing duration, namely the information browsing duration is smaller than or equal to the specified browsing duration, ending the detection processing of the information to be detected; if the information browsing time length exceeds the appointed browsing time length, namely, the information browsing time length is longer than the appointed browsing time length, it is determined that the browsing processing in the appointed processing flow is executed for the information to be detected.

S508, when the behavior data to be detected includes the first application switching behavior data, the client device determines that the application switching process is performed.

In the embodiment of the application, when the client device determines that browsing processing is executed for the information to be detected, the client device continues to judge whether the behavior data to be detected includes first application switching behavior data or not; the first application switching behavior data refers to behavior data for switching to other applications in response to a link operation for information to be detected. If the behavior data to be detected does not comprise the first application switching behavior data, ending the detection processing of the information to be detected; if the behavior data to be detected comprises first application switching behavior data, it is determined that application switching processing is executed for the information to be detected.

It should be noted that, the information to be detected includes linkable information (such as a website, a hyperlink, etc.), and the linking operation refers to an operation of triggering the linkable information in the information to be detected.

S509, the client device determines that the specified process flow is executed based on the result of the browsing process being executed and the result of the application switching process being executed.

When the specified processing flow is the browsing processing and the application switching processing, the client device determines that the browsing processing and the application switching processing are both executed based on the behavior data to be detected, that is, determines that the specified processing flow is executed with respect to the information to be detected.

Referring to fig. 7, fig. 7 is a flowchart of a method for detecting information according to an embodiment of the present application; as shown in fig. 7, in the embodiment of the present application, when the specified processing flow includes the selection process, the search process, and the interaction process, S510 to S513 are further included before S503; that is, when it is determined that the specified processing flow is executed based on the behavior data to be detected, the information detection method further includes S510 to S513 before the client device generates the report data corresponding to the information to be detected, and each step is described below separately.

S510, when the behavior data to be detected comprises the selected behavior data, the client device determines that the selected processing is executed.

In the embodiment of the application, the client device firstly judges whether the behavior data to be detected comprises selected behavior data, wherein the selected behavior data refers to behavior data for obtaining selected information in response to a selected operation for the information to be detected; if the behavior data to be detected does not comprise the selected behavior data, ending the detection of the information to be detected; if the behavior data to be detected comprises the selected behavior data, determining that the selected processing is executed for the information to be detected.

It should be noted that the selecting operation is used for triggering the selection of the information in the information to be detected; the selected information is selected information in the information to be detected.

S511, when the first search behavior data is included in the behavior data to be detected, the client device determines that the search process is performed.

In the embodiment of the application, when determining that the selection processing is performed on the information to be detected, the client device continues to determine whether the behavior data to be detected includes first search behavior data, where the first search behavior data refers to behavior data for searching for the selected information; if the behavior data to be detected does not comprise the first search behavior data, ending the detection processing of the information to be detected; if the first search behavior data is included in the behavior data to be detected, it is determined that search processing is performed for the information to be detected.

Referring to fig. 8, fig. 8 is a schematic diagram illustrating an exemplary execution specification process according to an embodiment of the present application; as shown in fig. 8, the information 8-11 to be detected (112233 is good) is displayed in the page 8-1, wherein "112233" in the information 8-11 to be detected is the selected information 8-111; clicking right button or long pressing selected information 8-111 for selected information 8-111, popping up options 8-12 comprising 'search', clicking options 8-12 to search for selected information 8-111; at this time, the selection process and the search process are also performed.

S512, when the to-be-detected behavior data comprise interactive behavior data, the client device determines that the interactive processing is executed.

In the embodiment of the application, when determining that search processing is performed on information to be detected, the client device continues to judge whether the behavior data to be detected includes interactive behavior data, wherein the interactive behavior data is behavior data of interaction of a pointer on a search result corresponding to the search behavior data; if the behavior data to be detected does not comprise the interactive behavior data, ending the detection processing of the information to be detected; if the behavior data to be detected includes interactive behavior data, it is determined that interactive processing is performed with respect to the information to be detected.

It should be noted that, the search result refers to a result obtained by searching the selected information; the search results may be interacted with, either by browsing the search results or by interacting with the search results (e.g., comment reply, attention, friends, group members).

S513, the client device determines that the specified process flow is executed based on the result of the selected process being executed, the result of the search process being executed, and the result of the interaction process being executed.

When the specified processing flow is the selected processing, the search processing, and the interaction processing, the client device determines that the selected processing, the search processing, and the interaction processing are all executed based on the behavior data to be detected, that is, determines that the specified processing flow is executed with respect to the information to be detected.

Referring to fig. 9, fig. 9 is a flowchart of a method for detecting information according to an embodiment of the present application; as shown in fig. 9, in the embodiment of the present application, when the specified processing flow includes the copy processing, the application switching processing, and the search processing, S514 to S517 are further included before S503; that is, when it is determined that the specified processing flow is executed based on the behavior data to be detected, the information detection method further includes S514 to S517 before the client device generates the report data corresponding to the information to be detected, and each step is described below.

S514, when the copy behavior data is included in the behavior data to be detected, determining that the copy processing is performed.

In the embodiment of the application, the client device first judges whether the behavior data to be detected includes the copy behavior data, wherein the copy behavior data refers to behavior data for obtaining copy information in response to a copy operation for the information to be detected; if the behavior data to be detected does not comprise the copying behavior data, ending the detection processing of the information to be detected; if the copy behavior data is included in the behavior data to be detected, it is determined that the copy processing is performed for the information to be detected. It is easy to know that the copy information belongs to the information to be detected.

S515, when the second application switching behavior data is included in the behavior data to be detected, the client device determines that the application switching process is performed.

