CN108295476B - Method and device for determining abnormal interaction account - Google Patents
Method and device for determining abnormal interaction account Download PDFInfo
- Publication number
- CN108295476B CN108295476B CN201810182329.2A CN201810182329A CN108295476B CN 108295476 B CN108295476 B CN 108295476B CN 201810182329 A CN201810182329 A CN 201810182329A CN 108295476 B CN108295476 B CN 108295476B
- Authority
- CN
- China
- Prior art keywords
- interaction
- account
- accounts
- group
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000003993 interaction Effects 0.000 title claims abstract description 236
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 93
- 238000000034 method Methods 0.000 title claims abstract description 56
- 230000002452 interceptive effect Effects 0.000 claims abstract description 85
- 230000002547 anomalous effect Effects 0.000 claims description 13
- 238000003860 storage Methods 0.000 claims description 12
- 238000012216 screening Methods 0.000 claims description 11
- 238000004458 analytical method Methods 0.000 claims description 9
- 238000000638 solvent extraction Methods 0.000 claims 1
- 238000010586 diagram Methods 0.000 description 13
- 238000004891 communication Methods 0.000 description 9
- 238000004364 calculation method Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 230000002776 aggregation Effects 0.000 description 4
- 230000000694 effects Effects 0.000 description 4
- 230000005856 abnormality Effects 0.000 description 3
- 238000004220 aggregation Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000001914 filtration Methods 0.000 description 3
- 238000009825 accumulation Methods 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000001680 brushing effect Effects 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 238000005520 cutting process Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000004900 laundering Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Images
Classifications
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/70—Game security or game management aspects
- A63F13/75—Enforcing rules, e.g. detecting foul play or generating lists of cheating players
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/70—Game security or game management aspects
- A63F13/79—Game security or game management aspects involving player-related data, e.g. identities, accounts, preferences or play histories
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
- A63F2300/50—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers
- A63F2300/53—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers details of basic data processing
- A63F2300/535—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers details of basic data processing for monitoring, e.g. of user parameters, terminal parameters, application parameters, network parameters
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
- A63F2300/50—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers
- A63F2300/55—Details of game data or player data management
- A63F2300/5586—Details of game data or player data management for enforcing rights or rules, e.g. to prevent foul play
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Multimedia (AREA)
- General Business, Economics & Management (AREA)
- Computer Security & Cryptography (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Economics (AREA)
- Development Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a method and a device for determining an abnormal interaction account. Wherein, the method comprises the following steps: acquiring interaction data among a plurality of accounts; determining an interactive network of the plurality of accounts and at least one key account in the interactive network based on the interaction data; determining at least one interaction group in the interaction network that contains a key account; and determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account. The invention solves the technical problem that the result accuracy is low because the account with abnormal interaction is determined only according to the number of the interactive contents between the accounts in the prior art.
Description
Technical Field
The invention relates to the field of computer internet, in particular to a method and a device for determining an abnormal interaction account.
Background
In the economic field of real society, there are economic crime acts including money laundering and the like. On the internet, a user can perform actions such as order brushing and water filling by registering a plurality of accounts, and the order of the internet is seriously influenced. Taking a game as an example, a network game is a virtual micro-society, and players have various connections. Various financial methods can be used for the economic system in the game, and the wealth in the game is accumulated in an abnormal mode, so that the fairness of the game and the balance of the economic system are seriously influenced. In the virtual world of the game, sometimes, some unpredictable economic bugs exist, and generally, the bugs cannot be directly perceived by people. Generally, the transactions between characters are approximately fair, the amount of money each character can obtain through the transactions is relatively balanced, and the amount of game money that can be accumulated by a single character is always relatively limited. However, some malicious arbitrage players exist in the game, and the players can operate a plurality of characters simultaneously and then aggregate game wealth to realize profit. At present, the most typical way for rapidly accumulating wealth in a game is to register a plurality of accounts, then carry out cooperative battles, collect the game coins in the accounts into one or a small number of accounts, and rapidly complete the accumulation of wealth in the game. The unusual allocation of game credits can have a significant impact on the economic systems of the game. Such abnormal players must involve a transaction link to complete the gathering of game credits. Abnormal players can be found in time by monitoring the transaction network; meanwhile, the behaviors of the transaction related parties are researched, more valuable information can be obtained, system bugs can be found in an assisted mode, and game balance is maintained.
At present, the discovery of abnormal players in the prior art is based on the discovery of abnormal transactions, and abnormal transactions are discovered through a large transaction filtering mode or a suspicious transaction filtering mode. Specifically, transaction information in the game is directly counted, a transaction limit is used as a screening standard, and a transaction log is extracted and then distinguished. Because the transactions in the game are very different, if the transactions are filtered only from the limit, the limit is large, and a lot of real abnormal transaction information can be lost; when the amount is small, a huge amount of transaction data is generated, and thus it is difficult to obtain effective information. Meanwhile, the abnormal transactions and the normal transactions are not distinguished exactly on the limit, and the filtered suspected abnormal transactions have insufficient argument to support the judgment of the abnormality, so that the corresponding abnormal players also have insufficient credibility. Meanwhile, in the case of group cheating, the transaction data of a certain game role is observed independently, any abnormality cannot be found generally, and the transaction data of a single role cannot reflect the wealth distribution of the whole group game.
Aiming at the problem that the result accuracy is low when the prior art determines the account with abnormal interaction only according to the number of the interactive contents between the accounts, an effective solution is not provided at present.
Disclosure of Invention
The embodiment of the invention provides a method and a device for determining an abnormal interaction account, which are used for solving the technical problem that the result accuracy is low because the account with abnormal interaction is determined only according to the number of interaction contents between accounts in the prior art.
