WO2024001816A1 - 消息处理方法和电子设备 - Google Patents

消息处理方法和电子设备 Download PDF

Info

Publication number
WO2024001816A1
WO2024001816A1 PCT/CN2023/100542 CN2023100542W WO2024001816A1 WO 2024001816 A1 WO2024001816 A1 WO 2024001816A1 CN 2023100542 W CN2023100542 W CN 2023100542W WO 2024001816 A1 WO2024001816 A1 WO 2024001816A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
account
suspected
harassment
time period
Prior art date
Application number
PCT/CN2023/100542
Other languages
English (en)
French (fr)
Inventor
杨晨鹏
唐钊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024001816A1 publication Critical patent/WO2024001816A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/52—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail for supporting social networking services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present application relate to the field of communication technology, and in particular, to a message processing method and electronic device.
  • Users can communicate with each other by sending and receiving messages. For example, users can send messages to other users' terminals through social communication applications on their terminals. There are a large number of users using social communication applications, and users will receive a lot of harassing messages in social communication applications.
  • Embodiments of the present application provide a message processing method and electronic device, which can block accounts and devices associated with the accounts, and intercept harassing messages more effectively.
  • embodiments of the present application provide a message processing method.
  • the execution subject that executes the method may be a server or a chip in the server.
  • the following embodiments take the server as an example for explanation.
  • the server may be a server corresponding to an application that sends and receives messages.
  • the server parses the message log and obtains the data of the first communication ID, which is associated with the first device ID and the first account ID.
  • the message log can record the information of the message sender and receiver, as well as the message information.
  • the message log may include: the device ID, account ID, communication ID of the message sender, the device ID, account ID, communication ID, message sending time, and message type of the message recipient.
  • the communication ID is obtained based on the device ID and the account ID, and the communication ID is associated with the device ID and the account ID.
  • the first communication ID is based on the first device ID and the first account ID. It can be said that the first communication ID is based on the first device ID and the first account ID.
  • the communication ID is associated with the first device ID and the first account ID.
  • the server detects whether the first communication ID is a suspected harassment communication ID based on the data of the first communication ID.
  • the server obtains the second communication ID.
  • the data of the second communication ID in the message log is used to detect whether the second communication ID is a suspected harassing communication ID.
  • the second communication ID includes: a communication ID associated with the first device ID, and a communication ID associated with the first account ID, and the second communication ID is different from the first communication ID.
  • the server when the server determines that the first communication ID is a suspected harassment communication ID, it can also obtain the communication ID associated with the first device ID and the communication ID associated with the first account ID, and then detect whether the second communication ID It is the ID of the suspected harassment communication. Wherein, in response to the second communication ID being a suspected harassing communication ID, the server blocks the first device ID, the first account ID, the second device ID and the second account ID associated with the second communication ID. .
  • the second device ID and the second account ID are the device ID and account ID directly associated with the second communication ID. Direct association can be understood as: the second communication ID is generated from the second device ID and the second account ID.
  • the second device ID and the second account ID are directly related to the second communication ID, and are indirectly related to the device ID and account ID.
  • the second device ID is: the device ID (or account ID) that generates the second communication ID is directly or indirectly associated with the device ID
  • the second account ID is: the device ID (or account ID) that generates the second communication ID. Account ID) directly or indirectly associated account ID.
  • indirect association can also be understood as: the second communication ID is associated again or multiple times according to the associated device ID or account ID.
  • the second communication ID is associated again or multiple times according to the associated device ID or account ID.
  • the server can parse the message log, combine it with the data of the message sender, and detect whether the communication ID is a suspected harassment communication ID. Because the data in the message log is massive and the detection accuracy is high, the server has not yet analyzed the message. Specific content can protect user privacy. On the other hand, the server not only analyzes a communication ID, but also analyzes whether the account corresponding to the communication ID and other communication IDs associated with the device are suspected harassment communication IDs, that is, logging in to multiple accounts on one device, and logging into multiple devices with one account.
  • the server can perform correlation and comprehensive analysis to catch them all in one go, to avoid logging in to other accounts on the same device after the account is banned, or using the mobile phone number to apply for a new account. Continue to send harassing messages and other issues.
  • a feature database is stored in the server, and the feature database stores features of suspected harassment communication IDs. According to the data of the first communication ID and the characteristics of the suspected harassment communication ID, it is detected whether the first communication ID is the suspected harassment communication ID. Wherein, if the data of the first communication ID meets the characteristics of the suspected harassment communication ID, the server can determine the first communication ID as the suspected harassment communication ID. If the data of the first communication ID does not meet the characteristics of the suspected harassment communication ID, the server can determine that the first communication ID is not the suspected harassment communication ID.
  • the characteristics of the suspected harassing communication ID include at least one of the following: the number of messages sent by the first communication ID within the preset time period is greater than the first quantity threshold, and the number of messages sent by the first communication ID to the message recipient.
  • the proportion is greater than the preset proportion, the time period for sending messages is in a concentrated time period, and the frequency of sending messages is fixed (or within the preset frequency range).
  • the server may detect whether the number of messages sent by the first communication ID within the preset time period is greater than or equal to a first quantity threshold, and in response to the fact that the number of messages sent by the first communication ID within the preset time period is greater than or equal to the first quantity threshold, the server can detect whether the proportion of the number of messages sent by the first communication ID to the message recipient is greater than or equal to the preset proportion, and respond to the number of messages sent by the first communication ID to the message recipient. If the proportion of the quantity is greater than or equal to the preset proportion, the server can detect whether the time period in which the first communication ID sends messages is in a concentrated time period, and/or whether the frequency of sending messages by the first communication ID is fixed frequency.
  • the server taking the server to detect whether the time period in which the first communication ID sends messages is in a concentrated time period, as an example, if the time period in which the first communication ID sends messages is in a concentrated time period, the server can determine that the first communication ID The ID is the suspected harassment communication ID.
  • the process of the server detecting whether the second communication ID is a suspected harassing communication ID can refer to the description of "The process of whether the first communication ID is a suspected harassing communication ID.”
  • the characteristics of the suspected harassing communication ID may include: the number of operations of adding and deleting contacts by the first communication ID within the preset time period is greater than the second quantity threshold; the number of operations of adding and deleting contacts within the preset time period by the first communication ID large number of people
  • the time period during which the first communication ID sends messages is in a concentrated time period, and the frequency at which messages are sent is fixed (or within a preset frequency range).
  • the server may detect whether the number of operations of adding and deleting contacts by the first communication ID within the preset time period is greater than a second quantity threshold, and whether the number of operations of adding and deleting contacts within the preset time period is is greater than the third quantity threshold, the number of operations of adding and deleting contacts within the preset time period in response to the first communication ID is greater than the second quantity threshold, and the number of adding and deleting contacts within the preset time period is greater than the third quantity threshold.
  • the server may detect whether the time period during which the first communication ID sends messages is in a concentrated time period, and/or whether the frequency at which messages are sent is a fixed frequency.
  • the server determines whether the first communication ID It is the ID of the suspected harassment communication.
  • the process of the server detecting whether the second communication ID is a suspected harassing communication ID can refer to the description of "The process of whether the first communication ID is a suspected harassing communication ID.”
  • the server when the server detects that the time period for sending messages by the first communication ID is in a concentrated time period, and/or when the frequency of sending messages is a fixed frequency, the server can also detect that the first communication ID sends messages at a fixed frequency. Whether a communication ID is read for multiple days and messages are sent in the same concentrated time period, whether the same concentrated time period is a preset time period, and whether the first time period is detected except for the preset time period. Whether the communication ID has not sent a message, and whether the proportion of detecting that the number of messages sent by the first communication ID to the message recipient is 100% is 100%.
  • the server determines that the first communication ID is a suspected harassment communication ID.
  • the process of the server detecting whether the second communication ID is a suspected harassing communication ID can refer to the description of "The process of whether the first communication ID is a suspected harassing communication ID.”
  • the message sending characteristics set in the embodiment of the present application are the message sending characteristics of the harassment ID. It is detected whether the data of the first communication ID is the same as the characteristics of the suspected harassment communication ID, and whether the first communication ID is suspected of the harassment communication ID can be accurately detected. . In one embodiment, the more message sending characteristics of the preset harassment ID, the more accurate the detection result will be.
  • the server detects whether the data of the communication ID meets the characteristics of the suspected harassment communication ID. When it is satisfied, it enters the judgment of the next characteristic. When it is not satisfied, it determines that the communication ID is not a suspected harassment communication ID. It adopts a one-size-fits-all approach (i.e. yes and no). method), this method is prone to misjudgment.
  • the server can detect whether the communication ID meets the characteristics of the suspected harassing communication ID each time and add The primary communication ID is the confidence level of the suspected harassment communication ID.
  • the server responds that the number of messages sent by the first communication ID within the preset time period is greater than or equal to the first quantity threshold, and sets the first communication ID as a suspected harassment communication ID.
  • the confidence level is increased by the first preset confidence level.
  • the confidence that the first communication ID is a suspected harassing communication ID is increased by a second preset confidence Spend.
  • the time period in which the first communication ID sends messages is in a concentrated time period, and/or the frequency of sending messages is a fixed frequency
  • the confidence that the first communication ID is a suspected harassment communication ID is increased by a third predetermined amount. Set reliability.
  • the server in response to the first communication ID satisfying any one of the following characteristics, changes the first communication ID to The confidence level of the suspected harassing communication ID is increased by a fourth preset confidence level: the first communication ID is read for multiple days and messages are sent in the same concentrated time period, and the same concentrated time period is the preset time period.
  • the proportion in which the first communication ID has not sent a message except for the preset time period and the number of messages sent by the first communication ID to the message recipient is 1 is 100%.
  • the server can obtain the first confidence level of the first communication ID, and then detect whether the first communication ID is a suspected harassing communication ID based on the first confidence level.
  • the process of the server detecting whether the second communication ID is a suspected harassing communication ID can refer to the description of "The process of whether the first communication ID is a suspected harassing communication ID.”
  • the server may obtain the confidence that the second communication ID is a suspected harassing communication ID based on the data of the second communication ID in the message log.
  • the server can increase the first confidence level by a fifth preset confidence level to obtain the first communication ID.
  • the second confidence level of the ID and further based on the second confidence level, it is detected whether the first communication ID is a suspected harassment communication ID. For example, when the confidence of the first communication ID is greater than or equal to the second confidence threshold, the first communication ID may be determined to be a suspected harassment communication ID. When the confidence of the first communication ID is less than the second confidence threshold, It can be determined that the first communication ID is not a suspected harassment communication ID.
  • the server can also add a suspected harassment list to detect whether the first communication ID is included in the suspected harassment list, and to detect whether the first communication ID is a suspected harassment communication ID to further improve detection accuracy. sex.
  • the server can aggregate the communication IDs whose number of operations of adding and deleting contacts within the preset time period is greater than or equal to the second quantity threshold, and the number of operations of adding and deleting contacts within the preset time period that is greater than the third quantity threshold, to obtain
  • the first suspected harassment list aggregates the mobile phone numbers associated with the account IDs and the communication IDs of the virtual numbers to obtain the second suspected harassment list.
  • the server detects whether the first communication ID is included in the first suspected harassment list, the second suspected harassment list, and the third suspected harassment list.
  • the second communication ID in the third suspected harassment list is The confidence levels are all less than the second confidence threshold.
  • the server may determine that the first communication ID is a suspected harassment communication based on whether the first communication ID is included in the first suspected harassment list, the second suspected harassment list, and the third suspected harassment list.
  • the third confidence level of the ID For example, every time the first communication ID is included in a suspected harassment list, the server can add a sixth preset confidence level based on the second confidence level of the first communication ID to obtain whether the first communication ID It is the third confidence level of the suspected harassment communication ID.
  • the server may detect whether the first communication ID is a suspected harassment communication ID based on the third confidence level. Exemplarily, the server determines that the first communication ID is a suspected harassment communication ID in response to the third confidence being greater than or equal to the second confidence threshold, and the server responds that the third confidence is less than the second confidence threshold.
  • the second confidence threshold is used to determine that the first communication ID is not a suspected harassing communication ID.
  • the server can aggregate data, such as the number of messages sent by the communication ID within the preset time period, the proportion of the number of messages sent to the message receiver, The time period for sending messages, the frequency of sending messages, etc., based on the aggregation results, the server performs the detection process of the suspected harassing communication ID in the above possible implementation.
  • the messages sent by the first communication ID are all user messages, and the first account ID is an unofficial account.
  • this embodiment of the present application executes the message processing method provided by the embodiment of the present application for user messages sent by unofficial accounts. Because official accounts and system messages are less likely to send harassing messages, detecting user messages sent by unofficial accounts can reduce the amount of data processing on the server side.
  • embodiments of the present application also support providing a front-end interface for user (administrator) operations to improve user experience.
  • the server when the server determines that both the first communication ID and the second communication ID are suspected harassment communication IDs, the server can output the first device ID, the first account ID, and the second device ID. , and the relationship between the second account ID. For example, the server can display the association relationship between the first device ID, the first account ID, the second device ID, and the second account ID, or the server can display the information to the display device (such as the bearer of the blocked account). Processing platform) sends the association relationship between the first device ID, the first account ID, the second device ID, and the second account ID, so that the display device displays the first device ID, the first account number ID, the second device ID, and the second account ID.
  • the target object In response to (the administrator's) operation on the target object in the association relationship, ban the target object, the target object is included in the first device ID, the first account ID, and the second device ID, And in the second account ID.
  • the first mobile phone number associated with the first account ID is associated with multiple accounts (including the first account ID and other accounts), then the server displays the first device ID, the first account number ID, the second device ID, and the second account ID, the first mobile phone number associated with the first account ID is also displayed.
  • the administrator can also perform operations such as blocking, unblocking, marking, adding to the suspected harassment list, querying, and updating the signature database on the interface of the blocking processing platform.
  • embodiments of the present application provide an electronic device, which may include a processor and a memory.
  • the memory is used to store computer-executable program code, and the program code includes instructions; when the processor executes the instructions, the instructions cause the electronic device to perform the method in the first aspect.
  • embodiments of the present application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the method in the first aspect.
  • embodiments of the present application provide a computer-readable storage medium that stores instructions that, when run on a computer, cause the computer to execute the method in the first aspect.
  • Figure 1 is a schematic diagram of the system architecture applicable to this application.
  • Figure 2 is a schematic flow chart of an embodiment of the message processing method provided by the embodiment of the present application.
  • Figure 3 is a schematic flow chart of another embodiment of the message processing method provided by the embodiment of the present application.
  • Figure 4A is a schematic diagram of an association relationship between devices and accounts provided by the embodiment of the present application.
  • Figure 4B is a schematic diagram of the relationship between equipment, accounts, and mobile phone numbers provided by the embodiment of the present application.
  • Figure 5 is a schematic flow chart of another embodiment of the message processing method provided by the embodiment of the present application.
  • Figure 6 is a schematic flow chart of another embodiment of the message processing method provided by the embodiment of the present application.
  • Figure 7 is a schematic flow chart of another embodiment of the message processing method provided by the embodiment of the present application.
  • Figure 8 is a schematic diagram of the interface of the ban processing platform provided by the embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the terminal in the embodiment of this application may be called user equipment (UE).
  • the terminal may be a mobile phone, a tablet (portable android device, PAD), a personal digital assistant (PDA), Handheld devices, computing devices, vehicle-mounted devices or wearable devices with wireless communication functions, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control (industrial control) , wireless terminals in smart homes, etc.
  • VR virtual reality
  • AR augmented reality
  • the form of the terminal is not specifically limited.
  • the terminal may include at least one social communication application, and the user may send messages to other users (terminals) through the social communication application on the terminal.
  • social communication applications may include but are not limited to: SMS applications, WeChat applications, etc.
  • SMS applications SMS applications
  • WeChat applications etc.
  • the embodiments of this application do not limit social communication applications.
  • SMS messages SMS messages
  • Wex messages the messages sent and received in the Wex application
  • “messages” are used to represent the messages sent and received in each application.
  • users can upload screenshots of harassment messages to the server (such as social communication application server) on social communication applications, and the server can ban the account that sent the harassment messages to prevent the account from sending harassment messages again.
  • the account sending harassing messages can be understood as the mobile phone number.
  • the account that sends harassing messages can be understood as the application account.
  • the account that sends harassing messages can be Wex account, and/or the account that sends harassing messages can be Wex.
  • the application account may be called an account identification number (identity document, ID).
  • banning an account can be understood as: the account cannot be used. If a social communication application cannot log in to the account, or a social communication application cannot send messages after logging in to the account, the embodiment of this application will not elaborate on the status of the account after the account is blocked.
  • the embodiments of this application are intended to: without analyzing the specific content of the message, on the premise of protecting user privacy, and to log in to multiple accounts on one terminal, log in to multiple terminals with one account at the same time, and associate one mobile phone number with multiple applications
  • Figure 1 is a schematic diagram of the system architecture applicable to this application.
  • the system architecture may include: at least one terminal and a server.
  • At least one terminal may include terminal 1, terminal 2, ..., terminal N, where N is an integer greater than or equal to 2.
  • terminal 1 may be called the first terminal
  • terminal 2 may be called the second terminal
  • terminal N may be called the Nth terminal.
  • Terminals can send and receive messages through the server.
  • the message is a text message
  • the server can be a text message.
  • the message is a Wex message
  • the server can be a Wex server. If terminal 1 sends a text message to terminal 2, the transmission process of the text message is as follows: terminal 1 - short message server - terminal 2.
  • the server can store message logs between terminals (can be referred to as logs for short).
  • the message log can record the message interaction process between terminals.
  • the system structure may include a database
  • message logs may be stored in the database
  • the server may access the database to obtain message logs between terminals.
  • the server may include: a log parsing module, a data aggregation module, and a harassment identification and interception module.
  • Log parsing module used to parse message logs.
  • the log parsing module may perform S201 in the following embodiment.
  • the data aggregation module is used to aggregate the parsed message logs. For example, sort the data from largest to smallest according to the number of messages sent.
  • the data aggregation module can perform aggregation operations in aggregation processing steps 1-10 in the following embodiments.
  • the harassment identification and interception module is used to identify harassing accounts, devices and mobile phone numbers based on the characteristics of suspected harassing communication IDs in the feature library for banning.
  • the harassment identification and interception module may execute S202-S205 in the following embodiment.
  • the system architecture may also include a ban processing platform.
  • the ban processing platform can be integrated with the server or set up separately.
  • the ban processing platform can display the status of accounts, devices, phone numbers, etc. (such as ban status, suspected status, etc.). Administrators can perform ban operations, unblock operations, query operations, and update signature databases on the ban processing platform.
  • the ban processing platform can display the status of accounts, devices, phone numbers, etc. (such as ban status, suspected status, etc.). Administrators can perform ban operations, unblock operations, query operations, and update signature databases on the ban processing platform.
  • FIG. 1 takes the administrator logging in to the banning processing platform on a computer as an example, that is, the device hosting the logging in banning processing platform is a computer.
  • the ban processing platform may include: a display module and a harassment information reading and writing module.
  • the harassment information reading and writing module is used to read the status of the account, device and mobile phone number on the server side, and then write it to the ban processing platform, and in response to the user's operation on the interface of the ban processing platform, synchronize the user operation trigger to the server Changes in the status of accounts, devices, phone numbers, etc., or changes in features in the feature database, etc.