In the embodiment of the application, after determining that application switching processing is performed on information to be detected, the client device continues to determine whether second application switching behavior data is included in the behavior data to be detected, where the second application switching behavior data refers to behavior data of a running search application (for example, a browser is opened, and a search module of an instant chat application is opened), and the search application belongs to other applications and is used for searching information; if the behavior data to be detected does not comprise the second application switching behavior data, ending the detection of the information to be detected; if the to-be-detected behavior data includes second application switching behavior data, it is determined that application switching processing is performed for the to-be-detected information.

S516, when the second search behavior data is included in the behavior data to be detected, the client device determines that the search process is performed.

In the embodiment of the application, when determining that application switching processing is performed on information to be detected, the client device continues to determine whether second search behavior data is included in the behavior data to be detected, where the second search behavior data refers to behavior data that searches for duplicate information in a search application; if the behavior data to be detected does not comprise the second search behavior data, ending the detection processing of the information to be detected; if the second search behavior data is included in the behavior data to be detected, it is determined that search processing is performed for the information to be detected.

S517, the client device determines that the specified process flow is executed based on the result of the application switching process being executed, the result of the copy process being executed, and the result of the search process being executed.

When the specified processing flow is the copy processing, the application switching processing, and the search processing, the client device determines that the copy processing, the application switching processing, and the search processing are all executed based on the behavior data to be detected, that is, determines that the specified processing flow is executed with respect to the information to be detected. For example, a process of obtaining information B by a copy process in application a, then opening application C, and automatically searching for information B in application C.

In the embodiment of the present application, when the search application includes a function of automatically acquiring the copy information (for example, the copy information in the switch board can be acquired or the copy information can be acquired from the switch information), the specified processing flow is the copy processing, the application switch processing, and the search processing in this order, and the client device determines that the specified processing flow is executed through S514 to S517. When the search application cannot automatically acquire the copy information, the specified processing flow is the copy processing, the application switching processing, the paste processing, and the search processing, and the client device determines that the specified processing flow is executed based on the results of S514 to S517 and the paste processing being executed; when the behavior data to be detected comprises pasting behavior data, the client device determines that pasting processing is executed, and the pasting behavior data is the behavior data of obtaining pasting information in response to pasting operation for copy information in a search application; that is, after the application switching process is performed for the information to be detected, the client device continues to determine whether the pasting behavior data is included in the behavior data to be detected; if the behavior data to be detected does not comprise the pasting behavior data, ending the detection processing of the information to be detected; if the behavior data to be detected comprise pasting behavior data, determining that pasting processing is executed for the information to be detected; accordingly, the second search behavior data refers to behavior data for searching for paste information in the search application. It is easy to know that the copy information is identical to the paste information and belongs to the information to be detected.

In the embodiment of the present application, each step in S506 to S518 may be combined according to actual situations during actual application, and the embodiment of the present application is not described here.

In the embodiment of the present application, the client device generates the report data corresponding to the information to be detected in S503, including S5031 and S5032 (not shown in the figure), and each step is described below.

S5031, the client device acquires the type of the information to be detected, the information identifier, the triggered target information in the information to be detected and the account information of the information to be detected.

It should be noted that, the server device may obtain the detection result based on the number of times of reporting the report data of the information to be detected, and at this time, different information types may also correspond to different specified times of reporting, where the information type to be detected is used to determine the specified times of reporting corresponding to the information to be detected. The target information is used for determining a first matching result with a specified abnormal information base, and the specified abnormal information base is composed of various abnormal character strings; the specified account information is used for determining a second matching result with a specified abnormal account library, and the specified abnormal account library is composed of various abnormal accounts. The target information is data, such as selected information, duplicated information, in which any one of the specified processing flows is performed in the information to be detected. The account information is an account for issuing information to be detected.

S5032, the client device generates reporting data corresponding to the information to be detected based on at least one of the information type to be detected, the information identification, the target information and the account information.

It should be noted that, after reporting the report data, the client device enables the server device to obtain the number of times of reporting, the first matching result and the second matching result corresponding to the information to be detected based on at least one of the type of the information to be detected, the information identifier, the target information and the account information, and determine the detection result based on at least one of the number of times of reporting, the first matching result and the second matching result corresponding to the information to be detected.

Referring to fig. 10, fig. 10 is a flowchart fifth of the information detection method provided in the embodiment of the present application; as shown in fig. 10, in the embodiment of the present application, S505 may be implemented by S5051 and S5052; that is, the server device determines the detection result of the information to be detected based on at least one report data, including S5051 and S5052, and each step is described below.

S5051, the server side equipment acquires reporting times of reporting data corresponding to at least one piece of reporting data.

It should be noted that the number of reporting times is the number of reported data obtained by the server device for the information to be detected.

S5052, when the number of reporting times is greater than the first designated number of times, the server device determines that the information to be detected is a detection result of the abnormal information.

In the embodiment of the application, a first designated number of times is set in the server device, or the server device can obtain the first designated number of times from other devices, where the first designated number of times is used to determine whether the information to be detected is the lowest reporting number of times of the abnormal information, and is a threshold; the server device compares the obtained reporting times with the first designated times, and when the reporting times are larger than the first designated times, the server device indicates that at least one client device reports corresponding reporting data for the information to be detected more times, so that the server device obtains a detection result that the information to be detected is abnormal information at the moment.

In the embodiment of the application, S5052 is preceded by S5053 and S5054 (not shown in the figure); that is, before the server device determines that the information to be detected is the detection result of the abnormal information when the number of reporting times is greater than the first specified number of times, the information detection method further includes S5053 and S5054, and each step is described below.

S5053, the server equipment acquires the type of the information to be detected corresponding to the information to be detected.