According to an aspect of the embodiments of the present invention, there is provided a method for determining an abnormal interaction account, including: acquiring interaction data among a plurality of accounts; determining an interactive network of the plurality of accounts and at least one key account in the interactive network based on the interaction data; determining at least one interaction group in the interaction network that contains a key account; and determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account.
Further, determining an interaction network of the plurality of accounts and at least one key account in the interaction network based on the interaction data, comprising: based on the interaction data, each account is taken as a node, and interaction information among the accounts is taken as an edge, so that an interaction network of a plurality of accounts is generated; dividing an interactive network into a plurality of connected graphs; and acquiring a central node of each connected graph, wherein an account corresponding to the central node is a key account.
Further, dividing the interactive network into a plurality of connectivity graphs, including: traversing each node in the interactive network to obtain all connected graphs; and screening out a plurality of connected graphs meeting preset conditions based on the number of nodes contained in each connected graph.
Further, screening out a plurality of connected graphs meeting preset conditions based on the number of nodes contained in each connected graph, and the screening comprises the following steps: deleting the connected graph with the number of nodes smaller than a first threshold value; based on a modularity algorithm, segmenting the connected graphs of which the number of nodes is greater than a second threshold value until the number of nodes of each connected graph is less than or equal to the second threshold value; and taking the connected graphs with the node number being more than or equal to the first threshold value and less than or equal to the second threshold value as a plurality of connected graphs meeting preset conditions.
Further, acquiring the central node of each connected graph includes: determining a central node of each connected graph based on at least one of the following node attributes of each connected graph: the accumulated interaction amount of each node, the degree of dependence of each node on other nodes, and the propagation influence degree of each node.
Further, determining at least one interaction group in the interaction network that contains a key account includes: acquiring a preset depth, wherein the preset depth is used for determining the size of an interactive group; and traversing according to a preset depth to obtain at least one interactive group containing the key account in the interactive network.
Further, determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group comprises the following steps: analyzing the characteristic information of each interactive group according to the sequence of the preset priority; and determining whether each interaction group is a group with abnormal interaction or not according to the analysis result.
Further, the characteristic information includes at least one of: the method comprises the steps of obtaining similarity between accounts in an interactive group, Internet Protocol (IP) information used by the accounts in the interactive group, role information corresponding to each account in the interactive group, and interactive information between accounts corresponding to other nodes in the interactive group and accounts corresponding to a central node.
Further, acquiring interaction data between a plurality of accounts comprises: acquiring log data of a plurality of accounts; extracting interaction data among the plurality of accounts based on log data of the plurality of accounts, wherein the interaction data comprises at least one of the following data: account information of each account, attribute information of each account, interaction time between accounts, and interaction content between accounts.
According to another aspect of the embodiments of the present invention, there is also provided an apparatus for determining an account with abnormal interaction, including: the acquisition unit is used for acquiring interactive data among a plurality of accounts; the first determining unit is used for determining an interactive network of a plurality of accounts and at least one key account in the interactive network based on the interactive data; the second determining unit is used for determining at least one interactive group containing the key account in the interactive network; and the third determining unit is used for determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account.
According to another aspect of the embodiments of the present invention, there is further provided a storage medium, where the storage medium includes a stored program, and when the program runs, the apparatus on which the storage medium is located is controlled to execute any one of the optional or preferred methods for determining an account with abnormal interaction in the foregoing method embodiments.
According to another aspect of the embodiments of the present invention, there is further provided a processor, configured to execute the program, where the program executes any one of the optional or preferred methods for determining an account for abnormal interaction in the above method embodiments.
According to another aspect of the embodiments of the present invention, there is also provided a terminal, including: one or more processors, memory, a display device, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for performing any one of the optional or preferred methods of determining an account for anomalous interaction in the above method embodiments.
In the embodiment of the invention, the interaction data among a plurality of accounts is acquired; determining an interactive network of the plurality of accounts and at least one key account in the interactive network based on the interaction data; determining at least one interaction group in the interaction network that contains a key account; the method comprises the steps of determining whether an interaction group is an abnormal interaction group or not based on characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account, and the purpose of determining the abnormal interaction account according to group interaction characteristics is achieved, so that the technical effect of positioning the accuracy of the abnormal interaction account is achieved, and the technical problem that in the prior art, the result accuracy is low due to the fact that the account with abnormal interaction is determined only according to the number of interaction contents between accounts is solved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:
FIG. 1 is a flow diagram of a method of determining an anomalous interaction account in accordance with an embodiment of the present invention;
FIG. 2 is a flow diagram of an alternative method of determining an account for anomalous interactions in accordance with an embodiment of the present invention;
FIG. 3 is a flow diagram of an alternative method of determining an account for anomalous interactions in accordance with an embodiment of the present invention;
FIG. 4 is a flow diagram of an alternative method of determining an account for anomalous interactions in accordance with an embodiment of the present invention;
FIG. 5 is a schematic diagram of an alternative connectivity graph with a large number of nodes, according to an embodiment of the invention;
FIG. 6 is a schematic diagram of an alternative connectivity graph after segmentation of a connectivity graph with a large number of nodes based on a modularity algorithm according to an embodiment of the present invention;
FIG. 7 is a schematic diagram illustrating an alternative independent connectivity graph according to an embodiment of the present invention;
FIG. 8 is a flow diagram of an alternative method of determining an account for anomalous interactions in accordance with an embodiment of the present invention;
FIG. 9 is a flowchart of an alternative method of determining an account for anomalous interactions, according to an embodiment of the present invention;
FIG. 10 is a flow diagram of a method for determining abnormal players in a preferred game, according to an embodiment of the present invention; and
fig. 11 is a schematic diagram of an apparatus for determining an account of abnormal interaction according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
In accordance with an embodiment of the present invention, there is provided an embodiment of a method for determining anomalous interaction accounts, it being noted that the steps illustrated in the flowchart of the figure may be performed in a computer system, such as a set of computer-executable instructions, and that while a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order different than here.
Fig. 1 is a flowchart of a method for determining an account with abnormal interaction according to an embodiment of the present invention, as shown in fig. 1, the method includes the following steps:
step S102, acquiring interaction data among a plurality of accounts.
Specifically, the account may be, but is not limited to, an account of any internet application, for example, a QQ account; the interaction data may be data generated by interaction of multiple accounts, including but not limited to specific content of the interaction and behavior data of the interaction, for example, chat content between QQ users, access information, and the like.
As an alternative embodiment, the present application takes a game as an example for illustration. In a game, players generally register a plurality of game accounts to earn virtual money in order to accumulate value of money, and collect the virtual money earned on the plurality of game accounts on a certain character or characters. Due to the fact that the randomness of transactions among game characters is large, abnormal transactions acquired in a pure rule mode are coarse in granularity and analyzed in an isolated mode, the relevance of the abnormal transactions is not fully utilized, and identified abnormal players lack enough logic support. According to the method and the device, abnormal economic flow is identified through group transaction characteristics among game characters, and then abnormal players are identified.
Step S104, determining an interactive network of a plurality of accounts and at least one key account in the interactive network based on the interactive data.
Specifically, the interaction network may be a network for characterizing an interaction relationship among a plurality of accounts, and optionally, transaction data between game characters may be organized in a graph manner, transaction data between characters may be organized in a graph form, transaction data in a game may be represented as a transaction network by taking game characters (accounts) as nodes and transactions (interaction data) between game characters as edges, and then the graph may be calculated to obtain a central node (key character) in the transaction network, so as to identify an abnormal player in combination with adjacent node information of the central node.
Step S106, at least one interactive group containing key accounts in the interactive network is determined.
Specifically, the interaction group is a small transaction network with key accounts as a central node in the whole transaction network, and after at least one key account in the interaction network is determined, at least one interaction group containing a key account in the transaction network may be determined, for example, an interaction group with each key user as a central node and having an interaction relationship.
And S108, determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account.
It should be noted that, in the prior art, the transaction amount of a single transaction is relied on to determine whether an abnormal transaction exists, for example, two transaction parties with transaction amounts exceeding a certain amount are determined as abnormal players, such a single role transaction cannot reflect the wealth allocation of a group game, for example, in the case of group cheating, it is difficult to find any abnormality by separately observing the transaction data of a certain game role. In addition, the definition of the filtering condition of the transaction amount also affects the accuracy of the determined abnormal player, for example, if the amount is large, many real abnormal transaction information can be lost; when the amount is small, a huge amount of transaction data is generated, and thus it is difficult to obtain effective information.
After determining at least one key account in the transaction network, determining at least one interaction group containing the key account in the interaction network (for example, an interaction group centered on each key account), analyzing group characteristic information of each interaction group (including but not limited to transaction amount between accounts, frequency of interaction between accounts, and whether a plurality of accounts interact with one account group) and determining whether each interaction group is an abnormal interaction group.
As can be seen from the above, in the above embodiments of the present application, after the interaction data between the multiple accounts to be analyzed is obtained, constructing an interaction network among the plurality of accounts according to the interaction data among the plurality of accounts, determining one or more key accounts in the transaction network by analyzing the interaction data among the accounts, then, taking each key account as a central node, determining at least one interactive group in the interactive network, analyzing the characteristic information of each interactive group to determine whether each interactive group is an abnormal interactive group, so as to determine the abnormal interaction account, and achieve the purpose of determining the abnormal interaction account according to the group interaction characteristic, thereby realizing the technical effect of positioning the accuracy of the abnormal interaction account, and the technical problem that the result accuracy is low because the account with abnormal interaction is determined only according to the number of the interactive contents between the accounts in the prior art is solved.
In an alternative embodiment, as shown in fig. 2, determining an interactive network of a plurality of accounts and at least one key account in the interactive network based on the interaction data may include the steps of:
step S202, based on the interactive data, each account is taken as a node, and the interactive information among the accounts is taken as a side to generate an interactive network of a plurality of accounts;
step S204, dividing the interactive network into a plurality of connected graphs;
step S206, obtaining a central node of each connected graph, wherein an account corresponding to the central node is a key account.
Specifically, after the interaction data among the multiple accounts is obtained, an interactive network with multiple account interactions may be established with the accounts as nodes and the interaction information among the accounts as sides, connectivity of the interactive network is divided to obtain multiple connectivity graphs, and a center node of each connectivity graph is obtained, where an account corresponding to the center node is a key account.
Taking a game as an example, a transaction network is generated with the ID of each game character as a node and each transaction as an edge. The edge recording mode has two types: (1) each transaction forms a separate edge. Namely, the role A and the role B are traded, two sides of 'A- > B' and 'B- > A' are formed in each trade, and the attributes of the sides are the game coins which are paid out correspondingly; (2) the edges of the transaction information are accumulated. And accumulating the transaction between the role A and the role B, and only forming two sides of 'A- > B' and 'B- > A', wherein the attributes of the sides are the accumulated transaction times and the accumulated paid-out game coins.
It should be noted that, when performing connectivity division on an interactive network, strong connectivity division may be performed, or weak connectivity division may be performed, and optionally, the present application performs weak connectivity division on a transaction network, that is, does not distinguish directions of edges.
Optionally, as an optional implementation manner, when the central node of each connected graph is obtained, the central node of each connected graph may be determined based on at least one of the following node attributes of each connected graph: the accumulated interaction amount of each node, the degree of dependence of each node on other nodes, and the propagation influence degree of each node.
Taking a game as an example, after a transaction network of a plurality of game accounts is obtained according to interaction data among the plurality of game accounts, and a plurality of connected graphs are obtained by traversing the transaction network, a central node of each connected graph, namely an important game role is calculated, and the following methods can be used:
(1) a token aggregation center. The aggregate value is defined as follows:
the aggregate value is the sum of all in-degree and all out-degree coins
And calculating the aggregation value of each node, and acquiring N accounts with the maximum aggregation value, namely N roles with the maximum accumulated game coins.
(2) Proximity centricity (Closeness center). And regarding the connected graph as an undirected graph, calculating the sum of the shortest paths from a certain node to all other nodes, wherein the weight of each edge is 1. The path and the smallest N nodes, i.e., the N roles that have the lowest dependency on other roles in the transaction, are obtained.
(3) Medium Centrality (short-path Betweenness centre). And (4) regarding the connected graph as an undirected graph, and calculating the times of a certain node on the shortest path among all nodes. And acquiring N roles which have the largest influence on the transaction propagation of the whole transaction network.
Based on the foregoing embodiment, in an optional implementation manner, as shown in fig. 3, dividing the interaction network into a plurality of connectivity graphs may include the following steps:
step S302, traversing each node in the interactive network to obtain all connected graphs;
and step S304, screening out a plurality of connected graphs meeting preset conditions based on the number of nodes contained in each connected graph.
Specifically, after traversing all nodes in the transaction network, a plurality of connected graphs with different sizes are formed. A connectivity graph with too small a number of nodes cannot accumulate enough interaction data (e.g., gamepieces in a game transaction); the connected graph information with too large number of nodes is too messy to be suitable for further analysis. Therefore, based on the above embodiment, after traversing each node in the interactive network to obtain all connected graphs, a plurality of connected graphs meeting the preset condition can be screened out based on the number of nodes included in each connected graph.
Optionally, as an optional implementation manner, as shown in fig. 4, screening out a plurality of connected graphs meeting a preset condition based on the number of nodes included in each connected graph may include the following:
step S402, deleting the connected graph with the number of nodes smaller than a first threshold value;
step S404, based on the modularity algorithm, segmenting the connected graphs of which the number of nodes is greater than a second threshold value until the number of nodes of each connected graph is less than or equal to the second threshold value;
step S406, regarding the connected graphs with the node number greater than or equal to the first threshold and less than or equal to the second threshold as a plurality of connected graphs meeting the preset condition.
Specifically, in the above-described embodiment, the first threshold value may be a lower limit value (k _ min) of the number of nodes in the connected graph, and the second threshold value (k _ max) may be an upper limit value of the number of nodes in the connected graph. After the transaction network is subjected to communication division to obtain a plurality of communication graphs, the communication graphs with the node number smaller than the lower limit value (first threshold value) can be filtered, and the communication graphs with the node number larger than the upper limit value (second threshold value) can be further segmented.
For example, after the weak connection graph division is performed on the transaction network to obtain all the weak connection graphs, the lower limit k _ min of the node number can be specified, and the connection graphs with the node number smaller than k _ min are filtered; and (3) specifying an upper limit k _ max of the number of nodes, and performing the operation of the step (S404) on the connected graph with the number of nodes larger than the number of nodes, and if the number of nodes is within the interval of [ k _ min, k _ max ], calculating the central node of the connected graph.
For a connected graph with a large number of nodes, when determining the nodes of the key account, very large computing resources are consumed. Because the abnormal interaction account is generally a node with larger transaction benefit, the whole connected graph can be divided into a plurality of small-scale transaction groups with balanced mutual benefits on the premise of keeping the characteristics of the basic center unchanged, and therefore the calculation complexity is greatly reduced.
Still taking a game as an example, fig. 5 is a schematic diagram of an optional connected graph with a large number of nodes according to an embodiment of the present invention, as shown in fig. 5, information of the connected graph with an excessively large number of nodes is too messy, and a large amount of computing resources are consumed when determining a central node, so that after the connected graph with the large number of nodes is segmented based on a modularity algorithm, the connected graph with the small number of nodes as shown in fig. 6 can be obtained, and when determining a central node in connectivity, the computation amount of the connected graph shown in fig. 6 is greatly reduced compared with that of the connected graph shown in fig. 5. Alternatively, FIG. 7 shows an alternative diagram of independent connectivity graph according to an embodiment of the present invention, where the abnormal player characteristics are evident as shown in FIG. 7.
It can be seen that the calculation amount for determining the central node of the connected graph can be greatly reduced by segmenting the connected graph by using the algorithm based on the modularity. The algorithm based on the modularity is typically the Louvain algorithm. When the luvain algorithm is used for the connectivity graph division, the weight of the edge needs to be specified to calculate the modularity (modeling) of the community, and for example, the weight here may use the absolute value of the transaction difference between game accounts, for example, the absolute value of the transaction difference of the accumulated tokens of the game role a and the game role B:
gaming token-SIGMA outputted from Weight (A, B) ═ SIGMA to B and gaming token outputted from SIGMA to A
After determining the key account in the transaction network, as an alternative embodiment based on any one of the above alternative embodiments, as shown in fig. 8, determining at least one interaction group in the interaction network that includes the key user may include:
step S802, traversing according to a preset depth to obtain at least one interactive group containing a key account in the interactive network, wherein the preset depth is used for determining the size of the interactive group.
Specifically, as an alternative implementation, a breadth-first traversal may be performed with a specified Depth from a key user, and a small and centralized trading network may be obtained. The centrality of the node is typically significant at depths between 3 and 6. And if other central nodes are included in the range of the designated Depth Depth, taking the network intersection of the central nodes.
After at least one interaction group is determined based on the determined key account in the transaction network, whether the interaction group is an abnormal interaction group or not is judged by combining the role information of each node in the interaction group network. Specifically, as an alternative embodiment, as shown in fig. 9, determining whether the interaction group is an abnormal interaction group based on the feature information of the interaction group includes:
step S902, analyzing the characteristic information of each interactive group according to the sequence of the preset priority;
and step S904, determining whether each interactive group is an abnormal interactive group according to the analysis result.
Specifically, the feature information of each interactive group includes, but is not limited to, at least one of the following: the method comprises the steps of obtaining similarity between accounts in an interactive group, Internet Protocol (IP) information used by the accounts in the interactive group, role information corresponding to each account in the interactive group, and interactive information between accounts corresponding to other nodes in the interactive group and accounts corresponding to a central node.
Taking a game as an example, the common feature information includes but is not limited to at least one of the following: (1) the accumulated value of the game currency has a relatively obvious aggregation effect, namely, a plurality of characters in a group transmit game wealth to a central character; (2) in the group, the similarity of the account mailbox names of the players is higher; (3) the IP overlap in the population is high, i.e. the number of IPs/number of roles is usually small; (4) the character occupation distribution characteristics in the group, such as a plurality of characters which are low in grade and easy to form groups to refresh money occupation, correspond to a high-grade character.
As an alternative implementation, the priority of analyzing each interaction group may be: the first priority is the intersection of the central nodes obtained by the calculation of the various centralities; the second priority is the node corresponding to the calculation of the game piece gathering center, and the third priority is the node corresponding to the adjacent center degree and the middle center degree. In an actual application scene, the most suspicious nodes are processed preferentially, and the central nodes corresponding to the first priority can be distinguished in time within the time limit of the requirement; the central nodes corresponding to the latter two priorities are processed in turn as appropriate according to time and processing capacity.
Based on any one of the above optional embodiments, in an optional embodiment, the acquiring interaction data between multiple accounts may include:
acquiring log data of a plurality of accounts;
step two, extracting interaction data among the plurality of accounts based on log data of the plurality of accounts, wherein the interaction data comprises at least one of the following data: account information of each account, attribute information of each account, interaction time between accounts, and interaction content between accounts.
Still taking the game as an example, after the original log data is obtained, the original log can be cleaned, extracted and converted. For example, extracting a transaction log (including but not limited to the ID of the game characters of both parties to the transaction, the transaction time, the transaction amount, etc.); extracting basic information of the character (including but not limited to game character ID, character account number, character level, character occupation, recharging condition, online time, game currency quantity and the like). Optionally, if the main tradable item in the game can be approximately evaluated through a recent transaction record, counting the recent transaction record to obtain a reference price of the item, and converting the item in the transaction of the game currency-item type into a game currency evaluation value; if the value cannot be estimated approximately (such as the same prop, different attributes and particularly large spread), all transactions only keep one-way information of the game currency transaction, and ignore the flow of the prop.
As a preferred embodiment, FIG. 10 is a flow chart of a method for determining abnormal players in a preferred game according to an embodiment of the present invention, including the steps of:
(1) cleaning, extracting and converting the original log to obtain transaction data among game roles and basic information of each game player (role);
(2) generating a trading network between a plurality of game characters based on trading data between the game characters;
(3) and carrying out weak communication graph division on the transaction network to form a plurality of communication subgraphs. The directions of the edges are not distinguished, and all the weak communication graphs are obtained.
(4) And for the connected graph with a larger number of nodes, cutting the connected graph into a plurality of sub-graphs with smaller scale by using an algorithm based on modularity.
(5) For each connected graph, the central node of the connected graph, namely the important game role, is calculated.
(6) And taking the key game role as a starting point, acquiring a transaction network with a specified depth, and acquiring a small group of abnormal players.
(7) Whether the group is an abnormal trading group is judged based on the economic circulation condition of the small centralized trading network and the basic information of each player.
Through the scheme disclosed by the embodiment of the application, the transaction information is organized in a graph mode, the overall network is subjected to centrality analysis, abnormal values are found from relative attributes, and uncertainty in pure transaction analysis is avoided. And the bigger connected graph is segmented by using the algorithm based on the modularity, so that the calculation amount of the central point obtained in the fifth step can be greatly reduced under the condition of keeping the central characteristics of the trading group unchanged. Starting from the player character interaction information in the game, a plurality of independent small groups are divided according to the mutual interaction degree. And aiming at each group, positioning the central player in each group, and performing key analysis on the key characters. The method can be expanded to obtain a plurality of types of key data, for example, by taking game wealth accumulation as an edge, abnormal players suspected of cheating can be obtained; by using the chat information as a side, highly active players and the like having a large number of chats in the game can be acquired.
According to an embodiment of the present invention, an apparatus embodiment for implementing the method for determining an account with abnormal interaction described above is further provided, fig. 11 is a schematic diagram of an apparatus for determining an account with abnormal interaction according to an embodiment of the present invention, as shown in fig. 11, the apparatus includes: an acquisition unit 111, a first determination unit 113, a second determination unit 115, and a third determination unit 117.
The obtaining unit 111 is configured to obtain interaction data between multiple accounts;
a first determining unit 113, configured to determine, based on the interaction data, an interaction network of the plurality of accounts and at least one key account in the interaction network;
a second determining unit 115, configured to determine at least one interaction group containing a key account in the interaction network;
a third determining unit 117, configured to determine, based on the feature information of the interaction group, whether the interaction group is a group of abnormal interactions, where the group of abnormal interactions includes an abnormal interaction account.
It should be noted here that the above-mentioned obtaining unit 111, the first determining unit 113, the second determining unit 115, and the third determining unit 117 correspond to steps S102 to S108 in the method embodiment, and the above-mentioned modules are the same as examples and application scenarios implemented by the corresponding steps, but are not limited to what is disclosed in the above-mentioned method embodiment. It should be noted that the modules described above as part of an apparatus may be implemented in a computer system such as a set of computer-executable instructions.
As can be seen from the above, in the above embodiment of the present application, after the obtaining unit 111 obtains the interaction data between the multiple accounts to be analyzed, the first determining unit 113 constructs an interaction network between the multiple accounts according to the interaction data between the multiple accounts, and analyzes the interaction data between the accounts to determine one or more key accounts in the transaction network, and then the second determining unit 115 determines at least one interaction group including the key accounts in the interaction network with each key account as a central node, and analyzes the feature information of each interaction group through the third determining unit 117 to determine whether each interaction group is an abnormal interaction group, so as to determine the abnormal interaction account, thereby achieving the purpose of determining the abnormal interaction account according to the group-specific interaction characteristics, and thus achieving the technical effect of locating the accuracy of the abnormal interaction account, and the technical problem that the result accuracy is low because the account with abnormal interaction is determined only according to the number of the interactive contents between the accounts in the prior art is solved.
In an alternative embodiment, the first determining unit may include: the generation module is used for generating an interactive network of a plurality of accounts by taking each account as a node and taking the interactive information among the accounts as an edge based on the interactive data; the dividing module is used for dividing the interactive network into a plurality of connected graphs; the first acquisition module is used for acquiring the central node of each connected graph, wherein the account corresponding to the central node is a key account.
In an optional embodiment, the dividing module may include: the traversal module is used for traversing each node in the interactive network to obtain all connected graphs; and the screening module is used for screening out a plurality of connected graphs meeting the preset conditions based on the number of nodes contained in each connected graph.
In an optional embodiment, the screening module includes: the deleting module is used for deleting the connected graph of which the node number is less than a first threshold value; the first processing module is used for segmenting the connected graphs of which the number of the nodes is larger than a second threshold value based on a modularity algorithm until the number of the nodes of each connected graph is smaller than or equal to the second threshold value; and the second processing module is used for taking the connected graphs of which the node number is greater than or equal to the first threshold value and is less than or equal to the second threshold value as a plurality of connected graphs meeting the preset condition.
In an optional embodiment, the obtaining module includes: a first determining module, configured to determine a central node of each connected graph based on at least one node attribute of each connected graph as follows: the accumulated interaction amount of each node, the degree of dependence of each node on other nodes, and the propagation influence degree of each node.
In an optional embodiment, the second determining unit includes: and the third processing module is used for traversing according to a preset depth to obtain at least one interactive group containing the key account in the interactive network, wherein the preset depth is used for determining the size of the interactive group.
In an optional embodiment, the third determining unit includes: the analysis module is used for analyzing the characteristic information of each interactive group according to the sequence of the preset priority; and the second determining module is used for determining whether each interactive group is an abnormal interactive group according to the analysis result.
In an optional embodiment, the characteristic information includes at least one of: the method comprises the steps of obtaining similarity between accounts in an interactive group, Internet Protocol (IP) information used by the accounts in the interactive group, role information corresponding to each account in the interactive group, and interactive information between accounts corresponding to other nodes in the interactive group and accounts corresponding to a central node.
In an optional embodiment, the obtaining unit includes: the second acquisition module is used for acquiring log data of a plurality of accounts; the extraction module is used for extracting interaction data among the plurality of accounts based on log data of the plurality of accounts, wherein the interaction data comprises at least one of the following data: account information of each account, attribute information of each account, interaction time between accounts, and interaction content between accounts.
According to an embodiment of the present invention, there is further provided a storage medium, where the storage medium includes a stored program, where when the program runs, the device on which the storage medium is located is controlled to execute any one of the optional or preferred methods for determining an account with abnormal interaction in the foregoing method embodiments.
According to an embodiment of the present invention, there is further provided a processor, where the processor is configured to execute a program, where the program executes any one of the optional or preferred methods for determining an account for abnormal interaction in the foregoing method embodiments.
According to an embodiment of the present invention, there is also provided a terminal including: one or more processors, memory, a display device, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for performing any one of the optional or preferred methods of determining an account for anomalous interaction in the above method embodiments.
The above-mentioned apparatus may comprise a processor and a memory, and the above-mentioned units may be stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement the corresponding functions.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The order of the embodiments of the present application described above does not represent the merits of the embodiments.
In the above embodiments of the present application, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments. In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways.
The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
The foregoing is only a preferred embodiment of the present application and it should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present application, and these improvements and modifications should also be considered as the protection scope of the present application.
Claims (11)
1. A method of determining an anomalous interaction account, comprising:
acquiring interaction data among a plurality of accounts;
determining, based on the interaction data, an interaction network of the plurality of accounts and at least one key account in the interaction network;
determining at least one interaction group in the interaction network that contains the key account;
determining whether the interaction group is an abnormal interaction group or not based on the characteristic information of the interaction group, wherein the abnormal interaction group comprises an abnormal interaction account;
determining, based on the interaction data, an interaction network of the plurality of accounts and at least one key account in the interaction network, including: based on the interaction data, each account is taken as a node, and interaction information among the accounts is taken as an edge, so that an interaction network of the accounts is generated; dividing the interactive network into a plurality of connected graphs; acquiring a central node of each connected graph, wherein an account corresponding to the central node is a key account;
the characteristic information includes at least one of: the similarity between the accounts in the interaction group, the Internet Protocol (IP) information used by the accounts in the interaction group, the role information corresponding to each account in the interaction group, and the interaction information between the accounts corresponding to other nodes in the interaction group and the account corresponding to the central node.
2. The method of claim 1, wherein partitioning the interaction network into a plurality of connectivity graphs comprises:
traversing each node in the interactive network to obtain all connected graphs;
and screening out a plurality of connected graphs meeting preset conditions based on the number of nodes contained in each connected graph.
3. The method of claim 2, wherein screening out a plurality of connected graphs meeting a preset condition based on the number of nodes contained in each connected graph comprises:
deleting the connected graph with the number of nodes smaller than a first threshold value;
based on a modularity algorithm, segmenting the connected graphs of which the number of nodes is greater than a second threshold value until the number of nodes of each connected graph is less than or equal to the second threshold value;
and taking the connected graphs with the node number being more than or equal to the first threshold value and less than or equal to the second threshold value as a plurality of connected graphs meeting the preset condition.
4. The method of claim 1, wherein obtaining the central node of each connectivity graph comprises:
determining a central node of each connected graph based on at least one of the following node attributes of each connected graph: the accumulated interaction amount of each node, the degree of dependence of each node on other nodes, and the propagation influence degree of each node.
5. The method of claim 1, wherein determining at least one interaction group in the interaction network that contains the key account comprises:
and traversing according to a preset depth to obtain at least one interactive group containing the key account in the interactive network, wherein the preset depth is used for determining the size of the interactive group.
6. The method of claim 1, wherein determining whether the interaction population is a population of abnormal interactions based on the feature information of the interaction population comprises:
analyzing the characteristic information of each interactive group according to the sequence of the preset priority;
and determining whether each interaction group is a group with abnormal interaction or not according to the analysis result.
7. The method of claim 1, wherein obtaining interaction data between a plurality of accounts comprises:
acquiring log data of the plurality of accounts;
extracting interaction data among the plurality of accounts based on the log data of the plurality of accounts, wherein the interaction data comprises at least one of the following data: account information of each account, attribute information of each account, interaction time between accounts, and interaction content between accounts.
8. An apparatus for determining an anomalous interaction account, comprising:
the acquisition unit is used for acquiring interactive data among a plurality of accounts;
a first determining unit, configured to determine, based on the interaction data, an interaction network of the plurality of accounts and at least one key account in the interaction network;
a second determining unit, configured to determine at least one interaction group in the interaction network that includes the key account;
a third determining unit, configured to determine, based on feature information of the interaction group, whether the interaction group is a group of abnormal interactions, where the group of abnormal interactions includes an abnormal interaction account;
determining, based on the interaction data, an interaction network of the plurality of accounts and at least one key account in the interaction network, including: based on the interaction data, each account is taken as a node, and interaction information among the accounts is taken as an edge, so that an interaction network of the accounts is generated; dividing the interactive network into a plurality of connected graphs; acquiring a central node of each connected graph, wherein an account corresponding to the central node is a key account;
the characteristic information includes at least one of: the similarity between the accounts in the interaction group, the Internet Protocol (IP) information used by the accounts in the interaction group, the role information corresponding to each account in the interaction group, and the interaction information between the accounts corresponding to other nodes in the interaction group and the account corresponding to the central node.
9. A storage medium, characterized in that the storage medium comprises a stored program, wherein when the program runs, a device in which the storage medium is located is controlled to execute the method for determining an account for abnormal interaction according to any one of claims 1 to 7.
10. A processor, wherein the processor is configured to run a program, wherein the program when running performs the method for determining an account for anomalous interaction of any one of claims 1 to 8.
11. A terminal, comprising:
one or more processors, memory, a display device, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for performing the method of determining an anomalous interaction account of any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810182329.2A CN108295476B (en) | 2018-03-06 | 2018-03-06 | Method and device for determining abnormal interaction account |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810182329.2A CN108295476B (en) | 2018-03-06 | 2018-03-06 | Method and device for determining abnormal interaction account |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108295476A CN108295476A (en) | 2018-07-20 |
| CN108295476B true CN108295476B (en) | 2021-12-28 |
Family
ID=62849112
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810182329.2A Active CN108295476B (en) | 2018-03-06 | 2018-03-06 | Method and device for determining abnormal interaction account |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108295476B (en) |
Families Citing this family (22)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108905210A (en) * | 2018-07-24 | 2018-11-30 | 合肥爱玩动漫有限公司 | A kind of method of quick detection game studios |
| CN109146638B (en) * | 2018-08-29 | 2021-11-30 | 创新先进技术有限公司 | Method and device for identifying abnormal financial transaction group |
| CN109091871B (en) * | 2018-09-17 | 2022-04-29 | 网易（杭州）网络有限公司 | Method and device for detecting game cheating player |
| CN109460930B (en) * | 2018-11-15 | 2021-11-26 | 武汉斗鱼网络科技有限公司 | Method for determining risk account and related equipment |
| CN109615521A (en) * | 2018-12-26 | 2019-04-12 | 天翼电子商务有限公司 | Anti-arbitrage identification method, system and server based on marketing anti-arbitrage model |
| TWI766144B (en) * | 2019-01-19 | 2022-06-01 | 遊戲橘子數位科技股份有限公司 | Method of game account price evaluation and system thereof |
| CN110264326B (en) * | 2019-05-24 | 2023-03-24 | 创新先进技术有限公司 | Method, device and equipment for identifying abnormal account set and risk account set |
| CN110490598B (en) * | 2019-08-23 | 2025-05-27 | 北京三快在线科技有限公司 | Abnormality detection method, device, equipment and storage medium |
| PH12022551062A1 (en) * | 2019-11-02 | 2023-09-18 | Gamania Digital Entertainment Co Ltd | Method and system for game account valuation |
| CN111292090A (en) * | 2020-02-19 | 2020-06-16 | 京东数字科技控股有限公司 | Method and Device for Detecting Abnormal Accounts |
| CN111400570B (en) * | 2020-04-17 | 2023-05-23 | 支付宝(杭州)信息技术有限公司 | User group auditing processing method and device |
| CN111539811B (en) * | 2020-05-27 | 2022-06-14 | 支付宝(杭州)信息技术有限公司 | Risk account identification method and device |
| CN111784502B (en) * | 2020-06-30 | 2024-08-13 | 中国工商银行股份有限公司 | Abnormal transaction account group identification method and device |
| CN112308565A (en) * | 2020-08-14 | 2021-02-02 | 中国工商银行股份有限公司 | Many-to-many cross-border fund wind control method and system based on knowledge graph |
| CN112245930B (en) * | 2020-09-11 | 2024-08-27 | 杭州浮云网络科技有限公司 | Risk behavior identification method and device and computer equipment |
| CN112184267B (en) * | 2020-10-27 | 2024-11-08 | 北京嘀嘀无限科技发展有限公司 | Method, device, equipment and medium for discovering user groups in service applications |
| CN112581270A (en) * | 2020-12-15 | 2021-03-30 | 中国建设银行股份有限公司 | Risk account identification method and device, electronic equipment and storage medium |
| CN112435126B (en) * | 2021-01-26 | 2021-06-18 | 深圳华锐金融技术股份有限公司 | Account identification method and device, computer equipment and storage medium |
| CN112948673B (en) * | 2021-02-22 | 2023-02-03 | 网易（杭州）网络有限公司 | Game content pushing method and device, electronic equipment and storage medium |
| CN113904943B (en) * | 2021-09-26 | 2024-04-05 | 北京百度网讯科技有限公司 | Account detection method and device, electronic equipment and storage medium |
| CN115999161A (en) * | 2023-01-18 | 2023-04-25 | 中国工商银行股份有限公司 | Abnormal transaction processing method and device for online game |
| CN119005985A (en) * | 2024-07-12 | 2024-11-22 | 中科聚信信息技术（北京）有限公司 | High-association group account identification method and system based on machine learning model |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103927307A (en) * | 2013-01-11 | 2014-07-16 | 阿里巴巴集团控股有限公司 | Website user identification method and device |
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106709800A (en) * | 2016-12-06 | 2017-05-24 | 中国银联股份有限公司 | Community partitioning method and device based on characteristic matching network |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7249094B2 (en) * | 2001-02-26 | 2007-07-24 | Paypal, Inc. | System and method for depicting on-line transactions |
| KR20130040049A (en) * | 2011-10-13 | 2013-04-23 | 주식회사 네오플 | Apparatus and method for detecting abnormal account |
| KR20130040048A (en) * | 2011-10-13 | 2013-04-23 | 주식회사 네오플 | Apparatus and method for detecting abnormal account |
| CN106301978A (en) * | 2015-05-26 | 2017-01-04 | 阿里巴巴集团控股有限公司 | The recognition methods of gang member account, device and equipment |
| US9818116B2 (en) * | 2015-11-11 | 2017-11-14 | Idm Global, Inc. | Systems and methods for detecting relations between unknown merchants and merchants with a known connection to fraud |
| RU2626337C1 (en) * | 2016-02-18 | 2017-07-26 | Акционерное общество "Лаборатория Касперского" | Method of detecting fraudulent activity on user device |
| CN107730262B (en) * | 2017-10-23 | 2021-09-24 | 创新先进技术有限公司 | Fraud identification method and device |
-
2018
- 2018-03-06 CN CN201810182329.2A patent/CN108295476B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103927307A (en) * | 2013-01-11 | 2014-07-16 | 阿里巴巴集团控股有限公司 | Website user identification method and device |
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| CN106709800A (en) * | 2016-12-06 | 2017-05-24 | 中国银联股份有限公司 | Community partitioning method and device based on characteristic matching network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108295476A (en) | 2018-07-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108295476B (en) | Method and device for determining abnormal interaction account | |
| US20230298031A1 (en) | Systems and methods for identity graph based fraud detection | |
| Xia et al. | Phishing detection on ethereum via attributed ego-graph embedding | |
| CN109063966B (en) | Risk account identification method and device | |
| Narayanam et al. | A shapley value-based approach to discover influential nodes in social networks | |
| CN112926990B (en) | Method and device for fraud detection | |
| CN106453357A (en) | Network ticket buying abnormal behavior recognition method and system and equipment | |
| CN105447028B (en) | The method and device of identification feature account | |
| CN105391594B (en) | The method and device of identification feature account | |
| CN112052404B (en) | Group discovery method, system, equipment and medium of multi-source heterogeneous relation network | |
| Drachen et al. | To be or not to be... social: Incorporating simple social features in mobile game customer lifetime value predictions | |
| CN110166344B (en) | Identity identification method, device and related equipment | |
| CN108492150B (en) | Method and system for determining entity heat degree | |
| CN108537542B (en) | Data processing method for social network | |
| CN110009365A (en) | User group's detection method, device and the equipment of improper transfer electronic asset | |
| CN107026731A (en) | A kind of method and device of subscriber authentication | |
| CN112819476A (en) | Risk identification method and device, nonvolatile storage medium and processor | |
| CN111686451B (en) | A business processing method, device, equipment and computer storage medium | |
| CN114463011A (en) | Abnormal transaction detection method, device, equipment and storage medium based on block chain | |
| Wu et al. | Understanding the dynamic and microscopic traits of typical Ethereum accounts | |
| CN108076032B (en) | Abnormal behavior user identification method and device | |
| CN112035570A (en) | Merchant evaluation method and system | |
| CN112330373B (en) | User behavior analysis method, device and computer-readable storage medium | |
| CN111723338A (en) | Detection method and detection equipment | |
| WO2024007565A1 (en) | Network analysis using optical quantum computing |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |