WO2023093638A1 - 异常数据识别方法、装置、设备和存储介质 - Google Patents

异常数据识别方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2023093638A1
WO2023093638A1 PCT/CN2022/132864 CN2022132864W WO2023093638A1 WO 2023093638 A1 WO2023093638 A1 WO 2023093638A1 CN 2022132864 W CN2022132864 W CN 2022132864W WO 2023093638 A1 WO2023093638 A1 WO 2023093638A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
abnormal
information
identified
account
Prior art date
Application number
PCT/CN2022/132864
Other languages
English (en)
French (fr)
Inventor
康焰龙
苏航
Original Assignee
百果园技术(新加坡)有限公司
康焰龙
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 百果园技术(新加坡)有限公司, 康焰龙 filed Critical 百果园技术(新加坡)有限公司
Publication of WO2023093638A1 publication Critical patent/WO2023093638A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2465—Query processing support for facilitating data mining operations in structured databases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28—Databases characterised by their database models, e.g. relational or object models
    • G06F16/284—Relational databases

Definitions

  • the embodiments of the present application relate to the field of computer technology, and in particular, to a method, device, device, and storage medium for identifying abnormal data.
  • the current storage method of account information is generally to store data of different dimensions in a structured design and then store them in different two-dimensional tables. During the retrieval process, it is difficult to directly associate account information in multiple dimensions.
  • the embodiment of the present application provides a method, device, device, and storage medium for identifying abnormal data, which solves the problem of low efficiency in identifying abnormal data such as stolen accounts and abnormal login devices in related technologies, and can quickly and accurately identify abnormal data. Identification of data.
  • the embodiment of the present application provides a method for identifying abnormal data, which includes:
  • the determined abnormal account information, the structured data, and the relationship data calculate and determine the device to be identified through a preset detection algorithm
  • the attribute information of the device to be identified satisfies a preset rule, it is determined that the device to be identified is an abnormal device.
  • an abnormal data identification device including:
  • a data acquisition module configured to acquire structured data and relational data stored in the graph database, where the structured data and the relational data include account information, device information, and associated attribute information;
  • the module for determining the device to be identified is configured to calculate and determine the device to be identified by using a preset detection algorithm according to the determined abnormal account information, the structured data, and the relationship data;
  • the abnormal equipment determination module is configured to determine that the equipment to be identified is an abnormal equipment if the attribute information of the equipment to be identified satisfies a preset rule.
  • an abnormal data identification device which includes:
  • processors one or more processors
  • a storage device configured to store one or more programs
  • the one or more processors are made to implement the abnormal data identification method described in the embodiment of the present application.
  • the embodiment of the present application further provides a storage medium storing computer-executable instructions, the computer-executable instructions are configured to execute the abnormal data identification method described in the embodiment of the present application when executed by a computer processor.
  • the embodiment of the present application further provides a program for identifying abnormal data.
  • the program When the program is executed, operations related to the method for identifying abnormal data as described in the first aspect can be realized.
  • the structured data and relational data include account information, device information and associated attribute information
  • calculate and determine the equipment to be identified through the preset detection algorithm if the attribute information of the equipment to be identified meets the preset rules, it is determined that the equipment to be identified is abnormal equipment, thus realizing efficient abnormal equipment identification.
  • FIG. 1 is a flow chart of a method for identifying abnormal data provided by an embodiment of the present application
  • FIG. 2 is a flow chart of another abnormal data identification method provided by the embodiment of the present application.
  • FIG. 3 is a flow chart of another abnormal data identification method provided by the embodiment of the present application.
  • FIG. 4 is a flowchart of another abnormal data identification method provided by the embodiment of the present application.
  • FIG. 5 is a flow chart of another abnormal data identification method provided by the embodiment of the present application.
  • FIG. 6 is a structural block diagram of an abnormal data identification device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an abnormal data identification device provided by an embodiment of the present application.
  • Fig. 1 is a flow chart of a method for identifying abnormal data provided by the embodiment of the present application, which can be applied to identifying abnormal data.
  • the method can be executed by computing devices such as desktops, notebooks, servers, etc., and specifically includes the following steps:
  • Step S101 Obtain structured data and relational data stored in a graph database, where the structured data and relational data include account information, device information and associated attribute information.
  • graph database refers to data storage and query in the form of graph structure, which embodies the relational model in the form of nodes and edges.
  • the graph structure is composed of nodes and edges. Nodes and edges can contain corresponding attribute information.
  • the edges connecting nodes have directions. There can be multiple edges of different types between the same node, or edges of the same type but with different attributes.
  • storing structured data and relational data in the form of a graph database is more convenient for the operation of nodes and edges in the network.
  • the structured data and relational data stored in the graph database are converted from the acquired account data of multiple dimensions.
  • it uses account information and device information as the main data generation node.
  • the account information and device information can be account ID and device ID, and the account ID can be generated by the platform for unique identification of the account.
  • Data, the device ID may be the data generated by the platform to uniquely identify the device used by the user.
  • the user can be a person who uses an app or a platform service, and one user can register multiple accounts at the same time or use multiple devices to log in with an account.
  • the structured data also includes node attribute information, which is associated with the account and/or device.
  • For relational data it uses account information and device information as the main data, and also includes edge attribute information to realize the connection between accounts and devices for the construction of relational networks.
  • Step S102 according to the determined abnormal account information, the structured data, and the relationship data, perform calculation through a preset detection algorithm to determine the device to be identified.
  • the abnormal account information is information of the determined abnormal account, such as an abnormal account ID.
  • the method of determining the abnormal account may be the abnormal account determined during manual processing of the appealing account, or the abnormal account discovered through other channels. Specifically, the abnormal account may be an account illegally stolen by others.
  • structured data and relational data are data stored in the aforementioned graph database.
  • a search is performed within a certain range in the graph database according to the abnormal account information to obtain a relationship network sub-graph associated with the abnormal account information, and the nodes in the relationship network sub-graph are obtained through a preset detection algorithm
  • the suspicious node is determined by calculation, and the device corresponding to the device information recorded by the suspicious node is the device to be identified.
  • Step S103 if the attribute information of the device to be identified satisfies a preset rule, determine that the device to be identified is an abnormal device.
  • attribute information of the device to be identified is used to judge whether it satisfies a preset rule, and if it satisfies the preset rule, it is determined that the device to be identified is an abnormal device.
  • the device to be identified includes a calculated central device and a connection device.
  • the central device represents the most important device in the network relationship subgraph, such as the corresponding central device in a large-scale community group, and the number of accounts logged in by the central device is relatively large.
  • a connected device represents a device that acts as a network bridge, such as a device that acts as a bridge connection among multiple community groups.
  • the attribute information of the device to be identified may satisfy the preset rule: the number of login accounts corresponding to the central device is greater than the first preset number; among the login accounts corresponding to the central device, the ratio of registered accounts to non-registered accounts is greater than the first A preset ratio value; in the login account corresponding to the central device, the ratio of the anchor type account to the shooter type account is greater than the second preset ratio value; in the login account corresponding to the central device, the number of historical abnormal records is greater than the second preset Quantity; connected devices are in the shortest path of at least two central devices.