It should be noted that the type of the information to be detected obtained by the server device is the type of the information to be detected.

S5054, the server device determines a first designated number of times corresponding to the information type to be detected based on the corresponding relation between the designated information type and the designated number of times.

It should be noted that, the appointed times of the reporting data corresponding to different information types are different, for example, when the information type is an article, the appointed times are 10 times; when the information type is comments, the appointed times are 5 times; when the information type is the reply content of the comment content, the designated times are 6 times. Here, the correspondence between the specified information type and the specified number of times is used for determining the specified number of times corresponding to the different information types; when one information type is given, the corresponding appointed times can be determined from the corresponding relation between the appointed information type and the appointed times; therefore, the server equipment determines the appointed times corresponding to the information type to be detected as the first appointed times from the corresponding relation between the appointed information type and the appointed times.

It can be understood that different designated times are set for different information types, and then a detection threshold value is determined based on the information type to be detected corresponding to the information to be detected (namely, the first designated times), so that the accuracy of information detection can be improved.

In the embodiment of the present application, S5051 is followed by S5055 and S5056 (not shown in the figure); that is, after the server device obtains the reporting times of the reporting data corresponding to at least one reporting data, the information detection method further includes S5055 and S5056, and each step is described below.

S5055, when the reporting times are smaller than or equal to the first designated times and larger than the second designated times, the server side equipment obtains at least one reporting duration corresponding to the reporting data.

In the embodiment of the application, when comparing the reporting times with the first designated times, if the reporting times are determined to be smaller than the first designated times, the server device continues to compare the reporting times with the second designated times; if the number of reporting times is less than or equal to the second designated number of times, continuing counting the number of reporting data aiming at the information to be detected; if the number of reporting times is determined to be larger than the second designated number of times, continuing to detect the information to be detected based on the reporting time length of at least one piece of reporting data. The reporting duration is a duration between an earliest reporting time and a latest reporting time corresponding to at least one piece of reporting data.

S5056, when the reporting time is smaller than the appointed reporting time, the server device determines that the information to be detected is a detection result of the abnormal information.

In the embodiment of the application, after the server side equipment obtains the reporting time length, judging the reporting time length and designating the size of the reporting time length; when the server side equipment determines that the reporting time length is greater than or equal to the appointed reporting time length, continuing to count the number of the reported data aiming at the information to be detected; and when the server equipment determines that the reporting time length is smaller than the appointed reporting time length, obtaining a detection result that the information to be detected is abnormal information.

It can be understood that the server device performs rechecking on the to-be-detected information of the received at least one reported data by combining the first designated times, the second designated times and the designated reporting time length, so that the accuracy of the detection result of the to-be-detected information can be improved, and the misjudgment rate can be reduced.

In the embodiment of the present application, S505 may also be implemented by S5057 to S50510 (not shown in the drawings); that is, the server device determines the detection result of the information to be detected based on at least one report data, including S5057 to S50510, and each step is described below.

S5057, the server equipment acquires triggered target information in the information to be detected from each piece of reporting data of at least one piece of reporting data, and at least one piece of target information corresponding to the at least one piece of reporting data is obtained.

S5058, the server device determines at least one of at least one piece of target information and information to be detected as information to be matched.

In the embodiment of the application, the reported data received by the server device comprises an information identifier, the information to be detected can be obtained through the information identifier, and the reported data is determined to be the data reported aiming at the information to be detected; in addition, the reported data also includes triggered information in the information to be detected, which is called target information, and can be copied content, selected content, searched content and the like. Here, the server device performs secondary detection by combining at least one piece of target information and information to be detected.

S5059, the server device matches the information to be matched in the appointed abnormal information base to obtain a first matching result.

It should be noted that, after the server device receives the report data for the information to be detected, the server device may implement secondary detection by matching at least one of the target information and the information to be detected in the specified abnormal information base, so as to improve accuracy of information detection.

S50510, when the first matching result is that the information to be matched is matched in the specified abnormal information base, the server device determines that the information to be detected is the detection result of the abnormal information.

It should be noted that, the server device matches the information matched with the information to be matched in the specified abnormal information base, so as to obtain a detection result that the information to be detected is abnormal information; and the information matched with the information to be matched is not matched in the appointed abnormal information base, and the detection can be continued based on the report times or the appointed abnormal account base.

In the embodiment of the present application, S50511 to S50513 (not shown in the figure) are further included before S5059; that is, before the server device matches the information to be matched in the specified abnormal information base to obtain the first matching result, the information detection method further includes S50511 to S50513, and each step is described below.

S50511, the server-side equipment divides the abnormal character string set into at least one abnormal character string sequence.

S50512, the server device constructs prefix structure information for each abnormal string sequence, and obtains at least one prefix structure information corresponding to at least one abnormal string sequence.

The abnormal character string set is composed of various abnormal character strings; combining a node and a child node sequence of the node in the prefix structure information into at least one abnormal character string, wherein one node is an abnormal character; the prefix structure information is, for example, a prefix tree.

S50513, the server determines at least one prefix structure information as a specified abnormality information base.

That is, the server performs matching of information to be matched in a specified abnormality information base based on at least one prefix structure information to the device.

Accordingly, in the embodiment of the present application, S5059 may be implemented by S50591 and S50592 (not shown in the drawings); that is, the server device matches the information to be matched in the specified abnormal information base to obtain a first matching result, including S50591 and S50592, and each step is described below.

S50591, in the appointed abnormal information base, the server side equipment obtains sub-matching results of the information to be matched in each prefix structure information, and at least one sub-matching result corresponding to at least one prefix structure information is obtained.

S50592, the server device determines at least one sub-matching result as a first matching result.

In the embodiment of the present application, the server device in S50511 divides the abnormal string set into at least one abnormal string sequence, including: the server device divides the abnormal character string set into at least one abnormal character string sequence based on the specified division mode.

It should be noted that the specified division manner includes at least one of a type of an abnormal character string and an identification index of an abnormal character; the types of the abnormal character strings are website types, sensitive word types and the like; the index of identity is, for example, pinyin initials, etc.

Accordingly, S5059 may be implemented by S50593 and S50596 (not shown in the drawings); that is, the server device matches the information to be matched in the specified exception information base to obtain a first matching result, including S50593 and S50596, and each step is described below.

S50593, the server equipment acquires the category to be matched corresponding to the information to be matched based on the specified division mode.

The category to be matched is at least one of a type and an identification index corresponding to the information to be matched. Such as pinyin initials, of the information to be matched.

S50594, the service side device determines a prefix structure information set corresponding to the category to be matched from at least one prefix structure information.

S50595, in the prefix structure information set, the server device obtains a sub-match result of the information to be matched in each prefix structure information, and obtains a sub-match result set corresponding to the prefix structure information set.

It should be noted that the prefix structure information set is formed by at least one prefix structure information including prefix structure information of a category to be matched; the sub-match result set is composed of sub-match results.

S50596, the server device determines the sub-matching result set as a first matching result.

In the embodiment of the present application, the server device in S50591 and S50595 obtains a sub-matching result of information to be matched in each prefix structure information, including: the server side equipment determines a reference node corresponding to a first character to be matched of the information to be matched in each prefix structure information; traversing the remaining character sequences to be matched in the information to be matched, wherein the remaining character sequences to be matched are sequences formed by the characters to be matched except the first character to be matched in the information to be matched; and carrying out iterative matching on the traversed characters to be matched in a corresponding reference sub-node sequence of the reference node in the prefix structure information to obtain a sub-matching result. That is, the (i+1) th character to be matched of the information to be matched is matched in the child node of the node corresponding to the (i) th character to be matched, wherein i is a positive integer.

When the information to be matched comprises three characters, namely a character 1, a character 2 and a character 3, the first character to be matched is the character 1, and the reference node is the node corresponding to the character 1 in the prefix structure information; here, the server device matches the character 2 in the child node of the reference node to obtain a new reference node corresponding to the character 2, and then matches the character 3 in the child node of the new reference node, so as to implement iterative matching.

In the embodiment of the present application, the determining, by the server device in S505, a detection result of the information to be detected based on at least one reported data includes: the method comprises the steps that a server device obtains account information triggering a specified processing flow from each piece of reporting data of at least one piece of reporting data, and at least one piece of account information corresponding to the at least one piece of reporting data is obtained; obtaining a second matching result of at least one account information in the appointed abnormal account library; and when the second matching result is that the account information is matched in the appointed abnormal account library, determining that the information to be detected is the detection result of the abnormal information.

It should be noted that, after the server device receives the report data for the information to be detected, if the report data includes account information corresponding to the information to be detected at this time, the account information may be matched in the specified abnormal account library, so as to implement secondary detection, and improve accuracy of information detection. Here, the server device matches the information matched with the account information in the specified abnormal account library, which indicates that the information to be detected is the information issued by the abnormal account (such as a black product account), and a detection result that the information to be detected is the abnormal information can be obtained; and the information matched with the account information is not matched in the appointed abnormal account library, so that the detection can be continued based on the report times or the appointed abnormal information library.

In the embodiment of the application, the processing of obtaining the detection result by the server device can be realized through a detection engine; wherein the detection engine is obtained by: the server equipment acquires the corresponding relation between the appointed information type and the appointed times; the server equipment acquires a second designated times corresponding to the designated reporting time length; the server device constructs a detection engine based on the corresponding relation between the appointed information type and the appointed times and the second appointed times corresponding to the appointed reporting time length.

It can be understood that the server device manages rule parameters of information detection by constructing the corresponding relationship between the designated information type and the designated times and the second designated times corresponding to the designated reporting time length as a detection engine, so that the updating efficiency of the information detection rule can be improved.

In the following, an exemplary application of the embodiments of the present application in a practical application scenario will be described. This exemplary application describes a process of detecting comment content (referred to as information to be detected) of a comment type (referred to as information to be detected) as blackout content.

Referring to fig. 11, fig. 11 is a schematic diagram of exemplary anomaly information provided in an embodiment of the present application; as shown in FIG. 11, a black-producing user has reviewed in the review area 11-1 under an article, as shown by the review content 11-2 ("c1234. CoM taken away does not decline").

Referring to fig. 12 for the detection process of comment content 11-2 in fig. 11, fig. 12 is a schematic flow chart of an exemplary information detection provided in an embodiment of the present application; as shown in fig. 12, this exemplary information detection includes S1201 to S1212, and the respective steps are described below.

S1201, the terminal (referred to as a client device) presents comment content.

It should be noted that, when the target object (for example, the user) opens the terminal, the terminal also enters the running state; and the terminal in the running state responds to the browsing operation of the object on the article content and the comment content, and presents the article content and the comment content. Here, the comment content presented is the comment content 11-2 in fig. 11.

S1202, the terminal collects target object behaviors (behavior data to be detected) aiming at comment contents.

S1203, the terminal determines whether or not the target object behavior sequentially performs timeout browsing (referred to as browsing processing), copying contents, cutting out an application, opening a browser (referred to as application switching processing together with the cutting out application), searching for copy contents (referred to as copying processing together with the copy contents, pasting processing, and searching processing). If yes, then execute S1204; if not, the collection of target object behaviors continues, and S1202 is performed.

