CN111726359A - Account information detection method and device - Google Patents
Account information detection method and device Download PDFInfo
- Publication number
- CN111726359A CN111726359A CN202010562179.5A CN202010562179A CN111726359A CN 111726359 A CN111726359 A CN 111726359A CN 202010562179 A CN202010562179 A CN 202010562179A CN 111726359 A CN111726359 A CN 111726359A
- Authority
- CN
- China
- Prior art keywords
- account
- current
- information
- behavior information
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the invention provides a method and a device for detecting account information, when detecting the account behavior information, the current behavior information of a current account is obtained, if the current behavior information of the account is abnormal behavior information, the attribute information of the current account is obtained, a target account associated with the current account is determined according to the attribute information, the target behavior information of the target account is obtained, the target behavior information is detected, if the target behavior information is also abnormal behavior information, the account number of the target account with the abnormal behavior information is determined, if the account number is greater than or equal to a preset threshold value, the current account and all the target accounts are taken as abnormal accounts, the accounts are subjected to abnormal processing, and when one account is abnormal, the associated account is detected by establishing the association relationship among the accounts, the detection efficiency of the account is greatly improved, and the omission factor is reduced by the account association mode.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a method and an apparatus for detecting account information.
Background
The account exception can include off-site login, login in an abnormal time period, centralized publishing of malicious information by a plurality of accounts, and the like. With the improvement of public safety awareness and network safety awareness of people, the attention on abnormal behavior detection in environments such as crowd scenes and networks is higher and higher. Currently, there are some working modes that a lawbreaker can operate multiple accounts by centralized registration, centralized authentication, and centralized release of malicious information. The current account abnormity detection is usually based on the behavior information of a single account, so that the manual detection efficiency is very low, and the condition of missed detection is easy to occur.
Disclosure of Invention
The embodiment of the invention provides an account information detection method, which aims to solve the problems of low abnormal account detection efficiency and high missed account detection rate in the prior art.
Correspondingly, the embodiment of the invention also provides a device for detecting the account information, which is used for ensuring the realization and the application of the method.
In order to solve the above problem, an embodiment of the present invention discloses a method for detecting account information, including:
acquiring current behavior information of a current account;
when the current behavior information is abnormal behavior information, acquiring attribute information of the current account, and determining at least one target account corresponding to the attribute information;
determining the account number of a target account with abnormal behavior information;
and when the account number is greater than or equal to a preset threshold value, taking the current account and the at least one target account as abnormal accounts.
Optionally, the method further comprises:
acquiring account data, wherein the account data comprises historical behavior information;
determining a primary account for the current account according to the attribute information;
and extracting an associated account associated with the current account from the primary account according to the historical behavior information.
Optionally, the determining, according to the attribute information, a primary account for a current account includes:
acquiring account service scene information;
determining an initial account of the account service scene information by adopting the attribute information;
the attribute information comprises at least one of equipment identification, communication identification and identity identification; the account service scene information comprises scene information such as account registration, account authentication, account login, account release and the like.
Optionally, the historical behavior information includes first historical behavior information of a current account and second historical behavior information of a primary account, and the extracting, according to the historical behavior information, an associated account associated with the current account from the primary account includes:
and taking the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs as an associated account associated with the current account.
Optionally, the obtaining the attribute information of the current account and determining the target account corresponding to the attribute information include:
acquiring attribute information of the current account;
and extracting at least one target account matched with the attribute information from the associated accounts.
The embodiment of the invention also discloses a device for detecting the account information, which comprises:
the current behavior information acquisition module is used for acquiring the current behavior information of the current account;
the attribute information acquisition module is used for acquiring the attribute information of the current account and determining at least one target account corresponding to the attribute information when the current behavior information is abnormal behavior information;
the account number determining module is used for determining the account number of the target account with abnormal behavior information;
and the account abnormity determining module is used for taking the current account and the at least one target account as abnormal accounts when the account number is greater than or equal to a preset threshold value.
Optionally, the method further comprises:
the account data acquisition module is used for acquiring account data, and the account data comprises historical behavior information;
the primary account determining module is used for determining a primary account aiming at the current account according to the attribute information;
and the associated account extracting module is used for extracting the associated account associated with the current account from the primary account according to the historical behavior information.