  • the specific values of the first preset number, the first preset ratio value, the second preset ratio value and the second preset number are not limited, and can be flexibly configured.
  • it is determined that the device to be identified is an abnormal device that is, the data recorded in the graph database corresponding to the abnormal device is used as Anomalous data is identified.
  • the abnormal data identification method provided by this scheme does not need to use the experience of the staff for abnormal identification, which solves the problem of low efficiency and high cost of abnormal data mining, and can identify abnormal equipment in advance, providing a basis for early prevention Constructive comments.
  • Fig. 2 is a flow chart of another abnormal data identification method provided by the embodiment of the present application, which provides a specific process of constructing and generating structured data and relational data, as shown in Fig. 2, including:
  • Step S201 Obtain login data stored in the original database, where the login data is relational table data, including account information, device information, and associated attribute information.
  • the login data stored in the original database is stored in the form of a relational data table. It records the login status of different accounts on different devices, as well as related attribute information of accounts and devices, which are stored in different fields.
  • the account information may be an account ID
  • the device information may be a device ID
  • the associated attribute information may be illustratively: account login time, login form (such as password login, verification code login, etc.), account registration time, registration form (such as Mobile phone number registration, email registration, etc.), registration type (such as anchor type, shooter type, etc.), and some historical abnormal record information.
  • Step S202 using the account information and the device information as nodes, selecting node attribute information from the attribute information as node attributes, generating structured data and storing it in the graph database, using the account information and the device information as node attributes For a node, edge attribute information is selected from the attribute information as an edge attribute, and relational data is generated and stored in the graph database.
  • the corresponding field content is selected as node attribute information and edge attribute information respectively, account information and device information are used as nodes, and node attribute information is used as node attributes to generate structured data; account information and device information as nodes, and edge attribute information as edge attributes to generate relational data.
  • the content of the selected field as attribute information may be information associated with login, such as login time, login times, and login duration.
  • node A represents account ID01
  • node B represents device ID01
  • the node attributes of node A can be the registration time, registration method, and login times of account ID01
  • the node attributes of node B can be the number of login accounts, login times, password change times, etc.
  • the node A account ID01 has logged in the node B device ID01, then node A and node B generate an edge
  • the edge attributes can be the number of logins, login time, and login duration of the account ID01 in the device ID01.
  • Step S203 acquiring structured data and relational data stored in the graph database, the structured data and the relational data including account information, device information and associated attribute information.
  • Step S204 according to the determined abnormal account information, the structured data, and the relationship data, perform calculations using a preset detection algorithm to determine the device to be identified.
  • Step S205 if the attribute information of the device to be identified satisfies a preset rule, determine that the device to be identified is an abnormal device.
  • Fig. 3 is a flow chart of another abnormal data identification method provided by the embodiment of the present application, which provides a specific method of calculating and determining the device to be identified through a preset detection algorithm, as shown in Fig. 3, including:
  • Step S301 Obtain login data stored in the original database, where the login data is relational table data, including account information, device information, and associated attribute information.
  • Step S302 using the account information and the device information as nodes, selecting node attribute information from the attribute information as node attributes, generating structured data and storing it in the graph database, and using the account information and the device information as node attributes For a node, edge attribute information is selected from the attribute information as an edge attribute, and relational data is generated and stored in the graph database.
  • Step S303 acquiring structured data and relational data stored in the graph database, the structured data and the relational data including account information, device information and associated attribute information.
  • Step S304 Determine the data to be identified at a preset level according to the determined abnormal account information, the structured data, and the relationship data.
  • the preset level is used to realize the limitation of different ranges. For example, if the value range of the preset level is 3, the representation is centered on the node corresponding to the abnormal account, and the associated map with the extended range of 3 levels is used as the data to be identified to be configured as subsequent Carry out algorithm calculation and screening.
  • Step S305 Calculate the data to be identified through the degree centrality algorithm to determine the central device, calculate the data to be identified through the medium centrality algorithm to determine the connected device, and determine the central device and the device corresponding to the connected device as the device to be identified equipment.
  • the central device when determining the device to be identified, is determined through a degree centrality algorithm, and the connected device is determined through a media centrality algorithm.
  • the degree centrality indicates the degree to which a node is connected with other nodes, and it is a direct measure of node centrality in a relationship network. The larger the node degree of a node, the higher the degree centrality of the node. In the network The greater the importance.
  • the medium centrality algorithm uses the number of shortest paths passing through a node to describe the index of the importance of the node, which reflects the importance of the node as a "bridge". Through the calculation of the media centrality algorithm, it is found that multiple community groups act as "bridges" to connect devices.
  • the calculation formula of the degree centrality algorithm is as follows: Among them, C D (N i ) represents the degree centrality of node i, It is used to calculate the number of direct connections between node i and other gi j nodes.
  • Step S306 if the attribute information of the device to be identified satisfies a preset rule, determine that the device to be identified is an abnormal device.
  • FIG. 4 is a flow chart of another abnormal data identification method provided by the embodiment of the present application, showing a process including information query feedback. As shown in Figure 4, including:
  • Step S401 Obtain structured data and relational data stored in a graph database, where the structured data and relational data include account information, device information and associated attribute information.
  • Step S402 Receive the account number to be queried, search the path of the relationship graph in the graph database with the account number to be queried as the center of the graph, determine and display the account information and device information associated with the account number to be queried.
  • a fast, multi-level scalable query can be performed through the converted structured data and relational data. If the user makes an account complaint, the system receives the account to be queried, and uses the account to be queried as the center node of the graph to query the relationship graph path in the graph database to determine and display the account information and device information associated with the account to be queried. It can intuitively display the relationship between accounts and devices. The staff can quickly identify abnormal accounts based on the displayed content. Wherein, during the query process of the relationship graph path, the account to be queried is used as the center of the graph to query along the edge paths of the nodes connected to the center, so as to determine the account information and device information associated with the account to be queried.
  • the graph database can also support the query of any node and attribute information, improving the efficiency of query and judgment.
  • the query obtains related information such as the login device of the account to be queried, the number of login times, and the login time, as well as the number of accounts logged into the login device of the account to be queried.
  • Step S403 according to the determined abnormal account information, the structured data, and the relationship data, perform calculation through a preset detection algorithm to determine the device to be identified.
  • Step S404 if the attribute information of the device to be identified satisfies a preset rule, determine that the device to be identified is an abnormal device.
  • the associated map path query is performed on the basis of the account to be queried to obtain and display the corresponding account information and device information associated with the account to be queried, which significantly improves
  • the data query efficiency is improved, and the display effect is better, which is convenient for the staff to judge whether the account has been stolen.