  • the display module is used to display the interface of the ban processing platform according to the user's operation.
  • system architecture does not constitute a specific limitation on the system architecture.
  • system architecture may include more or fewer components than shown in the figures, or some components may be combined, or some components may be separated, or may be arranged differently.
  • the components illustrated may be implemented in hardware, software, or a combination of software and hardware.
  • FIG. 2 is a schematic flowchart of an embodiment of the message processing method provided by the embodiment of the present application.
  • the message processing method provided by the embodiment of the present application may include:
  • the message log can record the message interaction process between terminals.
  • the server parses the message log and can obtain the device ID, account ID, communication ID of the message sender (the device that sends the message), and the device ID, account ID, communication ID, and message sending time of the message receiver (the device that receives the message). and message type.
  • the device ID may include, but is not limited to: the device's International Mobile Equipment Identity (IMEI), and other information used to uniquely indicate the device.
  • IMEI International Mobile Equipment Identity
  • the communication ID can be obtained based on the device ID and account ID. For example, specific digits in the device ID and specific digits in the account ID can be spliced to obtain the communication ID. Alternatively, a hash Hash algorithm can be used to obtain (generate) a communication ID based on the device ID and account ID. It should be noted that if the device ID or account ID is different, the communication ID obtained will be different. In other words, the communication ID can uniquely correspond to a device ID and account ID.
  • the message sending time refers to the time when the message sender sends the message.
  • Message types may include but are not limited to: text, pictures, voice, etc.
  • message types may also include, but are not limited to, system messages and user messages.
  • the message sender can obtain the communication ID based on the device ID and account ID, and when sending the message, it carries the message sender's device ID, account ID, communication ID, message sending time, and message type. In one embodiment, when sending a message, the message sender carries the device ID and account ID of the message sender, as well as the message sending time and message type. The server obtains the message based on the device ID and account ID of the message sender. The communication ID of the sender.
  • the server parses the log and can obtain relevant information of at least one message.
  • the relevant information of the message may include: the device ID, account ID, communication ID of the message sender, the device ID, account ID, communication ID of the message receiver, the message sending time, and the message type.
  • the message log may also include the contents of messages exchanged between terminals. In one embodiment, the message log may also include operations of the message sender and the message receiver adding and deleting contacts.
  • the server can parse the message log periodically, or parse the log at a fixed time every day.
  • S202 The server detects whether the first communication ID is a suspected harassing communication ID based on the data of the first communication ID in the message log. If yes, execute S203; if not, execute S206.
  • the message log may include records of multiple communication IDs.
  • the first communication ID is taken as an example to illustrate the process of the server detecting whether the communication ID is a suspected harassment communication ID.
  • the first communication ID is included in multiple communication IDs in the message log, or the first communication ID represents each communication ID in the message log.
  • the data of the first communication ID in the message log may include at least one of the following: the total number of messages sent by the first communication ID as the message sender in the message log, the number of messages sent within the preset time period, The number of message recipients of the first communication ID, the number of messages received by the message recipients of the first communication ID, as well as the message sending time period distribution, message sending frequency, etc. of the first communication ID.
  • the server can, based on the message log, count the number of messages sent by the first communication ID as the message sender within the preset time period (such as 3 minutes), if the number of messages sent within the preset time period is greater than or equal to the first threshold (such as 300), the first communication ID is determined to be the suspected harassment communication ID. If the number of messages sent within the duration is less than the first threshold, it is determined that the first communication ID is not a suspected harassment communication ID.
  • the server can first aggregate the message logs after parsing the message log, so as to determine whether the communication ID meets the characteristics of the suspected harassing communication ID. Among them, pass If the communication ID matches the characteristics of the suspected harassment communication ID, it can be determined that the communication ID is the suspected harassment communication ID. If the communication ID does not meet the characteristics of the suspected harassment communication ID, it can be determined that the communication ID is not the suspected harassment communication ID.
  • the server can store a feature library that stores characteristics of suspected harassing communication IDs. In this embodiment, the server can detect the first communication based on the data of the first communication ID in the message log. Whether the ID matches the characteristics of the suspected harassing communication ID to detect whether the first communication ID is the suspected harassing communication ID.
  • the aggregation processing on the server side can include:
  • Aggregation message type For example, in the message log, system messages and user messages can be aggregated.
  • System messages are messages sent by the terminal system, and user messages are messages sent and received interactively between users.
  • the message sender when sending a message, the message sender will carry an identifier used to identify whether the message is a system message or a user message.
  • the server After the server parses the log, it can aggregate system messages and user messages based on the identifier.
  • the message processing method in this application is executed for user messages.
  • the server can aggregate the message sender as an unofficial account.
  • the official account may be an account of a social communication application.
  • the server can store a whitelist, and the whitelist includes at least one official account.
  • the server can query the whitelist and aggregate messages from unofficial accounts.
  • the server solution can count the number of messages sent by the communication ID of the message sender. For example, the server can count the number of messages sent by communication ID1 as the message sender, the number of messages sent by communication ID2 as the message sender, and the number of messages sent by communication ID3 as the message sender, etc.
  • the server can count the number of messages sent by the same communication ID within a preset time period.
  • the preset time period can be the last one day or the last three days, and the server can count the number of messages sent by the communication ID in the last one day or the last three days.
  • the server can count the number of messages sent by communication ID1 in the last day, the number of messages sent by communication ID2 in the last day, and the number of messages sent by communication ID3 in the last day, etc.
  • the server can aggregate these communication IDs to each communication ID.
  • the number of messages sent by message recipients For example, among communication ID1, communication ID2, and communication ID3, the number of messages sent by communication ID1 in the last day is greater than the second threshold (such as 1,000), then the server can aggregate the messages sent by communication ID1 in the last day to each The number of messages sent by message recipients.
  • the second threshold may be referred to as the first quantity threshold. It should be understood that the "second threshold” is used to represent the "second quantity threshold” in the drawings.
  • the server may aggregate the proportion of the number of messages sent by the communication ID to the message recipient. For example, among communication ID1, communication ID2, and communication ID3, the number of messages sent by communication ID1 in the last day is greater than the second threshold (such as 1,000), then the server can aggregate the messages sent by communication ID1 in the last day to each The proportion of the number of messages sent by message receivers.
  • the second threshold such as 1,000
  • the server can aggregate the number of messages sent by communication ID1 to communication ID4 to 1, the number of messages sent to communication ID5 to 1, the number of messages sent to communication ID6 to 1, and the number of messages sent to communication ID7 to 1. is 2.
  • the server can count that the number of messages sent by communication ID1 to the message receiver is 3/4, and the number of messages sent to the message receiver is 3/4.
  • the proportion of messages with a number of 1 is 1/4.
  • the server when the server can aggregate the communication IDs whose number of messages sent to the message recipient is less than the third threshold, then aggregate the time period and frequency of sending messages by these communication IDs.
  • the third threshold may be 2. If the number of messages sent by the communication ID to each message recipient is 1 (all less than 2), the server may aggregate the time period and frequency of messages sent by the communication ID. For example, if the time period for sending messages by the server's aggregation communication ID is: 4:00 to 5:00 pm and 1:00 to 2:00 a.m. on this day, the frequency of sending messages by the server's aggregation communication ID is: 10 every 1 minute strip.
  • the server aggregates the proportion of the number of messages sent by the communication ID to the message recipient, if it is determined that the proportion of the number of messages sent by the communication ID to the message recipient is 1, which is greater than or equal to the preset proportion, Then the server aggregates the time period and frequency of sending messages by these communication IDs.
  • the server can aggregate the number of operations of adding and deleting contacts based on the communication ID of the message sender, as well as the total number of contacts added and deleted. For example, the server can aggregate the number of operations of adding and deleting contacts in descending order. , sorts the communication IDs that are the message senders. In one embodiment, the server can aggregate the communication ID of the message sender, the number of operations of adding and deleting contacts within a preset time period (such as within one day), and the number of contacts added and deleted.
  • the number of operations of adding and deleting contacts in a day is 50 times, and the number of contacts added and deleted is 500 people.
  • the message sender communication ID2 the number of operations to add and delete contacts in a day is 30 times, and the number of contacts added and deleted is 500 people.
  • the message sender communicates with ID3 the number of operations of adding and deleting contacts in a day is 100 times, and the number of contacts added and deleted is 500 people.
  • adding a contact can be regarded as an operation of adding or deleting a contact
  • deleting a contact can be regarded as an operation of adding or deleting a contact. Because there is an upper limit on the number of contacts for each add or delete operation, that is, each new or deleted operation can operate up to 100 (example) contacts. Therefore, if the number of contacts exceeds the upper limit, it needs to be operated in batches, that is, Add and delete contacts multiple times.
  • the data of the first communication ID aggregated by the server may include: message type, account type, the number of messages sent to the message recipient within the preset time period, and the number of messages sent to the message recipient.
  • the proportion of 1 the time period for sending messages, the frequency of sending messages, the number of operations to add and delete contacts, and the number of contacts to be added and deleted.
  • S301-S305, and S301A can refer to the description in the aggregation processing in 1-6 above:
  • S302 Determine whether the account sending the message is an unofficial account. If yes, execute S303; if not, execute S206.
  • S303 Determine whether the number of messages sent by the first communication ID within the preset time period is greater than the second threshold. If yes, execute S304; if not, execute S206.
  • S304 Determine whether the proportion of 1 messages sent by the first communication ID to the message recipient is greater than a preset proportion. If yes, execute S305; if not, execute S206.
  • S304 may be replaced by: determining whether the number of messages sent by the first communication ID to the message recipient is all 1. If yes, execute S305; if not, execute S206. It should be understood that FIG. 3 takes "determining whether the proportion of the number of messages sent by the first communication ID to the message recipient as 1 is greater than the preset proportion" as an example for explanation.
  • S305 Determine whether the time period during which the first communication ID sends messages is in a concentrated time period, and/or whether the frequency at which messages are sent is a fixed frequency. If yes, execute S203; if not, execute S206.
  • the concentrated time period can be understood as a preset time period.
  • the concentrated time period can be 2 hours.
  • the time period for the server to aggregate communication IDs and send messages is: 4 pm to 5 pm and 1 am to 2 am on this day, then the server determines the communication
  • the time period when ID sends messages is a concentrated time period.
  • the frequency at which the communication ID sends messages is a fixed frequency, that is, the frequency at which the communication ID sends messages remains unchanged or the frequency changes within a preset frequency range.
  • the frequency of sending messages by the communication ID is 10 messages per minute, and 10 messages/minute is the fixed frequency of sending messages by the communication ID.
  • S301A may also be performed:
  • S301A Determine whether the number of operations of adding and deleting contacts by the first communication ID within a preset time period is greater than (or equal to) a fourth threshold, and whether the number of added and deleted contacts is greater than (or equal to) a third quantity threshold. If yes, execute S305; if not, execute S206.
  • the fourth threshold may be referred to as the second quantity threshold. It should be understood that in the drawings, the "fourth threshold" is used to represent the "second quantity threshold", and the quantity threshold is used to represent the "third quantity threshold”.
  • S202 includes: S301-S305, and S301A.
  • S203 The server obtains the second communication ID associated with the first device ID and the first account ID based on the first device ID and the first account ID corresponding to the first communication ID.
  • one device such as device 1 can log in to multiple accounts (such as account 1, account 2)
  • the user can use multiple accounts on the device to send messages, and the message sender's identity will be recorded in the message log.
  • the information is device 1, account 1, and the communication ID1A obtained by device 1 and account 1.
  • the message log will also record the information of the message sender as device 1, account 2, and the communication ID1B obtained by device 1 and account 2.
  • account 1 and account 2 can both be mobile phone numbers; if the message is a Wex message, account 1 and account 2 can both be Wex accounts.
  • one device can log in to multiple accounts, which can be regarded as device 1 associated with account 1 and account 2.
  • the server can determine that device 1 and account 1 are both associated with communication ID 1A, and device 1 and account 2 are both associated with communication ID 1A.
  • Associated communication ID1B Associated communication ID1B.
  • the user can use account 1 on device 1 and account 1 on device 2 to send messages.
  • the message sender's information will be recorded as device 1, account 1, and the communication ID 1A obtained by device 1 and account 1.
  • the message log will also record the message sender's information as device 2, account 1, and the communication ID 1A obtained by device 2 and account 1. 1 Get the communication ID1C.
  • one account can log in to multiple devices, which can be regarded as account 1 associated with device 1 and device 2.
  • the server can determine that device 1 and account 1 are both associated with communication ID 1A, and device 2 and account 1 are both associated with communication ID 1A.
  • Associated communication ID1C Associated communication ID1C.
  • the server can store the user's operation log, and the operation log can include the user's binding relationship between the application account and the mobile phone number. A certain operation, so the server can query the operation log and determine the mobile phone number (such as Number 1) binds multiple application accounts (such as account 1 and account 2), and then confirms that number 1 can be associated with account 1 and account 2.
  • the server can build a relational database based on message logs.
  • the relational database includes: device ID, account ID, and communication ID relationships.
  • the relational database may use a tree diagram or a topology diagram to represent the association between the device ID, the account ID, and the communication ID. The embodiment of the present application does not limit this.
  • FIG. 4A represents the association relationship between account 1, account 2, device 1, device 2, and communication ID1A, communication ID1B, and communication ID1C in the form of a topology diagram.
  • the server can build a relational database based on message logs and operation logs.
  • the relational database includes: device ID, account ID, communication ID, and phone number relationships.
  • the operation log can be regarded as a message log. Therefore, it can also be said that the server builds a relational database as shown in Figure 4B based on the message log.
  • FIG. 4B represents the association relationship between account 1, account 2, device 1, device 2, communication ID1A, communication ID1B, communication ID1C, and number 1 in the form of a topology diagram.
  • the device ID and account ID associated with the first communication ID may be called the first device ID and the first account ID.
  • the first communication ID is obtained based on the first device ID and the first account ID.
  • the server determines that the first communication ID is a suspected harassment communication ID, it can query the relational database to obtain the communication ID associated with the first device ID and the communication ID associated with the first account ID.
  • the first device ID is The associated communication ID and the communication ID associated with the first account ID are called the second communication ID.
  • the first device ID is device 1
  • the first account ID is account 1
  • the communication ID associated with device 1 is communication ID 1A (that is, the first communication ID)
  • communication ID1B the communication ID associated with account 1 includes: communication ID1A, communication ID1C, ID1A, communication ID1B, ID1C can be used as the second communication ID.
  • the second communication ID is: a communication ID other than the first communication ID among the communication IDs associated with the first device ID and the communication IDs associated with the first account ID.
  • the first device ID is device 1
  • the first account ID is account 1
  • the second communication ID associated with device 1 is communication ID 1A. (i.e., the first communication ID) and communication ID1B.
  • the communication IDs associated with account 1 include: communication ID1A and communication ID1C. Communication ID1B and communication ID1C can be used as the second communication ID.
  • the server can also The communication ID associated with the third account ID is used as the second communication ID.
  • S204 The server detects whether the second communication ID is a suspected harassing communication ID based on the data of the second communication ID in the message log. If yes, execute S205; if not, execute S206.
  • the process of the server detecting whether the second communication ID is a suspected harassing communication ID can refer to the description of the server detecting whether the first communication ID is a suspected harassing communication ID in Figure 3.
  • Figure 3 does not show the specific process of detecting whether the second communication ID is a suspected harassing communication ID.
  • S205 The server blocks the first device ID and first account ID associated with the first communication ID, and the second device ID and second account ID associated with the second communication ID.
  • the server can ban the account ID associated with the first communication ID.
  • the server can block the device 1 and account 1 associated with communication ID1A, and the device 1 and 1 associated with communication ID1B.
  • Account 2 as well as device 2 and account 1 associated with communication ID1C, that is, the server can ban device 1, account 1, device 2, and account 2.
  • the second device ID and the second account ID are directly related to the device ID and the account ID as the second communication ID.
  • Direct association can be understood as: the second communication ID is generated by the second device ID and the second account ID.
  • the second communication ID is communication ID1B
  • communication ID1B is directly associated with device 1 and account 2.
  • the second communication ID is communication ID1C
  • communication ID1C is directly associated with device 2 and account 1.
  • Blocking a device can be understood as: the device cannot be used. If the device cannot send messages, or the device cannot log in to the social communication application, or the device is turned on and used, the embodiment of this application does not elaborate on the status of the device after the device is banned.
  • the server can also block the mobile phone numbers associated with the first account ID and the second account ID. Other accounts.
  • the second device ID and the second account ID include: the second communication ID is directly related, and the device ID and account ID are indirectly related. For direct correlation, refer to the relevant descriptions above.
  • Indirect association can be understood as the second device ID is: the device ID (or account ID) that generates the second communication ID is directly or indirectly associated with the device ID
  • the second account ID is: the device ID (or account ID) that generates the second communication ID.
  • Account ID) directly or indirectly associated account ID.
  • indirect association can also be understood as: the second communication ID is associated again or multiple times according to the associated device ID or account ID.
  • the second communication ID includes communication ID1B and communication ID1C.
  • Communication ID1B is directly associated with device 1 and account 2.
  • Communication ID1C is directly associated with device 2 and account 1.
  • Device 2 and account 3 can obtain communication ID1D, account 3 and device. 3 can get communication ID1E, account 2 and device 3 can get communication ID1F.
  • communication ID1C is not directly associated with account 3 and device 3, and communication ID1B is not directly associated with device 3, account 2, which communication ID1C is directly associated with, is associated with account 3. Therefore, communication ID1C can be indirectly associated with account 3, and account 3 is associated with it indirectly. Device 3, therefore communication ID1C can be indirectly associated with device 3.
  • communication ID1B is not directly associated with device 3, because the account 2 directly associated with communication ID1B is associated with device 3, communication ID1B can be indirectly associated with device 3.
  • the server may directly block the first device ID and first account ID associated with the first communication ID, and the second device ID and second account ID associated with the second communication ID. In one embodiment, the server may also detect whether the third communication ID is a suspected harassing communication ID, and if the third communication ID is a suspected harassing communication ID, block the device ID and account ID associated with the third communication ID. It should be understood that the third communication ID can be understood as: a communication ID that is indirectly associated with the second device ID that is associated with the second communication ID (directly, and indirectly), and a second account ID that is associated with the second communication ID that is indirectly associated with it (directly, and indirectly). and indirectly) the associated communication ID.
  • communication ID 1D is a suspected harassing communication ID
  • account 3 can be blocked; when communication ID 1E is a suspected harassing communication ID, account 3 and device 3 can be blocked; and when communication ID 1F is a suspected harassing communication ID, In this case, device 3 can be blocked.
  • the server does not respond, that is, the first communication ID is not blocked.
  • the server can parse the message log, and combine the message sender (through the message log) with ID), as well as the characteristics of the suspected harassment communication ID, detect whether the communication ID is the suspected harassment communication ID, because the data in the message log is massive, the detection accuracy is high, and the server does not analyze the specific content of the message, which can protect users privacy.
  • the server does not just block one account, but blocks the device, account, and mobile phone number associated with the communication ID to achieve a comprehensive ban.
  • not only one communication ID is analyzed, but also the account corresponding to the communication ID and other communication IDs associated with the device are analyzed to see whether they are suspected harassing communication IDs, that is, logging in to multiple accounts on one device, and logging in with one account.
  • the server can perform correlation and comprehensive analysis to catch them all at once, avoiding the possibility of logging in to other accounts on the same device after the account is banned, or using the mobile phone number to apply. New account, continue to send harassing messages and other issues.
  • features in the feature library can also be added to more accurately identify the suspected harassment communication ID.
  • the features in the feature database may also include: messages are sent in the same time period for multiple consecutive days (such as 3 days), the time period for sending messages is concentrated in the early morning, and messages are not sent in other time periods except early morning. messages, and the proportion of the number of messages sent to the message recipient with the communication ID is 1, which is 100%.
  • early morning (such as 1 a.m. - 3 a.m.) can be replaced with: a preset time period.
  • the preset time period is 4 pm - 6 pm, etc.
  • the concentrated time period can be customized, and the concentrated time period can be at least one.
  • the aggregation process on the server side may also include:
  • the server can query the time periods in which communication IDs send messages in the previous three days to detect whether communication IDs have sent messages in the same time period for three consecutive days. For example, through aggregation processing on the server side, the communication ID is obtained for three consecutive days, and messages are sent between 4:00 pm to 5:00 pm and 1:00 am to 2:00 am.
  • the server After the server aggregates the time period for sending messages by communication IDs, the server detects whether the time period for sending messages by communication IDs is concentrated in the early morning. For example, if the time period for the server to aggregate communication IDs to send messages is: 4 pm to 5 pm and 1 am to 2 am, the server can determine that the time period for communication IDs to send messages is concentrated in the early morning. .
  • the time period when the server aggregates communication IDs to send messages is concentrated in the early morning.
  • the server can also detect whether the communication IDs have not sent messages in other time periods.
  • the time period for the communication ID to send messages is: 4:00 to 5:00 pm and 1:00 to 2:00 am on this day. That is, in addition to sending messages in the early morning, the communication ID also sends messages from 4:00 to 5:00 pm. information.
  • the server aggregates the proportion of the number of messages sent by the communication ID to the message recipient, it also needs to detect whether the proportion of the number of messages sent by the communication ID to the message recipient is 100%.
  • the server when the server detects that the proportion of the number of messages sent by the communication ID to the message recipient is greater than or equal to the preset proportion, the server can further detect whether the proportion of the number of messages sent by the communication ID to the message recipient is 100%. .
  • the features in the feature database can be customized by the user. For details, refer to the relevant description in Figure 8 .
  • S306 detect whether the first communication ID sends messages in the same time period for multiple consecutive days (such as 3 days), whether the time period for sending messages is concentrated in the early morning, and whether no messages are sent in other time periods except early morning, and Whether the proportion of the number of messages sent by the first communication ID to the message recipient is 100%. If yes, execute S203; if not, execute S206.
  • the server detects that the first communication ID is read for multiple days (such as 3 days) and sends messages in the same time period.
  • the time period for sending messages is concentrated in the early morning, and does not occur in other time periods except early morning.
  • Send a message as well first If the number of messages sent by the communication ID to the message receiver is 1, the proportion is 100%, then S203 can be executed.
  • the server when performing S204, when the server detects whether the second communication ID is a suspected harassment communication ID, it also needs to detect whether the second communication ID has been read for multiple days (such as 3 days) in the same time period.
  • the time period for sending messages is concentrated in the early morning, whether no messages are sent in other time periods except early morning, and whether the proportion of the number of messages sent by the second communication ID to the message recipient is 100%.
  • a detection feature for detecting whether the communication ID is a suspected harassing communication ID can be added.
  • the added detection features fit the characteristics of the suspected harassing communication ID, so the detection accuracy of whether the communication ID is a suspected harassing communication ID can be improved.
  • the communication ID it is detected whether the communication ID satisfies the characteristics of the suspected harassment communication ID. If it meets the characteristics, it will enter the judgment of the next characteristic. If it does not meet the characteristics, it is determined that the communication ID is not a suspected harassment communication ID.
  • a one-size-fits-all approach is adopted. (That is, yes and no method), this method is prone to misjudgment.
  • a confidence level can be introduced in the embodiment of this application, and each time the server detects whether the communication ID meets the characteristics of a suspected harassing communication ID, add A communication ID is the confidence level of a suspected harassing communication ID, rather than a "yes and no" one-size-fits-all approach to improve detection accuracy.
  • the confidence level that the first communication ID is a suspected harassing communication ID can be increased by a first Preset confidence level, such as 50% (abbreviated as increasing the confidence level by 50% in Figure 3).
  • a first Preset confidence level such as 50% (abbreviated as increasing the confidence level by 50% in Figure 3).
  • the second preset confidence. degree such as 20%.
  • the confidence level that the first communication ID is a suspected harassing communication ID can be increased by the third Three preset confidence levels, such as 10%.
  • the confidence that the first communication ID is the suspected harassment communication ID can be increased by the third Four preset confidence levels, such as 5%. For example, if the first communication ID is read for multiple days (such as 3 days) and messages are sent in the same time period, the confidence that the first communication ID is a suspected harassing communication ID can be increased by 5%. If the time period when the first communication ID sends messages is concentrated in the early morning, the confidence that the first communication ID is a suspected harassing communication ID can be increased by 5%.
  • the confidence that the first communication ID is a suspected harassing communication ID is increased by 5%. If the number of messages sent by the first communication ID to the message recipient is 100%, the confidence that the first communication ID is a suspected harassing communication ID can be increased by 5%. It should be understood that the branch in which the first communication ID does not meet the characteristics in S306 is not shown in FIG. 6 .
  • the first confidence level that the first communication ID is the suspected harassing communication ID can be obtained.
  • the server when performing S204, can also obtain the confidence level that the second communication ID is a suspected harassing communication ID based on the detection of the data of the second communication ID.
  • the server obtains the confidence that the second communication ID is the suspected harassment communication ID, it can determine whether the confidence that the second communication ID is the suspected harassment communication ID is greater than or equal to the first confidence threshold (such as 80%). If the confidence that the second communication ID is a suspected harassing communication ID is greater than or equal to the first confidence threshold (such as 80%), the server can set the first communication ID to The reliability continues to increase with a fifth preset confidence level, such as 10%, to obtain a second confidence level of the first communication ID.
  • a fifth preset confidence level such as 10%
  • the server can detect whether the second confidence level of the first communication ID is greater than or equal to the second confidence threshold (such as 95%). If the first communication ID is a suspected harassing communication ID, the second confidence level is greater than or equal to the second confidence threshold, the first communication ID is determined to be a suspected harassing communication ID, and the server can block the first device ID, the first account ID associated with the first communication ID, and the second communication ID associated with the second communication ID. Device ID, second account ID. If the second confidence level that the first communication ID is a suspected harassment communication ID is less than the second confidence threshold, it is determined that the first communication ID is not a suspected harassment communication ID, and the server may not respond.
  • the second confidence level of the first communication ID is greater than or equal to the second confidence threshold (such as 95%). If the first communication ID is a suspected harassing communication ID, the second confidence level is greater than or equal to the second confidence threshold, the first communication ID is determined to be a suspected harassing communication ID, and the server can block the first device ID, the first account ID associated with the first
  • the server can detect whether the first confidence level of the first communication ID is greater than or equal to the second confidence threshold. (such as 95%), if the first confidence level that the first communication ID is a suspected harassing communication ID is greater than or equal to the second confidence threshold, then it is determined that the first communication ID is a suspected harassing communication ID, and the server can block the first communication ID The associated first device ID and first account ID, and the associated second device ID and second account ID with the second communication ID. If the first confidence level that the first communication ID is a suspected harassment communication ID is less than the second confidence threshold, it is determined that the first communication ID is not a suspected harassment communication ID, and the server may not respond.
  • the first confidence threshold such as 80%
  • Confidence is introduced in the embodiment of this application. For each time the server detects whether the communication ID meets the characteristics of the suspected harassment communication ID, the confidence level that the communication ID is the suspected harassment communication ID can be increased, instead of using a "yes and no" one-size-fits-all approach. method, which can improve detection accuracy.
  • the embodiment of the present application can also add a suspected harassment list, and further add whether the communication ID is included in the suspected harassment list to increase the judgment of whether the communication ID is a suspected harassment communication ID. To further improve the detection accuracy of communication ID.
  • the server when performing S301A, can parse the message log to collect the communication IDs whose number of operations to add or delete contacts within the preset time period is greater than the fourth threshold, and when the number of added or deleted contacts is greater than the third threshold. Get the first list of suspected harassment.
  • the mobile phone number associated with the communication ID is a virtual mobile phone number
  • the mobile phone number is largely a suspected harassing mobile phone number
  • the communication ID is also a suspected harassing communication ID to a large extent
  • the server parses In the message log, the mobile phone number can be used as the communication ID of the virtual number to obtain the second suspected harassment list.
  • the number segments of the virtual mobile phone number are all within the preset number segment.
  • the server determines whether the mobile phone number is a virtual mobile phone number by detecting whether the number segment of the mobile phone number is within the preset number segment. For example, a mobile phone number starting with 122 is a virtual mobile phone number, or a mobile phone number within the preset number range of 122xxxxxxxx-123xxxxxxxx is a virtual mobile phone number.
  • the server can obtain the second confidence of the first communication ID, wherein when the second confidence is greater than or equal to the second confidence threshold, the server can determine The first communication ID is the suspected harassment communication ID. When the second confidence level is less than the second confidence level threshold, the server may add the first communication ID to the third suspected harassment list. It should be understood that the second confidence levels of the communication IDs in the third suspected harassment list are all less than the second confidence threshold.
  • the server after the server obtains the second confidence level of the first communication ID, it can detect whether the first communication ID is included in the first suspected harassment list, the second suspected harassment list, and (continuous Three days) third list of suspected harassment.
  • the confidence level of the first communication ID can be increased by a sixth preset confidence level, such as 5%.
  • the confidence level of the first communication ID may be increased by 5%.
  • the second suspected harassment list contains the first communication ID
  • the second Confidence of communication ID increased by 5%.
  • the third suspected harassment list (for three consecutive days) contains the first communication ID, the confidence level of the second communication ID can be increased by 5%, so that the third confidence level of the first communication ID can be obtained.
  • the server may detect whether the third confidence level of the first communication ID is greater than or equal to the second confidence level threshold to detect whether the first communication ID is a suspected harassing communication ID. If the third confidence level of the first communication ID is greater than or equal to the second confidence level threshold, it is determined that the first communication ID is a suspected harassment communication ID; if the third confidence level of the first communication ID is less than the second confidence level threshold, it is determined that The first communication ID is not the suspected harassment communication ID.
  • the suspected harassment list can be added, and whether the communication ID is included in the suspected harassment list can be further added to increase the judgment of whether the communication ID is a suspected harassment communication ID and improve the detection accuracy of the communication ID.
  • the ban processing platform will be described below in conjunction with Figure 8. Among them, users (administrators) can block, unblock, mark, add suspected harassment lists, query, update signature database and other operations through the ban processing platform.
  • the above embodiment describes that when the server determines that the first communication ID is a suspected harassing communication ID, it can block the first device ID, the first account ID associated with the first communication ID, and the second device ID associated with the second communication ID. , the second account ID.
  • the server determines that the first communication ID is a suspected harassing communication ID it may display the first device ID, the first account ID associated with the first communication ID, and the second device associated with the second communication ID. ID, second account ID. It is operated by the administrator to determine which devices and accounts are specifically blocked based on the administrator's operations. In the embodiment of this application, adding the administrator's operation can improve the accuracy of the ban and avoid the trouble caused by mistaken ban.
  • a in Figure 8 when the server determines that the first communication ID is a suspected harassing communication ID, the server can display "the first device ID associated with the first communication ID, The first account ID, and the second device ID and second account ID associated with the second communication ID.”
  • a in Figure 8 takes the first communication ID as communication ID1A, the second communication ID as communication ID1B and communication ID1C as an example, and represents the association of communication IDs, devices, accounts, and mobile phone numbers in the form of a topology diagram. relation.
  • a in Figure 8 can display communication ID1A, communication ID1B, and communication ID1C.
  • Communication ID1A is associated with device 1 and account 1
  • communication ID1B is associated with device 1 and account 2
  • communication ID1C is associated with device 2 and account 1
  • account 1 is associated with a mobile phone. Number 1.
  • the association relationship is a complex topology diagram.
  • the status of the communication ID, device, account, and mobile phone number can be displayed in the topology map.
  • the status is used to represent the communication ID, device, account, and mobile phone number that are currently in a suspected harassment state, blocked state, or unblocked state.
  • communication ID1A is associated with device 1 and account 1
  • communication ID1B is associated with device 1 and account 2
  • communication ID1C is associated with device 2 and account 1
  • account 1 is associated with mobile phone number 1, all of which are in a suspected harassment state, as shown in a in Figure 8
  • Suspected harassment status is indicated by diagonal shading.
  • Indication of the blocked status Communication ID, device, account, and mobile phone number have been blocked. For example, a horizontal line shading can be used to indicate the blocked status.
  • Unblocked status representation Communication ID, device, account, and mobile phone number are not blocked. For example, white shading can be used to represent the unblocked status. It should be understood that the status of the communication ID, device, account, and mobile phone number can also be represented by different colors, shapes, etc., which will not be described in detail in the embodiment of this application.
  • the administrator can trigger the ban processing platform to display the operation list.
  • the interface of the ban processing platform can to display the operation list 80, as shown in b in FIG. 8 .
  • the operation list 80 may include: a blocking control 81 , an unblocking control 82 , a marking control 83 , and a adding suspected harassment list control 84 .
  • the blocking control 81 is used to update the status of the device, account, and mobile phone number to the blocking status.
  • the unblocking control 82 is used to update the status of the device, account, and mobile phone number to the unblocked status.
  • Mark control 83 is used to update the status of the device, account, and mobile phone number to the suspected harassment status.
  • the add suspected harassment list control 84 is used to add the communication ID to the suspected harassment list (such as the first suspected harassment list, the second suspected harassment list, and/or the third suspected harassment list).
  • the ban processing platform can update device 1 from the suspected harassment state to the ban state.
  • the ban processing platform can synchronize the status of device 1 with the server, and then the server can ban device 1.
  • the administrator can also operate the unblocking control 82 to modify the status of the accidentally blocked device, account, and mobile phone number, so as to trigger the server to unblock the accidentally blocked device, account, and mobile phone number.
  • the administrator can also operate the mark control 83 to update the device, account, and mobile phone number in the unblocked state to the suspected harassment state.
  • the server can update the device, account, and mobile phone number associated with the suspected harassment state. Mark the communication ID as a suspected harassment communication ID, or add the communication ID associated with the device, account, and mobile phone number updated to the suspected harassment status to the suspected harassment list.
  • the administrator performs an operation on "any communication ID, device, account, mobile phone number" that is different from the triggering display operation list 80, such as a double-click operation, which can trigger the ban processing platform to display the communication ID, device, Messages sent by account number and mobile phone number.
  • the administrator can determine whether to ban based on this message.
  • the interface of the ban processing platform may further include: a query box 85 .
  • Query box 85 is used to query the status of any device, account, and mobile phone number.
  • the ban processing platform can be triggered to display the status of the device, account, and mobile phone number, as well as the devices, accounts, and mobile phones associated with the device, account, and mobile phone number.
  • the status of the number is as shown in the topology diagram shown in a in Figure 8 above.
  • the ban processing platform may display a topology diagram as shown in a in Figure 8 on the interface.
  • the feature library includes features used to detect whether the communication ID is a suspected harassing communication ID.
  • the feature database may include: whether the message type is a user message, whether the account type is an unofficial account, whether the number of messages sent to the message recipient within the preset time period is greater than the second threshold, whether the number of messages sent to the message recipient is greater than the second threshold, Whether the proportion of the number of messages sent by the party is 1 is greater than the preset proportion, whether the time period for sending messages is concentrated, whether the frequency of sending messages is fixed, whether messages are sent in the same time period for multiple consecutive days (such as 3 days) , whether the time period for sending messages is concentrated in the early morning, whether no messages are sent in other time periods except early morning, whether the proportion of the number of messages sent by the communication ID to the message recipient is 100%, and whether the second communication ID is suspected Whether the confidence level of the harassment communication ID is greater than or equal to the first confidence threshold, whether the first communication ID is included in the first suspected harassment list, the second suspected harassment list, and the third suspected harassment list, and whether the first communication ID is included in the first suspected harassment list,
  • the user can customize "features used to detect whether the communication ID is a suspected harassing communication ID" in the feature library.
  • the interface of the ban processing platform may include: a feature database editing area 86 .
  • Feature Library The editing area 86 includes: a new control 861, a deletion control 862, an editing control 863, and an activation and deactivation control 864.
  • the administrator triggers the new control 861 to add "features used to detect whether the communication ID is a suspected harassing communication ID” in the feature library.
  • the administrator triggers the new control 862 to delete “features used to detect whether the communication ID is a suspected harassing communication ID” in the feature library.
  • the administrator triggers the edit control 863 and can modify the "features used to detect whether the communication ID is a suspected harassing communication ID" in the feature library to "the number of messages sent by communication ID 1 in the last day is greater than the second threshold, and the second threshold Taking "1000 items as an example", the administrator can modify the second threshold to 2000 items.
  • administrators can modify the confidence level added after each feature is detected.
  • the administrator can also operate the activation and deactivation control 864 to trigger the activation and deactivation of features in the feature library. For example, the administrator clicks the activation invalidation control 864 once to activate the features in the signature database, triggering the server to use the features in the signature database to detect whether the communication ID is a suspected harassment communication ID. The administrator clicks once again to activate the invalidation control 864, and the features in the feature database become invalid, triggering the server to not use the features in the feature database to detect whether the communication ID is a suspected harassment communication ID.
  • the ban processing platform can synchronize the administrator's operations on the interface of the ban processing platform to the server, and the server can perform corresponding operations according to the user's operations. For example, after the administrator modifies the characteristics in the signature database, the ban processing platform can synchronize the modified characteristics to the server to trigger the server to use the modified characteristics to detect whether the communication ID is a suspected harassment communication ID.
  • a banning processing platform can also be provided, so that the administrator can perform operations such as banning, unblocking, marking, adding to the suspected harassment list, querying, and updating the feature database through the interface of the banning processing platform.
  • the administrator can perform operations such as banning, unblocking, marking, adding to the suspected harassment list, querying, and updating the feature database through the interface of the banning processing platform.
  • it can enhance the human experience.
  • Machine-to-machine interaction and adding user operations can improve the detection accuracy of communication IDs and improve user experience.
  • users can customize the characteristics in the signature library used to detect whether the communication ID is a suspected harassment communication ID, that is, the characteristics are configurable.
  • it can improve the flexibility of detection, and on the other hand, administrators can continuously update and optimize the special signature library. , making the features in the feature library more appropriate for the detection of communication IDs, and also improving the detection accuracy of communication IDs.
  • the embodiment of the present application also provides an electronic device.
  • the electronic device can be the server described in the above embodiment.
  • the electronic device can include: a processor 901 (such as a CPU ), memory 902.
  • the memory 902 may include high-speed random-access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk memory.
  • RAM random-access memory
  • NVM non-volatile memory
  • Various instructions may be stored in the memory 902 , to complete various processing functions and implement the method steps of the present application.
  • the electronic device involved in this application may also include: a power supply 903, a communication bus 904, and a communication port 905.
  • the above-mentioned communication port 905 is used to realize connection and communication between the electronic device and other peripheral devices.
  • the memory 902 is used to store computer executable program code, and the program code includes instructions; when the processor 901 executes the instructions, the instructions cause the processor 901 of the electronic device to perform the actions in the above method embodiment, which implements The principles and technical effects are similar and will not be repeated here.
  • modules or components described in the above embodiments may be one or more integrated circuits configured to implement the above methods, such as: one or more application specific integrated circuits (ASICs), or , one or more microprocessors (digital signal processor, DSP), or one or more field programmable gate arrays (field programmable gate array, FPGA), etc.
  • ASICs application specific integrated circuits
  • DSP digital signal processor
  • FPGA field programmable gate array
  • the processing element can be a general processor, such as a central processing unit (CPU) or other processor that can call the program code, such as a controller.
  • these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • a computer program product includes one or more computer instructions.
  • Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g., computer instructions may be transmitted from a website, computer, server or data center via a wired link (e.g.
  • Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless means to transmit to another website site, computer, server or data center.
  • Computer-readable storage media can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or other integrated media that contains one or more available media. Available media may be magnetic media (eg, floppy disk, hard disk, tape), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)), etc.
  • the term "plurality” as used herein means two or more.
  • the term “and/or” in this article is just an association relationship that describes related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations.
  • the character "/" in this article generally indicates that the related objects before and after are an “or” relationship; in the formula, the character "/” indicates that the related objects before and after are a “division” relationship.
  • words such as “first” and “second” are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating. Or suggestive order.
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in the implementation of the present application.
  • the implementation of the examples does not constitute any limitations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请实施例提供了一种消息处理方法和电子设备，该方法中，服务端解析消息日志，获取第一通信ID的数据，第一通信ID与第一设备ID、第一账号ID关联；根据第一通信ID的数据，检测第一通信ID是否为疑似骚扰通信ID；响应于第一通信ID为疑似骚扰通信ID，获取第二通信ID，第二通信ID包括第一设备ID关联的通信ID以及第一账号ID关联的通信ID；根据第二通信ID的数据，检测第二通信ID是否为疑似骚扰通信ID；响应于第二通信ID为疑似骚扰通信ID，封禁第一设备ID、第一账号ID、第二通信ID关联的第二设备ID、第二账号ID。本申请实施例中可以封禁账号、以及账号关联的设备，可以有效地拦截骚扰消息。

Description

消息处理方法和电子设备
本申请要求于2022年06月30日提交中国专利局、申请号为202210761580.0、申请名称为“消息处理方法和电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种消息处理方法和电子设备。
背景技术
用户之间可以通过收发消息进行联系，如用户可以在终端上通过社交通信类应用，向其他用户的终端发送消息。使用社交通信类应用的用户数量大，用户在社交通信类应用中会收到很多骚扰消息。
目前，用户可以上传消息截图至服务端，由服务端封禁发送骚扰消息的账号，以避免骚扰账号再发送骚扰消息。但该种方式单一、效果差。
发明内容
本申请实施例提供一种消息处理方法和电子设备，可以封禁账号、以及账号关联的设备，更为有效地拦截骚扰消息。
第一方面，本申请实施例提供一种消息处理方法，执行该方法的执行主体可以为服务端或服务端中的芯片，下述实施例以服务端为例进行说明。在一种实施例中，服务端可以为收发消息的应用对应的服务器。
在该方法中，服务端解析消息日志，获取第一通信ID的数据，所述第一通信ID与第一设备ID、第一账号ID相关联。应理解，消息日志可以记录消息收发方的信息，以及消息的信息。在一种实施例中，消息日志中可以包括：消息发送方的设备ID、账号ID、通信ID、消息接收方的设备ID、账号ID、通信ID、消息发送时间，以及消息类型。其中，通信ID是根据设备ID和账号ID得到，通信ID关联设备ID和账号ID，本申请实施例中，第一通信ID是根据第一设备ID和第一账号ID，可以说所述第一通信ID与第一设备ID、第一账号ID相关联。
服务端根据所述第一通信ID的数据，检测所述第一通信ID是否为疑似骚扰通信ID，响应于所述第一通信ID为疑似骚扰通信ID，服务端获取第二通信ID，根据所述消息日志中所述第二通信ID的数据，检测所述第二通信ID是否为疑似骚扰通信ID。其中，所述第二通信ID包括：所述第一设备ID关联的通信ID，以及所述第一账号ID关联的通信ID，所述第二通信ID与所述第一通信ID不同。
换句话说，服务端在确定第一通信ID为疑似骚扰通信ID时，还可以获取第一设备ID关联的通信ID，以及所述第一账号ID关联的通信ID，进而检测第二通信ID是否为疑似骚扰通信ID。其中，响应于所述第二通信ID为疑似骚扰通信ID，服务端封禁所述第一设备ID、所述第一账号ID、所述第二通信ID关联的第二设备ID、第二账号ID。
在一种实施例中，所述第二设备ID、第二账号ID为所述第二通信ID直接关联的设备ID和账号ID。直接关联可以理解为：第二通信ID是由第二设备ID和第二账号ID生成的。
在一种实施例中，所述第二设备ID、第二账号ID为所述第二通信ID直接关联，以及间接关联的设备ID和账号ID。直接关联参照上述的相关描述。
间接关联可以理解为：第二设备ID是：生成第二通信ID的设备ID(或账号ID)直接关联或间接关联的设备ID，第二账号ID是：生成第二通信ID的设备ID(或账号ID)直接关联或间接关联的账号ID。
在一种实施例中，间接关联还可以理解为：第二通信ID根据关联的设备ID或账号ID，再次关联或者多次关联。也就是说，本申请实施例中，可以找到所有关联的账号、设备进行封禁，可以做到一网打尽。
本申请实施例中，服务端可以解析消息日志，结合消息发送方的数据，检测通信ID是否为疑似骚扰通信ID，因为消息日志中的数据海量，检测准确性高，服务端还不分析消息的具体内容，可以保护用户隐私。另一方面，服务端不仅分析一个通信ID，还分析了通信ID对应的账号、设备关联的其他通信ID是否为疑似骚扰通信ID，即在一个设备登录多个账号、一个账号登录多个设备，以及一个手机号码绑定多个账号的场景下，服务端可以做到关联、全面的分析，做到一网打尽，避免账号封禁后，在相同设备上登录其他账号，或者采用手机号码申请新的账号，继续发送骚扰消息等问题。
下述说明检测第一通信ID是否为疑似骚扰通信ID的过程：
在一种可能的实现方式中，服务端中存储有特征库，特征库中存储有疑似骚扰通信ID的特征。根据所述第一通信ID的数据，以及疑似骚扰通信ID的特征，检测所述第一通信ID是否为疑似骚扰通信ID。其中，若所述第一通信ID的数据，符合疑似骚扰通信ID的特征，服务端可以确定第一通信ID为疑似骚扰通信ID。若所述第一通信ID的数据，不符合疑似骚扰通信ID的特征，服务端可以确定第一通信ID不为疑似骚扰通信ID。
其中，疑似骚扰通信ID的特征包括如下至少一项：预设时长内所述第一通信ID发送的消息的数量大于第一数量阈值、所述第一通信ID向消息接收方发送消息的数量的占比大于预设占比、发送消息的时间段处于集中的时间段，以及发送消息的频率固定(或处于预设频率范围内)。
其中，服务端可以检测所述预设时长内所述第一通信ID发送的消息的数量是否大于或等于第一数量阈值，响应于预设时长内所述第一通信ID发送的消息的数量大于或等于第一数量阈值，服务端可以检测所述第一通信ID向消息接收方发送消息的数量的占比是否大于或等于预设占比，响应于第一通信ID向消息接收方发送消息的数量的占比大于或等于预设占比，服务端可以检测所述第一通信ID发送消息的时间段是否处于集中的时间段，和/或，所述第一通信ID发送消息的频率是否为固定频率。其中，以服务端检测第一通信ID发送消息的时间段是否处于集中的时间段为例，若第一通信ID发送消息的时间段处于集中的时间段，则服务端可以确定所述第一通信ID为疑似骚扰通信ID。
在该种实现方式中，服务端检测第二通信ID是否为疑似骚扰通信ID的过程可以参照“第一通信ID是否为疑似骚扰通信ID的过程”的描述。
在一种可能的实现方式中，疑似骚扰通信ID的特征可以包括：所述第一通信ID在所述预设时长内增删联系人的操作次数大于第二数量阈值、在预设时长内增删联系人的数量大 于第三数量阈值，以及所述第一通信ID发送消息的时间段处于集中的时间段，以及发送消息的频率固定(或处于预设频率范围内)。
在该可能的实现方式中，服务端可以检测所述第一通信ID在所述预设时长内增删联系人的操作次数是否大于第二数量阈值，以及在预设时长内增删联系人的数量是否大于第三数量阈值，响应于所述第一通信ID在所述预设时长内增删联系人的操作次数大于第二数量阈值，以及在预设时长内增删联系人的数量大于第三数量阈值。服务端可以检测所述第一通信ID发送消息的时间段是否处于集中的时间段，和/或，发送消息的频率是否为固定频率。其中，以服务端检测第一通信ID发送消息的时间段是否处于集中的时间段为例，若第一通信ID发送消息的时间段处于集中的时间段，则服务端确定所述第一通信ID为疑似骚扰通信ID。
在该种实现方式中，服务端检测第二通信ID是否为疑似骚扰通信ID的过程可以参照“第一通信ID是否为疑似骚扰通信ID的过程”的描述。
在如上两种实现方式的基础上，服务端在检测所述第一通信ID发送消息的时间段处于集中的时间段，和/或，发送消息的频率为固定频率时，还可以检测所述第一通信ID是否连读多天均在相同的集中的时间段发送消息、检测所述相同的集中的时间段是否为预设时间段，检测在除了所述预设时间段之外所述第一通信ID是否未发送消息，以及检测所述第一通信ID向消息接收方发送消息的数量为1的占比是否为100％。
其中，若第一通信ID连读多天均在相同的集中的时间段发送消息、所述相同的集中的时间段为预设时间段，在除了所述预设时间段之外所述第一通信ID未发送消息，以及所述第一通信ID向消息接收方发送消息的数量为1的占比为100％，则服务端确定所述第一通信ID为疑似骚扰通信ID。
在该种实现方式中，服务端检测第二通信ID是否为疑似骚扰通信ID的过程可以参照“第一通信ID是否为疑似骚扰通信ID的过程”的描述。
应理解，本申请实施例中设置的消息发送特征为骚扰ID的消息发送特征，检测第一通信ID的数据是否与疑似骚扰通信ID的特征相同，可以准确检测第一通信ID是否疑似骚扰通信ID。在一种实施例中，预先设置的骚扰ID的消息发送特征越多，检测结果越准确。
服务端以检测通信ID的数据是否满足疑似骚扰通信ID的特征，在满足时进入下一特征的判断，在不满足时确定通信ID不为疑似骚扰通信ID，采用一刀切的方式(即是和否的方式)，这种方式易发生误判。
为了提高通信ID是否为疑似骚扰通信ID的检测准确性，避免误封禁造成的困扰，在一种可能的实现方式中，服务端可以针对每一次检测通信ID是否符合疑似骚扰通信ID的特征，增加一次通信ID为疑似骚扰通信ID的置信度。
在该种实现方式中，服务端响应于所述预设时长内所述第一通信ID发送的消息的数量大于或等于所述第一数量阈值，将所述第一通信ID为疑似骚扰通信ID的置信度增加第一预设置信度。响应于所述第一通信ID向消息接收方发送消息的数量的占比大于或等于所述预设占比，将所述第一通信ID为疑似骚扰通信ID的置信度增加第二预设置信度。响应于所述第一通信ID发送消息的时间段处于集中的时间段，和/或，发送消息的频率为固定频率，将所述第一通信ID为疑似骚扰通信ID的置信度增加第三预设置信度。
其中，服务端响应于所述第一通信ID每满足一个如下任一特征，将所述第一通信ID为 疑似骚扰通信ID的置信度增加第四预设置信度：所述第一通信ID连读多天均在相同的集中的时间段发送消息、所述相同的集中的时间段为预设时间段，在除了所述预设时间段之外所述第一通信ID未发送消息，以及所述第一通信ID向消息接收方发送消息的数量为1的占比为100％。
据此，服务端可以得到所述第一通信ID的第一置信度，进而根据所述第一置信度，检测所述第一通信ID是否为疑似骚扰通信ID。
在该种实现方式中，服务端检测第二通信ID是否为疑似骚扰通信ID的过程可以参照“第一通信ID是否为疑似骚扰通信ID的过程”的描述。服务端可以根据消息日志中所述第二通信ID的数据，获取所述第二通信ID为疑似骚扰通信ID的置信度。
其中，若所述第二通信ID为疑似骚扰通信ID的置信度大于或等于第一置信度阈值，服务端可以将所述第一置信度增加第五预设置信度，得到所述第一通信ID的第二置信度，进而根据所述第二置信度，检测所述第一通信ID是否为疑似骚扰通信ID。示例性的，当第一通信ID的置信度大于或等于第二置信度阈值时，可以确定第一通信ID为疑似骚扰通信ID，当第一通信ID的置信度小于第二置信度阈值时，可以确定第一通信ID不为疑似骚扰通信ID。
在一种可能的实现方式中，服务端还可以增加疑似骚扰列表，以检测第一通信ID是否包含于疑似骚扰列表中，来检测第一通信ID是否为疑似骚扰通信ID，以进一步提高检测准确性。
在该实现方式中，服务端可以汇聚所述预设时长内增删联系人的操作次数大于或等于第二数量阈值，以及在预设时长内增删联系人数量大于第三数量阈值的通信ID，得到第一疑似骚扰列表，汇聚账号ID关联的手机号码为虚拟号码的通信ID，得到第二疑似骚扰列表。
服务端检测所述第一通信ID是否包含于所述第一疑似骚扰列表、所述第二疑似骚扰列表，以及第三疑似骚扰列表中，所述第三疑似骚扰列表中的通信ID的第二置信度均小于第二置信度阈值。服务端可以根据所述第一通信ID是否包含于所述第一疑似骚扰列表、所述第二疑似骚扰列表，以及第三疑似骚扰列表中的结果，得到所述第一通信ID为疑似骚扰通信ID的第三置信度。示例性的，所述第一通信ID每包含于一个疑似骚扰列表中，服务端可以在第一通信ID的第二置信度的基础上，增加第六预设置信度，得到第一通信ID是否为疑似骚扰通信ID的第三置信度。
服务端可以根据所述第三置信度，检测所述第一通信ID是否为疑似骚扰通信ID。示例性的，服务端响应于所述第三置信度大于或等于所述第二置信度阈值，确定所述第一通信ID为疑似骚扰通信ID，服务端响应于所述第三置信度小于所述第二置信度阈值，确定所述第一通信ID不为疑似骚扰通信ID。
在一种可能的实现方式中，因为消息日志中数据量巨大，服务端可以对汇聚数据，如汇聚通信ID在预设时长内发送消息的数量，向消息接收方发送消息的数量的占比、发送消息的时间段，以及发送消息的频率等，以在汇聚结果的基础上，服务端执行如上可能的实现方式中的疑似骚扰通信ID的检测过程。本申请实施例中，所述第一通信ID发送的消息均为用户消息，所述第一账号ID为非官方账号。
也就是说，本申请实施例针对非官方账号发送的用户消息，执行本申请实施例提供的消息处理方法。因为官方账号、系统消息发送骚扰消息的几率小，针对非官方账号发送的用户消息进行检测，可以减少服务端的数据处理量。
在一种可能的实现方式中，本申请实施例还支持提供前台界面，以供用户(管理员)操作，提高用户体验。
在该实现方式中，服务端在确定第一通信ID，以及第二通信ID均为疑似骚扰通信ID时，可以输出所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID的关联关系。示例性的，服务端可以显示所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID的关联关系，或者，服务端可以向显示设备(如承载封禁处理平台)发送所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID的关联关系，以便显示设备显示所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID的关联关系。
响应于(管理员)对所述关联关系中目标对象的操作，封禁所述目标对象，所述目标对象包含于所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID中。
在一种可能的场景中，第一账号ID关联的第一手机号码关联多个账号(包括第一账号ID以及其他账号)，则服务端在显示所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID时，还显示第一账号ID关联的所述第一手机号码。
在一种实施例中，管理员在封禁处理平台的界面上还可以执行封禁、解封、标记、加入疑似骚扰列表、查询、更新特征库等操作。
第二方面，本申请实施例提供一种电子设备，该电子设备可以包括：处理器、存储器。存储器用于存储计算机可执行程序代码，程序代码包括指令；当处理器执行指令时，指令使所述电子设备执行如第一方面中的方法。
第三方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面中的方法。
第四方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面中的方法。
上述第二方面至第四方面的各可能的实现方式，其有益效果可以参见上述第一方面所带来的有益效果，在此不加赘述。
附图说明
图1为本申请适用的系统架构的一种示意图；
图2为本申请实施例提供的消息处理方法的一种实施例的流程示意图；
图3为本申请实施例提供的消息处理方法的另一种实施例的流程示意图；
图4A为本申请实施例提供的设备、账号的一种关联关系示意图；
图4B为本申请实施例提供的设备、账号，以及手机号码的一种关联关系示意图；
图5为本申请实施例提供的消息处理方法的另一种实施例的流程示意图；
图6为本申请实施例提供的消息处理方法的另一种实施例的流程示意图；
图7为本申请实施例提供的消息处理方法的另一种实施例的流程示意图；
图8为本申请实施例提供的封禁处理平台的界面的一种示意图；
图9为本申请实施例提供的电子设备的一种结构示意图。
具体实施方式
本申请实施例中的终端(terminal)可以称为用户设备(user equipment，UE)，例如，终端可以为手机、平板电脑(portable android device，PAD)、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备、车载设备或可穿戴设备，虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、智慧家庭(smart home)中的无线终端等，本申请实施例中对终端的形态不做具体限定。
终端上可以包括至少一个社交通信类应用，用户在终端上可以通过社交通信类应用向其他用户(的终端)发送消息。示例性的，社交通信类应用可以包括但不限于：短信应用、微x应用等，本申请实施例对社交通信类应用不做限制。应理解，短信应用中收发的短信可以称为短信消息，微x应用中收发的消息可以称为微x消息，下述实施例中以“消息”表征各应用中收发的消息。
针对用户收到骚扰消息的问题，用户可以采用“关闭陌生账号消息”的方式，避免接收到骚扰消息，但这种方式一刀切，用户在不接收骚扰消息时也无法接收正常的陌生人的消息。目前还可以通过分析终端接收到的消息内容，在确定消息为骚扰消息时，拦截骚扰消息，该种方式需要分析消息的具体内容，隐私性差。
另，用户可以在社交通信类应用上向服务端(如社交通信类应用服务器)上传骚扰消息截图，服务端可以封禁发送骚扰消息的账号，避免该账号再发送骚扰消息。其中，对于短信应用来说，发送骚扰消息的账号可以理解为手机号码。对于其他社交通信类应用来说，发送骚扰消息的账号可以理解为应用账号，如微x应用中，发送骚扰消息的账号可以为微x账号，和/或，发送骚扰消息的账号可以为微x账号关联的手机号码。在一种实施例中，应用账号可以称为账号身份证标识号(identity document，ID)。
在一种实施例中，封禁账号可以理解为：账号无法使用。如社交通信类应用无法登陆该账号，或者社交通信类应用登陆该账号后不能发送消息，本申请实施例对封禁账号后账号的状态不做赘述。
目前封禁账号的方式单一，如恶意用户(发送骚扰消息的用户)可以申请新的账号(或更换账号)，使用新的账号(或其他账号)继续发送骚扰消息，该种封禁账号的方式效果差，用户还是会收到很多骚扰消息。
针对如上问题，本申请实施例旨在：不分析消息具体内容，在保护用户隐私的前提下，且在一个终端登录多个账号，一个账号同时登录多个终端，以及一个手机号码关联多个应用账号的场景中，识别发送骚扰消息的账号，以及账号关联的设备、电话号码，不仅封禁一个账号，而是封禁账号，以及账号关联的设备、电话号码，一网打尽，更为彻底地拦截骚扰消息。
在介绍本申请实施例提供的消息处理方法之前，首先对本申请适用的系统架构进行说明：图1为本申请适用的系统架构的一种示意图。参照图1，该系统架构中可以包括：至少一个终端和服务端。至少一个终端可以包括终端1、终端2，…，终端N，N为大于或等于2的整数。在一种实施例中，终端1可以称为第一终端，终端2可以称为第二终端，终端N可以称为第N终端。
终端之间可以通过服务端收发消息。示例性的，消息为短信消息，服务端可以为短信 服务器，消息为微x消息，服务端可以为微x服务器。如终端1向终端2发送短信，则短信的传输过程依次为：终端1-短信服务器-终端2。
服务端中可以存储终端之间的消息日志(可以简称为日志)。消息日志可以记录终端之间的消息交互过程。
在一种实施例中，该系统结构中可以包括数据库，消息日志可以存储在数据库中，服务端可以访问数据库，以获取终端之间的消息日志。
在一种实施例中，服务端可以包括：日志解析模块、数据汇聚模块、骚扰识别拦截模块。
日志解析模块，用于解析消息日志。在一种实施例中，日志解析模块可以执行下述实施例中的S201。
数据汇聚模块，用于对解析后的消息日志进行汇聚处理。如根据发送消息的数量，按照从大到小的顺序将数据排序。在一种实施例中，数据汇聚模块可以执行下述实施例中的汇聚处理步骤1-10中的汇聚操作。
骚扰识别拦截模块，用于根据特征库中的疑似骚扰通信ID的特征，识别骚扰账号、设备以及手机号码，以进行封禁。在一种实施例中，骚扰识别拦截模块可以执行下述实施例中的S202-S205。
在一种实施例中，该系统架构中还可以包括封禁处理平台。封禁处理平台可以与服务端集成为一体或者单独设置。
其中，管理员可以输入自己的账号和密码，在任一设备上登录封禁处理平台。封禁处理平台可以显示账号、设备、电话号码等的状态(如封禁状态，疑似状态等)，管理员可以在封禁处理平台上进行封禁操作、解封操作、查询操作，以及更新特征库等操作，封禁处理平台的界面，以及可以实现的功能可以参照图8中的相关描述。
应理解，图1中以管理员在计算机上登录封禁处理平台为例进行说明，即承载登录封禁处理平台的设备为计算机。
在一种实施例中，封禁处理平台中可以包括：显示模块和骚扰信息读写模块。
骚扰信息读写模块，用于在服务端读取账号、设备以及手机号码的状态，进而写入封禁处理平台，且响应于用户对封禁处理平台的界面的操作，向服务端同步用户操作触发的账号、设备、电话号码等的状态的改变，或特征库中的特征的改变等。
显示模块，用于根据用户的操作，显示封禁处理平台的界面。
可以理解的是，图1所示的结构并不构成对系统架构的具体限定。在本申请另一些实施例中，系统架构可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件，或软件和硬件的组合实现。
下面结合具体的实施例对本申请实施例提供的消息处理方法进行说明。下面这几个实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例不再赘述。
图2为本申请实施例提供的消息处理方法的一种实施例的流程示意图。参照图2，本申请实施例提供的消息处理方法可以包括：
S201，服务端解析消息日志。
消息日志可以记录终端之间的消息交互过程。
服务端解析消息日志，可以得到消息发送方(发送消息的设备)的设备ID、账号ID、通信ID、消息接收方(接收消息的设备)的设备ID、账号ID、通信ID、消息发送时间，以及消息类型。
设备ID可以包括但不限于为：设备的国际移动设备识别码(international mobile equipment identity，IMEI)，以及其他用于唯一指示设备的信息。账号ID可以参照上述实施例中的相关描述。
通信ID可以根据设备ID和账号ID得到。示例性的，如可以将设备ID中的特定几位和账号ID中的特定几位进行拼接，得到通信ID。或者，可以采用哈希Hash算法，根据设备ID和账号ID，得到(生成)通信ID。应注意，设备ID或账号ID不同，得到的通信ID不同。换句话说，通信ID可以唯一对应一个设备ID、账号ID。
消息发送时间指的是：消息发送方发送消息的时间。
消息类型可以包括但不限于：文本、图片、语音等。在一种实施例中，消息类型还可以包括但不限于系统消息和用户消息。
在一种实施例中，消息发送方可以根据设备ID和账号ID，得到通信ID，且在发送消息时，携带消息发送方的设备ID、账号ID、通信ID，以及消息发送时间，消息类型。在一种实施例中，消息发送方在发送消息时，携带消息发送方的设备ID、账号ID，以及消息发送时间，消息类型，由服务端根据消息发送方的设备ID、账号ID，得到消息发送方的通信ID。
换句话说，服务端解析日志，可以得到至少一个消息的相关信息。消息的相关信息可以包括：消息发送方的设备ID、账号ID、通信ID、消息接收方的设备ID、账号ID、通信ID、消息发送时间，以及消息类型。
在一种实施例中，消息日志中还可以包括终端之间交互的消息的内容。在一种实施例中，消息日志中还可以包括消息发送方、消息接收方增删联系人的操作。
在一种实施例中，服务端可以周期性地解析消息日志，或者每天在固定时刻解析日志。
S202，服务端根据消息日志中第一通信ID的数据，检测第一通信ID是否为疑似骚扰通信ID。若是，执行S203，若否，执行S206。
消息日志中可以包括多个通信ID的记录，这里以第一通信ID为例，说明服务端检测通信ID是否为疑似骚扰通信ID的过程。其中，第一通信ID包含于消息日志中的多个通信ID中，或者说第一通信ID表征消息日志中的每个通信ID。
在一种实施例中，消息日志中第一通信ID的数据可以包括如下至少一项：消息日志中作为消息发送方的第一通信ID的消息发送总数量、预设时长内的消息发送数量、第一通信ID的消息接收方的数量、第一通信ID的消息接收方接收到消息的数量，以及第一通信ID的消息发送时间段分布、消息发送频率等。
示例性的，以作为消息发送方的第一通信ID在预设时长内的消息发送数量为例，服务端可以根据消息日志，统计作为消息发送方的第一通信ID在预设时长内(如3分钟)的消息发送数量(如500条)，若在预设时长内的消息发送数量大于或等于第一阈值(如300条)，则确定第一通信ID为疑似骚扰通信ID，若在预设时长内的消息发送数量小于第一阈值，则确定第一通信ID不为疑似骚扰通信ID。
在一种实施例中，由于消息日志中消息数量巨大，服务端在解析消息日志后，可以先对消息日志进行汇聚处理，以便于判断通信ID是否符合疑似骚扰通信ID的特征。其中，通 信ID若符合疑似骚扰通信ID的特征，则可以确定通信ID为疑似骚扰通信ID，通信ID若不符合疑似骚扰通信ID的特征，则可以确定通信ID不为疑似骚扰通信ID。在一种实施例中，服务端可以存储特征库，特征库中存储有疑似骚扰通信ID的特征，在该实施例中，服务端可以根据消息日志中第一通信ID的数据，检测第一通信ID是否匹配疑似骚扰通信ID的特征，以检测第一通信ID是否为疑似骚扰通信ID。
其中，服务端的汇聚处理可以包括：
1、汇聚消息类型。如在消息日志中，可以汇聚系统消息和用户消息。
系统消息为终端的系统发送的消息，用户消息为用户之间交互收发的消息。在一种实施例中，消息发送方在发送消息时，会携带用于标识该消息是系统消息还是用户消息的标识。服务端解析日志后，可以根据该标识，汇聚系统消息和用户消息。本申请实施例中，针对用户消息执行本申请中的消息处理方法。
2、在用户消息中，汇聚消息发送方为非官方账号。
服务端在汇聚的用户消息中，可以汇聚消息发送方为非官方账号。示例性的，官方账号可以为社交通信类应用的帐号。在一种实施例中，服务端可以存储白名单，白名单中包括至少一个官方账号。
在服务端汇聚得到用户消息中，服务端可以查询白名单，汇聚非官方账号的消息。
3、在非官方账号发送的消息中，汇聚通信ID发送消息的数量。
在消息发送方为非官方账号发送的消息中，服务端解可以统计作为消息发送方的通信ID发送消息的数量。示例性的，服务端可以统计作为消息发送方的通信ID1发送消息的数量、作为消息发送方的通信ID2发送消息的数量，以及作为消息发送方的通信ID3发送消息的数量等。
在一种实施例中，服务端可以统计同一通信ID在预设时长内发送消息的数量。示例性的，如预设时长可以为最近1天或者最近三天，服务端可以统计最近1天或者最近三天通信ID发送消息的数量。如以最近1天为例，服务端可以统计通信ID1最近一天发送消息的数量、通信ID2最近一天发送消息的数量，以及通信ID3最近一天发送消息的数量等。
4、汇聚通信ID向消息接收方发送消息的数量。
在一种实施例中，服务端在汇聚通信ID的消息发送数量后，对于“通信ID在预设时长内发送消息的数量大于第二阈值”的通信ID，服务端可以汇聚这些通信ID向每个消息接收方发送的消息的数量。示例性的，如在通信ID1、通信ID2，以及通信ID3中，通信ID1在最近一天内发送消息的数量大于第二阈值(如1000条)，则服务端可以汇聚最近一天中，通信ID1向每个消息接收方发送的消息的数量。在一种实施例中，第二阈值可以称为第一数量阈值。应理解，附图中以“第二阈值”表征“第二数量阈值”。
或者，在一种实施例中，服务端可以汇聚通信ID向消息接收方发送消息的数量的占比。示例性的，如在通信ID1、通信ID2，以及通信ID3中，通信ID1在最近一天内发送消息的数量大于第二阈值(如1000条)，则服务端可以汇聚最近一天中，通信ID1向每个消息接收方发送的消息数量的占比。
如，在一天中，服务端可以汇聚通信ID1向通信ID4发送消息的数量为1，向通信ID5发送消息的数量为1，向通信ID6发送消息的数量为1，以及向通信ID7发送消息的数量为2。服务端可以统计通信ID1向消息接收方发送的消息数量为1的占比为3/4，向消息接收方发送 的消息数量为1的占比为1/4。
5、汇聚通信ID发送消息的时间段和频率。
在一种实施例中，当服务端可以汇聚向消息接收方发送的消息的数量均小于第三阈值的通信ID，进而汇聚这些通信ID发送消息的时间段和频率。示例性的，第三阈值如可以为2，若通信ID向每个消息接收方发送的消息数量均为1(均小于2)，则服务端可以汇聚通信ID发送消息的时间段和频率。示例性的，如服务端汇聚通信ID发送消息的时间段为：这一天的下午4点到5点，以及凌晨1点到2点，服务端汇聚通信ID发送消息的频率为：每1分钟10条。
在一种实施例中，服务端在汇聚通信ID向消息接收方发送消息的数量占比后，若确定通信ID向消息接收方发送的消息数量为1的占比大于或等于预设占比，则服务端汇聚这些通信ID发送消息的时间段和频率。
6、汇聚增删联系人的操作次数，以及增删联系人的数量。
如在消息日志中，服务端可以汇聚作为消息发送方的通信ID的增删联系人的操作次数，以及增删联系人的总数量，如服务端可以按照增删联系人的操作次数从大到小的顺序，对作为消息发送方的通信ID进行排序。在一种实施例中，服务端可以汇聚作为消息发送方的通信ID，在预设时长内(如一天内)增删联系人的操作次数，以及增删联系人的数量。
示例性的，如在消息日志中，作为消息发送方通信ID1，在一天内增删联系人的操作次数为50次，增删联系人的数量是500人。作为消息发送方通信ID2，在一天内增删联系人的操作次数为30次，增删联系人的数量是500人。以及，作为消息发送方通信ID3，在一天内增删联系人的操作次数为100次，增删联系人的数量是500人。
在一种实施例中，可以将增加一次联系人作为一次增删联系人的操作，以及将删除一次联系人作为一次增删联系人的操作。因为每次增删联系人操作时是有联系人的数量上限的，即每次新增、删除操作最多操作100个(示例)联系人，因此联系人的数量超过上限的需要分批操作，即需要多次增删联系人。
在一种实施例中，参照图3，服务端汇聚的第一通信ID的数据可以包括：消息类型、账号类型、预设时长内向消息接收方发送消息的数量、向消息接收方发送消息的数量为1的占比，发送消息的时间段，发送消息的频率，以及增删联系人的操作次数，增删联系人的数量。
结合图3，说明服务端检测第一通信ID是否为疑似骚扰通信ID的过程。其中，S301-S305，以及S301A可以参照上述1-6的汇聚处理中的描述：
S301，判断消息是否为用户消息。若是，执行S302，若否，执行S206。
S302，判断发送消息的账号是否为非官方账号。若是，执行S303，若否，执行S206。
S303，判断第一通信ID在预设时长内发送消息的数量是否大于第二阈值。若是，执行S304，若否，执行S206。
S304，判断第一通信ID向消息接收方发送消息的数量为1的占比是否大于预设占比。若是，执行S305，若否，执行S206。
在一种实施例中，S304可以替换为：判断第一通信ID向消息接收方发送消息的数量是否均为1。若是，执行S305，若否，执行S206。应理解，图3中以“判断第一通信ID向消息接收方发送消息的数量为1的占比是否大于预设占比”为例进行说明。
S305，判断第一通信ID发送消息的时间段是否处于集中的时间段，和/或，发送消息的频率是否为固定频率。若是，执行S203，若否，执行S206。
集中的时间段可以理解为一预设时长。示例性的，集中的时间段可以为2个小时，如服务端汇聚通信ID发送消息的时间段为：这一天的下午4点到5点，以及凌晨1点到2点，则服务端确定通信ID发送消息的时间段处于集中的时间段。
在一种实施例中，通信ID发送消息的频率为固定频率，即通信ID发送消息的频率不变或频率的变化处于预设频率范围内。如通信ID发送消息的频率为每1分钟10条，10条/分钟为通信ID发送消息的固定频率。
在一种实施例中，“通信ID发送消息的时间段是否处于集中的时间段”，以及“发送消息的频率是否为固定频率”可以择一使用，或者全部使用。
在一种实施例中，参照图3，还可以执行S301A：
S301A，判断预设时长内第一通信ID增删联系人的操作次数是否大于(或等于)第四阈值，以及增删联系人的数量是否大于(或等于)第三数量阈值。若是，执行S305，若否，执行S206。在一种实施例中，第四阈值可以称为第二数量阈值。应理解，附图中以“第四阈值”表征“第二数量阈值”，以数量阈值表征“第三数量阈值”。
应理解，图3中所示的判断步骤的前后顺序可以调整，如可以将S304和S303互换，或者将S303调整为S301，图3中的判断步骤的顺序为一种示例说明。
在一种实施例中，可以理解为S202包括：S301-S305，以及S301A。
S203，服务端根据第一通信ID对应的第一设备ID、第一账号ID，获取与第一设备ID、第一账号ID关联的第二通信ID。
其一，在一个设备(如设备1)可以登录多个账号(如账号1、账号2)的场景下，用户可以使用该设备上的多个账号发送消息，消息日志中会记录消息发送方的信息为设备1、账号1，以及由设备1和账号1得到的通信ID1A，消息日志中也会记录消息发送方的信息为设备1、账号2，以及由设备1和账号2得到的通信ID1B。其中，如若消息为短信消息时，账号1和账号2可以均为手机号码，如若消息为微x消息时，账号1和账号2可以均为微x账号。
其中，一个设备可以登录多个账号，可以看做设备1关联账号1和账号2，且根据消息日志中的记录，服务端可以确定设备1、账号1均关联通信ID1A，设备1、账号2均关联通信ID1B。
其二，在一个账号(如账号1)登录多个设备(如设备1、设备2)的场景下，用户可以使用设备1上的账号1，以及设备2上的账号1发送消息，消息日志中会记录消息发送方的信息为设备1、账号1，以及由设备1和账号1得到的通信ID1A，消息日志中也会记录消息发送方的信息为设备2、账号1，以及由设备2和账号1得到的通信ID1C。
其中，一个账号可以登录多个设备，可以看做账号1关联设备1、设备2，且服务端根据消息日志中的记录，可以确定设备1、账号1均关联通信ID1A，设备2、账号1均关联通信ID1C。
其三，在一个手机号码(如号码1)绑定多个应用账号(如账号1和账号2)的场景下，号码1可以关联账号1、账号2。该种场景下，虽然消息日志中不会记录手机号码和应用账号的绑定关系，本申请实施例中服务端可以存储用户的操作日志，操作日志中可以包括用户对应用账号和手机号码的绑定操作，因此服务端可以查询操作日志，确定手机号码(如 号码1)绑定多个应用账号(如账号1和账号2)，进而确定号码1可以关联账号1、账号2。
在一种实施例中，服务端可以根据消息日志，构建关系数据库。关系数据库中包括：设备ID、账号ID，以及通信ID的关联关系。在一种实施例中，关系数据库中可以采用树图或拓扑图等形式表征设备ID、账号ID，以及通信ID的关联关系，本申请实施例对此不做限制。
示例性的，图4A中以拓扑图的形式表征账号1、账号2、设备1、设备2，以及通信ID1A、通信ID1B、通信ID1C的关联关系。
在一种实施例中，服务端可以根据消息日志和操作日志，构建关系数据库。关系数据库中包括：设备ID、账号ID、通信ID，以及电话号码的关联关系。在一种实施例中，操作日志可以看做消息日志，因此，也可以说服务端根据消息日志，构建如图4B所示的关系数据库。
示例性的，图4B中以拓扑图的形式表征账号1、账号2、设备1、设备2、通信ID1A、通信ID1B、通信ID1C，以及号码1的关联关系。
在一种实施例中，可以将第一通信ID关联的设备ID、账号ID称为第一设备ID、第一账号ID。其中，第一通信ID是根据第一设备ID和第一账号ID得到的。服务端在确定第一通信ID为疑似骚扰通信ID时，可以查询关系数据库，获取第一设备ID关联的通信ID，以及第一账号ID关联的通信ID，本申请实施例中将第一设备ID关联的通信ID，以及第一账号ID关联的通信ID称为第二通信ID。
参照图4A，以第一通信ID为通信ID1A为例，则第一设备ID为设备1、第一账号ID为账号1，设备1关联的通信ID为通信ID1A(即第一通信ID)、通信ID1B，账号1关联的通信ID包括：通信ID1A、通信ID1C，可以将ID1A、通信ID1B、ID1C作为第二通信ID。
在一种实施例中，为了减少重复计算，第二通信ID为：第一设备ID关联的通信ID以及第一账号ID关联的通信ID中，除了第一通信ID之外的通信ID。在该种实施例中，参照图4A，以第一通信ID为通信ID1A为例，则第一设备ID为设备1、第一账号ID为账号1，设备1关联的第二通信ID为通信ID1A(即第一通信ID)、通信ID1B，账号1关联的通信ID包括：通信ID1A、通信ID1C，可以将通信ID1B和通信ID1C作为第二通信ID。
在一种实施例中，若第一账号ID关联的手机号码，绑定的不止一个账号(即第一账号ID)，还绑定了其他账号(如第三账号ID)，则服务端还可以将第三账号ID关联的通信ID，作为第二通信ID。
S204，服务端根据消息日志中第二通信ID的数据，检测第二通信ID是否为疑似骚扰通信ID。若是，执行S205，若否，执行S206。
服务端检测第二通信ID是否为疑似骚扰通信ID的过程，可以参照图3中服务端检测第一通信ID是否为疑似骚扰通信ID的描述。图3中未示出具体检测第二通信ID是否为疑似骚扰通信ID的过程。
S205，服务端封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。
因为第一通信ID、第二通信ID均为疑似骚扰通信ID，则第一通信ID关联的第一设备ID、第二通信ID关联的第二设备ID，均为疑似骚扰设备ID，以及第一通信ID关联的第一账号ID、第二通信ID关联的第二账号ID，均为疑似骚扰账号ID，服务端可以封禁第一通信ID关联的 第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。
示例性的，以第一通信ID为通信ID1A，以第二通信ID为通信ID1B、通信ID1C为例进行说明，服务端可以封禁通信ID1A关联的设备1、账号1，通信ID1B关联的设备1、账号2，以及通信ID1C关联的设备2、账号1，即服务端可以封禁设备1、账号1、设备2，以及账号2。在该种示例中，第二设备ID和第二账号ID为第二通信ID直接关联设备ID和账号ID。直接关联可以理解为：第二通信ID是由第二设备ID和第二账号ID生成的，如第二通信ID为通信ID1B，通信ID1B直接关联设备1、账号2，如第二通信ID为通信ID1C，通信ID1C直接关联设备2、账号1。
封禁账号可以参照上述实施例中的相关描述。
封禁设备可以理解为：设备无法使用。如设备无法发送消息，或者设备无法登陆该社交通信类应用，或者设备开机使用，本申请实施例对封禁设备后设备的状态不做赘述。
在一种实施例中，若第一账号ID、第二账号ID绑定的手机号码还关联了其他账号，则服务端还可以封禁第一账号ID、第二账号ID绑定的手机号码关联的其他账号。
在一种实施例中，所述第二设备ID、第二账号ID包括：所述第二通信ID直接关联，以及间接关联的设备ID和账号ID。直接关联参照上述的相关描述。
间接关联可以理解为，第二设备ID是：生成第二通信ID的设备ID(或账号ID)直接关联或间接关联的设备ID，第二账号ID是：生成第二通信ID的设备ID(或账号ID)直接关联或间接关联的账号ID。在一种实施例中，间接关联还可以理解为：第二通信ID根据关联的设备ID或账号ID，再次关联或者多次关联。
示例性的，如第二通信ID包括通信ID1B和通信ID1C，通信ID1B直接关联设备1、账号2，通信ID1C直接关联设备2、账号1，设备2与账号3可以得到通信ID1D，账号3和设备3可以得到通信ID1E，账号2和设备3可以得到通信ID1F。
虽然通信ID1C未直接关联账号3、设备3，通信ID1B与并未直接关联设备3，但是通信ID1C直接关联的账号2与账号3有关联关系，因此通信ID1C可以间接关联账号3，账号3又关联设备3，因此通信ID1C可以间接关联设备3。同理的，虽然通信ID1B未直接关联设备3，因为通信ID1B直接关联的账号2与设备3有关联关系，则通信ID1B可以间接关联设备3。
在一种实施例中，服务端可以直接封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。在一种实施例中，服务端还可以检测第三通信ID是否为疑似骚扰通信ID，在第三通信ID为疑似骚扰通信ID的情况下，封禁第三通信ID关联的设备ID和账号ID。应理解，第三通信ID可以理解为：第二通信ID间接关联的第二设备ID关联(直接，以及间接)关联的通信ID，以及第二通信ID间接关联的第二账号ID关联(直接，以及间接)关联的通信ID。示例性的，在通信ID1D为疑似骚扰通信ID的情况下，可以封禁账号3，在通信ID1E为疑似骚扰通信ID的情况下，可以封禁账号3和设备3，在通信ID1F为疑似骚扰通信ID的情况下，可以封禁设备3。
S206，服务端不响应。
在第一通信ID不为疑似骚扰通信ID，或者第一通信ID为疑似骚扰通信ID，但第一通信ID不为疑似骚扰通信ID的情况下，服务端不响应，即不封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID，避免误封禁。
本申请实施例中，一方面，服务端可以解析消息日志，结合消息日志中消息发送方(通 信ID)的数据，以及疑似骚扰通信ID的特征，检测通信ID是否为疑似骚扰通信ID，因为消息日志中的数据海量，检测准确性高，服务端还不分析消息的具体内容，可以保护用户隐私。另一方面，服务端不是只封一个账号，而是封禁通信ID关联的设备、账号，以及手机号码等，做到全方位封禁。再一方面，本申请实施例中，不仅分析一个通信ID，还分析了通信ID对应的账号、设备关联的其他通信ID是否为疑似骚扰通信ID，即在一个设备登录多个账号、一个账号登录多个设备，以及一个手机号码绑定多个账号的场景下，服务端可以做到关联、全面的分析，做到一网打尽，避免账号封禁后，在相同设备上登录其他账号，或者采用手机号码申请新的账号，继续发送骚扰消息等问题。
为了更为准确地检测通信ID是否为疑似骚扰通信ID，在一种实施例中，还可以增加特征库中的特征，达到更准确识别疑似骚扰通信ID。
示例性的，特征库中的特征还可以包括：连读多天(如3天)均在相同的时间段发送消息，发送消息的时间段集中在凌晨，在除了凌晨之外其他时间段未发送消息，以及通信ID向消息接收方发送消息的数量为1的占比为100％。
在一种实施例中，凌晨(如凌晨1点-3点)可以替换为：预设时间段。如预设时间段为下午4点-6点等，集中的时间段可以自定义设置，集中的时间段可以为至少一个。
在该种实施例中，服务端的汇聚过程还可以包括：
7、服务端在汇聚通信ID发送消息的时间段之后，可以查询前三天通信ID发送消息的时间段，以检测通信ID是否连续3天均在相同的时间段发送消息。示例性的，通过服务端的汇聚处理，得到通信ID连续3天，均在下午4点到5点，以及凌晨1点到2点发送消息。
8、服务端在汇聚通信ID发送消息的时间段之后，服务端检测通信ID发送消息的时间段是否集中在凌晨。示例性的，如服务端汇聚通信ID发送消息的时间段为：下午4点到5点，以及凌晨1点到2点，则服务端可以确定通信ID发送消息的时间段存在集中在凌晨的情况。
9、服务端在汇聚通信ID发送消息的时间段存在集中在凌晨的情况，服务端还可以检测在其他时间段，通信ID是否未发送消息。如上，通信ID发送消息的时间段为：这一天的下午4点到5点，以及凌晨1点到2点，即通信ID除了集中在凌晨发送消息外，还在下午4点到5点发送了消息。
10、服务端在汇聚通信ID向消息接收方发送消息的数量的占比后，还需要检测通信ID向消息接收方发送消息的数量的占比是否为100％。
其中，在服务端检测通信ID向消息接收方发送消息的数量的占比大于或等于预设占比时，服务端可以进一步检测通信ID向消息接收方发送消息的数量的占比是否为100％。
在一种实施例中，特征库中的特征可以由用户自定义，具体可以参照图8中的相关描述。
在该实施例中，在上述图3所示的步骤的基础上，参照图5，在S305之后还可以包括：
S306，检测第一通信ID是否连读多天(如3天)均在相同的时间段发送消息，发送消息的时间段是否集中在凌晨，在除了凌晨之外其他时间段是否未发送消息，以及第一通信ID向消息接收方发送消息的数量为1的占比是否为100％。若是，执行S203，若否，执行S206。
在该种实施例中，服务端检测第一通信ID连读多天(如3天)均在相同的时间段发送消息，发送消息的时间段集中在凌晨，在除了凌晨之外其他时间段未发送消息，以及第一 通信ID向消息接收方发送消息的数量为1的占比是100％，则可以执行S203。
在该种实施例中，在执行S204中，服务端检测第二通信ID是否为疑似骚扰通信ID时，也需要检测第二通信ID是否连读多天(如3天)均在相同的时间段发送消息，发送消息的时间段是否集中在凌晨，在除了凌晨之外其他时间段是否未发送消息，以及第二通信ID向消息接收方发送消息的数量为1的占比是否为100％。
本申请实施例中，可以增加检测通信ID是否为疑似骚扰通信ID的检测特征，增加的检测特征贴合疑似骚扰通信ID的特征，因此可以提高通信ID是否为疑似骚扰通信ID的检测准确性。
上述实施例中，以检测通信ID是否满足疑似骚扰通信ID的特征，在满足时进入下一特征的判断，在不满足时确定通信ID不为疑似骚扰通信ID，上述实施例中采用一刀切的方式(即是和否的方式)，这种方式易发生误判。
为了提高通信ID是否为疑似骚扰通信ID的检测准确性，避免误封禁造成的困扰，本申请实施例中可以引入置信度，针对服务端每一次检测通信ID是否符合疑似骚扰通信ID的特征，增加一次通信ID为疑似骚扰通信ID的置信度，而不是采用“是和否”一刀切的方式，以提高检测准确性。
参照图6，示例性的，在执行S303时，若第一通信ID在预设时长内发送消息的数量大于第二阈值，则可以将第一通信ID为疑似骚扰通信ID的置信度增加第一预设置信度，如50％(图3中简写为将置信度增加50％)。在执行S304时，若第一通信ID向消息接收方发送消息的数量为1的占比大于预设占比，则可以将第一通信ID为疑似骚扰通信ID的置信度增加第二预设置信度，如20％。在执行S305时，若第一通信ID发送消息的时间段处于集中的时间段，和/或，发送消息的频率为固定频率，则可以将第一通信ID为疑似骚扰通信ID的置信度增加第三预设置信度，如10％。
在执行S306时，需要检测第一通信ID是否符合疑似骚扰通信ID的4个特征，其中，每满足一个疑似骚扰通信ID的特征，可以将第一通信ID为疑似骚扰通信ID的置信度增加第四预设置信度，如5％。示例性的，如第一通信ID连读多天(如3天)均在相同的时间段发送消息，可以将第一通信ID为疑似骚扰通信ID的置信度增加5％。如第一通信ID发送消息的时间段集中在凌晨，则可以将第一通信ID为疑似骚扰通信ID的置信度增加5％。第一通信ID在除了凌晨之外其他时间段未发送消息，则将第一通信ID为疑似骚扰通信ID的置信度增加5％。若第一通信ID向消息接收方发送消息的数量为1的占比为100％，则可以将第一通信ID为疑似骚扰通信ID的置信度增加5％。应理解，图6中未示出第一通信ID不符合S306中的特征的分支。
如此，基于对第二通信ID的检测，可以获取第一通信ID为疑似骚扰通信ID的第一置信度。
在该实施例中，因为引入了置信度的判断，因此在执行S204时，服务端基于对第二通信ID的数据的检测，也可以获取第二通信ID为疑似骚扰通信ID的置信度。其中，当服务端获取第二通信ID为疑似骚扰通信ID的置信度后，可以判断第二通信ID为疑似骚扰通信ID的置信度是否大于或等于第一置信度阈值(如80％)。其中，若第二通信ID为疑似骚扰通信ID的置信度大于或等于第一置信度阈值(如80％)，则服务端可以将第一通信ID的第一置 信度继续增加第五预设置信度，如10％，得到第一通信ID的第二置信度。
在一种实施例中，服务端可以检测第一通信ID的第二置信度是否大于或等于第二置信度阈值(如95％)，若第一通信ID为疑似骚扰通信ID的第二置信度大于或等于第二置信度阈值，则确定第一通信ID为疑似骚扰通信ID，服务端可以封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。若第一通信ID为疑似骚扰通信ID的第二置信度小于第二置信度阈值，则确定第一通信ID不为疑似骚扰通信ID，服务端可以不响应。
其中，若第二通信ID为疑似骚扰通信ID的置信度小于第一置信度阈值(如80％)，则服务端可以检测第一通信ID的第一置信度是否大于或等于第二置信度阈值(如95％)，若第一通信ID为疑似骚扰通信ID的第一置信度大于或等于第二置信度阈值，则确定第一通信ID为疑似骚扰通信ID，服务端可以封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。若第一通信ID为疑似骚扰通信ID的第一置信度小于第二置信度阈值，则确定第一通信ID不为疑似骚扰通信ID，服务端可以不响应。
本申请实施例中引入置信度，针对服务端每一次检测通信ID是否符合疑似骚扰通信ID的特征，可以增加一次通信ID为疑似骚扰通信ID的置信度，而不是采用“是和否”一刀切的方式，可以提高检测准确性。
在图6所示的实施例的基础上，本申请实施例中还可以增加疑似骚扰列表，进一步增加通信ID是否包含于疑似骚扰列表中，来增加对通信ID是否为疑似骚扰通信ID的判断，以进一步提高通信ID的检测准确性。
参照图7，在执行S301A时，服务端通过解析消息日志，可以将预设时长内增删联系人的操作次数大于第四阈值的通信ID，以及增删联系人的数量大于第三数量阈值时，汇聚得到第一疑似骚扰列表。
在一种实施例中，若通信ID关联的手机号码为虚拟手机号码，则手机号码很大程度上是疑似骚扰手机号码，则通信ID很大程度上也是疑似骚扰通信ID，因此服务端通过解析消息日志，可以将手机号码为虚拟号码的通信ID，汇聚得到第二疑似骚扰列表。
示例性的，虚拟手机号码的号段均处于预设号段范围内，服务端通过检测手机号码的号段是否处于预设号段范围内，判断手机号码是否为虚拟手机号码。如以122开头的手机号码为虚拟手机号码，或者，处于122xxxxxxxx-123xxxxxxxx预设号段范围内的手机号码为虚拟手机号码。
在一种实施例中，按照图6所示的方法，服务端可以获取第一通信ID的第二置信度，其中，在第二置信度大于或等于第二置信度阈值时，服务端可以确定第一通信ID为疑似骚扰通信ID。在第二置信度小于第二置信度阈值时，服务端可以第一通信ID加入第三疑似骚扰列表。应理解，第三疑似骚扰列表中的通信ID的第二置信度均小于第二置信度阈值。
在该种实施例中，参照图7，在服务端获取第一通信ID的第二置信度后，可以检测第一通信ID是否包含于第一疑似骚扰列表、第二疑似骚扰列表，以及(连续三天的)第三疑似骚扰列表。其中，第一通信ID每包含于一个疑似骚扰列表中，可以将第一通信ID的置信度增加第六预设置信度，如5％。示例性的，若第一疑似骚扰列表中包含第一通信ID，则可以将第一通信ID的置信度增加5％。若第二疑似骚扰列表中包含第一通信ID，则可以将第二 通信ID的置信度增加5％。若(连续三天的)第三疑似骚扰列表中均包含第一通信ID，则可以将第二通信ID的置信度增加5％，如此可以得到第一通信ID的第三置信度。
在该实施例中，服务端可以检测第一通信ID的第三置信度是否大于或等于第二置信度阈值，来检测第一通信ID是否为疑似骚扰通信ID。若第一通信ID的第三置信度大于或等于第二置信度阈值，则确定第一通信ID为疑似骚扰通信ID，若第一通信ID的第三置信度小于第二置信度阈值，则确定第一通信ID不为疑似骚扰通信ID。
应理解，图7所示的置信度为示例说明，置信度可以自定义设置。
本申请实施例中，可以增加疑似骚扰列表，进一步增加通信ID是否包含于疑似骚扰列表中，来增加对通信ID是否为疑似骚扰通信ID的判断，提高通信ID的检测准确性。
下述结合图8对封禁处理平台进行说明。其中，用户(管理员)可以通过封禁处理平台进行封禁、解封、标记、加入疑似骚扰列表、查询、更新特征库等操作。
上述实施例中讲述了服务端在确定第一通信ID为疑似骚扰通信ID时，可以封禁第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。在一种实施例中，服务端在确定第一通信ID为疑似骚扰通信ID时，可以显示第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID。由管理员操作，以根据管理员的操作，确定具体封禁哪些设备和账号。本申请实施例中，加入管理员的操作，可以提高封禁准确性，避免误封造成的困扰。
其一，关于封禁、解封、标记、加入疑似骚扰列表的操作。
在一种实施例中，参照图8中的a，服务端在确定第一通信ID为疑似骚扰通信ID时，可以在封禁处理平台的界面上显示“第一通信ID关联的第一设备ID、第一账号ID，以及第二通信ID关联的第二设备ID、第二账号ID”。示例性的，图8中的a以第一通信ID为通信ID1A，第二通信ID为通信ID1B、通信ID1C为例，且以拓扑图的形式表征通信ID、设备、账号，以及手机号码的关联关系。其中，图8中的a可以显示通信ID1A、通信ID1B、通信ID1C，通信ID1A关联设备1、账号1，通信ID1B关联设备1、账号2，通信ID1C关联设备2、账号1，以及账号1关联手机号码1。
应理解，图8中的a中以部分关联关系进行说明。可以想到的是，手机号码还可以关联其他账号，其他账号还可以关联其他设备、其他通信ID，关联关系是一个复杂的拓扑图。在一种实施例中，拓扑图中可以显示通信ID、设备、账号，以及手机号码的状态。
其中，状态用于表征通信ID、设备、账号，以及手机号码目前处于疑似骚扰状态、封禁状态或解封状态等。示例性的，通信ID1A关联设备1、账号1，通信ID1B关联设备1、账号2，通信ID1C关联设备2、账号1，以及账号1关联手机号码1均处于疑似骚扰状态，图8中的a中以斜线阴影表征疑似骚扰状态。
封禁状态表征：通信ID、设备、账号，以及手机号码已经被封禁，如可以采用横线阴影表征封禁状态。解封状态表征：通信ID、设备、账号，以及手机号码未被封禁，如可以采用白色阴影表征解封状态。应理解，通信ID、设备、账号，以及手机号码的状态还可以采用不同的颜色、形状等进行表征，本申请实施例对此不作赘述。
其中，管理员操作任一通信ID、设备、账号、手机号码，可以触发封禁处理平台显示操作列表。示例性的，如图8中的a所示，以用户操作设备1为例，封禁处理平台的界面上可 以显示操作列表80，如图8中的b所示。操作列表80中可以包括：封禁控件81、解封控件82、标记控件83，以及加入疑似骚扰列表控件84。
封禁控件81，用于将设备、账号、手机号码的状态更新为封禁状态。
解封控件82，用于将设备、账号、手机号码的状态更新为解封状态。
标记控件83，用于将设备、账号、手机号码的状态更新为疑似骚扰状态。
加入疑似骚扰列表控件84，用于将通信ID加入疑似骚扰列表(如第一疑似骚扰列表、第二疑似骚扰列表，和/或，第三疑似骚扰列表)。
以管理员操作封禁控件81为例，封禁处理平台可以将设备1从疑似骚扰状态更新为封禁状态，相应的，封禁处理平台可以向服务端同步设备1的状态，进而服务端可以封禁设备1。
同理的，管理员还可以操作解封控件82，修改误封禁的设备、账号、手机号码的状态，以触发服务端可以解封误封禁的设备、账号、手机号码。
同理的，管理员还可以操作标记控件83，将处于解封状态的设备、账号、手机号码更新为疑似骚扰状态，如此服务端可以将更新为疑似骚扰状态的设备、账号、手机号码关联的通信ID标记为疑似骚扰通信ID，或者将更新为疑似骚扰状态的设备、账号、手机号码关联的通信ID添加至疑似骚扰列表。
在一种实施例中，管理员对“任一通信ID、设备、账号、手机号码”执行与触发显示操作列表80不同的操作，如双击操作，可以触发封禁处理平台显示该通信ID、设备、账号、手机号码发送的消息。管理员可以根据该消息，确定是否进行封禁。
其二，关于查询操作。
在一种实施例中，参照图8中的a，封禁处理平台的界面上还可以包括：查询框85。查询框85，用于查询任一设备、账号、手机号码的状态。
如管理员在查询框85中输入任一设备、账号、手机号码，可以触发封禁处理平台的显示该设备、账号、手机号码的状态，以及该设备、账号、手机号码关联的设备、账号、手机号码的状态，如上图8中的a所示的拓扑图。
示例性的，如管理员在查询框85中输入账号1，则封禁处理平台可以在界面上显示如图8中的a所示的拓扑图。
其三，关于更新特征库操作。
应理解，特征库包括：用于检测通信ID是否为疑似骚扰通信ID的特征。
示例性的，参照图7所示，特征库可以包括：消息类型是否为用户消息、账号类型是否为非官方账号、预设时长内向消息接收方发送消息的数量是否大于第二阈值、向消息接收方发送消息的数量为1的占比是否大于预设占比，发送消息的时间段是否集中、发送消息的频率是否固定，是否连读多天(如3天)均在相同的时间段发送消息、发送消息的时间段是否集中在凌晨、在除了凌晨之外其他时间段是否未发送消息、通信ID向消息接收方发送消息的数量为1的占比是否为100％，第二通信ID为疑似骚扰通信ID的置信度是否大于或等于第一置信度阈值、第一通信ID是否包含于第一疑似骚扰列表、第二疑似骚扰列表，以及第三疑似骚扰列表中，以及第一通信ID的第三置信度是否大于或等于第二置信度阈值。
在一种实施例中，用户可以自定义特征库中“用于检测通信ID是否为疑似骚扰通信ID的特征”。参照图8中的a，封禁处理平台的界面上可以包括：特征库编辑区域86。特征库 编辑区域86包括：新增控件861、删除控件862、编辑控件863，以及激活失效控件864。
其中，管理员触发新增控件861，可以在特征库中新增“用于检测通信ID是否为疑似骚扰通信ID的特征”。管理员触发新增控件862，可以在特征库中删除“用于检测通信ID是否为疑似骚扰通信ID的特征”。管理员触发编辑控件863，可以在特征库中修改“用于检测通信ID是否为疑似骚扰通信ID的特征”，以“通信ID1在最近一天内发送消息的数量大于第二阈值，且第二阈值为1000条为例”，管理员可以修改第二阈值为2000条。
另外，管理员可以修改每个特征检测后增加的置信度。
另，管理员还可以操作激活失效控件864，可以触发特征库中的特征激活、失效。示例性的，管理员点击一次激活失效控件864，可以激活特征库中的特征，触发服务端采用特征库中的特征，检测通信ID是否为疑似骚扰通信ID。管理员再点击一次激活失效控件864，特征库中的特征失效，触发服务端不采用特征库中的特征检测通信ID是否为疑似骚扰通信ID。
应理解的是，封禁处理平台可以将管理员对封禁处理平台的界面的操作，同步至服务端，服务端可以根据用户的操作执行相应的操作。示例性的，管理员修改特征库中的特征后，封禁处理平台可以将修改后的特征同步至服务端，以触发服务端采用修改后的特征，检测通信ID是否为疑似骚扰通信ID。
应理解，图8中显示的样式均为示例说明，本申请实施例中不限制封禁处理平台的界面的显示。
本申请实施例中，还可以提供封禁处理平台，使得管理员可以通过封禁处理平台的界面，进行封禁、解封、标记、加入疑似骚扰列表、查询、更新特征库等操作，一方面可以增强人机交互，加入用户的操作，可以提高通信ID的检测准确性，以及提高用户体验。另一方面用户可以自定义设置特征库中用于检测通信ID是否为疑似骚扰通信ID的特征，即特征可配置，一方面可以提高检测灵活性，另一方面管理员可以不断更新优化特证库，使得特征库中的特征更为贴切通信ID的检测，也可以提高通信ID的检测准确性。
在一种实施例中，本申请实施例还提供一种电子设备，参照图9，该电子设备可以为上述实施例中所述的服务端，该电子设备中可以包括：处理器901(例如CPU)、存储器902。存储器902可能包含高速随机存取存储器(random-access memory，RAM)，也可能还包括非易失性存储器(non-volatile memory，NVM)，例如至少一个磁盘存储器，存储器902中可以存储各种指令，以用于完成各种处理功能以及实现本申请的方法步骤。
可选的，本申请涉及的电子设备还可以包括：电源903、通信总线904以及通信端口905。上述通信端口905用于实现电子设备与其他外设之间进行连接通信。在本申请实施例中，存储器902用于存储计算机可执行程序代码，程序代码包括指令；当处理器901执行指令时，指令使电子设备的处理器901执行上述方法实施例中的动作，其实现原理和技术效果类似，在此不再赘述。
需要说明的是，上述实施例中所述的模块或部件可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个专用集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)等。再如，当以上某个模块通过处 理元件调度程序代码的形式实现时，该处理元件可以是通用处理器，例如中央处理器(central processing unit，CPU)或其它可以调用程序代码的处理器如控制器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
本文中的术语“多个”是指两个或两个以上。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系；在公式中，字符“/”，表示前后关联对象是一种“相除”的关系。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。
可以理解的是，在本申请的实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施例的实施过程构成任何限定。

Claims (16)

  1. 一种消息处理方法，其特征在于，包括：
    解析消息日志，获取第一通信ID的数据，所述第一通信ID与第一设备ID、第一账号ID相关联；
    根据所述第一通信ID的数据，检测所述第一通信ID是否为疑似骚扰通信ID；
    响应于所述第一通信ID为疑似骚扰通信ID，获取第二通信ID，所述第二通信ID包括：所述第一设备ID关联的通信ID，以及所述第一账号ID关联的通信ID，所述第二通信ID与所述第一通信ID不同；
    根据所述消息日志中所述第二通信ID的数据，检测所述第二通信ID是否为疑似骚扰通信ID；
    响应于所述第二通信ID为疑似骚扰通信ID，封禁所述第一设备ID、所述第一账号ID、所述第二通信ID关联的第二设备ID、第二账号ID，所述第二设备ID和所述第二账号ID为所述第二通信ID直接关联以及间接关联的设备ID和账号ID。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述第一通信ID的数据，检测所述第一通信ID是否为疑似骚扰通信ID，包括：
    根据所述第一通信ID的数据，以及疑似骚扰通信ID的特征，检测所述第一通信ID是否为疑似骚扰通信ID。
  3. 根据权利要求2所述的方法，其特征在于，所述疑似骚扰通信ID的特征包括：预设时长内通信ID发送的消息的数量大于或等于第一数量阈值、通信ID向消息接收方发送消息的数量的占比大于或等于预设占比、发送消息的时间段处于集中的时间段，以及发送消息的频率固定；
    所述根据所述第一通信ID的数据，以及疑似骚扰通信ID的特征，检测所述第一通信ID是否为疑似骚扰通信ID，包括：
    检测所述预设时长内所述第一通信ID发送的消息的数量是否大于或等于所述第一数量阈值；
    若是，检测所述第一通信ID向消息接收方发送消息的数量的占比是否大于或等于所述预设占比；
    若是，检测所述第一通信ID发送消息的时间段是否处于集中的时间段，和/或，所述第一通信ID发送消息的频率是否为固定频率；
    若是，确定所述第一通信ID为疑似骚扰通信ID。
  4. 根据权利要求2所述的方法，其特征在于，所述疑似骚扰通信ID的特征还包括：通信ID在预设时长内增删联系人的操作次数大于第二数量阈值，以及增删联系人的数量大于第三数量阈值；所述方法还包括：
    检测所述第一通信ID在预设时长内增删联系人的操作次数是否大于所述第二数量阈值，以及所述预设时长内增删联系人的数量大于所述第三数量阈值；
    若是，检测所述第一通信ID发送消息的时间段是否处于集中的时间段，和/或，发送消息的频率是否为固定频率；
    若是，确定所述第一通信ID为疑似骚扰通信ID。
  5. 根据权利要求2-4中任一项所述的方法，其特征在于，所述第一通信ID发送的消 息为用户消息，所述第一账号ID为非官方账号。
  6. 根据权利要求3所述的方法，其特征在于，所述确定所述第一通信ID为疑似骚扰通信ID之前，还包括：
    检测所述第一通信ID是否连读多天均在相同的集中的时间段发送消息、检测所述相同的集中的时间段是否为预设时间段，检测在除了所述预设时间段之外所述第一通信ID是否未发送消息，以及检测所述第一通信ID向消息接收方发送消息的数量为1的占比是否为100％；
    若是，则确定所述第一通信ID为疑似骚扰通信ID。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    响应于所述预设时长内所述第一通信ID发送的消息的数量大于或等于所述第一数量阈值，将所述第一通信ID为疑似骚扰通信ID的置信度增加第一预设置信度；
    响应于所述第一通信ID向消息接收方发送消息的数量的占比大于或等于所述预设占比，将所述第一通信ID为疑似骚扰通信ID的置信度增加第二预设置信度；
    响应于所述第一通信ID发送消息的时间段处于集中的时间段，和/或，发送消息的频率为固定频率，将所述第一通信ID为疑似骚扰通信ID的置信度增加第三预设置信度；
    响应于所述第一通信ID每满足一个如下任一疑似骚扰通信ID的特征，将所述第一通信ID为疑似骚扰通信ID的置信度增加第四预设置信度：所述第一通信ID连读多天均在相同的集中的时间段发送消息、所述相同的集中的时间段为预设时间段，在除了所述预设时间段之外所述第一通信ID未发送消息，以及所述第一通信ID向消息接收方发送消息的数量为1的占比为100％；
    得到所述第一通信ID的第一置信度；
    根据所述第一置信度，检测所述第一通信ID是否为疑似骚扰通信ID。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述第一置信度，检测所述第一通信ID是否为疑似骚扰通信ID，包括：
    根据所述第二通信ID的数据，获取所述第二通信ID为疑似骚扰通信ID的置信度；
    若所述第二通信ID为疑似骚扰通信ID的置信度大于或等于第一置信度阈值，则将所述第一置信度增加第五预设置信度，得到所述第一通信ID的第二置信度；
    根据所述第二置信度，检测所述第一通信ID是否为疑似骚扰通信ID。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    汇聚所述预设时长内增删联系人的操作次数大于第二数量阈值，以及增删联系人的数量大于第三数量阈值的通信ID，得到第一疑似骚扰列表；
    汇聚账号ID关联的手机号码为虚拟号码的通信ID，得到第二疑似骚扰列表；
    检测所述第一通信ID是否包含于所述第一疑似骚扰列表、所述第二疑似骚扰列表，以及第三疑似骚扰列表中，所述第三疑似骚扰列表中的通信ID的第二置信度均小于第二置信度阈值；
    根据所述第一通信ID是否包含于所述第一疑似骚扰列表、所述第二疑似骚扰列表，以及第三疑似骚扰列表中的结果，得到所述第一通信ID为疑似骚扰通信ID的第三置信度；
    所述根据所述第二置信度，检测所述第一通信ID是否为疑似骚扰通信ID，包括：
    根据所述第三置信度，检测所述第一通信ID是否为疑似骚扰通信ID。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述第三置信度，检测所述第一通信ID是否为疑似骚扰通信ID，包括：
    响应于所述第三置信度大于或等于所述第二置信度阈值，确定所述第一通信ID为疑似骚扰通信ID；
    响应于所述第三置信度小于所述第二置信度阈值，确定所述第一通信ID不为疑似骚扰通信ID。
  11. 根据权利要求1-10中任一项所述的方法，其特征在于，所述封禁所述第一设备ID、所述第一账号ID、所述第二通信ID关联的第二设备ID、第二账号ID，包括：
    显示所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID的关联关系；
    响应于对所述关联关系中目标对象的操作，封禁所述目标对象，所述目标对象包含于所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID中。
  12. 根据权利要求11所述的方法，其特征在于，所述第一账号ID关联的手机号码为第一手机号码，所述显示所述第一设备ID、所述第一账号ID、所述第二设备ID，以及第二账号ID，包括：
    显示所述第一设备ID、所述第一账号ID、所述第二设备ID、所述第二账号ID，以及所述第一手机号码。
  13. 一种电子设备，其特征在于，包括：处理器和存储器；
    所述存储器存储计算机指令；
    所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如权利要求1-12中任一项所述的方法。
  14. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令被运行时，实现如权利要求1-12中任一项所述的方法。
  15. 一种计算机程序产品，其特征在于，包括计算机程序或指令，所述计算机程序或指令被处理器执行时，实现权利要求1-12中任一项所述的方法。
  16. 一种程序产品，其特征在于，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，通信装置的至少一个处理器可以从所述可读存储介质读取所述计算机程序，所述至少一个处理器执行所述计算机程序使得通信装置实施如权利要求1-12任意一项所述的方法。
PCT/CN2023/100542 2022-06-30 2023-06-15 消息处理方法和电子设备 WO2024001816A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210761580.0 2022-06-30
CN202210761580.0A CN117375860A (zh) 2022-06-30 2022-06-30 消息处理方法和电子设备

Publications (1)

Publication Number Publication Date
WO2024001816A1 true WO2024001816A1 (zh) 2024-01-04

Family

ID=89383211

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/100542 WO2024001816A1 (zh) 2022-06-30 2023-06-15 消息处理方法和电子设备

Country Status (2)

Country Link
CN (1) CN117375860A (zh)
WO (1) WO2024001816A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120030293A1 (en) * 2010-07-27 2012-02-02 At&T Intellectual Property I, L.P. Employing report ratios for intelligent mobile messaging classification and anti-spam defense
KR20170006158A (ko) * 2015-07-07 2017-01-17 주식회사 케이티 문자 메시지 부정 사용 탐지 방법 및 시스템
CN112153222A (zh) * 2020-10-20 2020-12-29 中国联合网络通信集团有限公司 骚扰号码的识别方法及服务器
CN114168423A (zh) * 2021-12-10 2022-03-11 恒安嘉新（北京）科技股份公司 异常号码的呼叫监控方法、装置、设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120030293A1 (en) * 2010-07-27 2012-02-02 At&T Intellectual Property I, L.P. Employing report ratios for intelligent mobile messaging classification and anti-spam defense
KR20170006158A (ko) * 2015-07-07 2017-01-17 주식회사 케이티 문자 메시지 부정 사용 탐지 방법 및 시스템
CN112153222A (zh) * 2020-10-20 2020-12-29 中国联合网络通信集团有限公司 骚扰号码的识别方法及服务器
CN114168423A (zh) * 2021-12-10 2022-03-11 恒安嘉新（北京）科技股份公司 异常号码的呼叫监控方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN117375860A (zh) 2024-01-09

Similar Documents

Publication Publication Date Title
CN106357517B (zh) 定向标签生成方法及装置
CN105898085B (zh) 骚扰通信账号的识别方法及装置
WO2021012509A1 (zh) 一种异常账号检测方法、装置及计算机存储介质
TW202008157A (zh) 喚醒、資訊推送方法和裝置、計算設備及儲存媒體
CN108038130B (zh) 虚假用户的自动清理方法、装置、设备及存储介质
CN107346397B (zh) 信息处理方法及相关产品
US11537751B2 (en) Using machine learning algorithm to ascertain network devices used with anonymous identifiers
WO2021164253A1 (zh) 用户行为实时多维度分析方法、装置及存储介质
CN106470150B (zh) 关系链存储方法及装置
TWI661321B (zh) Method and device for determining user relationship
US20160179849A1 (en) Machine to machine data aggregator
CN107872494A (zh) 一种消息推送方法和装置
US20210240860A1 (en) Index creation for data records
CN107563187A (zh) 访问操作监控方法、装置、移动终端及可读存储介质
US20130332540A1 (en) Structural Presentation and Smart Alerts for Instant Messaging Contacts
CN112306700A (zh) 一种异常rpc请求的诊断方法和装置
WO2024045969A1 (zh) 排队号的管理方法、装置、电子设备及可读介质
CN103888919A (zh) 短消息监控方法及装置
CN113141368A (zh) 一种支持海量数据实时安全威胁关联分析的系统
CN111756745A (zh) 告警方法、告警装置及终端设备
WO2019144803A1 (zh) 流量统计方法、装置、存储介质及电子装置
WO2024001816A1 (zh) 消息处理方法和电子设备
CN110674168A (zh) 一种缓存键异常检测方法、装置、存储介质以及终端
US11599673B2 (en) Ascertaining network devices used with anonymous identifiers
CN108111328B (zh) 一种异常处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23829996

Country of ref document: EP

Kind code of ref document: A1