Optionally, the primary account determining module is specifically configured to:
acquiring account service scene information;
determining a primary account of the account service scene information from the database by adopting the attribute information;
the attribute information comprises at least one of equipment identification, communication identification and identity identification; the account service scene information comprises scene information such as account registration, account authentication, account login, account release and the like.
Optionally, the historical behavior information includes first historical behavior information of the current account and second historical behavior information of the primary account, and the associated account extraction module is specifically configured to:
and taking the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs as an associated account associated with the current account.
Optionally, the attribute information obtaining module is specifically configured to:
acquiring attribute information of the current account;
and extracting at least one target account matched with the attribute information from the associated accounts.
The embodiment of the invention also discloses an electronic device, which comprises:
one or more processors; and
one or more machine-readable media having instructions stored thereon, which when executed by the one or more processors, cause the electronic device to perform the method as described above.
Embodiments of the invention also disclose one or more machine-readable media having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the methods as described above.
The embodiment of the invention has the following advantages:
in the embodiment of the invention, when detecting the behavior information of the user account, the current behavior information of the current account can be obtained, if the current behavior information of the account is abnormal behavior information, the attribute information of the current account is obtained, at least one target account associated with the current account is determined according to the attribute information, the target behavior information of the target account is obtained, the target behavior information is detected, if the target behavior information is also abnormal behavior information, the account number of the target account with the abnormal behavior information is determined, if the account number is greater than or equal to a preset threshold value, the current account and all the target accounts are taken as abnormal accounts, the accounts can be subjected to abnormal processing simultaneously, and therefore, by establishing the association relationship among the accounts, when one account is abnormal, the associated accounts are detected simultaneously, the detection efficiency of the account is greatly improved, and the missing rate is reduced in an account association mode.
Drawings
FIG. 1 is a flowchart illustrating steps of an embodiment of a method for detecting account information according to the present invention;
FIG. 2 is a flowchart illustrating steps of an embodiment of a method for detecting account information according to the present invention;
FIG. 3 is a schematic diagram of data processing in an embodiment of the invention;
fig. 4 is a block diagram of an embodiment of an account information detection apparatus according to the present invention.
Detailed Description
In order to make the aforementioned objects, features and advantages of the present invention comprehensible, embodiments accompanied with figures are described in further detail below.
Referring to fig. 1, a flowchart illustrating steps of an embodiment of a method for detecting account information according to the present invention is shown, which may specifically include the following steps:
with the improvement of public safety awareness and network safety awareness of people, the attention on abnormal behavior detection in environments such as crowd scenes and networks is higher and higher. However, there are working modes such as centralized registration, centralized authentication and centralized release of malicious information, and a lawbreaker controls multiple accounts by one person to release false information, malicious information and the like on the network, which brings bad experience to network users.
As an example, in the process of finding a house in a network, some brokers, landlords and the like register a plurality of accounts in a centralized manner, and then publish the same house source, so that the information of the house source in the network is repeated, and a false house source is published, which greatly affects the house finding experience of a user; or users who compete with each other exist, and assiduous competition is caused by maliciously publishing assassassault messages in posts published by competitors by registering a plurality of accounts, so that the current network environment is influenced very much. It can be understood that, in the embodiment of the present application, the house finding in the network is taken as an example for description, and for scenes such as network recruitment, online transaction, and the like, there are also situations such as centralized registration, centralized authentication, centralized release, and the like, which is not limited in this respect.
In the embodiment of the present invention, the behavior information of the user account may include an account login location, an account login time period, a release content, a release frequency, and the like. For a general account, the login location and the login time period may be relatively fixed, and the account abnormality detection may be performed according to the location and the login time period where the current account frequently logs in. And, the account behavior can be detected when the account is online after logging in.
In a specific implementation, the terminal may have a corresponding application program installed therein, and the user may log in an account in the application program so as to implement a related service. Specifically, for the detection of the account behavior, after the application program detects that the account is logged in, the application program may send the account information corresponding to the currently logged-in account to the detection system (which may be a server), so that the detection system may start to detect the account behavior information from the beginning of the account login until the account is offline.
Optionally, for data communication between an application program (i.e., a client) and a detection system, in order to reduce efficiency of data transmission, the application program may report a message to the detection system once every time an account behavior is executed, so that it is not necessary to maintain real-time connection between the client and the detection system, and only when an account in the application program executes an account behavior, the application program reports behavior information, so as to reduce data transmission between the application program and the detection system, and reduce computational overhead of the detection system.