  • FIG. 5 is a flow chart of another method for identifying abnormal data provided by the embodiment of the present application, showing a process of adjusting a verification strategy after identifying abnormal data. As shown in Figure 5, including:
  • Step S501 Obtain the login data stored in the original database.
  • the login data is relational table data, including account information, device information and associated attribute information.
  • Step S502 use the account information and the device information as nodes, select node attribute information from the attribute information as node attributes, generate structured data and store it in the graph database, and use the account information and the device information as node attributes
  • edge attribute information is selected from the attribute information as an edge attribute, and relational data is generated and stored in the graph database.
  • Step S503 acquiring the structured data and relational data stored in the graph database, the structured data and the relational data including account information, device information and associated attribute information.
  • Step S504. Determine data to be identified at a preset level according to the determined abnormal account information, the structured data, and the relationship data.
  • Step S505 Calculate the data to be identified by the degree centrality algorithm to determine the central device, calculate the data to be identified by the medium centrality algorithm to determine the connected device, and determine the central device and the device corresponding to the connected device as the device to be identified equipment.
  • Step S506 if the attribute information of the device to be identified satisfies a preset rule, determine that the device to be identified is an abnormal device.
  • Step S507 Add the device ID and abnormal level of the abnormal device to the cache, and when it is detected that the device ID of the login device is consistent with the device ID of the abnormal device, determine the corresponding verification strategy according to the abnormal level, based on The verification policy verifies the login device.
  • the abnormal level of the abnormal equipment is determined.
  • the abnormality level is determined according to the number of preset rules satisfied by the abnormal device, and the higher the number of preset rules satisfied, the higher the abnormality level.
  • the device ID and abnormal level of the abnormal device are added to the cache, so that when it is detected that the device ID of the logged-in device is consistent with the device ID of the abnormal device, a higher-level verification strategy is adopted to verify the logged-in device. Only the more verified content can pass the verification. Exemplarily, it includes face recognition verification, question answering verification, etc. Among them, the higher the abnormality level is, the more complex the corresponding verification strategy is.
  • the identification of the abnormal device is stored in the cache to perform complex verification on the hit login device.
  • the verification strategy is determined according to the abnormal level of the abnormal device, which ensures the security of account login and does not Routine normal login devices perform overly complicated authentication to affect user experience.
  • FIG. 6 is a structural block diagram of an abnormal data identification device provided in an embodiment of the present application.
  • the device is configured to execute the abnormal data identification method provided in the above embodiment, and has corresponding functional modules and beneficial effects for executing the method.
  • the system specifically includes: a data acquisition module 101, a device to be identified determination module 102 and an abnormal device determination module 103, wherein,
  • the data acquisition module 101 is configured to acquire structured data and relational data stored in the graph database, the structured data and the relational data including account information, device information and associated attribute information;
  • the device-to-be-recognized determining module 102 is configured to calculate and determine the device to be recognized by using a preset detection algorithm according to the determined abnormal account information, the structured data, and the relationship data;
  • the abnormal device determining module 103 is configured to determine that the device to be recognized is an abnormal device if the attribute information of the device to be recognized meets the preset rules. It can be seen from the above scheme that multiple data synchronization tasks are created according to the registration center information, wherein, Each data synchronization task corresponds to at least two different registration centers. When the information change of a certain registration center is detected, the information change content is converted into the change information of different types of registration centers through the created data synchronization task, and the change information It is sent to the corresponding registration center and configured to synchronize information between other registration centers and the first registration center to provide information calling, which significantly improves the abnormal data identification efficiency and reduces the overall cost.
  • the device also includes a data conversion storage module 104 configured to:
  • the login data is relational table data, including account information, device information and associated attribute information;
  • the account information and the device information are used as nodes, and edge attribute information is selected from the attribute information as edge attributes to generate relational data and store them in the graph database.
  • the device-to-be-identified determining module 102 is specifically configured as:
  • the to-be-identified data is calculated by using a preset detection algorithm to determine the to-be-identified device.
  • the device-to-be-identified determining module 102 is specifically configured to: determine the central device by calculating the data to be identified through a degree centrality algorithm;
  • the data to be identified is calculated by using a media centrality algorithm to determine the connected device.
  • the attribute information of the device to be identified satisfies preset rules, including at least one of the following:
  • the number of login accounts corresponding to the central device is greater than the first preset number; or,
  • the ratio of registered accounts to non-registered accounts is greater than a first preset ratio value
  • the ratio of the anchor type account to the shooter type account is greater than the second preset ratio value
  • the number of historical abnormal records is greater than the second preset number
  • the connecting device is in the shortest path of at least two central devices.
  • the device further includes a query display module 105 configured to:
  • Receive the account number to be queried perform a relationship map path query in the graph database with the account number to be queried as the graph center, determine and display the account information and device information associated with the account number to be queried.
  • the device also includes a safety verification module 106 configured to:
  • the login device is authenticated based on the authentication policy.
  • Fig. 7 is a schematic structural diagram of an abnormal data identification device provided by an embodiment of the present application.
  • the device includes a processor 201, a memory 202, an input device 203, and an output device 204; the number of processors 201 in the device There may be one or more, and a processor 201 is taken as an example in FIG. as an example.
  • the memory 202 can be configured to store software programs, computer-executable programs and modules, such as program instructions/modules corresponding to the abnormal data identification method in the embodiment of the present application.
  • the processor 201 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 202, that is, realizes the above-mentioned abnormal data identification method.
  • the input device 203 can be configured to receive input numbers or character information, and generate key signal input related to user settings and function control of the device.
  • the output device 204 may include a display device such as a display screen.
  • the embodiment of the present application also provides a storage medium containing computer-executable instructions.
  • the computer-executable instructions are executed by a computer processor, the computer-executable instructions are configured to execute a method for identifying abnormal data described in the above-mentioned embodiments, specifically including:
  • the determined abnormal account information, the structured data, and the relationship data calculate and determine the device to be identified through a preset detection algorithm
  • the unit and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be realized; in addition, The specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the embodiments of the present application.
  • various aspects of the method provided in this application can also be implemented in the form of a program product, which includes program code, and when the program product is run on a computer device, the program code is configured to:
  • the computer device is made to execute the steps in the methods described above in this specification according to various exemplary implementations of the present application.
  • the computer device may execute the abnormal data identification method described in the embodiments of the present application.
  • the program product can be implemented using any combination of one or more readable media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Fuzzy Systems (AREA)
  • Mathematical Physics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computational Linguistics (AREA)
  • Computing Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请实施例提供了一种异常数据识别方法、装置、设备和存储介质，该方法包括：获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。本方案实现了对异常数据快速、精确的进行识别。

Description

异常数据识别方法、装置、设备和存储介质
本申请要求在2021年11月24日提交中国专利局，申请号为202111403923.8的中国专利申请的优先权，该申请的全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及计算机技术领域，尤其涉及一种异常数据识别方法、装置、设备和存储介质。
背景技术
在互联网领域中的各个APP或者平台上，大多都存在着盗号团伙通过各种方式盗取用户账号的情况。多数平台通过验证账号密码对用户进行识别，再提供相应服务。在不法分子通过某种方式获取用户的账号和密码进行登录后，其可以进行侵占账号内财产、修改密码占有账号等活动，或者向他人发送广告信息，色情或病毒链接导致用户账号被平台封禁。在该情况下，用户只能通过平台进行账号找回或者账号解封等申诉。
相关技术中，在处理该类被盗账号的申诉时，大多采用根据用户提供的申诉信息，人工检索相关日志获取多维度的账号信息，再与预先设定的规则进行比对，最后根据过往经验做出该账号是否被盗的判断。其存在的缺陷主要在于：目前账号信息的存储方式一般是将不同维度的数据进行结构化的设计后分别存储到不同的二维表格中，在检索过程中，多个维度的账号信息难以直接关联，需要进行多次交叉搜索才能建立起多维信息的关联关系，检索和分析的效率低，耗时长，对工作人员的专业能力有一定要求，同时判断的准确性取决于工作人员的经验；在对一个关系链路进行多层级关联关系的挖掘时，需要进行多次的数据查询才能对链路进行扩展，一方面效率低耗时长，一方面二维表格展现数据的方式难以直接发现异常的关联关系。因此大多只能根据申诉来处理单个账号被盗的案例，即事后补救，难以通过对多层级关系网络的挖掘，提前识别出异常数据，如异常的登录设备或者异常账号，无法高效的挖掘出大规模的盗号行为和团伙，做出提前的防范和处理。
发明内容
本申请实施例提供了一种异常数据识别方法、装置、设备和存储介质，解决了相关技术中对异常数据如被盗账号、异常登录设备的识别效率低的问题，可以快速、准确的进行异常数据的识别。
第一方面，本申请实施例提供了一种异常数据识别方法，该方法包括：
获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
第二方面，本申请实施例还提供了一种异常数据识别装置，包括：
数据获取模块，配置为获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
待识别设备确定模块，配置为根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
异常设备确定模块，配置为如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
第三方面，本申请实施例还提供了一种异常数据识别设备，该设备包括：
一个或多个处理器；
存储装置，配置为存储一个或多个程序，
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现本申请实施例所述的异常数据识别方法。
第四方面，本申请实施例还提供了一种存储计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时配置为执行本申请实施例所述的异常数据识别方法。
第五方面，本申请实施例还提供一种异常数据识别的程序，该程序被执行时，可以实现如第一方面所述的异常数据识别方法有关的操作。
本申请实施例中，通过获取图数据库中存储的结构化数据以及关系数据， 其中，结构化数据以及关系数据包括账号信息、设备信息以及关联的属性信息，再根据确定的异常账号信息、结构化数据以及关系数据，通过预设检测算法进行计算确定待识别设备，如果所述待识别设备的属性信息满足预设规则，则确定该待是识别设备为异常设备，由此实现了高效的异常设备的识别。
附图说明
图1为本申请实施例提供的一种异常数据识别方法的流程图；
图2为本申请实施例提供的另一种异常数据识别方法的流程图；
图3为本申请实施例提供的另一种异常数据识别方法的流程图；
图4为本申请实施例提供的另一种异常数据识别方法的流程图；
图5为本申请实施例提供的另一种异常数据识别方法的流程图；
图6为本申请实施例提供的一种异常数据识别装置的结构框图；
图7为本申请实施例提供的一种异常数据识别设备的结构示意图。
具体实施方式
下面结合附图和实施例对本申请实施例作进一步的详细说明。可以理解的是，此处所描述的具体实施例仅仅用于解释本申请实施例，而非对本申请实施例的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与本申请实施例相关的部分而非全部结构。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”等所区分的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”，一般表示前后关联对象是一种“或”的关系。
图1为本申请实施例提供的一种异常数据识别方法的流程图，可应用于异常数据识别，该方法可以由计算设备如台式机、笔记本、服务器等来执行，具体包括如下步骤：
步骤S101、获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息。
其中，图数据库指利用图结构的形式进行数据存储和查询，其通过节点和边的形式体现关系模型。图结构由节点和边组成，节点和边可包含相应的属性信息，节点之间相连的边具备方向，同一节点之间可存在多条不同类型的边，或者相同类型但属性不同的边。在一个实施例中，通过图数据库形式进行结构化数据以及关系数据的存储，对于网络中节点和边的操作更加便利。
在一个实施例中，图数据库中存储的结构化数据以及关系数据由获取的多个维度的账号数据转化而来。其中，针对结构化数据，其使用账号信息和设备信息作为主数据生成节点，该账号信息和设备信息可以是账号ID和设备ID，其中账号ID可以是平台生成的用于进行账号唯一性标识的数据，设备ID可以是平台生成的对用户使用的设备进行唯一性标识的数据。其中，用户可以是使用app应用的或者平台服务的人，其中一个用户可以同时注册多个账号也可以使用多个设备进行账号登录，结构化数据中除包含账号信息和设备信息外，还包括节点的属性信息，该属性信息于账号和/或设备关联。针对关系数据，其使用账号信息和设备信息作为主数据，还包括边的属性信息，实现账号和设备之间的连接，以进行关系网络的构建。
步骤S102、根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备。
其中，异常账号信息为确定出的异常账号的信息，如异常账号ID。该异常账号的确定方式可以是人工对进行申诉的账号进行处理时确定的异常账号，或者通过其它渠道发现的异常账号。该异常账号具体可以是被他人进行非法盗取的账号。
其中，结构化数据以及关系数据为前述图数据库存储的数据。在一个实施例中，根据异常账号信息在图数据库中进行一定范围内的查询搜索，以得到和该异常账号信息关联的关系网络子图，通过预设检测算法对该关系网络子图中的节点进行计算确定出可疑节点，其中可疑节点记录的设备信息所对应的设备即待识别设备。
步骤S103、如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
在确定出待识别设备后，通过预设规则判断得出待识别设备是否为异常设备。在一实施例中，通过待识别设备的属性信息以判断其是否满足预设规则，如果其满足预设规则，则确定待识别设备为异常设备。
在一个实施例中，待识别设备包括计算得出的中心设备以及连接设备。其中，中心设备表征了网络关系子图中重要程度最高的设备，如一个大规模社群团伙中对应的中心设备，该中心设备登录的账号数量较多。连接设备表征了充当网络桥梁，如多个社群团伙中充当桥梁连接的设备。
