KR20180052243A - Method and device for detecting frauds by using click log data - Google Patents

Abstract

The present invention relates to a method and an apparatus for detecting an abnormal user by using click log data with respect to an item within a site. According to an embodiment of the present invention, the method for detecting an abnormal user through click log data with respect to an item within a site comprises the steps of: collecting click log data for each site user; extracting inter arrival time (IAT) for each site user by using the collected click log data; extracting diurnal activity (DA) for each site user by using the collected click log data; extracting eigenscore (ES) for each site user by using the collected click log data; calculating a doubt score for each site user by using at least one among the extracted IAT, DA and ES; and detecting an abnormal user from the site users based on the calculated doubt score for each user. The present invention is able to easily detect an abnormal user at low costs.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and an apparatus for detecting an abnormal user using click log data,

The present invention relates to a method and an apparatus for detecting an abnormal user by using click log data of an item in a site. According to an embodiment of the present invention, And can detect an abnormal user.

Conventional fraud detection studies have been done through observation of activity domains and activity patterns of abnormal users. For example, a click fraud detection study is a research that detects behavior for a user who intentionally clicks on a specific advertisement, and a reputation fraud is a rating or comment on an e-commerce site And so on. In addition, ranking fraud is a research that detects users who use abnormal methods to increase popularity ranking of a specific application in mobile app store.

On the other hand, research on analyzing behavior patterns (eg, click actions) of price comparison site users and detecting users who show suspicious behavior patterns as abnormal users has not been performed so far. This is because users who exhibit abnormal behaviors among users who use the price comparison site are more likely to be users of other services, for example, click fraud in the advertisement network, reputation in the online e-commerce site fraud), or ranking frauds in the mobile app store.

More specifically, users who exhibit abnormal behaviors among users using the price comparison site can be classified into various types such as a user who has various reactions (for example, purchase, rating, Click, etc.) can be shown.

In an existing domain system, one user is not allowed to show more than one reaction to an item, or is regarded as an unnatural act. Therefore, the conventional domain system can not be applied to the abnormal user detection of the price comparison site where one user can show various reactions for one item, and the existing abnormal fraud detection methods are also applied Can not.

As described above, when one user can show various responses to one item, the conventional abnormal user detection methods can not be used. Accordingly, an embodiment of the present invention can provide a method of detecting an abnormal user among users using a price comparison site.

According to an embodiment of the present invention, a method for detecting an abnormal user through click log data on an item in a site includes collecting click log data for each site user, using the collected click log data, Extracting a star interat arrival time (IAT), extracting a diurnal activity by the site user using the collected click log data, extracting a diurnal activity by the site user per ES using the collected click log data, eigenscore), calculating the suspicious point score for each site user using at least one of the extracted IAT, DA, or ES, and calculating a suspicious score for each of the site users based on the calculated user- And a step of detecting.

According to an embodiment of the present invention, there is provided a method of detecting an abnormal user through click log data on items in a site, the method comprising: storing click log data per user connected to the site for a preset time; And removing the click log data whose total number of clicks for the items in the site is less than the threshold.

According to an embodiment of the present invention, a method for detecting an anomaly through click log data on an item in a site includes the steps of: I _normal, which includes time interval information for two consecutive pairs of click logs of all users of the site; Setting an I _u vector including time interval information for two consecutive click-log pairs of any user u of the site, and based on the set I _normal vector and I _u vector, And calculating the IAT of any user u.

According to an embodiment of the present invention, a method for detecting an abnormal user through click log data on an item in a site includes: setting a D _normal vector including information on the number of clicks per time zone for all users of the site , Setting a D _u vector containing information on the number of clicks per time zone for any user u of the site, and calculating DA per user based on the set D _normal vector and D _u vector have.

According to an embodiment of the present invention, a method for detecting an abnormal user through click log data on an item in a site includes constructing a user-item matrix for each user using the click log data for each site user, searching for a dense block in the constructed matrix through a singular vector decomposition, and extracting the ES for each site user based on the retrieved dense block.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data on an item in a site includes a database for storing the click log data and a processor, Collects the log data, extracts the inter arrival time (IAT) for each site user using the collected click log data, extracts the diurnal activity by the site user using the collected click log data Extracts an ES (eigenscore) for each site user using the collected click log data, calculates the suspicious points for each site user by using at least one of the extracted IAT, DA, or ES, The abnormal user among the users of the site can be detected on the basis of the star suspect score.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data for an item in a site stores click log data per user connected to the site for a predetermined time, And removing the click log data whose total number of clicks for items in the site is less than the threshold.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data on an item in a site includes: I _normal, which includes time interval information for two consecutive click log pairs of all users of the site; Sets an I _u vector including time interval information on two consecutive click log pairs of a certain user u of the site, and generates an I _u vector based on the set I _normal vector and I _u vector, Lt; RTI ID = 0.0 > u < / RTI >

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data for an item in a site may set a D _normal vector including information on the number of clicks per time zone for all users of the site, Setting a D _u vector including the number of clicks per time zone for an arbitrary user u of the site, and computing DA per user based on the set D _normal vector and D _u vector.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data for an item in a site configures a user-item matrix for each user using the click log data for each site user, searching a dense block in the constructed matrix through singular vector decomposition and extracting the ES for each site user based on the dense block searched.

According to an embodiment of the present invention, an abnormal user among the users using the price comparison site can be detected. More specifically, the present invention can provide a method by which a provider (Naver Shop, Enuri.com, Danawa, etc.) that provides a conventional price comparison service can detect an abnormal user among site users without installing an additional device. Accordingly, a service provider providing a price comparison service can easily detect an abnormal user with a small cost.

Also, according to an embodiment of the present invention, various attempts of users who use an unfair method can be restricted to increase the popularity of a product they sell.

1 is a view for explaining a mode in which a recommended product is displayed in a site according to an embodiment of the present invention.
2 is a diagram for comparing IAT differences between a general user and an abnormal user in a site according to an embodiment of the present invention.
3 is a diagram for comparing DA differences between a general user and an ideal user in a site according to an embodiment of the present invention.
4 is a diagram for comparing ES differences between a general user and an ideal user in a site according to an embodiment of the present invention.
5 is a flowchart illustrating a method of detecting an abnormal user using click log data for an item in a site according to an embodiment of the present invention.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are presented for the purpose of describing embodiments only in accordance with the concepts of the present invention, May be embodied in various forms and are not limited to the embodiments described herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms " comprises " or " having ", and the like, are used to specify one or more of the features, numbers, steps, operations, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

1 is a view for explaining a mode in which a recommended product is displayed in a site according to an embodiment of the present invention.

A site according to an embodiment means a site that includes an item that can analyze a behavior pattern of a user through a click log date of a site user. For example, in the case of a price comparison site in which the prices of various products are compared with each other, the ranking of the products can be provided based on popularity of various products, sales volume, and the like. Items provided as links in the form of images or texts at these price comparison sites can be used as means for detecting the user's click log data.

FIG. 1 is an example of a screen that can be displayed when a user searches for a laptop at a price comparison site. In FIG. 1, various items related to the laptop searched by the user can be displayed. The items corresponding to the search term entered by the user can be provided as links in the form of images or texts.

In FIG. 1, the items related to the laptop searched by the user can be displayed in order according to popularity ranking. The popularity ranking of the items displayed at 120 may be provided based on the click log data of the users using the site. For example, the item that receives the largest number of clicks from the site users may be displayed in a rank order. Or, the items sold most to the site users may be ranked first.

The site disclosed in FIG. 1 may be provided to a user through an apparatus for detecting an abnormal user according to an embodiment of the present invention. The apparatus for detecting an abnormal user can collect click log data of users using the site and extract interat arrival time (IAT), diurnal activity (DA) and ES (eigenscore) for the user from the collected click log data And a database in which the processor and the collected click log data are stored. Hereinafter, the IAT, DA, and ES will be described in detail with reference to FIGS. 2 to 4. FIG.

2 is a diagram for comparing IAT differences between a general user and an abnormal user in a site according to an embodiment of the present invention.

The inter arrival time (IAT) for each site user that can be extracted from the collected click log data is a value indicating the time taken for the first user to click on the first item and again click on the first item . In other words, IAT is one of the indicators that can be used to distinguish general users from ideal users.

The processor included in the apparatus for detecting abnormal users can set an I _u vector based on the IAT value for an arbitrary user u using the click log data. I _u vector is an n-dimensional vector, and n can mean the length of the session (the time difference between the first click and the last click of the user u connected to the site). The value of the i-th dimension of the _{u u} vector may refer to the ratio of the click log pairs having a click interval of i seconds among two consecutive click log pairs of the user u. For example, n may be set to 1,200. This means that if the user u connecting to the site does not perform the next click operation for 1,200 seconds (i.e., 20 minutes) after performing the first click on any item in the site, the user is considered to have finished the session. In this manner, the processor may set the I _normal vector using the click log data of all users using the site.

The x-axis of the graph illustrated in Fig. 2 represents the i-value, which is the time interval for the user's two consecutive clicks, and the y-axis, may represent the number of click-log pairs having a click time interval of i seconds. For example, when a user who accesses the site performs 10 clicks at intervals of 3 seconds, it can be expressed in coordinates corresponding to (3, 10) on the graph (a) of FIG.

The graph (a) of FIG. 2 is a graph based on IAT of all users using a site, and the graph (b) is a graph based only on IAT of users classified as abnormal users.

Referring to graph (a), it can be seen that most of the IATs of all users using the site exist between 1 and 100 seconds. An IAT pattern such as graph (a) is a typical pattern of IAT that can be extracted based on click log data that can be collected through a shopping site where operations such as item search or price comparison are performed. For example, the IAT extracted from the click log data of the users using the price comparison site can be expressed in a form similar to the graph (a).

On the other hand, the IAT extracted from the click log data of users classified as abnormal users can be expressed in a form similar to the graph (b) of FIG. Referring to graph (b), it can be seen that the majority of two consecutive click log pairs have a click time interval 210 of 9 to 14 seconds or a click time interval 220 of 40 seconds. It can be seen that the behavior pattern of a user who performs a plurality of clicks on a single item at a specific time interval is considerably different from a behavior pattern of a general user.

According to one embodiment, by comparing an I _normal vector based on the IAT value extracted from the click log data of all the users using the site and the I _u vector based on the IAT value extracted from the individual user's click log data, It is possible to determine whether the individual user is an abnormal user. For example, by calculating for all users of the click log data I _normal based on the IAT value extracted from the vector and the user u of the similarity of I _u vector in the basis of the IAT value extracted from click log data using a site, A _{u u} ^IAT , which is the suspicious score of the user u's click interval, can be obtained.

According to one embodiment, Kullback-Leibler divergence (DKL) may be used to calculate the similarity between I _normal vectors and I _u vectors. This can be expressed by the following equation (1).

은 I_u 벡터와 I_normal 벡터의 쿨백-라이블러 발산이고, i 는 I_u 벡터와 I_normal 벡터의 차원을 나타내는 지표이다. 일반적으로

은 비대칭 함수이므로, a_u ^IAT 는

및

값을 평균하여 계산할 수 있다. 이는 아래의 수학식 2와 같이 나타낼 수 있다.here,

I _u is the Kullback vector and the _normal vector I - and Lai blur divergence, i is an index indicating the dimension of the vector _u I I and _normal vector. Generally

Is an asymmetric function, a _u ^IAT is

And

Can be calculated by averaging the values. This can be expressed by the following equation (2).

는 최소-최대 정규화(min-max normalization)를 통해 0과 1사이의 값으로 표현될 수 있다.

Can be expressed as a value between 0 and 1 through min-max normalization.

Although the similarity between vectors is calculated using the DKL in the above embodiment, the present invention is not limited thereto, and any method for calculating the similarity between vectors can be applied. For example, Euclidean distance, Manhattan distance, cosine similarity, or Hamming distance may be applied.

3 is a diagram for comparing DA differences between a general user and an ideal user in a site according to an embodiment of the present invention.

The diurnal activity per site user that can be extracted from the collected click log data is one of the indicators that can be used to distinguish general users from ideal users.

The processor included in the apparatus for detecting an abnormal user may set a D _u vector based on the DA value for an arbitrary user u using click log data. The D _u vector is a 24-dimensional vector, and 24 can mean 24 hours a day. The value of the i-th dimension of the D _u vector is the ratio of clicks occurring from 0 minutes 0 seconds to i 59 minutes 59 seconds i, and more specifically, the ratio of the number of clicks of user u by time zone . In this manner, the processor may set the D _normal vector using the click log data of all users using the site.

The x-axis of the graph shown in Fig. 3 represents 24 hours a day, and the y-axis represents the ratio of clicks by time zone.

The graph (a) of FIG. 3 is a graph based on DA of all users using the site, and the graph (b) is a graph based only on DAs of users classified as abnormal users.

Referring to the graph (a), all users using the site are at the lowest sleeping time (sleeping interval) from 3:00 am to 8:00 am, and conversely, all users have the highest DA at 10:00 pm 0 am to 0 am. A DA pattern such as graph (a) is a typical pattern of a DA that can be extracted based on click log data that can be collected through a shopping site where an operation such as item search or price comparison is performed. For example, the DA extracted from the click log data of the users using the price comparison site can be expressed in a form similar to the graph (a).

On the other hand, the DA extracted from the click log data of the users classified as the abnormal users can be expressed in a form similar to the graph (b) of FIG. Referring to 310 of the graph (b), it can be seen that most of the abnormal users have been clicked between 7 pm and 10 pm. It can be seen that the behavior pattern of a user performing a click only at a specific time of day is considerably different from a behavior pattern of a general user.

According to one embodiment, by comparing the D _normal vector based on the DA value extracted from the click log data of all the users using the site and the D _u vector based on the DA value extracted from the individual user's click log data, It is possible to determine whether the individual user is an abnormal user. For example, the similarity of a D _normal vector based on the DA value extracted from the click log data of all the users using the site and the D _u vector based on the DA value extracted from the click log data of the user u is calculated, A _u ^DA , which is the suspicious score of the daily activity amount of the user u, can be obtained.

According to one embodiment, Kullback-Leibler divergence (DKL) may be used to calculate the similarity between the D _normal vector and the D _u vector. This can be expressed by Equation (3).

은 D_u 벡터와 D_normal 벡터의 쿨백-라이블러 발산이고, i 는 D_u 벡터와 D_normal 벡터의 차원을 나타내는 지표이다. 일반적으로

은 비대칭 함수이므로, a_u ^DA 는

및

값을 평균하여 계산할 수 있다. 이는 수학식 4와 같이 나타낼 수 있다.here,

Is the Kullback D vector _u and the _normal vector D-lie and blur divergence, i is an index indicating the dimension of the vector D _u and D _normal vector. Generally

Since asymmetric function, a _u ^DA is

And

Can be calculated by averaging the values. This can be expressed by Equation (4).

는 최소-최대 정규화(min-max normalization)를 통해 0과 1사이의 값으로 표현될 수 있다.

Can be expressed as a value between 0 and 1 through min-max normalization.

Although the similarity between vectors is calculated using the DKL in the above embodiment, the present invention is not limited thereto, and any method for calculating the similarity between vectors can be applied. For example, Euclidean distance, Manhattan distance, cosine similarity, or Hamming distance may be applied.

4 is a diagram for comparing ES differences between a general user and an ideal user in a site according to an embodiment of the present invention.

The ES (eigenscore) for each site user that can be extracted from the collected click log data is a value extracted based on the total number of daily clicks for each item in the site. For example, a high ES of a particular user may mean that a particular user has a high number of clicks on a single item, and at the same time, it may mean that a particular user is more likely to be an abnormal user. The per-user ES is one of the indicators that can be used to distinguish general users from ideal users.

The processor included in the apparatus for detecting an abnormal user can generate a matrix indicating the total number of daily clicks for each item in the site using the click log data of the users using the site. For example, the rows of the matrix may list the first to n-th users, and the column of the matrix may list the number of clicks by date of the first to n-th items.

Referring to the table of FIG. 4, in the first row and first column of the matrix according to an embodiment, the number of clicks of the first day for the first item of the first user may be expressed. 410, it can be seen that the first user performed 75 clicks on the first day and the 42 clicks on the second day for the second item. 420, it can be seen that the third user performed 69 clicks on the first day and 80 clicks on the second day for the third item.

A processor according to an exemplary embodiment may classify a user associated with a dense block existing in a generated matrix as an abnormal user. The density of the dense block may be set to correspond to the ratio of the non-zero elements of the block and the number magnitude of each element. According to the embodiment, a dense block can be generated when a user intensively clicks on a specific item in a short time.

For example, the processor may use the click log data to generate a daily user-item click matrix as shown in FIG. 4, and then find a dense block in the generated matrix. The processor can then measure the association between each user and the dense block.

In the process of finding a dense block by the processor, singular vector decomposition (SVD) can be used. (SVD is a commonly used method for finding a dense block included in a matrix, and corresponds to a known technique, so that a method of applying SVD is omitted.) For example, SVD can be applied to a matrix. If 50 dense blocks are detected, the processor can derive 50 singular values and singular vectors corresponding to each singular value.

The processor may set the absolute value of the values contained in each derived singular vector to ES (eigenscore). ES (eigenscore) can be used as an indicator of how closely a user is associated with a dense block. For example, the larger the ES (eigenscore), the greater the association between the user and the dense block. The processor can normalize the ES (eigenscore) to a value between 0 and 1.

According to one embodiment, the processor can obtain a _{u u} ^ES , a singular value suspect score for any user u. To this end, the processor may calculate the average of the distance _u relative RE ES (eigenscore) to the mean _average of RE and the user u of the relative ES (eigenscore) for all users. This can be expressed as Equation (5) as follows.

The processor according to an embodiment may calculate at least one of a _u ^IAT , which is a suspicious score of a user u, a _u ^DA , a suspicious score of a user u, or a _u ^ES , which is a suspicious score of a unique value for a user u Based on this, the final suspect score for user u can be calculated. An extended p-norm model, which is often used in information retrieval, can be used as a method for a processor to calculate the final suspect score. The extended p-norm model can be divided into two types according to the kind of query (AND or OR).

5 is a flowchart illustrating a method of detecting an abnormal user using click log data for an item in a site according to an embodiment of the present invention.

According to an embodiment of the present invention, a method performed through an apparatus for detecting an abnormal user through click log data for an item in a site may include the following steps.

At step 500, the processor may collect click log data for each and every user utilizing the site. For example, users who access a site can click on various items contained within the site. Items included in the site may refer to links or contents provided in the form of images or text. When a user clicks an item, the processor may store identification information for the user who performed the click operation and corresponding click log data in the database.

The processor may edit the click log data stored in the database for a predetermined collection period. For example, if the number of clicks performed within the site by the first user during the collection period is less than the threshold, the click log data for the first user may be excluded from the sample, .

In step 510 to step 530, the processor determines whether the inter-arrival time (IAT), the diurnal activity (DA), or the ES (eigenscore) for the users using the site based on the click log data stored in the database At least one can be extracted.

For example, in step 510, the processor may extract an inter arrival time (IAT) per site user based on the click log data stored in the database. The inter-arrival time (IAT) for each site user that can be extracted from stored click log data means the time taken for the first user to click on the first item and then click again on the first item . In other words, IAT is one of the indicators that can be used to distinguish general users from ideal users.

At step 520, the processor may extract the diurnal activity DA per site user based on the click log data stored in the database. The diurnal activity per site user that can be extracted from stored click log data is one of the indexes that can be used to distinguish general users from ideal users.

At step 530, the processor may extract an ES (eigenscore) by site user based on the click log data stored in the database. The ES (eigenscore) for each site user that can be extracted from stored click log data is a value extracted based on the total number of daily clicks for each item in the site. For example, a high ES of a first user may mean that a first user has a high number of clicks on a single item, and at the same time, it may mean that a first user is highly likely to be an abnormal user. The per-user ES is one of the indicators that can be used to distinguish general users from ideal users.

At step 540, the processor may calculate a site user-specific suspicious score using at least one of the extracted IAT, DA, or ES. More specifically, the processor is based on a _u ^IAT , which is a click interval suspicion score calculated based on the ^IAT of user u, a _u ^DA , a daily activity suspicious score calculated based on ^{DA of} user u, or ES of user u , The final suspect score for the user u can be calculated using at least one of the a _u ^{ES, which} is the suspicious score of the specific value calculated as e u.

At step 550, the processor may detect an abnormal user among the site users based on the computed per-user suspicious score. For example, the suspicious scores calculated in step 540 may have values between [0, 1], and the closer the calculated value is to 1, the more likely the user is an abnormal user. The system administrator who manages the device that detects abnormal users can set the classification criteria for the abnormal user by setting the reference value. For example, if the suspicious score set by the system administrator is 0.7, users who have obtained a suspicious score of 0.7 or higher may be classified as abnormal users.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

A method for detecting an abnormal user through click log data on items in a site,
Collecting click log data for each site user;
Extracting an inter arrival time (IAT) for each site user using the collected click log data;
Extracting a diurnal activity DA per site user using the collected click log data;
Extracting an ES (eigenscore) for each site user using the collected click log data;
Calculating a suspect point score for each site user using at least one of the extracted IAT, DA, or ES; And
Detecting an abnormal user among the site users based on the calculated user-specific suspicious scores;
≪ / RTI > The method according to claim 1,
Wherein the collecting of the click log data comprises:
Storing click log data per user connected to the site for a preset time; And
Removing the click log data whose total number of clicks for items in the site is less than the threshold among the stored click log data
≪ / RTI > The method according to claim 1,
The step of extracting the inter arrival time (IAT)
Setting an I _normal vector including time interval information for two consecutive click log pairs of all users of the site;
Setting an I _u vector containing time interval information for two consecutive click-log pairs of any user u of the site; And
Calculating an IAT of any user u based on the set I _normal vector and I _u vector,
≪ / RTI > The method according to claim 1,
The step of extracting the diurnal activity DA per site user includes:
Setting a D _normal vector including information on the number of clicks per time zone for all users of the site;
Setting a D _u vector including the number of clicks per time zone for any user u of the site; And
Calculating DA by user based on the set D _normal vector and D _u vector
≪ / RTI > The method according to claim 1,
The step of extracting the ES (eigenscore)
Constructing a user-item matrix for each user using the site log user click log data;
Searching a dense block in the constructed matrix through singular vector decomposition (SVD); And
Extracting an ES for each site user based on the retrieved dense block;
≪ / RTI > An apparatus for detecting an abnormal user through click log data on items in a site,
A database for storing the click log data; And
A processor,
The processor comprising:
To collect click log data per site user,
Extracting an inter arrival time (IAT) for each site user using the collected click log data,
Extracting diurnal activity DA for each site user using the collected click log data,
Extracts ES (eigenscore) for each site user using the collected click log data,
Calculates a suspect point score per site user using at least one of the extracted IAT, DA, or ES,
And detects an abnormal user among the site users based on the calculated user-specific suspicious scores. The method according to claim 6,
The processor collecting the click log data comprises:
Stores click log data per user connected to the site for a preset time,
And removing the click log data whose total number of clicks for items in the site is less than the threshold among the stored click log data. The method according to claim 6,
Wherein the processor extracts the inter-arrival time (IAT) per site user,
Setting an I _normal vector containing time interval information for two consecutive click log pairs of all users of the site,
Sets an I _u vector containing time interval information for two consecutive click-log pairs of any user u in the site,
And computing an IAT of any user u based on the set I _normal vector and I _u vector. The method according to claim 6,
The processor extracting the site user DA (diurnal activity)
Sets a D _normal vector including information on the number of clicks per time zone for all the users of the site,
Sets a D _u vector including the number of clicks per time zone for any user u in the site,
And computing a per user DA based on the set D _normal vector and the D _u vector. The method according to claim 6,
Wherein the processor extracts the ES (eigenscore)
A user-item matrix for each user is constructed using the click log data for each site user,
A dense block is searched in the constructed matrix through singular vector decomposition (SVD)
And extracting the site-specific user ES based on the searched dense block.

Images