102, when the current behavior information is abnormal behavior information, acquiring attribute information of the current account, and determining at least one target account corresponding to the attribute information;
in a specific implementation, after the detection system obtains the current behavior information of the current account, the current behavior information may be matched with the historical behavior information of the current account, or the current behavior information may be matched with preset reference behavior information, so as to determine whether the current behavior information of the current account is abnormal behavior information.
For example, the current account has a login location of Guangzhou, a login time of 10 AM, publication content including 20 house-sourced posts, a publication frequency of one every 5 seconds, and so on. And the historical login sites of the account are all Beijing, the login time is 3 pm, the abnormal login behavior of the current account can be preliminarily determined according to the login sites and the login time, and the release behavior of the current account can be further detected. And referring to the behavior information, issuing a house source post every 2 minutes to be considered as normal, so that the account can be judged to have abnormal issuing behavior, and the current account can be determined to belong to an abnormal account, which belongs to abnormal accounts such as malicious screen refreshing and false house source issuing.
It should be noted that, the embodiment of the present invention includes but is not limited to the foregoing examples, and it is understood that, under the guidance of the idea of the embodiment of the present invention, a person skilled in the art may detect the behavior information of the account in other ways according to actual situations, and the present invention is not limited to this.
In a specific implementation, after determining that the current behavior information of the current account is abnormal behavior information, the attribute information of the current account may be obtained, and at least one target account corresponding to the attribute information may be determined. The attribute information may be information associated with the account, and the attribute information may include at least one of a device identifier, a communication identifier, and an identity identifier.
The device identifier may be a device number of the user terminal, such as a serial number of the user terminal, an International Mobile Equipment Identity (IMEI), and the like; the communication identifier can be a mobile phone number, an IP address and the like of the user terminal; the identification may be an identification number of the user used for registering the account, or a business license, etc., which is not limited by the present invention.
and when at least one target account associated with the current account is found through the attribute information, acquiring the current target behavior information of the target account, then performing abnormal detection on the behavior information, and counting the account number of the target account with the abnormal behavior information.
In an example, the associated target account may be found through the identity card number used when the current account is registered, and may include a target account (r), a target account (c), a target account (r), a target account (c), and the like. In order to improve the detection efficiency, the target accounts may be sampled and detected according to a certain proportion, for example, 20% of the target accounts are randomly extracted from all the target accounts associated with the current account as detection objects, after extraction, the target behavior information of each target account may be obtained, and the behavior information detection may be performed, and then the account number of the target account having abnormal behavior information is counted, so as to process the account in the following.
In another example, the target accounts may correspond to an account identifier, all the target accounts may be sorted according to the account identifier, then the target behavior information of each target account is detected one by one according to the sorted order, and the account number of the target account having abnormal behavior information is counted in real time.
It should be noted that, the embodiment of the present invention includes but is not limited to the above examples, and it is understood that, under the guidance of the idea of the embodiment of the present invention, a person skilled in the art may set a detection mode and a quantity statistical mode of a target account according to an actual situation, and the present invention is not limited to this.
And 104, when the account number is greater than or equal to a preset threshold value, taking the current account and the at least one target account as abnormal accounts.
In the specific implementation, when the number of the accounts of the target accounts with the abnormal behavior information is greater than or equal to the preset threshold, the current account and all the target accounts can be used as abnormal accounts, so that the detection efficiency of the accounts is greatly improved by establishing the association relationship between the accounts and simultaneously detecting the associated accounts when one account is abnormal, and the missed detection rate is reduced by the account association mode.
In an example, assuming that a target account is subjected to spot check, when more than 70% (including 70%) of target behavior information of the target account in the target account subjected to spot check is abnormal behavior information, all the target accounts and the current account can be taken as abnormal accounts, so that one abnormal account can be associated with a plurality of abnormal accounts, the detection efficiency of the account is greatly improved, and when the proportion of the abnormal accounts reaches a certain threshold, the associated accounts are subjected to full processing, so that the detection efficiency is further improved.
In another example, if all the behavior information of the target accounts is detected in a certain sequence, when the account number of the abnormal accounts counted in real time reaches more than 70%, all the target accounts and the current account can be used as the abnormal accounts, so that a plurality of abnormal accounts can be associated through one abnormal account, the detection efficiency of the account is greatly improved, and when the proportion of the abnormal accounts reaches a certain threshold value, the associated accounts are subjected to full processing, so that the detection efficiency is further improved.