可选的，待识别设备的属性信息满足预设规则可以是：中心设备对应的登录账号的数量大于第一预设数量；中心设备对应的登录账号中，注册账号与非注册账号的比值大于第一预设比例值；中心设备对应的登录账号中，主播类型账号与拍客类型账号的比例值大于第二预设比例值；中心设备对应的登录账号中，历史异常记录数量大于第二预设数量；连接设备处于至少两个中心设备的最短路径中。其中，该第一预设数量、第一预设比例值、第二预设比例值以及第二预设数量的具体数值不做限定，可灵活的进行配置。在一个实施例中，当确定出待识别设备的属性信息满足上述的一条或多条预设规则时，则判定该待识别设备为异常设备，即该异常设备对应的图数据库中记录的数据作为异常数据被识别得到。
由上述方案可知，本方案提供的异常数据识别方法，无需通过工作人人员的经验进行异常识别，解决了异常数据挖掘效率低、成本高的问题，可以事先确定出异常设备，为进行提前防范提供建设性意见。
图2为本申请实施例提供的另一种异常数据识别方法的流程图，给出了一种具体的构建生成结构化数据以及关系数据的过程，如图2所示，包括：
步骤S201、获取原始数据库中存储的登录数据，所述登录数据为关系型表格数据，包括账号信息、设备信息以及关联的属性信息。
其中，原始数据库中存储的登录数据以关系型数据表格的形式存储。其记录了不同账号在不同设备下的登录情况，以及账号和设备的相关的属性信息，其通过不同字段进行存储。账号信息可以是账号ID，设备信息可以是设备ID，相关联的属性信息示例性的可以是：账号登录时间、登录形式(如密码登录、验证码登录等)、账号注册时间、注册形式(如手机号注册、邮箱注册等)、注册类型(如主播类型、拍客类型等)以及一些历史的异常记录信息。
步骤S202、将所述账号信息和所述设备信息作为节点，所述属性信息中选取节点属性信息作为节点属性，生成结构化数据存储至图数据库中，将所述账号信息和所述设备信息作为节点，所述属性信息中选取边属性信息作为边属性，生成关系数据存储至所述图数据库中。
其中，针对原始数据库中存储的登录数据，进行相应字段内容的选取分别作为节点属性信息和边属性信息，将账号信息和设备信息作为节点，节点属性信息作为节点属性生成结构化数据；将账号信息和设备信息作为节点，边属性信息作为边属性生成关系数据。示例性的，选取的字段作为属性信息的内容可以是登录时间、登录次数、登录持续时间等和登录相关联的信息。如节点A代表账号ID01，节点B代表设备ID01，节点A的节点属性可以是账号ID01的注册时间、注册方式、登录次数；节点B的节点属性可以是登录账号数量、登录次数、修改密码次数等；节点A账号ID01在节点B设备ID01进行过登录，则节点A和节点B生成一条边，边属性可以是账号ID01在设备ID01中的登录次数、登录时间、登录持续时间等。
步骤S203、获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息。
步骤S204、根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备。
步骤S205、如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
由上述方案可知，通过将原始数据库存储的登录数据进行转化，生成构化数据以及关系数据进行存储，通过对多维度的用户信息进行转化，便于关系网络的分析以及构建图数据模型，优化了查询、检索机制，提高了数据处理效率。
图3为本申请实施例提供的另一种异常数据识别方法的流程图，给出了一种具体的通过预设检测算法进行计算确定待识别设备的方法，如图3所示，包括：
步骤S301、获取原始数据库中存储的登录数据，所述登录数据为关系型表格数据，包括账号信息、设备信息以及关联的属性信息。
步骤S302、将所述账号信息和所述设备信息作为节点，所述属性信息中选取节点属性信息作为节点属性，生成结构化数据存储至图数据库中，将所述账号信息和所述设备信息作为节点，所述属性信息中选取边属性信息作为边属性，生成关系数据存储至所述图数据库中。
步骤S303、获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息。
步骤S304、根据确定的异常账号信息、所述结构化数据以及所述关系数据 确定预设层级的待识别数据。
其中，该预设层级用以实现不同范围的限定，如预设层级的取值范围为3则，表征以异常账号对应节点为中心，扩展3级范围的关联图谱作为待识别数据以配置为后续进行算法计算筛选。
步骤S305、通过度中心性算法对所述待识别数据进行计算确定中心设备，通过介质中心性算法对所述待识别数据进行计算确定连接设备，将中心设备以及连接设备对应的设备确定为待识别设备。
在一个实施例中，在确定待识别设备时，通过度中心性算法确定中心设备，通过介质中心性算法确定连接设备。其中，度中心性表示一个节点与其他节点相联系的程度，在一个关系网络中刻画节点中心性的直接度量指标，一个节点的节点度越大意味着该节点的度中心性越高，在网络中重要程度越大。通过度中心性算法的计算以发现大规模社群团伙的中心设备。介质中心性算法是以经过某个节点的最短路径数目来刻画节点重要性的指标，反映了节点作为“桥梁”的重要程度。通过介质中心性算法计算以发现多个社群团伙之间充当“桥梁”连接设备。
在一实施例中，度中心性算法的计算公式如为：
Figure PCTCN2022132864-appb-000001
其中，C D(N i)表示节点i的度中心度，
Figure PCTCN2022132864-appb-000002
用来计算节点i和其他g-i个j节点之间直接联系的数量。
Figure PCTCN2022132864-appb-000003
节点s到节点t的最短路径条数。
步骤S306、如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
由上述方案可知，基于异常账号信息和预设层级的设置在图数据库中确定出合理的待识别数据范围，通过度中心性算法以及介质中心性算法分别计算得到其中的中心设备和连接设备，在对其属性信息是否满足预设规则进行判断以最终确定出异常设备，合理、高效的实现了异常设备的挖掘，其准确度高且节省了大量的人力资源。
图4为本申请实施例提供的另一种异常数据识别方法的流程图，给出了一种包含信息查询反馈的过程。如图4所示，包括：
步骤S401、获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息。
步骤S402、接收待查询账号，以所述待查询账号为图中心在所述图数据库中进行关系图谱路径查询，确定和所述待查询账号关联的账号信息和设备信息并进行展示。
在一个实施例中，针对用户的账号申诉，可以通过转化的结构化数据以及关系数据进行快速的、可多级扩展的查询。如用户进行某个账号申诉后，系统接收到待查询账号，以待查询账号为图中心节点在图数据库中进行关系图谱路径查询，确定和待查询账号关联的账号信息和设备信息并进行展示，可以直观的进行账号和设备关联关系的展示。工作人员可根据该展示内容进行异常账号的快速认定。其中，关系图谱路径查询过程中，以待查询账号为图中心沿和该中心相连的节点的边路径进行查询，以确定出待查询账号关联的账号信息和设备信息。除此之外，由于图数据库的建立，也可支持针对任意节点、属性信息的查询，提高查询和判断效率。如查询得到该待查询账号的登录设备、登录次数、登录时间，以及该待查询账号登录设备中，该登录设备登录的账号数量等关联信息。
步骤S403、根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备。
步骤S404、如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
由上述可知，通过图数据库存储的结构化数据和关系数据，以待查询账号为基础进行关联图谱路径查询，以得到相应的和该待查询账号关联的账号信息和设备信息并进行展示，显著提高了数据查询效率，展示效果更佳便于工作人员进行账号是否被盗的判断。
图5为本申请实施例提供的另一种异常数据识别方法的流程图，给出了一种异常数据识别后进行验证策略调整的过程。如图5所示，包括：
步骤S501、获取原始数据库中存储的登录数据，所述登录数据为关系型表格数据，包括账号信息、设备信息以及关联的属性信息。
步骤S502、将所述账号信息和所述设备信息作为节点，所述属性信息中选取节点属性信息作为节点属性，生成结构化数据存储至图数据库中，将所述账号信息和所述设备信息作为节点，所述属性信息中选取边属性信息作为边属性， 生成关系数据存储至所述图数据库中。
步骤S503、获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息。
步骤S504、根据确定的异常账号信息、所述结构化数据以及所述关系数据确定预设层级的待识别数据。
步骤S505、通过度中心性算法对所述待识别数据进行计算确定中心设备，通过介质中心性算法对所述待识别数据进行计算确定连接设备，将中心设备以及连接设备对应的设备确定为待识别设备。
步骤S506、如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
步骤S507、将所述异常设备的设备标识以及异常等级添加至缓存中，当检测到登录设备的设备标识与所述异常设备的设备标识一致时，根据所述异常等级确定对应的验证策略，基于所述验证策略对所述登录设备进行验证。
在一个实施例中，确定异常设备后，确定异常设备的异常等级。可选的，根据异常设备满足的预设规则数量进行异常等级的确定，满足的预设规则数量越多其异常等级越高。异常设备的设备标识以及异常等级添加至缓存中，以在检测到登录设备的设备标识与该异常设备的设备标识一致时，采取更高级别的验证策略对该登录设备进行验证，如需提供复杂的、数量更多的验证内容才可通过验证。示例性的，包括人脸识别验证、问题问答验证等。其中，异常等级越高对应的验证策略也越复杂。
由上述可知，在确定异常设备后，将异常设备的标识存入缓存中，以对命中的登录设备进行复杂验证，验证策略根据异常设备的异常等级确定，保证了账号登录安全，同时不会对常规正常的登录设备进行过度复杂验证以影响用户体验。
图6为本申请实施例提供的一种异常数据识别装置的结构框图，该装置配置为执行上述实施例提供的异常数据识别方法，具备执行方法相应的功能模块和有益效果。如图6所示，该系统具体包括：数据获取模块101、待识别设备确定模块102和异常设备确定模块103，其中，
数据获取模块101，配置为获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
待识别设备确定模块102，配置为根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
异常设备确定模块103，配置为如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备由上述方案可知，根据注册中心信息创建多个数据同步任务，其中，每个数据同步任务对应至少两个不同的注册中心，当检测到某个注册中心的信息变更时，通过创建的数据同步任务将信息变更内容转换为不同类型的注册中心的变更信息，将变更信息发送至对应的注册中心，配置为实现其它注册中心和所述第一注册中心的信息同步以提供信息调用，显著提升了异常数据识别效率，降低了总体成本。
在一个可能的实施例中，该装置还包括数据转换存储模块104，配置为：
在获取图数据库中存储的结构化数据以及关系数据之前，获取原始数据库中存储的登录数据，所述登录数据为关系型表格数据，包括账号信息、设备信息以及关联的属性信息；
将所述账号信息和所述设备信息作为节点，所述属性信息中选取节点属性信息作为节点属性，生成结构化数据存储至图数据库中；
将所述账号信息和所述设备信息作为节点，所述属性信息中选取边属性信息作为边属性，生成关系数据存储至所述图数据库中。
在一个可能的实施例中，所述待识别设备确定模块102具体配置为：
根据确定的异常账号信息、所述结构化数据以及所述关系数据确定预设层级的待识别数据；
通过预设检测算法对所述待识别数据进行计算确定待识别设备。
在一个可能的实施例中，所述待识别设备确定模块102具体配置为：通过度中心性算法对所述待识别数据进行计算确定中心设备；
通过介质中心性算法对所述待识别数据进行计算确定连接设备。
在一个可能的实施例中，所述待识别设备的属性信息满足预设规则，包括下述至少一种：
所述中心设备对应的登录账号的数量大于第一预设数量；或，
所述中心设备对应的登录账号中，注册账号与非注册账号的比值大于第一预设比例值；或，
所述中心设备对应的登录账号中，主播类型账号与拍客类型账号的比例值大于第二预设比例值；或，
所述中心设备对应的登录账号中，历史异常记录数量大于第二预设数量；或，
所述连接设备处于至少两个中心设备的最短路径中。
在一个可能的实施例中，该装置还包括查询显示模块105配置为：
接收待查询账号，以所述待查询账号为图中心在所述图数据库中进行关系图谱路径查询，确定和所述待查询账号关联的账号信息和设备信息并进行展示。
在一个可能的实施例中，该装置还包括安全验证模块106，配置为：
在确定所述待识别设备为异常设备之后，将所述异常设备的设备标识以及异常等级添加至缓存中；
当检测到登录设备的设备标识与所述异常设备的设备标识一致时，根据所述异常等级确定对应的验证策略；
基于所述验证策略对所述登录设备进行验证。
图7为本申请实施例提供的一种异常数据识别设备的结构示意图，如图7所示，该设备包括处理器201、存储器202、输入装置203和输出装置204；设备中处理器201的数量可以是一个或多个，图7中以一个处理器201为例；设备中的处理器201、存储器202、输入装置203和输出装置204可以通过总线或其他方式连接，图7中以通过总线连接为例。存储器202作为一种计算机可读存储介质，可配置为存储软件程序、计算机可执行程序以及模块，如本申请实施例中的异常数据识别方法对应的程序指令/模块。处理器201通过运行存储在存储器202中的软件程序、指令以及模块，从而执行设备的各种功能应用以及数据处理，即实现上述的异常数据识别方法。输入装置203可配置为接收输入的数字或字符信息，以及产生与设备的用户设置以及功能控制有关的键信号输入。输出装置204可包括显示屏等显示设备。
本申请实施例还提供一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时配置为执行一种上述实施例描述的异常数据识别方法，具体包括：
获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为 异常设备。值得注意的是，上述异常数据识别装置的实施例中，所包括的各个单元和模块只是按照功能逻辑进行划分的，但并不局限于上述的划分，只要能够实现相应的功能即可；另外，各功能单元的具体名称也只是为了便于相互区分，并不用于限制本申请实施例的保护范围。
在一些可能的实施方式中，本申请提供的方法的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序产品在计算机设备上运行时，所述程序代码配置为使所述计算机设备执行本说明书上述描述的根据本申请各种示例性实施方式的方法中的步骤，例如，所述计算机设备可以执行本申请实施例所记载的异常数据识别方法。所述程序产品可以采用一个或多个可读介质的任意组合实现。

Claims (10)

  1. 异常数据识别方法，应用于服务器，其中，包括：
    获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
    根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
    如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
  2. 根据权利要求1所述的异常数据识别方法，其中，在获取图数据库中存储的结构化数据以及关系数据之前，还包括：
    获取原始数据库中存储的登录数据，所述登录数据为关系型表格数据，包括账号信息、设备信息以及关联的属性信息；
    将所述账号信息和所述设备信息作为节点，所述属性信息中选取节点属性信息作为节点属性，生成结构化数据存储至图数据库中；
    将所述账号信息和所述设备信息作为节点，所述属性信息中选取边属性信息作为边属性，生成关系数据存储至所述图数据库中。
  3. 根据权利要求1或2所述的异常数据识别方法，其中，所述根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备，包括：
    根据确定的异常账号信息、所述结构化数据以及所述关系数据确定预设层级的待识别数据；
    通过预设检测算法对所述待识别数据进行计算确定待识别设备。
  4. 根据权利要求3所述的异常数据识别方法，其中，所述通过预设检测算法对所述待识别数据进行计算确定待识别设备，包括：
    通过度中心性算法对所述待识别数据进行计算确定中心设备；
    通过介质中心性算法对所述待识别数据进行计算确定连接设备。
  5. 根据权利要求4所述的异常数据识别方法，其中，所述待识别设备的属性信息满足预设规则，包括下述至少一种：
    所述中心设备对应的登录账号的数量大于第一预设数量；或，
    所述中心设备对应的登录账号中，注册账号与非注册账号的比值大于第一预设比例值；或，
    所述中心设备对应的登录账号中，主播类型账号与拍客类型账号的比例值 大于第二预设比例值；或，
    所述中心设备对应的登录账号中，历史异常记录数量大于第二预设数量；或，
    所述连接设备处于至少两个中心设备的最短路径中。
  6. 根据权利要求1-5中任一项所述的异常数据识别方法，其中，还包括：
    接收待查询账号，以所述待查询账号为图中心在所述图数据库中进行关系图谱路径查询，确定和所述待查询账号关联的账号信息和设备信息并进行展示。
  7. 根据权利要求1-6中任一项所述的异常数据识别方法，其中，在确定所述待识别设备为异常设备之后，还包括：
    将所述异常设备的设备标识以及异常等级添加至缓存中；
    当检测到登录设备的设备标识与所述异常设备的设备标识一致时，根据所述异常等级确定对应的验证策略；
    基于所述验证策略对所述登录设备进行验证。
  8. 异常数据识别装置，其中，包括：
    数据获取模块，配置为获取图数据库中存储的结构化数据以及关系数据，所述结构化数据以及所述关系数据包括账号信息、设备信息以及关联的属性信息；
    待识别设备确定模块，配置为根据确定的异常账号信息、所述结构化数据以及所述关系数据，通过预设检测算法进行计算确定待识别设备；
    异常设备确定模块，配置为如果所述待识别设备的属性信息满足预设规则，则确定所述待识别设备为异常设备。
  9. 一种异常数据识别设备，所述设备包括：一个或多个处理器；存储装置，配置为存储一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求1-7中任一项所述的异常数据识别方法。
  10. 一种存储计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时配置为执行如权利要求1-7中任一项所述的异常数据识别方法。
PCT/CN2022/132864 2021-11-24 2022-11-18 异常数据识别方法、装置、设备和存储介质 WO2023093638A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111403923.8A CN114154166A (zh) 2021-11-24 2021-11-24 异常数据识别方法、装置、设备和存储介质
CN202111403923.8 2021-11-24

Publications (1)

Publication Number Publication Date
WO2023093638A1 true WO2023093638A1 (zh) 2023-06-01

Family

ID=80457612

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/132864 WO2023093638A1 (zh) 2021-11-24 2022-11-18 异常数据识别方法、装置、设备和存储介质

Country Status (2)

Country Link
CN (1) CN114154166A (zh)
WO (1) WO2023093638A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116823511A (zh) * 2023-08-30 2023-09-29 北京中科心研科技有限公司 一种识别用户社交孤立状态的方法、装置及可穿戴设备

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114154166A (zh) * 2021-11-24 2022-03-08 百果园技术(新加坡)有限公司 异常数据识别方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110784470A (zh) * 2019-10-30 2020-02-11 上海观安信息技术股份有限公司 一种用户异常登录的确定方法及装置
CN110839003A (zh) * 2018-08-16 2020-02-25 北京嘀嘀无限科技发展有限公司 盗号行为识别方法、装置、计算机设备和存储介质
CN112487210A (zh) * 2020-12-14 2021-03-12 每日互动股份有限公司 异常设备识别方法、电子设备和介质
US20210218760A1 (en) * 2020-01-10 2021-07-15 Capital One Services, Llc Fraud detection using graph databases
CN114154166A (zh) * 2021-11-24 2022-03-08 百果园技术(新加坡)有限公司 异常数据识别方法、装置、设备和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110839003A (zh) * 2018-08-16 2020-02-25 北京嘀嘀无限科技发展有限公司 盗号行为识别方法、装置、计算机设备和存储介质
CN110784470A (zh) * 2019-10-30 2020-02-11 上海观安信息技术股份有限公司 一种用户异常登录的确定方法及装置
US20210218760A1 (en) * 2020-01-10 2021-07-15 Capital One Services, Llc Fraud detection using graph databases
CN112487210A (zh) * 2020-12-14 2021-03-12 每日互动股份有限公司 异常设备识别方法、电子设备和介质
CN114154166A (zh) * 2021-11-24 2022-03-08 百果园技术(新加坡)有限公司 异常数据识别方法、装置、设备和存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116823511A (zh) * 2023-08-30 2023-09-29 北京中科心研科技有限公司 一种识别用户社交孤立状态的方法、装置及可穿戴设备
CN116823511B (zh) * 2023-08-30 2024-01-09 北京中科心研科技有限公司 一种识别用户社交孤立状态的方法、装置及可穿戴设备

Also Published As

Publication number Publication date
CN114154166A (zh) 2022-03-08

Similar Documents

Publication Publication Date Title
US11916944B2 (en) Network anomaly detection and profiling
US11438383B2 (en) Controlling permissible actions a computing device can perform on a data resource based on a use policy evaluating an authorized context of the device
WO2021077642A1 (zh) 一种基于异构图嵌入的网络空间安全威胁检测方法及系统
WO2023093638A1 (zh) 异常数据识别方法、装置、设备和存储介质
US11570209B2 (en) Detecting and mitigating attacks using forged authentication objects within a domain
US10396992B2 (en) Authentication of a user and/or a device through parallel synchronous update of immutable hash histories
US11030311B1 (en) Detecting and protecting against computing breaches based on lateral movement of a computer file within an enterprise
US20160344737A1 (en) Uniqueness and auditing of a data resource through an immutable record of transactions in a hash history
TWI587672B (zh) Login authentication method, client, server and system
US11916920B2 (en) Account access security using a distributed ledger and/or a distributed file system
US11128606B2 (en) Client fingerprinting for information system security
US20110271118A1 (en) Password generation methods and systems
US10965521B2 (en) Honeypot asset cloning
US20130185645A1 (en) Determining repeat website users via browser uniqueness tracking
US9563763B1 (en) Enhanced captchas
US10282461B2 (en) Structure-based entity analysis
WO2019153507A1 (zh) 社保数字证书管理方法、可读存储介质、终端设备及装置
JP6553816B2 (ja) ユーザデータ共有方法及び装置
US10282239B2 (en) Monitoring method
US20120066497A1 (en) Method and device for enabling portable user reputation
Zhou et al. Polynomial‐Based Google Map Graphical Password System against Shoulder‐Surfing Attacks in Cloud Environment
Lamba et al. Model-based cluster analysis for identifying suspicious activity sequences in software
JP2017076170A (ja) リスク評価装置、リスク評価方法及びリスク評価プログラム
WO2021052033A1 (zh) 数据调用方法、装置、设备及计算机可读存储介质
CN113935070A (zh) 基于区块链的数据处理方法、装置、设备以及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897721

Country of ref document: EP

Kind code of ref document: A1