WO2022021977A1

WO2022021977A1 - Underground industry account detection method and apparatus, computer device, and medium

Info

Publication number: WO2022021977A1
Application number: PCT/CN2021/090947
Authority: WO
Inventors: 孙家棣; 马宁
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-07-31
Filing date: 2021-04-29
Publication date: 2022-02-03
Also published as: CN111931048A; CN111931048B

Abstract

An artificial intelligence-based underground industry account detection method and a related apparatus. The method comprises: upon determining that the number of accounts bound to a mobile phone number of a user exceeds a predetermined number, obtaining the account attribute data set of an account, wherein the user is associated with a target subject (S110); using attribute field data in the account attribute data set as a connection edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject (S120); performing graph clustering on the accounts in the account detection graph to obtain a plurality of account clusters (S130); using the attribute field data of each account cluster to generate a first field data document, and obtaining a second field data document of a whitelist account corresponding to the target subject (S140); calculating the weight of each word in the first field data document (S150); and determining an underground industry account cluster according to the weight of each word (S160). The solution further relates to the field of blockchains, and the account attribute data set can be stored in a blockchain, thereby effectively improving the accuracy of underground industry account detection.

Description

Black production account detection method, device, computer equipment and medium

This application claims the priority of the Chinese patent application filed on July 31, 2020 with the application number CN 202010763020.X, and the invention title is "artificial intelligence-based black product account detection method and related device", all of which The contents are incorporated herein by reference.

technical field

The present application relates to the technical field of artificial intelligence, and in particular, to a method, device, computer equipment, and computer-readable storage medium for detecting a fraudulent account based on artificial intelligence.

Background technique

In general, as the popularization of the Internet becomes more and more widespread, normal users enjoy the convenience of the Internet, but at the same time, they are also accompanied by the dangers brought by the black production of the Internet. At present, the network black production has been scaled and chained, and the forms of black production are becoming more and more diverse, and it is more and more difficult to prevent cheating. The purpose of black production has been profit-seeking. If there is demand, there will be a market.

With the advancement of technology, hacking attacks have become a problem that major companies attach great importance to, and they are facing hacking attacks all the time. No matter how the black product is realized, it needs to register a large number of fake accounts first to attack.

The inventor realizes that, at present, business risk identification needs to crack down on illegal activities and identify and crack down on fake illegal accounts. The industry currently mainly uses expert rules of thumb to identify and combat fake accounts. The identification surface of expert rules is relatively simple and narrow, mainly targeted and accurate identification and attack, because the logic is relatively simple, and it is easy to be identified and bypassed by illegal behavior.

SUMMARY OF THE INVENTION

In the field of artificial intelligence technology, in order to solve the above technical problems, the purpose of this application is to provide a method, device, computer equipment and computer-readable storage medium for detecting a fraudulent account based on artificial intelligence.

In the first aspect, an artificial intelligence-based black production account detection method is provided, including:

When it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject;

Using the attribute field data in the account attribute data set as a connecting edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject;

Perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connected edges in the account detection diagram to obtain a plurality of account clusters;

Using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject;

From the first field data document and the second field data document, calculate a weight for each word in the first field data document, the weight indicating that each of the words is in the first field data document relative to the importance in the second field data document;

Based on the weight of each of the words, a cluster of black production accounts is determined, and a group of black production accounts associated with the target subject is obtained.

In the second aspect, an artificial intelligence-based black production account detection device is provided, including:

an acquisition module, configured to acquire an account attribute data set of the account when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, and the mobile phone number is derived from the account database of the target subject;

A building module, used to use the attribute field data in the account attribute data set as a connection edge, and use the mobile phone number as a vertex to construct an account detection graph of the target subject;

a clustering module, configured to perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram, to obtain a plurality of account clusters;

The generating module is used for using the attribute field data of each of the account clusters to generate the first field data document of each of the account clusters, and to obtain the second field of the whitelist account corresponding to the target subject data files;

A calculation module, configured to calculate the weight of each word in the first field data document according to the first field data document and the second field data document, and the weight indicates that each of the words is in the first field data document. importance in a field data document relative to the second field data document;

The determining module is configured to determine the black production account clusters based on the weight of each of the words, and obtain the black production account groups associated with the target subject.

In a third aspect, a computer device is provided, including a memory and a processor, where the memory is configured to store a program for detecting a fraudulent account based on artificial intelligence of the processor, and the processor is configured to execute the program based on the artificial intelligence The artificial intelligence black product account detection program performs the following processing: when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject; The attribute field data in the account attribute data set is used as a connection edge, and the mobile phone number is used as a vertex to construct an account detection graph of the target subject; based on the attribute field data of the connection edge in the account detection graph, the account Perform graph clustering on the accounts in the detection graph to obtain a plurality of account clusters; use the attribute field data of each of the account clusters to generate the first field data document of each of the account clusters, and obtain all the account clusters. The second field data document of the whitelist account corresponding to the target subject; according to the first field data document and the second field data document, the weight of each word in the first field data document is calculated, and the weight Indicate the importance of each of the words in the first field data document relative to the second field data document; determine the black product account cluster based on the weight of each of the words, and obtain an association with all the words. Describe the target group of black-produced accounts.

In a fourth aspect, there is provided a computer-readable storage medium storing computer-readable instructions, on which is stored a program for detecting a fraudulent account based on artificial intelligence, and the program for detecting a fraudulent account based on artificial intelligence is processed When the device is executed, the following processing is implemented: when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject; the account attribute data set is collected. The attribute field data is used as the connection edge, and the mobile phone number is used as the vertex to construct the account detection graph of the target subject; based on the attribute field data of the connection edge in the account detection graph, the account in the account detection graph is graphed. to obtain a plurality of account clusters; use the attribute field data of each of the account clusters to generate the first field data document of each of the account clusters, and obtain the whitelist corresponding to the target subject The second field data document of the account; according to the first field data document and the second field data document, calculate the weight of each word in the first field data document, and the weight indicates that each word is in the The importance in the first field data document relative to the second field data document; determine the black production account cluster cluster based on the weight of each of the words, and obtain the black production account group associated with the target subject .

The above-mentioned artificial intelligence-based black production account detection method, device, computer equipment and computer-readable storage medium, first, when it is determined that the number of accounts bound to the mobile phone number derived from the account database of the target subject exceeds a predetermined number, the account number of the account is obtained. Attribute data set; preliminary screening of accounts in the target subject, excluding accounts whose mobile phone numbers are bound to accounts less than a predetermined number, obtain the account attribute data set to be detected, narrow the detection range and improve the detection reliability; then, the account attribute data The centralized attribute field data is used as a connection edge, and the mobile phone number is used as a vertex to construct an account detection graph of the target subject; based on the attribute field data of the connection edge in the account detection graph, graph clustering is performed on the accounts in the account detection graph to obtain multiple Account clustering cluster; build a graph by taking the mobile phone number of the associated account as a vertex, and then clustering the account clustering cluster based on the attribute field data graph, and reliable clustering to obtain the account gang; then, using the attribute field of each account clustering cluster data, generate the first field data document of each account cluster, and obtain the second field data document of the whitelist account corresponding to the target subject; it is convenient to perform data analysis based on the data document, and at the same time pass the normal second field data document As a comparison of the first field data document, the accuracy of the detection of the black product account is guaranteed; finally, according to the first field data document and the second field data document, the weight of each word in the first field data document is calculated to be based on each The weights of the words determine the clusters of black product accounts, the weights indicating the importance of each word in the first field data document relative to the second field data document. It can be accurately determined whether the account cluster is a black-producing account group according to the importance of each word in the first field data document relative to the second field data document.

It is to be understood that the foregoing general description and the following detailed description are exemplary only and do not limit the present application.

Description of drawings

FIG. 1 schematically shows a flow chart of a method for detecting a fraudulent account based on artificial intelligence.

FIG. 2 schematically shows an example diagram of an application scenario of an artificial intelligence-based black production account detection method.

FIG. 3 schematically shows a flow chart of a method for acquiring an account attribute data set of an account.

FIG. 4 schematically shows a block diagram of an artificial intelligence-based black product account detection device.

FIG. 5 schematically shows an example block diagram of a computer device for implementing the above-mentioned artificial intelligence-based black production account detection method.

FIG. 6 schematically shows a computer-readable storage medium for implementing the above-mentioned artificial intelligence-based black product account detection method.

detailed description

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments, however, can be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical solutions of the present application may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be employed. In other instances, well-known solutions have not been shown or described in detail to avoid obscuring aspects of the application.

Furthermore, the drawings are merely schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repeated descriptions will be omitted. Some of the block diagrams shown in the figures are functional entities that do not necessarily necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.

This example embodiment first provides an artificial intelligence-based black production account detection method. The artificial intelligence-based black production account detection method can be run on a server, a server cluster or a cloud server, etc. Of course, those skilled in the art The method of the present application can also be executed on other platforms according to requirements, which is not particularly limited in this exemplary embodiment. Referring to Fig. 1, the artificial intelligence-based black production account detection method may include the following steps:

Step S110, when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, obtain the account attribute data set of the account, and the mobile phone number is derived from the account database of the target subject;

Step S120, using the attribute field data in the account attribute data set as a connection edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject;

Step S130, performing graph clustering on the accounts in the account detection diagram based on the attribute field data of the connected edges in the account detection diagram, to obtain a plurality of account clusters;

Step S140, using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject ;

Step S150, according to the first field data document and the second field data document, calculate the weight of each word in the first field data document, the weight indicating that each word is in the first field importance in the data document relative to the second field in the data document;

Step S160: Determine a cluster of black product accounts based on the weight of each of the words, and obtain a black product account group associated with the target subject.

In the above-mentioned artificial intelligence-based black production account detection method, first, when it is determined that the number of accounts bound to the mobile phone number derived from the account database of the target subject exceeds a predetermined number, the account attribute data set of the account is obtained; Preliminary screening, excluding accounts whose mobile phone numbers are bound to an account number smaller than a predetermined number, obtains the account attribute data set to be detected, narrows the detection range and improves the detection reliability.