In the embodiment of the invention, when detecting the behavior information of the user account, the current behavior information of the current account can be obtained, if the current behavior information of the account is abnormal behavior information, the attribute information of the current account is obtained, at least one target account associated with the current account is determined according to the attribute information, the target behavior information of the target account is obtained, the target behavior information is detected, if the target behavior information is also abnormal behavior information, the account number of the target account with the abnormal behavior information is determined, if the account number is greater than or equal to a preset threshold value, the current account and all the target accounts are taken as abnormal accounts, the accounts can be subjected to abnormal processing simultaneously, and therefore, by establishing the association relationship among the accounts, when one account is abnormal, the associated accounts are detected simultaneously, the detection efficiency of the account is greatly improved, and the missing rate is reduced in an account association mode.
Referring to fig. 2, a flowchart illustrating steps of an embodiment of a method for detecting account information according to the present invention is shown, which may specifically include the following steps:
in a specific implementation, the terminal may have a corresponding application program installed therein, and the user may log in an account in the application program so as to implement a related service. Specifically, for the detection of the account behavior, after the application program detects that the account is logged in, the application program may send the account information corresponding to the currently logged-in account to the detection system (which may be a server), so that the detection system may start to detect the account behavior information from the beginning of the account login until the account is offline.
Optionally, for data communication between an application program (i.e., a client) and a detection system, in order to reduce efficiency of data transmission, the application program may report a message to the detection system once every time an account behavior is executed, so that it is not necessary to maintain real-time connection between the client and the detection system, and only when an account in the application program executes an account behavior, the application program reports behavior information, so as to reduce data transmission between the application program and the detection system, and reduce computational overhead of the detection system.
in a specific implementation, after the detection system obtains the current behavior information of the current account, the current behavior information may be matched with the historical behavior information of the current account, or the current behavior information may be matched with preset reference behavior information, so as to determine whether the current behavior information of the current account is abnormal behavior information.
Specifically, if the login location of the current account is different from the frequent login location, it may be preliminarily determined that the current account is an abnormal account, and then the content issued by the current account is acquired, and if the issued content relates to yellow, political, malicious harassment, fraud and other information, it may be determined that the current behavior information of the current account is abnormal behavior information, and the current account may be an abnormal account.
In one example, whether the account is an abnormal account can be determined by whether the login location of the current account is abnormal, whether the login time period is abnormal, whether the post issued is abnormal, whether the chat content is abnormal, whether the qualification is abnormal, the post is deleted, the post is blacked, the post is triggered, and the like. The chat content can be obtained by performing data extraction on the related account after the user reports, so that under the condition of ensuring the privacy of the user, the chat content can be obtained for the related user only after the illegal user is reported, and the anomaly detection is performed.
In a specific implementation, when it is determined that the behavior information of the current account is abnormal behavior information, the attribute information of the current account may be acquired, so that at least one target account matched with the attribute information is extracted from the preset associated accounts according to the attribute information.
In an optional embodiment of the present invention, the association relationship between different accounts may be established through the attribute information and the behavior information of the accounts. Taking the current account as an example for illustration, account data may be obtained from the database, historical behavior information of user accounts in the account data, then an initial account for the current account is determined from all user accounts according to the attribute information of the current account, and then an associated account associated with the current account is extracted from all initial accounts according to the historical behavior information as a homogeneous account associated with the current account.
In a specific implementation, after the attribute information of the current account is obtained, account service scenario information may be obtained, where the account service scenario information may include scenario information such as account registration, account authentication, account login, and account release, and the account registration may be performed for a user to register a new account; the account authentication can be real-name authentication for the user; the account login can be the login of the user at the user terminal; the account publication may be a post publication or the like.
Specifically, the attribute information of the current account may be used to determine the primary account of the account service scenario information from the database, for example, an account that belongs to the same device identifier as the current account, or an account that belongs to the same communication identifier as the current account, or an account that belongs to the same identity identifier as the current account, or the like may be searched in the database. Then, the first historical behavior information of the current account and the second historical behavior information of each primary account can be obtained and matched, then the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs is used as a related account related to the current account, and therefore through the correlation of the accounts, one problem account can be related and inquired to a plurality of related accounts, the processing of working modes of centralized registration, centralized authentication and centralized release is facilitated, the detection efficiency of the accounts is greatly improved, and the omission factor of the accounts is reduced.