Here, the sequentially executed processing is a specified processing flow in the embodiment of the present application, and the time-out browsing refers to, for example, that the information browsing duration exceeds the specified browsing duration (for example, 5 seconds).

S1204, the terminal reports information (referred to as reporting data) to the server (referred to as server device) for the comment content. S1205 or S1209 or S1211 is performed.

If the terminal determines that the target object triggers the screen based on the target object behavior, copying the content in the comment content, cutting out the application, opening the application such as a browser, and performing content pasting and searching in the application such as the browser; the terminal determines that the comment content is likely to be black content, and reports information to the server side aiming at the comment content.

Here, the information reported by the terminal may include a content Identification (ID) of the comment content and a copied content (referred to as target content); in addition, the reported information can also carry the content type (called information type) of the comment content, the target object identification (called account information) and the like. The data format of the reported information may be { content type (content_type): comment type (comment); content identification (content_id): comment_123456; copy content (opy _content):

-a }; it is readily apparent that content identification is used to determine comment content.

S1205, the server side counts the reporting times of the reported information received for the same comment content.

Here, the data format of the reported information received by the server side for the same comment content may be { content type (content_type): comment type (comment); content identification (content_id): comment_123456; number of reports (upload_num): 103}.

S1206, the server determines whether the number of reporting is greater than a target threshold (referred to as a first specified number). If yes, then execution S1208; if not, S1207 is performed.

It should be noted that, the target threshold is obtained from a configuration file, where the configuration file is a different threshold (called a designated number of times) set by the server side for different content types, and the corresponding data format may be { content type (content_type): comment type (comment), threshold (threshold): 200; content type (content_type): article type (content), threshold (threshold): 100}; thus, the server side can obtain the target threshold 200 based on the content type in the reported information.

S1207, the server side judges whether the reporting times are larger than the appointed reporting times (called second appointed times) corresponding to the appointed reporting time length; if yes, then execution S1208; if not, the number of times of reporting is counted, that is, S1205 is executed.

S1208, the server determines that the comment content is black content.

S1209, the server side matches in a black-out content library (called a designated abnormal information library) based on the reported information to obtain a first matching result.

S1210, the server side judges whether the first matching result is the comment content or the copy content of the comment content. If yes, then execution S1208; if not, S1205 is performed.

It should be noted that, the server side can obtain comment content based on the content identifier in the reported information, and then match in the black product content library based on the comment content and the copy content.

Here, in order to improve matching efficiency in the black content library, the black character string in the black content library may be stored in a database (for example, mySQL database), and then a prefix tree (Trie tree, referred to as at least one prefix structure information) is constructed based on the black character string derived from the database; each node in the prefix tree represents a black-producing character, and each node and a sub-node sequence thereof form a black-producing character string. When matching is performed in the prefix tree, an automaton algorithm (AC algorithm) may be used to record nodes that fail matching.

It should be further noted that, in order to improve the matching efficiency again, the prefix tree may be split in a parallel processing (e.g., mapReduce) manner. Referring to fig. 13, fig. 13 is an exemplary matching diagram provided in an embodiment of the present application; as shown in fig. 13, the server device divides all the black-product strings in the database 13-1 into a plurality of black-product string sequences according to a fixed step length, and each black-product string sequence is configured to be a sub-prefix tree 13-2 (called prefix structure information), and uses the sub-prefix tree as an atomic computation operator; the plurality of atomic computation operators are uniformly managed and called by the central management module 13-3; after the central management module 13-3 obtains the matching request, multiple atomic computation operators (namely multiple sub-prefix trees 13-2) are called concurrently to perform parallel matching, and the obtained multiple sub-matching results are combined. The number of the sub-prefix trees obtained by different step sizes is different, and the sub-prefix trees can be horizontally expanded along with the increase of the black product character strings.

Here, the server device may divide all the black-produced strings in the database into a plurality of black-produced string sequences (called at least one abnormal string sequence) according to the identification index (for example, the initial consonant of pinyin) and the type (for example, the website type and the sensitive word type) of the black-produced strings, and each obtained atomic computation operator at this time stores a corresponding service address and sub-library information (for example, the initial consonant range and the type) in the central management module; therefore, after the central management module acquires the matching request, based on the information to be matched corresponding to the matching request, the atomic calculation operators to be matched (called prefix structure information set) can be screened out from all the atomic calculation operators, so that parallel matching is carried out in the screened atomic calculation operators to be matched, and each obtained result is combined.

S1211, the server side matches in a black-product account library (called a designated abnormal account library) based on the reported information, and a second matching result is obtained.

S1212, the server side judges whether the second matching result is the target object identification matched with the comment content. If yes, then execution S1208; if not, S1205 is performed.

In this embodiment of the present application, the server may perform the judgment on the number of times of reporting through a rule engine (called a detection engine), where the rule engine includes a judgment rule (e.g., an expression) for detecting information on the number of times of reporting, for example, including a threshold value (called a correspondence between a specified information type and a specified number of times) set by different content types, specifying the number of times of reporting within a reporting duration, a matching manner with a black-out content library, a matching manner with a black-out account library, and so on. In this way, the rule engine is used for managing and judging the judging rules, so that the resource consumption of frequent variation of the judging rules can be reduced; and based on various judging rules in the rule engine, the accuracy of information detection can be improved, and the misjudgment rate is reduced.

Referring to fig. 14, fig. 14 is a schematic flow chart of information detection based on a detection engine according to an embodiment of the present application; as shown in fig. 14, for the information reported by the terminal 14-1, the server 14-2 generates reporting statistics 14-3, and invokes the rule engine 14-4 to perform black-out judgment on the reporting statistics 14-3, so as to obtain a result 14-5 for trial and a result 14-6 for non-trial.

It can be understood that, in the embodiment of the application, the behavior of the target object on the black product content is detected on the black product content, and the behavior of the target object on the black product content is usually fixed, so that the information detection method has universality and persistence; in addition, when the obtained reporting times are larger than a target threshold or larger than the appointed reporting times corresponding to the appointed reporting time length, or when the reported information is received and the corresponding information is matched in a black product character string library or a black product account library based on the reported information, the server side equipment determines that the information is black product content, and realizes multiple detection of the information, so that the accuracy of information detection can be improved, and the misjudgment rate is reduced; in addition, the information detection efficiency can be improved in a parallel matching mode; in addition, according to the embodiment of the application, the information is detected through the rule engine, so that the modification efficiency of the detection rule can be improved.

Continuing with the description below of an exemplary structure of the information detection device 455 implemented as a software module provided in an embodiment of the present application, in some embodiments, as shown in fig. 3, the software module stored in the information detection device 455 of the first memory 450 may include:

an information presenting module 4551 for presenting information to be detected;

the data acquisition module 4552 is configured to acquire behavior data to be detected for the information to be detected;

a data generating module 4553, configured to generate report data corresponding to the information to be detected when it is determined that a specified process flow is performed based on the behavior data to be detected, where the specified process flow is a process flow performed by a pointer on abnormal information;

and the data sending module 4554 is configured to send the report data to a server device, so that the server device determines a detection result of the information to be detected based on at least one received report data, where the detection result refers to whether the information to be detected is the abnormal information.

In this embodiment, when the specified processing flow includes a browsing process and an application switching process, the information detection device 455 further includes an execution determining module 4555, configured to obtain, from the behavior data to be detected, an information browsing duration for the information to be detected; when the information browsing time period is longer than the appointed browsing time period, determining that the browsing process is executed; when the behavior data to be detected comprises first application switching behavior data, determining that the application switching processing is executed, wherein the first application switching behavior data refers to behavior data which is switched to the other applications in response to a link operation aiming at the information to be detected; and determining that the specified process flow is executed based on the result of the browsing process being executed and the result of the application switching process being executed.

In this embodiment of the present application, when the specified processing flow includes a selection process, a search process, and an interaction process, the execution determining module 4555 is further configured to determine that the selection process is executed when the behavior data to be detected includes a selection behavior data, where the selection behavior data is behavior data for obtaining selection information in response to a selection operation for the information to be detected; when the behavior data to be detected comprises first search behavior data, determining that the search processing is executed, wherein the first search behavior data refers to behavior data for searching the selected information; when the behavior data to be detected comprises interactive behavior data, determining that the interactive processing is executed, wherein the interactive behavior data refers to the behavior data of the interaction aiming at the search result corresponding to the search behavior data; and determining that the specified process flow is executed based on the result of the selected process being executed, the result of the search process being executed, and the result of the interaction process being executed.

In this embodiment, when the specified processing flow includes a copy process, an application switching process, and a search process, the execution determining module 4555 is further configured to determine that the copy process is executed when the to-be-detected behavior data includes copy behavior data, where the copy behavior data is behavior data for obtaining copy information in response to a copy operation for the to-be-detected information; when the behavior data to be detected comprises second application switching behavior data, determining that the application switching processing is executed, wherein the second application switching behavior data refers to behavior data of running a search application, and the search application belongs to the other applications; determining that the search process is performed when second search behavior data is included in the behavior data to be detected, wherein the second search behavior data refers to behavior data for searching the copy information in the search application; the specified process flow is determined to be executed based on the result of the application switching process being executed, the result of the copying process being executed, and the result of the search process being executed.

In this embodiment of the present application, the data generating module 4553 is further configured to obtain a type of information to be detected of the information to be detected, an information identifier, triggered target information in the information to be detected, and account information of the information to be detected, where the type of information to be detected is used to determine a specified number of times of reporting corresponding to the information to be detected, the target information is used to determine a first matching result with a specified abnormal information library, the specified abnormal information library is formed by an abnormal character string, the specified account information is used to determine a second matching result with a specified abnormal account library, and the specified abnormal account library is formed by abnormal accounts; and generating the report data corresponding to the information to be detected based on at least one of the information type to be detected, the information identification, the target information and the account information.

Embodiments of the present application provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The first processor of the computer device (referred to as a client device) reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, so that the computer device performs the information detection method applied to the client device according to the embodiment of the present application.

Continuing with the description below of an exemplary structure implemented as a software module for another information detection device 255 provided in an embodiment of the present application, in some embodiments, as shown in fig. 4, the software module stored in the information detection device 255 of the second memory 250 may include:

a data receiving module 2551, configured to receive at least one report data sent by at least one client device for information to be detected, where each client device is configured to determine, according to behavior data to be detected of the information to be detected, an execution condition of a specified processing procedure, where the report data is sent by the client device when it is determined that the specified processing procedure is executed for the information to be detected, and the specified processing procedure is a processing procedure performed by a pointer on abnormal information;

the result determining module 2552 is configured to determine a detection result of the information to be detected based on at least one of the reported data, where the detection result refers to whether the information to be detected is the abnormal information.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain reporting times of the reporting data corresponding to at least one piece of reporting data; and when the reporting times are greater than the first designated times, determining that the information to be detected is the detection result of the abnormal information.

In this embodiment of the present application, when the number of times of reporting is greater than a first specified number of times, the result determining module 2552 is further configured to obtain a type of information to be detected corresponding to the information to be detected; and determining the first designated times corresponding to the information type to be detected based on the corresponding relation between the designated information type and the designated times.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain a reporting duration corresponding to at least one piece of reporting data when the number of reporting times is less than or equal to the first specified number of times and greater than the second specified number of times; and when the reporting time length is smaller than the appointed reporting time length, determining the information to be detected as the detection result of the abnormal information.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain, from each piece of reporting data of at least one piece of reporting data, triggered target information in the information to be detected, to obtain at least one piece of target information corresponding to at least one piece of reporting data; determining at least one of the target information and the information to be detected as information to be matched; matching the information to be matched in a specified abnormal information base to obtain a first matching result; when the first matching result is that the information to be matched is matched in the appointed abnormal information base, determining that the information to be detected is the detection result of the abnormal information.

In this embodiment of the present application, the information detecting apparatus 255 further includes a character dividing module 2553, configured to divide an abnormal string set into at least one abnormal string sequence, where the abnormal string set is formed by abnormal strings; constructing prefix structure information for each abnormal character string sequence to obtain at least one piece of prefix structure information corresponding to at least one abnormal character string sequence, wherein a node in the prefix structure information and a child node sequence of the node are combined into at least one abnormal character string, and one node is an abnormal character; at least one of the prefix structure information is determined as the specified abnormality information base.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain, in the specified abnormal information base, a sub-matching result of the information to be matched in each prefix structure information, and obtain at least one sub-matching result corresponding to at least one prefix structure information; at least one of the sub-match results is determined as the first match result.

In this embodiment of the present application, the character division module 2553 is further configured to divide the abnormal string set into at least one abnormal string sequence based on a specified division manner, where the specified division manner includes at least one of a type of the abnormal string and an identification index of the abnormal character.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain a category to be matched corresponding to the information to be matched based on the specified division manner; determining a set of prefix structure information corresponding to the category to be matched from at least one of the prefix structure information; obtaining a sub-matching result of the information to be matched in each prefix structure information in the prefix structure information set to obtain a sub-matching result set corresponding to the prefix structure information set, wherein the sub-matching result set is composed of the sub-matching results; and determining the sub-matching result set as the first matching result.

In this embodiment of the present application, the result determining module 2552 is further configured to determine, in each prefix structure information, a reference node corresponding to a first character to be matched of the information to be matched; traversing the residual character sequences to be matched in the information to be matched, wherein the residual character sequences to be matched are sequences formed by the characters to be matched except the first character to be matched in the information to be matched; and carrying out iterative matching on the traversed characters to be matched in a reference sub-node sequence corresponding to the reference node in the prefix structure information to obtain the sub-matching result.

In this embodiment of the present application, the result determining module 2552 is further configured to obtain, from each piece of reporting data of at least one piece of reporting data, account information triggering the specified processing flow, to obtain at least one piece of account information corresponding to at least one piece of reporting data; acquiring a second matching result of at least one account information in a specified abnormal account library; and when the second matching result is that the account information is matched in the appointed abnormal account library, determining that the information to be detected is the detection result of the abnormal information.

Embodiments of the present application provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The second processor of the computer device (referred to as a server device) reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, so that the computer device executes the information detection method applied to the server device in the embodiment of the present application.

The embodiment of the application provides a computer readable storage medium storing executable instructions, wherein the executable instructions are stored, and when the executable instructions are executed by a first processor, the first processor is caused to execute the information detection method applied to the client device provided by the embodiment of the application; or, when the executable instructions are executed by the second processor, the second processor is caused to perform the information detection method applied to the client device provided in the embodiments of the present application; for example, an information detection method as shown in fig. 5.

In some embodiments, the computer readable storage medium may be FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; but may be a variety of devices including one or any combination of the above memories.

In some embodiments, the executable instructions may be in the form of programs, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and they may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.

As an example, the executable instructions may, but need not, correspond to files in a file system, may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a hypertext markup language (HTML, hyper Text Markup Language) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub-programs, or portions of code).

As an example, the executable instructions may be deployed to be executed on one computer device (at this time, the one computer device, i.e., the client device and the server device), or on a plurality of computer devices located at one site (at this time, the plurality of computer devices located at one site, i.e., the client device and the server device), or on a plurality of computer devices distributed at a plurality of sites and interconnected by a communication network (at this time, the plurality of computer devices distributed at a plurality of sites and interconnected by a communication network, i.e., the client device and the server device).

It will be appreciated that in the embodiments of the present application, related data such as behavioral data may be related, when the embodiments of the present application are applied to a specific product or technology, target object permissions or consents may need to be obtained, and the collection, use and processing of related data may need to comply with relevant laws and regulations and standards of the relevant country and region.

In summary, in the embodiment of the present application, by presetting a specified processing flow for abnormal information, determining an execution condition of the specified processing flow based on behavior data to be detected of the information to be detected, and sending report data for the information to be detected to a server device when the specified processing flow is determined to be executed, so that the server device determines whether the information to be detected is abnormal information based on at least one report data for the information to be detected received from at least one client device; the method is a process for detecting whether the information to be detected is the abnormal information based on the processing flow of the abnormal information, and because the processing flow of the abnormal information is usually fixed, whether the information to be detected is the abnormal information can be effectively detected, so that the effectiveness of information detection can be improved.

The foregoing is merely exemplary embodiments of the present application and is not intended to limit the scope of the present application. Any modifications, equivalent substitutions, improvements, etc. that are within the spirit and scope of the present application are intended to be included within the scope of the present application.

Claims

1. An information detection method, the method comprising:

Presenting information to be detected;

2. The method according to claim 1, wherein the specified processing flow includes at least one of a browsing process, an application switching process, a selection process, a copying process, a pasting process, a search process, and an interaction process, wherein the browsing process is a process in which a browsing time period of information is longer than a specified browsing time period, the application switching process is a process in which an application corresponding to the information to be detected is switched to other applications, the selection process is a process in which information is selected, the copying process is a process in which information is copied, the pasting process is a process in which information is pasted, the search process is a process in which information is searched, and the interaction process is a process in which information is interacted.

3. The method according to claim 1 or 2, wherein when the specified processing flow includes a browsing process and an application switching process, before generating the report data corresponding to the information to be detected when it is determined that the specified processing flow is executed based on the behavior data to be detected, the method further comprises:

acquiring information browsing duration aiming at the information to be detected from the behavior data to be detected;

when the information browsing time period is longer than the appointed browsing time period, determining that the browsing process is executed;

when the behavior data to be detected comprises first application switching behavior data, determining that the application switching processing is executed, wherein the first application switching behavior data refers to behavior data which is switched to the other applications in response to a link operation aiming at the information to be detected;

and determining that the specified process flow is executed based on the result of the browsing process being executed and the result of the application switching process being executed.

4. The method according to claim 1 or 2, wherein when the specified processing flow includes a selection process, a search process, and an interaction process, before generating the report data corresponding to the information to be detected when it is determined that the specified processing flow is executed based on the behavior data to be detected, the method further comprises:

When the behavior data to be detected comprises selected behavior data, determining that the selected processing is executed, wherein the selected behavior data is the behavior data for obtaining selected information in response to a selected operation for the information to be detected;

when the behavior data to be detected comprises first search behavior data, determining that the search processing is executed, wherein the first search behavior data refers to behavior data for searching the selected information;

when the behavior data to be detected comprises interactive behavior data, determining that the interactive processing is executed, wherein the interactive behavior data refers to the behavior data of the interaction aiming at the search result corresponding to the search behavior data;

and determining that the specified process flow is executed based on the result of the selected process being executed, the result of the search process being executed, and the result of the interaction process being executed.

5. The method according to claim 1 or 2, wherein when the specified processing flow includes a copy process, an application switching process, and a search process, before generating report data corresponding to the information to be detected when it is determined that the specified processing flow is executed based on the behavior data to be detected, the method further comprises:

Determining that the copy processing is performed when the copy behavior data is included in the behavior data to be detected, wherein the copy behavior data refers to behavior data for obtaining copy information in response to a copy operation for the information to be detected;

when the behavior data to be detected comprises second application switching behavior data, determining that the application switching processing is executed, wherein the second application switching behavior data refers to behavior data of running a search application, and the search application belongs to the other applications;

determining that the search process is performed when second search behavior data is included in the behavior data to be detected, wherein the second search behavior data refers to behavior data for searching the copy information in the search application;

the specified process flow is determined to be executed based on the result of the application switching process being executed, the result of the copying process being executed, and the result of the search process being executed.

6. The method according to claim 1 or 2, wherein the generating of the report data corresponding to the information to be detected comprises:

acquiring a to-be-detected information type of the to-be-detected information, an information identifier, triggered target information in the to-be-detected information and account information of the to-be-detected information, wherein the to-be-detected information type is used for determining the appointed times of reporting corresponding to the to-be-detected information, the target information is used for determining a first matching result with an appointed abnormal information base, the appointed abnormal information base is composed of abnormal character strings, the appointed account information is used for determining a second matching result with an appointed abnormal account base, and the appointed abnormal account base is composed of abnormal accounts;

And generating the report data corresponding to the information to be detected based on at least one of the information type to be detected, the information identification, the target information and the account information.

7. An information detection method, the method comprising:

8. The method of claim 7, wherein the determining the detection result of the information to be detected based on at least one of the reported data comprises:

acquiring reporting times of the reporting data corresponding to at least one piece of reporting data;

And when the reporting times are greater than the first designated times, determining that the information to be detected is the detection result of the abnormal information.

9. The method according to claim 8, wherein before determining that the information to be detected is the detection result of the abnormal information when the number of times of reporting is greater than a first specified number of times, the method further comprises:

acquiring the type of the information to be detected corresponding to the information to be detected;

and determining the first designated times corresponding to the information type to be detected based on the corresponding relation between the designated information type and the designated times.

10. The method according to claim 8 or 9, wherein after the obtaining the number of times of reporting the reporting data corresponding to at least one of the reporting data, the method further comprises:

when the reporting times are smaller than or equal to the first designated times and larger than the second designated times, acquiring at least one reporting duration corresponding to the reporting data;

and when the reporting time length is smaller than the appointed reporting time length, determining the information to be detected as the detection result of the abnormal information.

11. The method of claim 7, wherein the determining the detection result of the information to be detected based on at least one of the reported data comprises:

Acquiring triggered target information in the information to be detected from each piece of reporting data of at least one piece of reporting data to obtain at least one piece of target information corresponding to at least one piece of reporting data;

determining at least one of the target information and the information to be detected as information to be matched;

matching the information to be matched in a specified abnormal information base to obtain a first matching result;

when the first matching result is that the information to be matched is matched in the appointed abnormal information base, determining that the information to be detected is the detection result of the abnormal information.

12. A client device for information detection, the client device comprising:

a first memory for storing executable instructions;

a first processor for implementing the information detection method of any one of claims 1 to 6 when executing executable instructions stored in the first memory.

13. A server device for information detection, the server device comprising:

a second memory for storing executable instructions;

a second processor for implementing the information detection method of any one of claims 7 to 11 when executing the executable instructions stored in the second memory.

14. A computer readable storage medium storing executable instructions for implementing the information detection method of any one of claims 1 to 6 when executed by a first processor; or executable instructions for implementing the information detection method of any one of claims 7 to 11 when executed by a second processor.

15. A computer program product comprising a computer program or instructions which, when executed by a first processor, implements the information detection method of any one of claims 1 to 6; or which computer program or instructions, when executed by a second processor, implement the information detection method of any one of claims 7 to 11.