Then, the attribute field data in the account attribute data set is used as the connecting edge, and the mobile phone number is used as the vertex to construct the account detection graph of the target subject; Clustering is performed to obtain multiple account clusters; a graph is constructed by taking the mobile phone numbers of the associated accounts as vertices, and then based on attribute field data graph clustering, account clusters are obtained, and account groups are obtained by reliable clustering.

Then, use the attribute field data of each account cluster to generate the first field data document of each account cluster, and obtain the second field data document of the whitelist account corresponding to the target subject; Data analysis, and at the same time, the normal second field data document is used as the comparison of the first field data document to ensure the accuracy of black production account detection.

Finally, according to the first field data document and the second field data document, the weight of each word in the first field data document is calculated, so as to determine the black product account clusters based on the weight of each said word, the weight indicating each The importance of a word in the first field data document relative to the second field data document. Whether the account cluster is a black-producing account group can be reliably determined by the importance of each word in the first field data document relative to the second field data document.

Hereinafter, each step in the above-mentioned artificial intelligence-based black product account detection method in this exemplary embodiment will be explained and described in detail with reference to the accompanying drawings.

In step S110, when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, an account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject.

In the implementation of this example, referring to FIG. 2 , the server 210 may obtain the account attribute data set of the account associated with the target subject from the server 220; then, the server 210 may determine that the number of accounts bound to the user's mobile phone number exceeds When the predetermined number is reached, the account attribute data sets of all accounts corresponding to the mobile phone numbers whose number of bound accounts exceeds the predetermined number are acquired. Wherein, the server 210 and the server 220 may be various terminal devices with an instruction processing function and a data storage function, such as a computer and a mobile phone, which are not specially limited herein.

In the factual manner of this example, the server 210 and the server 220 are node servers in the blockchain, and based on the immutability and security of the data in the blockchain, the server 210 can safely and reliably obtain the association of the target subject from the server 220 The account attribute data set of the account.

The account attribute data set of each account includes field data of account-related attribute fields, which may include field data of related attribute fields such as mobile phone number, device, network environment, and login password, such as account password, mobile phone number, and login device id. The target subject can be any enterprise or platform.

When the number of accounts bound to the user's mobile phone number exceeds the predetermined number, it means that the account bound to the user's mobile phone number is suspected of being a fraudster. The predetermined number can be set according to the actual situation and is associated with a preset mobile phone number. The standard number of accounts, and the number of accounts associated with a mobile phone number exceeds this threshold, indicating that there is a suspicion of black production, for example, it can be 5 and so on.

In an example, account attribute data such as the network environment, device parameters, and registration passwords collected by the application can be used. Network black products may disguise dimensions such as network environment, device parameters, registration passwords, etc., but it is impossible to bypass the account indicator requirements for registering and binding the same user's mobile phone number. For example, when the target entity's requirement for the user's mobile phone number to register and bind the account is to take effect at the end of each month, it can first obtain accounts according to the predetermined number set by the target entity's bound account number within one month of binding the same user's mobile phone number. attribute dataset.

When it is determined that the number of accounts bound to the user's mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and all accounts associated with the target subject can be preliminarily screened, and accounts whose mobile phone number is bound to an account number less than the predetermined number are excluded. , to obtain the remaining account attribute data sets to be detected, which reduces the detection range and improves the detection accuracy.

In one embodiment, referring to FIG. 3 , when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, acquiring the account attribute data set of the account includes:

Step S310, obtain the business association condition between the target entity and the mobile phone number, the business association condition indicates the threshold of the number of accounts that can be bound to the mobile phone number in the target business, and the target business originates from the target entity ;

Step S320, when the account number bound with the mobile phone number exceeds the number threshold, acquire the account attribute data set of the account number.

The business association condition indicates the threshold of the number of accounts that can be bound to the user's mobile phone number in the target business, that is, the threshold of the number of accounts that can be bound to the mobile phone number set in a certain business activity held by the target entity, which is suitable for the target business. Realize accurate monitoring of suspected black-produced accounts according to different businesses.

In step S120, the attribute field data in the account attribute data set is used as a connection edge, and the mobile phone number is used as a vertex to construct an account detection graph of the target subject.

In the implementation of this example, the attribute field data in the account attribute data set is used as the connection edge and the mobile phone number is used as the vertex to construct the detection graph, that is, the mobile phone number associated with the account is used as the vertex, and the association relationship between the accounts according to the field data, Using the field as a connection edge, connect the associated accounts to obtain a detection graph, which can include various associations between the acquired accounts.

In an embodiment, the attribute field data in the account attribute data set is used as a connecting edge, and the mobile phone number is used as a vertex to construct an account detection graph of the target subject, including:

Obtain a fingerprint type field and a category type field in the account attribute data set, the fingerprint type field at least includes the login device ID, login password and the boot time of the login device, and the category type field at least includes the login device model, system version, The total storage space of the device, the login network address, and the physical address of the wireless network card;

The combination of the first predetermined number of the fingerprint-type fields and the combination of the second predetermined number of the category-type fields in the account attribute data set is used as a connection edge, and the corresponding field data combination is combined. The mobile phone number is used as a vertex to construct an account detection graph.

Define fields into two categories: fingerprint-type fields and category-type fields. For a fingerprint type field, any first predetermined number of field data can be used as a connection edge of the detection graph; while a category type field requires a second predetermined number of field data, which can be put together as a connection edge of the detection map.

In an embodiment, the first predetermined number is 2, and the second predetermined number is greater than or equal to 3 and less than or equal to 5.

A single field of the fingerprint field can be used as a connection edge for filtering, or two combinations can be used as edges together, which can effectively avoid accidental collisions. For example, the field data of a certain fingerprint field changed by a black product happened to be the same as that of a normal account. The two were combined together and used as a connection edge, which reduced the probability of accidental injury and collision. Similarly, multiple categorical fields are put together to filter data more accurately.

For example, (a) Ios system fingerprint type variables are the logon device identification id, the logon password, and the boottime boottime of the logon device. The correspondence between single field data and the number of mobile phone numbers is as follows (a1-a3):

(a1) The corresponding relationship between the number of device IDs and the number of mobile phone numbers is 1:1.06. (a2) The relationship between the number of login passwords and the number of mobile phone numbers is 1:1.51. (a3) The relationship between the number of boottimes and the number of mobile phone numbers is 1:1.18.

For example, if (a4-a6) are combined in pairs, there is almost a one-to-one relationship between the data combination of the two fields and the number of mobile phone numbers: (a4) The relationship between the device id and boottime and the number of mobile phone numbers is 1: 1.04. (a5) The relationship between the login password and boottime and the number of mobile phone numbers is 1:1.01. (a6) The relationship between the device id and the login password and the number of mobile phone numbers is 1:1.02.

For example, categorical variables include login device model, system version, total device storage space, login network address ip, physical address of wireless network card wifimac, etc. Usually, except for the above fingerprint variables, all can be attributed to categorical variables. The corresponding relationship between the single field data and the number of mobile phone numbers is (b1-b2): (b1) The relationship between the number of models and the number of mobile phone numbers is 1:28470.36, and the total number of models is usually 70. (b2) The relationship between the total storage space of the device and the number of mobile phone numbers is 1:134.34. Through the combination, the number of corresponding mobile phone numbers can be effectively reduced.

Step S130: Perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram to obtain a plurality of account clusters.

In the implementation of this example, the account detection graph can be graph-clustered using the existing graph clustering method to obtain account clusters. In this way, the relationship network of accounts can be constructed based on the construction of the account detection graph, and the accounts can be clustered based on the attribute field data to obtain similar account clusters.

In one embodiment, graph clustering is performed on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram to obtain a plurality of account clusters, including:

Based on the attribute field data of the connected edges, the account detection graph is subjected to graph clustering processing using the Connected Component algorithm to obtain multiple account groups;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with the same login network address, and obtain a first account group combination;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with physical addresses of the same wireless network card, and obtain a second account group combination;

The first account group combination and the second account group combination are determined as the account cluster.

The mobile phone number is the vertex, and the connected edges defined in the above steps are calculated by graph clustering using the Connected Component algorithm to obtain multiple node clusters.

The Connected Components algorithm, that is, the connected body algorithm labels each connected body (multiple account groups) in the graph with an ID, and uses the ID of the vertex with the smallest sequence number in the connected body as the ID of the connected body. If there is a path between any two vertices (mobile phone numbers) in the graph G, then G is called a connected graph, otherwise the graph is called a non-connected graph, and the maximally connected subgraph is called a connected body.

Then, perform a second graph clustering, taking the group number (identification id) of the first clustering result as the vertex, first, from the multiple account groups, obtain the number of mobile phone numbers that are greater than or equal to a predetermined number and are associated with Obtain a first account group combination from account groups with the same login network address. For example, acquire account groups that include a number of mobile phone numbers greater than or equal to 3 and are associated with the same login network address to obtain the first account group combination. Then, from the plurality of account groups, obtain account groups that include mobile phone numbers greater than or equal to the predetermined number and are associated with the physical address of the same wireless network card, and obtain a second account group combination, for example, (obtaining The number of accounts is greater than or equal to 3 and is associated with the account group of the physical address of the same wireless network card, and the second account group combination is obtained. The use of the quadratic graph clustering mainly corresponds to the second dial dynamic ip (login network address, the physical address of the wireless network card ) and merging small groups that were supposed to be the same gang.

For example, first, when the three account groups A, B and C are connected based on ip; then, when the three groups A, D and E are connected; in this case: A, B and C, D, E are jointly counted as a group account cluster clusters.

The black product will disguise the ip of several mobile phone numbers and change the ip or wifimac. In this way, in a graph clustering result, there are groups with a relatively small number of mobile phone numbers, and the ip or wifimac in the group are the same. These group ids are used as vertices, and ip or wifimac are used as connecting edges to achieve quadratic clustering.

Step S140, using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject .

In the implementation of this example, the first field data document and the second field data document may be text documents or tables.

The whitelist account corresponding to the target subject, that is, the account of the whitelisted user, can be the account attribute data set of the internal user of the subject corresponding to the target subject. For example, the account-related data of an employee of an organization can be determined as non-black data. .

The second field data document of the whitelist account corresponding to the target subject can be generated from the attribute field data of the whitelist account.

By generating the first field data file and the second field data file, it is convenient to perform data analysis based on the data file, and at the same time, the normal second field data file is used as the comparison of the first field data file to ensure the accuracy of the detection of the black product account.

Step S150, according to the first field data document and the second field data document, calculate the weight of each word in the first field data document, the weight indicating that each word is in the first field Importance in the data document relative to the second field in the data document.

In the implementation of this example, the first field data document of each account cluster can be obtained by calculating a weight indicating the importance of each word in the first field data document relative to the second field data document Words with "unique" weights (that is, attribute field data), and furthermore, if there is "unique" attribute field data of the group in the account gang, there is a high probability that it is a simulator parameter modified by black products.

In one embodiment, calculating the weight of each word in the first field data document according to the first field data document and the second field data document, including:

For each word in the first field data document, calculating the first frequency of occurrence of each word in the first field data document;

For each word in the first field data document, calculating a second frequency of simultaneous occurrence of each of the words in the first field data document and the second field data document;

The product of the first frequency and the second frequency is used as the weight of each of the words.

Calculate the first frequency that each word appears in the first field data document, and the importance of each word in the first field data document to be detected can be obtained; then, calculate the first field data document and the first field data document of each word. The second frequency that appears simultaneously in the two-field data document can obtain the global importance of each word. Finally, the product of the first frequency and the second frequency is used as the weight of each word, which can be obtained from the perspective of the global data set through the weight. Indicates the importance of each word in the first field data document relative to the second field data document.

The weight of each word is calculated based on the formula tf-idf(t,d)=tf(t,d)×idf(t), idf(t)=log(N/e), wherein the tf-id(tf , d) is the weight, the t is the word, the d is the first field data document, the tf(t, d) is the frequency of the word appearing in the first field data document, so The idf(t) is the inverse text frequency of the word in the document, the N is the total number of the first field data document and the second field data document, and e is the first field data document and the second field data document. The number of documents in which the word appears in the field data document.

Through the formula tf-idf(t,d)=tf(t,d)×idf(t), idf(t)=log(N/e), the TF-IDF algorithm can accurately and efficiently identify the account of the black gang ( The simulator parameters of the black production account cluster). There are words with large TF-IDF weights in the gang account, indicating that there are words that are "unique" for the gang account in the gang account, and the high probability is the simulator parameter. In this way, detection resources can be saved. Under the same number of detections, more black gang accounts can be fished out according to the TF-IDF weight sorting. Experiments have shown that by sorting according to this standard, more black gang accounts can be found under the same number of detections.

According to the importance of each word in the first field data document relative to the second field data document, it can be reliably judged whether the account cluster is a black-producing account group.

In one embodiment, the weight of each described word is used to determine the clusters of black production accounts, including:

Determine the first field data document from which the word with the weight higher than the predetermined weight comes from, as the black product data document;

The account cluster corresponding to the black product data document is determined as a black product account group.

The predetermined weight can be set according to the actual situation. There are words with weights higher than the predetermined weights, indicating that the data in the first field data document from which the words with weights higher than the predetermined weights come from are abnormal, and it is determined as a black production data document, and then, yes, the account corresponding to the black production data document is The cluster is determined to be a black-produced account gang.

Calculate the average weight of words in each of the first field data documents;

Determine the first field data document with the weight average value higher than a predetermined average value as a black product data document;

To calculate the average weight of words in each first field data document, the weights of all words can be comprehensively considered, and the abnormal situation of account clusters can be considered globally based on the first field data document. Furthermore, the first field data document whose weight average value is higher than the predetermined average value is determined as the black product data document, and the black product account gang can be reliably detected globally.

The present application also provides an artificial intelligence-based black production account detection device. Referring to FIG. 4 , the artificial intelligence-based black production account detection device may include an acquisition module 410 , a construction module 420 , a clustering module 430 , a generation module 440 , a calculation module 450 and a determination module 460 . in:

The acquisition module 410 can be used to determine that when the number of accounts bound to the user's mobile phone number exceeds a predetermined number, acquire the account attribute data set of the account, and the user is associated with the target subject;

The building module 420 can be configured to use the attribute field data in the account attribute data set as a connection edge, and use the mobile phone number as a vertex to construct an account detection graph of the target subject;

The clustering module 430 may be configured to perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram, to obtain a plurality of account clusters;

The generating module 440 can be configured to use the attribute field data of each of the account clusters to generate the first field data document of each of the account clusters, and obtain the second data of the whitelist account corresponding to the target subject. field data document;

The calculation module 450 may be configured to calculate the weight of each word in the first field data document according to the first field data document and the second field data document, the weight indicating that each word is in the importance in the first field data document relative to the second field data document;

The determining module 460 may be configured to determine a cluster of black product accounts based on the weight of each of the words, and obtain a black product account group associated with the target subject.

In one embodiment, the obtaining module is further configured to:

Obtain the business association condition between the target entity and the mobile phone number, the business association condition indicates the threshold of the number of accounts that can be bound to the mobile phone number in the target business, and the target business originates from the target entity;

When the account number bound to the mobile phone number exceeds the number threshold, the account attribute data set of the account number is acquired.

In one embodiment, the clustering module is further configured to:

In one embodiment, the computing module is further configured to:

In one embodiment, the determining module is further configured to:

It should be noted that although several modules or units of the apparatus for action performance are mentioned in the above detailed description, this division is not mandatory. Indeed, according to embodiments of the present application, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of one module or unit described above may be further divided into multiple modules or units to be embodied.

Additionally, although the various steps of the methods of the present application are depicted in the figures in a particular order, this does not require or imply that the steps must be performed in the particular order or that all illustrated steps must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, and the like.

According to a third aspect of the present application, a computer device is also provided, which performs all or part of the steps of any of the above-mentioned artificial intelligence-based methods for detecting fraudulent accounts. The computer equipment includes:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute as illustrated in any of the above-described exemplary embodiments The artificial intelligence-based black production account detection method.

As will be appreciated by one skilled in the art, various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application can be embodied in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which may be collectively referred to herein as implementations "circuit", "module" or "system".

A computer device 500 according to this embodiment of the present application is described below with reference to FIG. 5 . The computer device 500 shown in FIG. 5 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

As shown in FIG. 5, computer device 500 takes the form of a general-purpose computing device. Components of the computer device 500 may include, but are not limited to, the above-mentioned at least one processing unit 510 , the above-mentioned at least one storage unit 520 , and a bus 530 connecting different system components (including the storage unit 520 and the processing unit 510 ).

Wherein, the storage unit stores program codes, and the program codes can be executed by the processing unit 510, so that the processing unit 510 executes various exemplary methods according to the present application described in the above-mentioned “Methods of Embodiments” of this specification. Implementation steps. For example, the processing unit 510 may execute step S110 as shown in FIG. 1 , and when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, obtain the account attribute data set of the account, and the mobile phone number is derived from the target The account database of the subject; Step S120, use the attribute field data in the account attribute data set as a connection edge, and use the mobile phone number as a vertex to construct an account detection graph of the target subject; Step S130, based on the account detection graph Perform graph clustering on the accounts in the account detection diagram by using the attribute field data of the connecting edges in the middle to obtain a plurality of account clusters; step S140, use the attribute field data of each of the account clusters to generate each of the account clusters. The first field data file of the account cluster, and the second field data file of the whitelist account corresponding to the target subject is obtained; Step S150, according to the first field data file and the second field data file, calculate The weight of each word in the first field data document, the weight indicating the importance of each word in the first field data document relative to the second field data document; Step S160, Based on the weight of each of the words, a cluster of black production accounts is determined, and a group of black production accounts associated with the target subject is obtained.

The storage unit 520 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 5201 and/or a cache storage unit 5202 , and may further include a read only storage unit (ROM) 5203 .

The storage unit 520 may also include a program/utility 5204 having a set (at least one) of program modules 5205 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, An implementation of a network environment may be included in each or some combination of these examples.

The bus 530 may be representative of one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any of a variety of bus structures. bus.

Computer device 500 may also communicate with one or more external devices 700 (eg, keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the computer device 500, and/or communicate with Any device (eg, router, modem, etc.) that enables the computer device 500 to communicate with one or more other computer devices. Such communication may take place through an input/output (I/O) interface 550 , which may also include a display unit 540 coupled to the input/output (I/O) interface 550 . Also, the computer device 500 may communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network such as the Internet) through a network adapter 560 . As shown, network adapter 560 communicates with other modules of computer device 500 via bus 530 . It should be understood that, although not shown, other hardware and/or software modules may be used in conjunction with computer device 500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives and data backup storage systems.

From the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein may be implemented by software, or may be implemented by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present application may be embodied in the form of software products, and the software products may be stored in a non-volatile storage medium (which may be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computer device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present application.

According to a fourth aspect of the present application, there is also provided a computer-readable storage medium on which a program product capable of implementing the above-mentioned method of the present specification is stored, and the computer-readable storage medium may be non-volatile or easily accessible. loss of sex. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes program code, which is used to cause the program product to run on a terminal device when the program product is executed. The terminal device performs the steps according to various exemplary embodiments of the present application described in the above-mentioned "Example Method" section of this specification.

Referring to FIG. 6, a program product 600 for implementing the above method according to an embodiment of the present application is described, which can adopt a portable compact disk read only memory (CD-ROM) and include program codes, and can be used in a terminal device, For example running on a personal computer. However, the program product of the present application is not limited thereto, and in this document, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

A computer readable signal medium may include a propagated data signal in baseband or as part of a carrier wave with readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium can also be any readable medium, other than a readable storage medium, that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming Language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computer device, partly on the user's computer device, as a stand-alone software package, partly on the user's computer device and partly on a remote computer device, or entirely on the remote computer device or execute on the server. Where remote computer equipment is involved, the remote computer equipment may be connected to the user computer equipment via any kind of network, including a local area network (LAN) or wide area network (WAN), or may be connected to external computer equipment (eg, using an Internet service provider business via an Internet connection).

In addition, the above-mentioned figures are only schematic illustrations of the processes included in the methods according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the chronological order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, in multiple modules.

It should be understood that the present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

An artificial intelligence-based black production account detection method, including:

When it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject;

Using the attribute field data in the account attribute data set as a connecting edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject;

Perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connected edges in the account detection diagram to obtain a plurality of account clusters;

Using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject;

From the first field data document and the second field data document, calculate a weight for each word in the first field data document, the weight indicating that each of the words is in the first field data document relative to the importance in the second field data document;

Based on the weight of each of the words, a cluster of black production accounts is determined, and a group of black production accounts associated with the target subject is obtained.
The method according to claim 1, wherein, when the number of accounts bound to the mobile phone number is determined to exceed a predetermined number, acquiring the account attribute data set of the account, comprising:

Obtain the business association condition between the target entity and the mobile phone number, the business association condition indicates the threshold of the number of accounts that can be bound to the mobile phone number in the target business, and the target business originates from the target entity;

When the account number bound to the mobile phone number exceeds the number threshold, the account attribute data set of the account number is acquired.
The method according to claim 1, wherein the graph clustering of the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram to obtain a plurality of account clusters, comprising:

Based on the attribute field data of the connected edges, the account detection graph is subjected to graph clustering processing using the Connected Component algorithm to obtain multiple account groups;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with the same login network address, and obtain a first account group combination;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with physical addresses of the same wireless network card, and obtain a second account group combination;

The first account group combination and the second account group combination are determined as the account cluster.
The method according to claim 1, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises:

For each word in the first field data document, calculating the first frequency of occurrence of each word in the first field data document;

For each word in the first field data document, calculating a second frequency of simultaneous occurrence of each of the words in the first field data document and the second field data document;

The product of the first frequency and the second frequency is used as the weight of each of the words.
The method according to claim 1, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises:

The weight of each word is calculated based on the formula tf-idf(t,d)=tf(t,d)×idf(t), idf(t)=log(N/e), wherein the tf-id(tf , d) is the weight, the t is the word, the d is the first field data document, the tf(t, d) is the frequency of the word appearing in the first field data document, so The idf(t) is the inverse text frequency of the word in the document, the N is the total number of the first field data document and the second field data document, and e is the first field data document and the second field data document. The number of documents in which the word appears in the field data document.
The method according to claim 1, wherein the determining of the black product account clusters based on the weight of each of the words comprises:

Determine the first field data document from which the word with the weight higher than the predetermined weight comes from, as the black product data document;

The account cluster corresponding to the black product data document is determined as a black product account group.
The method according to claim 1, wherein the determining of the black product account clusters based on the weight of each of the words comprises:

Calculate the average weight of words in each of the first field data documents;

Determine the first field data document with the weight average value higher than a predetermined average value as a black product data document;

The account cluster corresponding to the black product data document is determined as a black product account group.
An artificial intelligence-based black production account detection device, comprising:

an acquisition module, configured to acquire an account attribute data set of the account when it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, and the mobile phone number is derived from the account database of the target subject;

A building module, used to use the attribute field data in the account attribute data set as a connection edge, and use the mobile phone number as a vertex to construct an account detection graph of the target subject;

a clustering module, configured to perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram, to obtain a plurality of account clusters;

The generating module is used for using the attribute field data of each of the account clusters to generate the first field data document of each of the account clusters, and to obtain the second field of the whitelist account corresponding to the target subject data files;

A calculation module, configured to calculate the weight of each word in the first field data document according to the first field data document and the second field data document, and the weight indicates that each of the words is in the first field data document. importance in a field data document relative to the second field data document;

The determining module is configured to determine the black production account clusters based on the weight of each of the words, and obtain the black production account groups associated with the target subject.
A computer device, comprising a memory and a processor, wherein computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the processor is caused to execute:

When it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject;

Using the attribute field data in the account attribute data set as a connecting edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject;

Perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connected edges in the account detection diagram to obtain a plurality of account clusters;

Using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject;

From the first field data document and the second field data document, calculate a weight for each word in the first field data document, the weight indicating that each of the words is in the first field data document relative to the importance in the second field data document;

Based on the weight of each of the words, a cluster of black production accounts is determined, and a group of black production accounts associated with the target subject is obtained.
The computer device according to claim 9, wherein, when the number of accounts bound to the mobile phone number is determined to exceed a predetermined number, acquiring the account attribute data set of the account, comprising:

Obtain the business association condition between the target entity and the mobile phone number, the business association condition indicates the threshold of the number of accounts that can be bound to the mobile phone number in the target business, and the target business originates from the target entity;

When the account number bound to the mobile phone number exceeds the number threshold, the account attribute data set of the account number is acquired.
The computer device according to claim 9, wherein the graph clustering of the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram to obtain a plurality of account clusters, comprising:

Based on the attribute field data of the connection side, the account detection graph utilizes the Connected Component algorithm to perform graph clustering processing to obtain a plurality of account groups;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with the same login network address, and obtain a first account group combination;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with physical addresses of the same wireless network card, and obtain a second account group combination;

The first account group combination and the second account group combination are determined as the account cluster.
The computer device according to claim 9, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises:

For each word in the first field data document, calculating the first frequency of occurrence of each word in the first field data document;

For each word in the first field data document, calculating a second frequency of simultaneous occurrence of each of the words in the first field data document and the second field data document;

The product of the first frequency and the second frequency is used as the weight of each of the words.
The computer device according to claim 9, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises:

The weight of each word is calculated based on the formula tf-idf(t,d)=tf(t,d)×idf(t), idf(t)=log(N/e), wherein the tf-id(tf , d) is the weight, the t is the word, the d is the first field data document, the tf(t, d) is the frequency of the word appearing in the first field data document, so The idf(t) is the inverse text frequency of the word in the document, the N is the total number of the first field data document and the second field data document, and e is the first field data document and the second field data document. The number of documents in which the word appears in the field data document.
The computer device according to claim 9, wherein the determining of the black product account clusters based on the weight of each of the words comprises:

Determine the first field data document from which the word with the weight higher than the predetermined weight comes from, as the black product data document;

The account cluster corresponding to the black product data document is determined as a black product account group.
The computer device according to claim 9, wherein the determining of the black product account clusters based on the weight of each of the words comprises:

Calculate the average weight of words in each of the first field data documents;

Determine the first field data document with the weight average value higher than a predetermined average value as a black product data document;

The account cluster corresponding to the black product data document is determined as a black product account group.
A computer-readable storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to execute:

When it is determined that the number of accounts bound to the mobile phone number exceeds a predetermined number, the account attribute data set of the account is obtained, and the mobile phone number is derived from the account database of the target subject;

Using the attribute field data in the account attribute data set as a connecting edge, and using the mobile phone number as a vertex to construct an account detection graph of the target subject;

Perform graph clustering on the accounts in the account detection diagram based on the attribute field data of the connected edges in the account detection diagram to obtain a plurality of account clusters;

Using the attribute field data of each of the account clusters, generate the first field data document of each of the account clusters, and obtain the second field data document of the whitelist account corresponding to the target subject;

From the first field data document and the second field data document, a weight is calculated for each word in the first field data document, the weight indicating that each of the words is in the first field data document relative to the importance in the second field data document;

Based on the weight of each of the words, a cluster of black production accounts is determined, and a group of black production accounts associated with the target subject is obtained.
The computer-readable storage medium according to claim 16, wherein, when the number of accounts bound to the mobile phone number is determined to exceed a predetermined number, acquiring the account attribute data set of the account, comprising:

Obtain the business association condition between the target entity and the mobile phone number, the business association condition indicating the threshold of the number of accounts that can be bound to the mobile phone number in the target business, and the target business originates from the target entity;

When the account number bound to the mobile phone number exceeds the number threshold, the account attribute data set of the account number is acquired.
The computer-readable storage medium according to claim 16, wherein the graph clustering is performed on the accounts in the account detection diagram based on the attribute field data of the connection edges in the account detection diagram to obtain a plurality of account clusters ,include:

Based on the attribute field data of the connected edges, the account detection graph is subjected to graph clustering processing using the Connected Component algorithm to obtain multiple account groups;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with the same login network address, and obtain a first account group combination;

From the plurality of account groups, obtain account groups that include a number of mobile phone numbers greater than or equal to a predetermined number and are associated with physical addresses of the same wireless network card, and obtain a second account group combination;

The first account group combination and the second account group combination are determined as the account cluster.
The computer-readable storage medium of claim 16, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises: :

For each word in the first field data document, calculating the first frequency of occurrence of each word in the first field data document;

For each word in the first field data document, calculating a second frequency of simultaneous occurrence of each of the words in the first field data document and the second field data document;

The product of the first frequency and the second frequency is used as the weight of each of the words.
The computer-readable storage medium of claim 16, wherein calculating the weight of each word in the first field data document according to the first field data document and the second field data document comprises: :

The weight of each word is calculated based on the formula tf-idf(t,d)=tf(t,d)×idf(t), idf(t)=log(N/e), wherein the tf-id(tf , d) is the weight, the t is the word, the d is the first field data document, the tf(t, d) is the frequency of the word appearing in the first field data document, so The idf(t) is the inverse text frequency of the word in the document, the N is the total number of the first field data document and the second field data document, and e is the first field data document and the second field data document. The number of documents in which the word appears in the field data document.