In an example, the attribute information of the current account includes a device identifier, a communication identifier, an identity identifier, and the like, and the primary account matching the attribute information may be searched from different service scenarios, such as account registration, account authentication, account login, and account release, for example, including 5 primary accounts matching the identity identifier in an account registration scenario; in the account authentication scene, 10 primary accounts matched with the identity marks; and in the account login scenario, 5 primary accounts matched with the device identification, or 10 primary accounts matched with the communication identification, and the like, so that a plurality of primary accounts associated with the current account can be preliminarily queried through the attribute information. Then, the behavior information of the primary account can be associated according to the historical behavior information of the current account, so as to improve the association between different accounts, for example, 30 primary accounts can be matched according to the login time, and accounts with basically similar login time (a time interval can be set, and if the accounts are in the same time interval, the accounts are regarded as associated accounts) are used as associated accounts associated with the current account and recorded as like accounts; or matching 30 primary accounts according to the login location, taking the accounts with the same login location as the associated accounts associated with the current account, and recording the accounts as the same type of account; the primary accounts can be screened according to the similarity degree of the issued content, the issuing frequency and the like, and the screening is not repeated here, so that one problem account can be associated to inquire a plurality of related accounts by associating the accounts, the processing of the working modes of centralized registration, centralized authentication and centralized issuing is facilitated, the account detection efficiency is greatly improved, and the missing rate of the accounts is reduced.
and when at least one target account associated with the current account is found through the attribute information, acquiring the current target behavior information of the target account, then performing abnormal detection on the behavior information, and counting the account number of the target account with the abnormal behavior information.
And 204, when the account number is greater than or equal to a preset threshold value, taking the current account and the at least one target account as abnormal accounts.
In the specific implementation, when the number of the accounts of the target accounts with the abnormal behavior information is greater than or equal to the preset threshold, the current account and all the target accounts can be used as abnormal accounts, so that the detection efficiency of the accounts is greatly improved by establishing the association relationship between the accounts and simultaneously detecting the associated accounts when one account is abnormal, and the missed detection rate is reduced by the account association mode.
Specifically, for a plurality of target accounts associated with the current account, if the accounts are abnormal accounts, the account number between the current account and the target accounts may be counted, and if the account number is greater than or equal to a preset threshold, all the accounts (including the current account) associated with the current account are determined to be abnormal accounts, so that for a worker or a detection system, the abnormal processing of the accounts is not required to be performed after all the abnormal accounts are determined, and the account detection efficiency is further improved.
In the embodiment of the invention, when detecting the behavior information of the user account, the current behavior information of the current account can be obtained, if the current behavior information of the account is abnormal behavior information, the attribute information of the current account is obtained, at least one target account associated with the current account is determined according to the attribute information, the target behavior information of the target account is obtained, the target behavior information is detected, if the target behavior information is also abnormal behavior information, the account number of the target account with the abnormal behavior information is determined, if the account number is greater than or equal to a preset threshold value, the current account and all the target accounts are taken as abnormal accounts, the accounts can be subjected to abnormal processing simultaneously, and therefore, by establishing the association relationship among the accounts, when one account is abnormal, the associated accounts are detected simultaneously, the detection efficiency of the account is greatly improved, and the missing rate is reduced in an account association mode.
In order to enable a person skilled in the art to better understand the embodiments of the present invention, the following description is given by way of an example:
as shown in fig. 3, which illustrates a schematic diagram of data processing in an embodiment of the present invention, account data is first obtained from a Hive database, where the account data may include user basic data, wind control detection data, posting service data, and the like, and then historical behavior data and attribute information of an account are extracted from these data, and aggregation statistics and cleansing are performed, for example, statistics of posting city number of the account, current account number of account registration IP, number and reason of risk prompts, and whether there is a foreign login, a publishing behavior, and the like are performed, and these data are stored in a search base as basic data (including single-dimensional statistics data, user summary data, user basic data, user risk data, and the like) for subsequent data search, account detection, establishment of an associated account, and the like.
For the establishment of the associated accounts, the same type of accounts, such as accounts with the same login time, accounts with the same login location, accounts with the same content, accounts with the same publishing frequency, and the like, can be established by acquiring the attribute information of the accounts, finding the associated primary account from the database according to the attribute information, then acquiring the historical behavior information of the accounts, matching the behavior information, and taking the successfully matched accounts as the associated users.
For the abnormal detection of the current account, the attribute information of the current account is acquired, data search is performed to obtain at least one target account associated with the current account and target behavior information of the target account if the current behavior information of the account is abnormal behavior information, the target behavior information of the target account is acquired, the target behavior information is detected and data filtering is performed, and if the target behavior information is also abnormal behavior information, it can be determined that the current account and the target account are both abnormal accounts; and if the target behavior information is normal behavior information, filtering the target account. And then, the accounts with the abnormal behavior information can be subjected to abnormal processing at the same time, account information of each abnormal account is supplemented and exported, and then data verification is carried out, so that the detection efficiency of the accounts is greatly improved by establishing an association relation between the accounts and simultaneously detecting the associated accounts when one account is abnormal, and the missed detection rate is reduced by an account association mode.
It should be noted that, for simplicity of description, the method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the illustrated order of acts, as some steps may occur in other orders or concurrently in accordance with the embodiments of the present invention. Further, those skilled in the art will appreciate that the embodiments described in the specification are presently preferred and that no particular act is required to implement the invention.
Referring to fig. 4, a block diagram of a structure of an embodiment of the apparatus for detecting account information according to the present invention is shown, and specifically, the apparatus may include the following modules:
a current behavior information obtaining module 401, configured to obtain current behavior information of a current account;
an attribute information obtaining module 402, configured to, when the current behavior information is abnormal behavior information, obtain attribute information for the current account, and determine at least one target account corresponding to the attribute information;
an account number determining module 403, configured to determine the account number of the target account with the abnormal behavior information;
an account exception determining module 404, configured to, when the account number is greater than or equal to a preset threshold, take the current account and the at least one target account as an exception account.
In an optional embodiment of the present invention, further comprising:
the account data acquisition module is used for acquiring account data, and the account data comprises historical behavior information;
the primary account determining module is used for determining a primary account aiming at the current account according to the attribute information;
and the associated account extracting module is used for extracting the associated account associated with the current account from the primary account according to the historical behavior information.
In an optional embodiment of the present invention, the primary account determining module is specifically configured to:
acquiring account service scene information;
determining a primary account of the account service scene information from the database by adopting the attribute information;
the attribute information comprises at least one of equipment identification, communication identification and identity identification; the account service scene information comprises scene information such as account registration, account authentication, account login, account release and the like.
In an optional embodiment of the present invention, the historical behavior information includes first historical behavior information of a current account and second historical behavior information of a primary account, and the associated account extraction module is specifically configured to:
and taking the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs as an associated account associated with the current account.
In an optional embodiment of the present invention, the attribute information obtaining module 402 is specifically configured to:
acquiring attribute information of the current account;
and extracting at least one target account matched with the attribute information from the associated accounts.
For the device embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, refer to the partial description of the method embodiment.
An embodiment of the present invention further provides an electronic device, including:
one or more processors; and
one or more machine-readable media having instructions stored thereon, which when executed by the one or more processors, cause the electronic device to perform methods as described in embodiments of the invention.
Embodiments of the invention also provide one or more machine-readable media having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the methods described in embodiments of the invention.
The embodiments in the present specification are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
Embodiments of the present invention are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing terminal to cause a series of operational steps to be performed on the computer or other programmable terminal to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications of these embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the embodiments of the invention.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or terminal that comprises the element.
The above detailed description is provided for the method and device for detecting account information, and a specific example is applied in this document to explain the principle and implementation of the present invention, and the description of the above embodiment is only used to help understanding the method and core idea of the present invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.
Claims (12)
1. A method for detecting account information is characterized by comprising the following steps:
acquiring current behavior information of a current account;
when the current behavior information is abnormal behavior information, acquiring attribute information of the current account, and determining at least one target account corresponding to the attribute information;
determining the account number of a target account with abnormal behavior information;
and when the account number is greater than or equal to a preset threshold value, taking the current account and the at least one target account as abnormal accounts.
2. The method of claim 1, further comprising:
acquiring account data, wherein the account data comprises historical behavior information;
determining a primary account for the current account according to the attribute information;
and extracting an associated account associated with the current account from the primary account according to the historical behavior information.
3. The method of claim 2, wherein the determining a primary account for a current account according to the attribute information comprises:
acquiring account service scene information;
determining an initial account of the account service scene information by adopting the attribute information;
the attribute information comprises at least one of equipment identification, communication identification and identity identification; the account service scene information comprises scene information such as account registration, account authentication, account login, account release and the like.
4. The method of claim 2, wherein the historical behavior information comprises first historical behavior information of a current account and second historical behavior information of a primary account, and wherein extracting an associated account associated with the current account from the primary account according to the historical behavior information comprises:
and taking the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs as an associated account associated with the current account.
5. The method of claim 2, wherein the obtaining attribute information of the current account and determining a target account corresponding to the attribute information comprises:
acquiring attribute information of the current account;
and extracting at least one target account matched with the attribute information from the associated accounts.
6. An apparatus for detecting account information, comprising:
the current behavior information acquisition module is used for acquiring the current behavior information of the current account;
the attribute information acquisition module is used for acquiring the attribute information of the current account and determining at least one target account corresponding to the attribute information when the current behavior information is abnormal behavior information;
the account number determining module is used for determining the account number of the target account with abnormal behavior information;
and the account abnormity determining module is used for taking the current account and the at least one target account as abnormal accounts when the account number is greater than or equal to a preset threshold value.
7. The apparatus of claim 6, further comprising:
the account data acquisition module is used for acquiring account data, and the account data comprises historical behavior information;
the primary account determining module is used for determining a primary account aiming at the current account according to the attribute information;
and the associated account extracting module is used for extracting the associated account associated with the current account from the primary account according to the historical behavior information.
8. The apparatus of claim 7, wherein the primary account determination module is specifically configured to:
acquiring account service scene information;
determining a primary account of the account service scene information from the database by adopting the attribute information;
the attribute information comprises at least one of equipment identification, communication identification and identity identification; the account service scene information comprises scene information such as account registration, account authentication, account login, account release and the like.
9. The apparatus of claim 7, wherein the historical behavior information comprises first historical behavior information of a current account and second historical behavior information of a primary account, and the associated account extraction module is specifically configured to:
and taking the primary account to which the second historical behavior information successfully matched with the first historical behavior information belongs as an associated account associated with the current account.
10. The apparatus according to claim 6, wherein the attribute information obtaining module is specifically configured to:
acquiring attribute information of the current account;
and extracting at least one target account matched with the attribute information from the associated accounts.
11. An electronic device, comprising:
one or more processors; and
one or more machine-readable media having instructions stored thereon that, when executed by the one or more processors, cause the electronic device to perform the method of any of claims 1-5.
12. One or more machine-readable media having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010562179.5A CN111726359B (en) | 2020-06-18 | 2020-06-18 | Account information detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010562179.5A CN111726359B (en) | 2020-06-18 | 2020-06-18 | Account information detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111726359A true CN111726359A (en) | 2020-09-29 |
| CN111726359B CN111726359B (en) | 2023-04-07 |
Family
ID=72567516
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010562179.5A Active CN111726359B (en) | 2020-06-18 | 2020-06-18 | Account information detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111726359B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112541022A (en) * | 2020-12-18 | 2021-03-23 | 网易（杭州）网络有限公司 | Abnormal object detection method, abnormal object detection device, storage medium and electronic equipment |
| CN112860741A (en) * | 2021-01-18 | 2021-05-28 | 平安科技（深圳）有限公司 | Data sampling detection method, device, equipment and storage medium |
| CN113344062A (en) * | 2021-05-31 | 2021-09-03 | 北京达佳互联信息技术有限公司 | Abnormal account identification method, abnormal account identification device, server and storage medium |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104025094A (en) * | 2011-10-13 | 2014-09-03 | 新人类有限公司 | Apparatus And Method For Detecting Abnormal Account |
| CN107481009A (en) * | 2017-08-28 | 2017-12-15 | 广州虎牙信息科技有限公司 | Identify that live platform supplements the method, apparatus and terminal of user with money extremely |
| CN109727027A (en) * | 2018-06-01 | 2019-05-07 | 平安普惠企业管理有限公司 | Account recognition methods, device, equipment and storage medium |
| CN109740352A (en) * | 2018-12-28 | 2019-05-10 | 微梦创科网络科技（中国）有限公司 | A kind of account processing method, device and electronic equipment |
| CN109858919A (en) * | 2017-11-27 | 2019-06-07 | 阿里巴巴集团控股有限公司 | Determination method and device, online ordering method and the device of abnormal account |
| CN110418173A (en) * | 2019-07-18 | 2019-11-05 | 北京达佳互联信息技术有限公司 | Determine method, apparatus, server and the storage medium of exception account |
| CN110430245A (en) * | 2019-07-17 | 2019-11-08 | 北京达佳互联信息技术有限公司 | A kind of control method, device, equipment and the medium of the identification of exception account |
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
-
2020
- 2020-06-18 CN CN202010562179.5A patent/CN111726359B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104025094A (en) * | 2011-10-13 | 2014-09-03 | 新人类有限公司 | Apparatus And Method For Detecting Abnormal Account |
| CN107481009A (en) * | 2017-08-28 | 2017-12-15 | 广州虎牙信息科技有限公司 | Identify that live platform supplements the method, apparatus and terminal of user with money extremely |
| CN109858919A (en) * | 2017-11-27 | 2019-06-07 | 阿里巴巴集团控股有限公司 | Determination method and device, online ordering method and the device of abnormal account |
| CN109727027A (en) * | 2018-06-01 | 2019-05-07 | 平安普惠企业管理有限公司 | Account recognition methods, device, equipment and storage medium |
| CN109740352A (en) * | 2018-12-28 | 2019-05-10 | 微梦创科网络科技（中国）有限公司 | A kind of account processing method, device and electronic equipment |
| CN110430245A (en) * | 2019-07-17 | 2019-11-08 | 北京达佳互联信息技术有限公司 | A kind of control method, device, equipment and the medium of the identification of exception account |
| CN110418173A (en) * | 2019-07-18 | 2019-11-05 | 北京达佳互联信息技术有限公司 | Determine method, apparatus, server and the storage medium of exception account |
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112541022A (en) * | 2020-12-18 | 2021-03-23 | 网易（杭州）网络有限公司 | Abnormal object detection method, abnormal object detection device, storage medium and electronic equipment |
| CN112860741A (en) * | 2021-01-18 | 2021-05-28 | 平安科技（深圳）有限公司 | Data sampling detection method, device, equipment and storage medium |
| CN113344062A (en) * | 2021-05-31 | 2021-09-03 | 北京达佳互联信息技术有限公司 | Abnormal account identification method, abnormal account identification device, server and storage medium |
| CN113344062B (en) * | 2021-05-31 | 2024-03-22 | 北京达佳互联信息技术有限公司 | Abnormal account identification method, device, server and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111726359B (en) | 2023-04-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108989150B (en) | Login abnormity detection method and device | |
| CN109951500B (en) | Network attack detection method and device | |
| CN111726359B (en) | Account information detection method and device | |
| WO2016192495A1 (en) | Account theft risk identification method, identification apparatus, and prevention and control system | |
| CN108881265B (en) | Network attack detection method and system based on artificial intelligence | |
| CN105791255B (en) | Computer risk identification method and system based on account clustering | |
| CN108881263B (en) | Network attack result detection method and system | |
| CN108683687B (en) | Network attack identification method and system | |
| CN107273833B (en) | Method for monitoring floating population and system thereof | |
| CN109063969B (en) | Account risk assessment method and device | |
| CN107798541B (en) | Monitoring method and system for online service | |
| CN107819747B (en) | Telecommunication fraud association analysis system and method based on communication event sequence | |
| CN110852148B (en) | Visitor destination verification method and system based on target tracking | |
| CN111865925A (en) | Network traffic based fraud group identification method, controller and medium | |
| CN112733045B (en) | User behavior analysis method and device and electronic equipment | |
| CN108449349B (en) | Method and device for preventing malicious domain name attack | |
| CN114389871A (en) | Automatic analysis method and device for abnormal login of account | |
| CN111353138A (en) | Abnormal user identification method and device, electronic equipment and storage medium | |
| CN113572757A (en) | Server access risk monitoring method and device | |
| CN109428804B (en) | Account management method and device | |
| CN111818025A (en) | User terminal detection method and device | |
| CN110516170B (en) | Method and device for checking abnormal web access | |
| CN113535823B (en) | Abnormal access behavior detection method and device and electronic equipment | |
| CN113032764A (en) | Account registration login service wind control system and service wind control method | |
| CN112153222A (en) | Harassment number identification method and server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |