WO2018088824A1

WO2018088824A1 - Method and apparatus for detecting abnormal user by using click log data

Info

Publication number: WO2018088824A1
Application number: PCT/KR2017/012689
Authority: WO
Inventors: 김상욱; 이상철; 채동규
Original assignee: 주식회사 파운트에이아이
Priority date: 2016-11-10
Filing date: 2017-11-09
Publication date: 2018-05-17
Also published as: KR20180052243A; KR101879829B1

Abstract

The present invention relates to an apparatus for detecting and method for detecting an abnormal user by using click log data with respect to an item on a site, wherein, according to one embodiment of the present invention, a method for detecting an abnormal user through the click log data with respect to an item on a site may comprise: a step of collecting click log data for each site user; a step of extracting an inter arrival time (IAT) for each site user by using the collected click log data; a step of extracting a diurnal activity (DA) for each site user using the collected click log data; a step of extracting an eigenscore (ES) for each site user by using the collected click log data; a step of calculating a suspicion score for each site user by using at least one of the extracted IAT, DA, or ES; and a step of detecting an abnormal user among the site users on the basis of the calculated suspicion score for each site user.

Description

Method and apparatus for detecting abnormal user using click log data

The present invention relates to a method and an apparatus for detecting an abnormal user using click log data of an item in a site, and according to an embodiment of the present invention, a behavior pattern of a site user using click log data of a site user. Analyze and detect abnormal users.

Furthermore, the present invention claims the benefit of Korean Patent Application No. 10-2016-0149329, filed November 10, 2016, the entire contents of which are incorporated herein.

Conventional fraud detection studies have been made through observation of an abnormal user's activity domain and activity pattern. For example, a click fraud detection study is one that detects behavior for users who intentionally click on a particular ad.Reputation fraud is a rating or comment on an ecommerce site. It is a study to detect a user who manipulates public opinion. In addition, ranking fraud is a study of detecting a user who uses an abnormal method to increase the popularity ranking of a specific application in the mobile app store.

In contrast, studies on analyzing behavior patterns (eg, click actions) of price comparison site users and detecting users showing behavior patterns suspected of abnormal users have not been conducted until now. This means that users who have anomalous behavior among price comparison sites are abnormal users of other services, such as click fraud on ad networks and reputation misconduct on online e-commerce sites. fraud), or different behavioral features than ranking frauds in the mobile app store.

More specifically, among the users who use the price comparison site, users who exhibit anomalous behavior may have a variety of reactions (e.g., purchases, ratings, download data related to items, items, etc.) for a single user. Click, etc.).

In existing domain systems, one user is not allowed to show more than one reaction to an item, or is considered unnatural. Therefore, the existing domain system cannot be applied to the abnormal user detection of the price comparison site where one user can exhibit various reactions to one item, and the existing abnormal user detection methods are also applied. Can not.

As described above, when one user is able to show various responses to one item, existing abnormal user detection methods cannot be used. Accordingly, an embodiment of the present invention may provide a method for detecting an abnormal user among users who use a price comparison site.

According to an embodiment of the present invention, a method of detecting an abnormal user through click log data of an item in a site may include collecting click log data for each site user, and using the collected click log data. Extracting IAT (inter arrival time) for each site; extracting DA (diurnal activity) for each site user using the collected click log data; and ES for each site user using the collected click log data; extracting an eigenscore, calculating a suspicion score for each site user using at least one of the extracted IAT, DA, or ES, and based on the calculated suspicion score for each user. Detecting.

According to an embodiment of the present invention, a method for detecting an abnormal user through click log data of an item in a site may include storing click log data for each user accessing the site for a preset time and storing the click log. Removing click log data whose total number of clicks on items in the site of the data is below a threshold.

According to an embodiment of the present invention, a method for detecting an abnormal user through click log data of an item in a site includes I _normal including time interval information of two consecutive click log pairs of all users of the site. Setting a vector, setting an I _u vector comprising time interval information for two consecutive click log pairs of any user u at the site, and based on the set I _normal vector and I _u vector, Calculating the IAT of any user u.

According to one embodiment of the invention, a method of detecting at least the user via the click log data for the items in the site comprises the steps of setting the D _normal vector comprising a time-specific clicks, information on all users of the site And setting a D _u vector including time slot click count information for any user u of the site, and calculating DA for each user based on the set D _normal vector and the D _u vector. have.

According to an embodiment of the present invention, a method of detecting an abnormal user through click log data of an item in a site comprises: configuring a user-item matrix for each user by using the click log data for each site user, SVD The method may include searching for a density block in the constructed matrix through singular vector decomposition, and extracting an ES for each site user based on the found density block.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data of an item in a site includes a database and a processor for storing the click log data, and the processor includes a click for each site user. Collect log data, extract IAT (inter arrival time) for each site user using the collected click log data, and extract DA (diurnal activity) for each site user using the collected click log data. Extracts ES (eigenscore) for each site user by using the collected click log data, calculates a suspicion score for each site user using at least one of the extracted IAT, DA, or ES, and calculates the calculated user The abnormal user may be detected among the site users based on the suspicion score.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data of an item in a site may store click log data for each user accessing the site for a preset time, and store the stored click log data. And removing click log data in which the total number of clicks on items in the site is less than a threshold.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data of an item in a site may include I _normal including time interval information of two consecutive click log pairs of all users of the site. Set an I _u vector containing time interval information for two consecutive click log pairs of any user u of the site, and based on the set I _normal and I _u vectors, And calculating an IAT of user u of.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data of an item in a site may set a D _normal vector including time slot click information for all users of the site, The method may include setting a D _u vector including click time information for each user u of the site, and calculating DA for each user based on the set D _normal vector and the D _u vector.

According to an embodiment of the present invention, an apparatus for detecting an abnormal user through click log data of an item in a site may construct a user-item matrix for each user and use SVD ( The method may include searching for a density block in the constructed matrix through singular vector decomposition, and extracting an ES for each site user based on the found density block.

According to an embodiment of the present invention, abnormal users may be detected among users who use the price comparison site. More specifically, the present invention may provide a method for detecting an abnormal user among site users without having to install an additional device by a provider (a neighbor shopping, Enuri.com, Danawa, etc.) providing a conventional price comparison service. Accordingly, an operator providing a price comparison service can easily detect an abnormal user at a small cost.

In addition, according to an embodiment of the present invention, it is possible to limit various attempts of users who use an unjust method in order to increase the popularity of the products they sell.

1 is a view illustrating a form in which recommended products are displayed on a site according to an embodiment of the present invention.

FIG. 2 is a diagram for comparing IAT differences between general users and abnormal users of a site according to an exemplary embodiment of the present invention.

3 is a view for comparing the DA difference between the general user and the abnormal user of the site according to an embodiment of the present invention.

4 is a diagram for comparing ES differences between a general user and an abnormal user of a site according to an embodiment of the present invention.

5 is a flowchart illustrating a method of detecting an abnormal user using click log data of an item in a site according to an embodiment of the present invention.

Specific structural or functional descriptions of the embodiments according to the inventive concept disclosed herein are merely illustrated for the purpose of describing the embodiments according to the inventive concept, and the embodiments according to the inventive concept. These may be embodied in various forms and are not limited to the embodiments described herein.

Embodiments according to the inventive concept may be variously modified and have various forms, so embodiments are illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments in accordance with the concept of the present invention to specific embodiments, and includes modifications, equivalents, or substitutes included in the spirit and scope of the present invention.

Terms such as first or second may be used to describe various components, but the components should not be limited by the terms. The terms are only for the purpose of distinguishing one component from another component, for example, without departing from the scope of the rights according to the inventive concept, the first component may be called a second component, Similarly, the second component may also be referred to as the first component.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected or connected to that other component, but it may be understood that other components may be present in the middle. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between. Expressions describing the relationship between the two, such as "between" and "immediately between" or "directly neighboring", should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. As used herein, the terms "comprise" or "having" are intended to designate that the stated feature, number, step, operation, component, part, or combination thereof is present, but one or more other features or numbers, It is to be understood that it does not exclude in advance the possibility of the presence or addition of steps, actions, components, parts or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined herein. Do not.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference numerals in the drawings denote like elements.

According to an embodiment, the site refers to a site including an item for analyzing a user's behavior pattern through click log data of the site user. For example, in the case of a price comparison site that compares and provides prices of various products, the ranking of the products may be provided based on popularity, sales volume, and the like of various products. Items provided as a link in the form of an image or text in the price comparison site may be used as a means for detecting the user's click log data.

1 is an example of a screen that may be displayed when a user searches for a laptop on a price comparison site. In FIG. 1, various items related to the laptop searched by the user may be displayed. Items corresponding to the search word input by the user may be provided as a link in the form of an image or text.

In FIG. 1, items related to a laptop searched by a user may be displayed in order according to popularity ranking. The popularity ranking of the items displayed on 120 may be provided based on click log data of users who use the site. For example, an item that receives the highest number of clicks from site users may be displayed as a priority. Alternatively, the item sold most to site users may be displayed in the first rank.

The site disclosed in FIG. 1 may be provided to a user through an apparatus for detecting an abnormal user according to an embodiment of the present invention. The apparatus for detecting an abnormal user may collect click log data of users who use the site, and extract inter-at arrival time (IAT), diurnal activity (DA), and ES (eigenscore) for the user from the collected click log data. And a database in which the collected click log data is stored. Hereinafter, IAT, DA, and ES will be described in detail with reference to FIGS. 2 to 4.

An inter arrival time (IAT) per site user, which can be extracted from the collected click log data, is a value representing a time required for the first user to click the first item again after clicking the first item. . That is, IAT is one of the indicators that can be used to distinguish between ordinary users and abnormal users.

The processor included in the apparatus for detecting the abnormal user may set the I _u vector based on the IAT value for any user u using the click log data. The I _u vector is an n-dimensional vector, where n may mean the length of the session (the time difference between the first click and the last click of the user u accessing the site). The value of the i-th dimension I of the vector _u, can be the ratio of the user u in the successive two-click log pairs having a second i-click time interval (click interval), click logs pair. For example, n may be set to 1,200. This means that if the user u accessing the site does not perform the next click operation for 1,200 seconds (ie, 20 minutes) after performing the first click on any item in the site, the user is considered to have ended the session. In this manner, the processor may set the I _normal vector using click log data of all users who use the site.

The x-axis of the graph disclosed in FIG. 2 may represent an i value, which is a time interval for two consecutive clicks of a user, and the y-axis may represent a number of click log pairs having a click time interval of i seconds. For example, when a user who accesses the site performs 10 clicks every three seconds, the user may be represented by coordinates corresponding to (3, 10) on the graph (a) of FIG. 2.

The graph (a) of FIG. 2 is a graph based on the IAT of all users who use the site, and the graph (b) is a graph based only on the IAT of users classified as abnormal users.

Referring to graph (a), it can be seen that most of the IATs of all users who use the site exist between 1 and 100 seconds. The IAT pattern, such as graph (a), is a typical pattern of IAT that can be extracted based on click log data that can be collected through a shopping site where an operation such as item search or price comparison is performed. For example, the IAT extracted from the click log data of users using the price comparison site may be expressed in a form similar to that of graph (a).

On the contrary, the IAT extracted from the click log data of the users classified as the abnormal users may be expressed in a form similar to that of the graph (b) of FIG. 2. Referring to graph (b), it can be seen that the majority of two consecutive click log pairs have a click time interval 210 of 9 to 14 seconds or a click time interval 220 of 40 seconds. It can be seen that the behavior pattern of a user who performs a plurality of clicks on one item at a specific time interval differs significantly from the behavior pattern of a general user.

According to an embodiment, by comparing an I _normal vector based on IAT values extracted from click log data of all users using a site and an I _u vector based on IAT values extracted from click log data of an individual user, It may be determined whether an individual user is an abnormal user. For example, by calculating the similarity between the I _normal vector based on the IAT value extracted from the click log data of all users using the site and the I _u vector based on the IAT value extracted from the user log click log data, A _u ^IAT , which is a suspicion score of a user interval, may be obtained.

According to an embodiment, a coolback-leibler divergence (DKL) may be used to calculate the similarity between the I _normal vector and the I _u vector. And, this can be expressed as Equation 1 below.

[Equation 1]

here,

I _u is the Kullback vector and the _normal vector I - and Lai blur divergence, i is an index indicating the dimension of the vector _u I I and _normal vector. Generally

Is an asymmetric function, so a _u ^IAT is

And

It can be calculated by averaging the values. This can be expressed as Equation 2 below.

[Equation 2]

Can be expressed as a value between 0 and 1 through min-max normalization.

In the above embodiment, the similarity between vectors is calculated using DKL, but is not limited thereto, and any method of calculating similarity between vectors may be applied. For example, Euclidean distance, Manhattan distance, cosine similarity or Hamming distance may be applied.

DA (diurnal activity) for each site user, which can be extracted from the collected click log data, is a value representing the daily activity amount per user and is one of the indicators that can be used to distinguish the general user from the abnormal user.

The processor included in the apparatus for detecting the abnormal user may set the D _u vector based on the DA value for any user u using the click log data. The D _u vector is a 24-dimensional vector, and 24 may mean 24 hours a day. The value of the i-th dimension of the D _u vector means the ratio of clicks that occur from i: 0 minutes 0 seconds to i: 59 minutes 59 seconds, and more specifically, may indicate the ratio of clicks per time period of the user u. . In this manner, the processor may set the D _normal vector using click log data of all users who use the site.

The x-axis of the graph disclosed in FIG. 3 may represent 24 hours a day, and the y-axis may represent a ratio of clicks per time zone.

The graph (a) of FIG. 3 is a graph based on DAs of all users who use the site, and the graph (b) is a graph based only on DAs of users classified as abnormal users.

Referring to graph (a), the lowest time zone for all users using the site is from 3 AM to 8 AM, which is the sleeping time, whereas the highest time zone for all users is 10 PM, which is night time. It can be seen that the hour to 0 am. The DA pattern, such as graph (a), is a typical pattern of DA that can be extracted based on click log data that can be collected through a shopping site where an operation such as item search or price comparison is performed. For example, DA extracted from click log data of users using a price comparison site may be expressed in a form similar to that of graph (a).

In contrast, DA extracted from click log data of users classified as abnormal users may be expressed in a form similar to that of graph (b) of FIG. 3. Referring to 310 of the graph (b), it can be seen that most clicks of the abnormal user were performed between 7 pm and 10 pm. It can be seen that the behavior pattern of the user who clicks only at a certain time of day is quite different from the behavior pattern of the general user.

According to an embodiment, by comparing a D _normal vector based on a DA value extracted from click log data of all users using a site and a D _u vector based on a DA value extracted from click log data of an individual user, It may be determined whether an individual user is an abnormal user. For example, by calculating the similarity of the D _normal vector based on the DA value extracted from the click log data of all users using the site and the D _u vector based on the DA value extracted from the click log data of the user u, A _u ^DA , which is a suspicion score for user u's daily activity, may be obtained.

According to an embodiment, a coolback-leibler divergence (DKL) may be used to calculate the similarity between the D _normal vector and the D _u vector. This may be represented as in Equation 3.

[Equation 3]

here,

Is the Kullback D vector _u and the _normal vector D-lie and blur divergence, i is an index indicating the dimension of the vector D _u and D _normal vector. Generally

Since a is asymmetric, a _u ^DA is

And

It can be calculated by averaging the values. This may be represented as in Equation 4.

[Equation 4]

Can be expressed as a value between 0 and 1 through min-max normalization.

The ES (eigenscore) per site user, which can be extracted from the collected click log data, is a value extracted based on the total number of daily clicks per user for each item existing in the site. For example, high ES of a specific user may mean that the number of clicks on a single item of a specific user is high, and at the same time, it may mean that the specific user is more than an abnormal user. User-specific ES is one of the indicators that can be used to distinguish between ordinary users and abnormal users.

The processor included in the apparatus for detecting the abnormal user may generate a matrix representing the total number of clicks per user for each item existing in the site, using the click log data of the users who use the site. For example, the first user to the nth user may be listed in a row of the matrix, and the number of clicks by date of the first to nth items may be listed in the column of the matrix.

Referring to the table of FIG. 4, the number of clicks on the first day of the first item of the first user may be expressed in one row and one column of the matrix according to an embodiment. Referring to 410, it can be seen that the first user performed 75 clicks on the first day and 42 clicks on the second day. Referring to 420, the third user may have performed 69 clicks on the first day and 80 clicks on the second day.

According to an embodiment, the processor may classify a user associated with a density block existing in the generated matrix as an abnormal user. The density of the density block may be set to correspond to the ratio of non-zero elements of the block and the numerical size of each element. According to the above embodiment, a density block may be generated when the user intensively clicks on a specific item in a short time.

For example, the processor may generate a daily user-item click matrix as disclosed in FIG. 4 using the click log data and then find a density block in the generated matrix. The processor may then measure the association between each user and the density block.

Singular vector decomposition (SVD) may be used for the processor to find a density block. (SVD is a commonly used method for finding density blocks included in a matrix. Since it corresponds to a known technology, the method of applying SVD is omitted.) For example, the generated SVD is based on click log data. You can apply SVD to a matrix. If 50 density blocks are detected, the processor may derive 50 singular values and singular vectors corresponding to each singular value.

The processor may set the absolute value of the values included in each derived singular vector to ES (eigenscore). ES (eigenscore) can be used as an indicator of how much the user is associated with the density block (dense block). For example, the larger the eigenscore, the greater the association between the user and the density block. The processor may normalize the ES (eigenscore) to a value between 0 and 1.

According to one embodiment, the processor may obtain a _u ^ES , which is a singular value suspicion score for any user u. To this end, the processor may calculate a distance between RE _average which is an average of eigenscores relative to all users and RE _u which is an average of eigenscores relative to users u. If this is expressed as an equation, it may be expressed as Equation 5 as follows.

[Equation 5]

According to an embodiment of the present disclosure, a processor may include at least one of a _u ^IAT which is a suspicion score of a user interval, a _u ^DA which is a suspicion score of daily activity of a user u, and a _u ^{ES which} is a suspicious value suspicion score of a user u. On the basis, the final suspicious score for user u can be calculated. The extended p-norm model, which is widely used in the field of information retrieval, may be used as a method for calculating a final suspicious score. The extended p-norm model can be divided into two types depending on the type of query (AND or OR).

According to an embodiment of the present invention, the method performed by the apparatus for detecting the abnormal user through the click log data of the item in the site may include the following steps.

In step 500, the processor may collect click log data of each user using the site. For example, users who access the site can click on various items contained within the site. Items included in the site may refer to links or contents provided in an image or text form. When the user clicks on the item, the processor may store identification information about the user who performed the click operation and corresponding click log data in the database.

The processor may edit the click log data stored in the database for a preset collection period. For example, if the number of clicks performed by the first user on the site during the collection period is below the threshold, the sample may exclude click log data for the first user from the sample, and the processor may exclude the click log data of the first user from the database. You can delete it from.

In steps 510 to 530, the processor is based on the click log data stored in the database, and among the inter arrival time (IAT), differential activity (DA) or ES (eigenscore) for users using the site. At least one can be extracted.

For example, in step 510, the processor may extract an inter arrival time (IAT) for each site user based on the click log data stored in the database. An inter arrival time (IAT) per site user, which can be extracted from the stored click log data, means, for example, the time taken for the first user to click on the first item after clicking the first item. Is a value. That is, IAT is one of the indicators that can be used to distinguish between ordinary users and abnormal users.

In operation 520, the processor may extract the DA (diurnal activity) per site user based on the click log data stored in the database. DA (diurnal activity) for each site user, which can be extracted from the stored click log data, is a value representing the daily activity amount per user and is one of the indicators that can be used to distinguish a general user from an abnormal user.

In operation 530, the processor may extract an ES (eigenscore) for each site user based on the click log data stored in the database. The ES (eigenscore) per site user, which can be extracted from the stored click log data, is a value extracted based on the total number of daily clicks per user for each item existing in the site. For example, a high ES of the first user may mean that the number of clicks for a single item of the first user is high, and at the same time, the first user may be an abnormal user. User-specific ES is one of the indicators that can be used to distinguish between ordinary users and abnormal users.

In operation 540, the processor may calculate a suspicion score for each site user using at least one of the extracted IAT, DA, or ES. More specifically, the processor is based on a _u ^IAT which is a click interval suspicion score calculated based on the user's ^IAT , a _u ^DA which is a suspicion of daily activity calculated based on the user's ^DA, or ES of the user u. The final suspicion score for the user u may be calculated using at least one value of a _u ^{ES which} is a singular value suspicion score calculated as.

In operation 550, the processor may detect an abnormal user among site users based on the calculated suspicious score for each user. For example, the suspicious scores calculated in step 540 may have values between [0, 1], and the closer the calculated value is to 1, the more likely that user is an anomaly. The system administrator who manages the device for detecting the abnormal user can set the reference value to determine the classification criteria for the abnormal user. For example, when the suspicion score set by the system administrator is 0.7, users who have obtained a suspicion score of 0.7 or higher may be classified as the abnormal user.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims

In the method for detecting an abnormal user through the click log data for the items in the site,

Collecting click log data for each site user;

Extracting an inter arrival time (IAT) for each site user by using the collected click log data;

Extracting DA (diurnal activity) for each site user using the collected click log data;

Extracting ES (eigenscore) for each site user by using the collected click log data;

Calculating a suspicious score for each site user using at least one of the extracted IAT, DA, or ES; And

Detecting abnormal users among the site users based on the calculated suspicious score for each user;

How to include.
The method of claim 1,

Collecting the click log data,

Storing click log data for each user accessing the site for a preset time; And

Removing click log data of the stored click log data in which the total number of clicks for items in the site is below a threshold;

How to include.
The method of claim 1,

Extracting the inter arrival time (IAT) for each site user may include:

Setting an I normal vector containing time interval information for two consecutive click log pairs of all users of the site;

Setting an I u vector containing time interval information for two consecutive click log pairs of any user u at the site; And

Calculating an IAT of the arbitrary user u based on the set I normal vector and I u vector

How to include.
The method of claim 1,

Extracting the DA (diurnal activity) for each site user,

Setting a D normal vector including click time information for all users of the site;

Setting a D u vector including time zone click count information for any user u of the site; And

Computing DA for each user based on the set D normal vector and the D u vector.

How to include.
The method of claim 1,

Extracting the ES (eigenscore) for each site user,

Constructing a user-item matrix for each user by using the click log data for each site user;

Retrieving a density block in the constructed matrix via singular vector decomposition; And

Extracting the ES for each site user based on the found density block;

How to include.
An apparatus for detecting an abnormal user through click log data of an item in a site,

A database for storing the click log data; And

Includes a processor,

The processor,

Collect click log data by site user,

Extract the IAT (inter arrival time) for each site user by using the collected click log data,

Extract DA (diurnal activity) for each site user by using the collected click log data,

Extract the ES (eigenscore) for each site user by using the collected click log data,

Using the extracted IAT, DA, or ES to calculate a suspicious score for each site user;

And detecting an abnormal user among the site users based on the calculated suspicious score for each user.
The method of claim 6,

The processor collects the click log data,

Stores click log data for each user who accesses the site for a preset time,

And removing click log data of the stored click log data for which the total number of clicks for items in the site is below a threshold.
The method of claim 6,

The processor extracts the inter arrival time (IAT) for each site user,

Set an I normal vector containing time interval information for two consecutive click log pairs of all users at the site,

Set an I u vector containing time interval information for two consecutive click log pairs of any user u at the site,

And calculating an IAT of the arbitrary user u based on the set I normal vector and I u vector.
The method of claim 6,

The processor extracts the DA (diurnal activity) for each site user,

Set a D normal vector containing information about clicks per hour for all users of the site,

Set a D u vector including time zone click count information for any user u of the site,

And calculating DA for each user based on the set D normal vector and the D u vector.
The method of claim 6,

The processor extracts the ES (eigenscore) for each site user,

The user-item matrix for each user is constructed by using the click log data for each site user.

Search for density blocks in the constructed matrix through singular vector decomposition,

And extracting the ES for each site user based on the found density block.