CN111417021A - Plug-in identification method and device, computer equipment and readable storage medium - Google Patents
Plug-in identification method and device, computer equipment and readable storage medium Download PDFInfo
- Publication number
- CN111417021A CN111417021A CN202010183780.3A CN202010183780A CN111417021A CN 111417021 A CN111417021 A CN 111417021A CN 202010183780 A CN202010183780 A CN 202010183780A CN 111417021 A CN111417021 A CN 111417021A
- Authority
- CN
- China
- Prior art keywords
- behavior data
- user behavior
- plug
- behavior
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/443—OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/21—Server components or server architectures
- H04N21/218—Source of audio or video content, e.g. local disk arrays
- H04N21/2187—Live feed
Landscapes
- Engineering & Computer Science (AREA)
- Multimedia (AREA)
- Signal Processing (AREA)
- Databases & Information Systems (AREA)
- Software Systems (AREA)
- Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
Abstract
The application discloses a plug-in identification method and device, computer equipment and a readable storage medium, and relates to the technical field of live broadcast. The plug-in identification method is applied to computer equipment and comprises the following steps: acquiring user behavior data, wherein the user behavior data is operation behavior data of any audience account in a target live broadcast room; performing feature construction according to the user behavior data to obtain a behavior feature value, wherein the behavior feature value is used for representing the execution state of the user behavior data; inputting the behavior characteristic value into a pre-constructed detection model so as to judge whether the user behavior data is matched with the plug-in-based false user behavior data or not according to the execution state of the user behavior data; when the user behavior data are matched with the plug-in-based false user behavior data, the plug-in-based false user is judged to exist in the target live broadcast room, and the plug-in can be reliably identified.
Description
Technical Field
The application relates to the technical field of live broadcast, in particular to a plug-in identification method and device, computer equipment and a readable storage medium.
Background
With the rise of the live broadcast industry, the business value brought by live broadcast is increased. The live broadcast platform generally uses the popularity of a main broadcast as a reference standard for allocating resources (exposure, upload code rate, etc.) to the live broadcast platform. At present, in order to obtain more resources of a platform, a director realizes illegal competition by using a human-air plug-in mode and the like. At present, the method for identifying the human-air cheating generally detects whether a large number of users use one IP address at the same time or judges whether a client occupation ratio of a certain version suddenly increases in a live broadcast room. In the prior art, the external plug-in identification method can only identify a simpler external plug-in, and in an actual situation, the technology of the external plug-in is updated very quickly, so that the external plug-in cannot be reliably identified by the existing external plug-in identification method.
In view of the above, a need exists for those skilled in the art to provide a reliable plug-in identification scheme.
Disclosure of Invention
The embodiment of the application provides a plug-in identification method and device, computer equipment and a readable storage medium.
In a first aspect, an embodiment of the present application provides a plug-in identification method, which is applied to a computer device, and the method includes:
acquiring user behavior data, wherein the user behavior data is operation behavior data of any audience account in a target live broadcast room;
performing feature construction according to the user behavior data to obtain a behavior feature value, wherein the behavior feature value is used for representing the execution state of the user behavior data;
inputting the behavior characteristic value into a pre-constructed detection model so as to judge whether the user behavior data is matched with the plug-in based false user behavior data or not according to the execution state of the user behavior data;
and when the user behavior data is matched with the plug-in-based false user behavior data, judging that the plug-in-based false user exists in the target live broadcast room.
Optionally, the behavior characteristic value includes a user behavior characteristic value and a server behavior characteristic value;
the step of performing feature construction according to the user behavior data to obtain a behavior feature value includes:
acquiring server behavior data corresponding to the user behavior data, wherein the server behavior data is operation behavior data performed by a server where the target live broadcast room is located in response to the user behavior data;
performing feature construction on the user behavior data to obtain a user behavior feature value, wherein the user behavior feature value is used for representing the execution state of the audience account corresponding to the user behavior data; and/or performing characteristic construction on the server behavior data to obtain a server behavior characteristic value, wherein the server behavior characteristic value is used for representing the execution state of a server where the target live broadcast room is located.
Optionally, the user behavior data includes a plurality of event identifications and occurrence time corresponding to each of the event identifications;
the step of performing feature construction according to the user behavior data to obtain a behavior feature value includes:
sequencing the event identifications according to the occurrence time corresponding to each event identification to obtain a behavior sequence;
and carrying out feature construction on the behavior sequence according to an N-gram model to obtain the behavior feature value.
Optionally, the step of performing feature construction on the behavior sequence according to an N-gram model to obtain a behavior feature value includes: comparing the behavior sequence with a preset behavior combination, wherein the preset behavior combination comprises a plurality of preset event identifications which are arranged according to a preset sequence;
when the event identifier included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 1 to obtain an effective value;
when an event identifier which is not included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 0, and obtaining an invalid value; and obtaining the behavior characteristic value according to the effective value and/or the invalid value.
Optionally, the detection model is constructed based on detection coefficients and a logistic regression model;
the detection coefficient is obtained by inputting a sample behavior characteristic value into the logistic regression model, wherein the sample behavior characteristic value is used for representing the execution state of the sample user behavior data;
the sample behavior characteristic value is obtained based on a sample user behavior data characteristic structure;
the sample user behavior data is pre-acquired.
Optionally, when the user behavior data matches plug-in based false user behavior data, the method further comprises:
and judging that the audience account corresponding to the user behavior data has 1 plug-in, and taking the user behavior data corresponding to the audience account with the plug-in as the sample user behavior data.
In a second aspect, an embodiment of the present application provides a plug-in identification device, which is applied to a computer device, where the device includes:
the acquisition module is used for acquiring user behavior data, wherein the user behavior data is operation behavior data of any audience account in a target live broadcast room;
the computing module is used for carrying out feature construction according to the user behavior data to obtain a behavior feature value, and the behavior feature value is used for representing the execution state of the user behavior data;
the detection module is used for inputting the behavior characteristic value into a pre-constructed detection model so as to judge whether the user behavior data is matched with the plug-in-based false user behavior data or not according to the execution state of the user behavior data;
and the judging module is used for judging that the plug-in-based false user exists in the target live broadcast room when the user behavior data is matched with the plug-in-based false user behavior data.
In a third aspect, an embodiment of the present application provides a computer device, where the computer device includes a processor and a nonvolatile memory storing computer instructions, and when the computer instructions are executed by the processor, the computer device executes the plug-in identification method according to any one of the first aspect.
In a fourth aspect, an embodiment of the present application provides a readable storage medium, where the readable storage medium includes a computer program, and the computer program controls, when running, a computer device where the readable storage medium is located to execute the plug-in identification method in any one of the first aspects.
Compared with the prior art, the beneficial effects provided by the application comprise: the method comprises the steps of obtaining user behavior data, carrying out feature construction according to the user behavior data to obtain a behavior feature value, inputting the behavior feature value into a pre-constructed detection model so as to judge whether the user behavior data is matched with plug-in-based false user behavior data or not according to the execution state of the user behavior data, judging that plug-in-based false users exist in a target live broadcast room when the user behavior data is matched with the plug-in-based false user behavior data, and reliably identifying the plug-ins through the process.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly described below. It is appreciated that the following drawings depict only certain embodiments of the application and are therefore not to be considered limiting of its scope. For a person skilled in the art, it is possible to derive other relevant figures from these figures without inventive effort.
FIG. 1 provides a schematic diagram of a video software application according to an embodiment of the present application;
fig. 2 is a schematic block diagram of a live broadcast system architecture provided in an embodiment of the present application;
fig. 3 is a schematic structural diagram of a terminal device according to an embodiment of the present application;
FIG. 4 is a flowchart of a plug-in identification method according to an embodiment of the present application;
FIG. 5 is a flowchart of another plug-in identification method according to an embodiment of the present application;
FIG. 6 is a flowchart of another plug-in identification method according to an embodiment of the present application;
fig. 7a, fig. 7b, and fig. 7c are schematic views illustrating a live broadcast interaction flow provided by an embodiment of the present application;
FIG. 8 is a flowchart of another plug-in identification method according to an embodiment of the present application;
FIG. 9 is a flowchart of a method for constructing a detection model according to an embodiment of the present application;
FIG. 10 is a flow chart of another method for constructing a test model according to an embodiment of the present application;
fig. 11 is a block diagram illustrating a structure of a plug-in identification device according to an embodiment of the present disclosure;
fig. 12 is a block diagram of a computer device according to an embodiment of the present disclosure.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. It is to be understood that the embodiments described are only a few embodiments of the present application and not all embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations.
Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
Furthermore, the terms "first," "second," and the like are used merely to distinguish one description from another, and are not to be construed as indicating or implying relative importance.
The following detailed description of embodiments of the present application will be made with reference to the accompanying drawings.
Currently, for a system capable of providing video streams, it generally comprises: a server and a terminal device; the server is used for storing the account related information of the user, receiving the instruction sent by the terminal equipment and responding; the terminal equipment is used for providing hardware conditions for watching videos or uploading videos for a user and is also used as a medium for interaction between the user and video software in the terminal equipment;
the terminal device may be installed with firmware, drivers and Applications (APP) related to video stream acquisition, playing and storage. The APP has a necessary graphical interface so that a user can browse, select, acquire and listen to and watch the audio and video through the APP. With particular reference to fig. 1, it comprises: a scrolling home recommendation area a and a viewing history area B.
For a scene providing live audio and video, the terminal devices can be divided into terminal devices used by a main broadcasting user and terminal devices used by audiences. Specifically, for a live scene, a possible system implementation architecture is given below, and referring to fig. 2, the system includes a terminal device 1, a terminal device 2a, a terminal device 2b, and a server 3.
Wherein the terminal device 1 is used by a broadcaster, the terminal device 2a is used by a spectator user 1 and the terminal device 2b is used by a spectator user 2.
Wherein, audience user 1 and audience user 2 can enter corresponding live broadcast room through APP of respective terminal equipment, so as to watch live broadcast content carried out by the main broadcast.
Specifically, the anchor performs interactive operations such as live video broadcasting, gift receiving, lottery drawing initiating, video uploading and the like through an anchor end APP on the terminal device 1, and the audience users 1 and 2 perform operations such as watching, barrage sending, gift sending and the like through audience end APPs in respective terminal devices;
the server 3 is mainly used for storing account information of the anchor and audience users, receiving various instructions sent by the audience and the anchor and giving corresponding responses, and can also be used for storing related data of each live broadcast room and performing corresponding feedback when the audience users and the anchor interact with the live broadcast rooms.
Certainly, in order to implement functions such as interaction of audio and video streams, the server 3 may also refer to a cluster formed by a plurality of servers, a distributed storage system, a device for implementing Software Defined Network (SDN), and the like.
In addition, in order to ensure normal transmission of audio and video streams, necessary network devices, such as a network access device, a cellular network access device, a gateway, a core network device, and the like, may be further disposed between the server and the terminal device.
It should be noted that, for the terminal device, it may be: smart phones, notebook computers, desktop computers, and tablet computers (Portable Android devices, abbreviated as PDAs).
Specifically, taking a smart phone as an example, the smart phone may include: RF (Radio Frequency) circuit 210, memory 220, input unit 230, display unit 240, sensor 250, audio circuit 260, WiFi (wireless fidelity) module 270, processor 280, and power supply 290. Those skilled in the art will appreciate that the handset architecture shown in fig. 3 is by way of example only, is not intended to be limiting, and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.
The following describes the components of the handset 20 in detail with reference to fig. 3:
the RF circuit 210 may be used to receive the video stream from the server 3 in FIG. 2, and transmit the interactive command to the server 3 after interaction by the host or viewer user, and in particular, receive the downlink information of the base station and process it to the processor 280. in General, the RF circuit includes but is not limited to an antenna, at least one Amplifier, a transceiver, a coupler, L NA (L ow Noise Amplifier), a duplexer, etc. furthermore, the RF circuit 210 may also communicate with the network and other devices via wireless communication, which may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), SMS (Short message Service, L), and so on.
The input unit 230 may be configured to receive input digital or character information, and generate a key signal input related to user setting and function control of the mobile phone 20, and may enter a corresponding block in the APP by touching the corresponding area, for example, a live broadcast room recommended by switching may be implemented by sliding the scroll type home recommendation area a in fig. 1, or a live broadcast room icon in the viewing history area B in fig. 1 is clicked to enter the live broadcast room, and after entering the video playing interface, a corresponding function (such as adjustment of volume, adjustment of screen brightness, and the like) may also be implemented by touching the corresponding icon.
Specifically, the input unit 230 may include a touch panel 231 and other input devices 232. The touch panel 231, also referred to as a touch screen, may collect touch operations of a user (e.g., operations of the user on or near the touch panel 231 using any suitable object or accessory such as a finger, a stylus, etc.) thereon or nearby, and drive the corresponding connection device according to a preset program.
Alternatively, the touch panel 231 may include two parts of a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts it to touch point coordinates, and then provides the touch point coordinates to the processor 280, and can receive and execute commands from the processor 280. In addition, the touch panel 231 may be implemented in various types, such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. The input unit 230 may include other input devices 232 in addition to the touch panel 231. In particular, other input devices 232 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.
The Display unit 240 may be used to Display information input by or provided to a user and various menus of the mobile phone 20, such as displaying a scrolling home recommendation area a and a viewing history area b in fig. 1. the Display unit 240 may include a Display panel 241, and optionally, the Display panel 241 may be configured in the form of a liquid Crystal Display (L acquired Crystal Display, abbreviated as L CD), an O L ED (Organic light Emitting Diode), and the like, further, the touch panel 231 may cover the Display panel 241, and when the touch panel 231 detects a touch operation on or near the touch panel 231, the touch panel 231 may be transmitted to the processor 280 to determine the type of the touch event, and then the processor 280 may provide a corresponding visual output on the Display panel 241 according to the type of the touch event.
Although not shown, the mobile phone 20 may further include a camera, a bluetooth module, and the like, for example, when the mobile phone 20 is used as the terminal device 1 of the anchor in fig. 2, live video shooting may be performed by using the camera, which is not described herein again.
Under the scenes shown in fig. 1 and fig. 2, the commercial value brought by the current live broadcast industry is gradually increased. As a live broadcast platform, corresponding resources, such as a code rate and a number of occurrences of a top page, are generally allocated to a anchor live broadcast room according to popularity of the anchor live broadcast room. The popularity of the anchor live broadcast room is determined by the number of audiences in the live broadcast room, so that some anchors can make a false popularity by using a plug-in mode in order to obtain more resources provided by the platform. However, in the prior art, only some simple plug-ins can be identified, for example, there are a large number of audience accounts in one IP address in a certain live broadcast room, or the live APP occupancy of a certain version of audience in a certain live broadcast room suddenly increases, and the like. In practical situations, the plug-ins used by plug-in users are developed aiming at the existing detection technology, the use rules of the plug-ins are continuously changed, and for maintenance personnel, the maintenance and development are required to be carried out again every time a new plug-in is detected, so that a large amount of manpower and material resources are consumed.
The applicant has found, through thinking, that in practical application, for audience devices, for example, as shown in fig. 2, the audience devices can be divided into a terminal device 2a (i.e., a device for performing various operations in a live broadcast room by a real audience user 1) and a terminal device 2b (i.e., a device for performing various operations in a live broadcast room by a false audience user 2 through a plug-in means), when the terminal device 2a interacts with an incoming live broadcast room, behavior data thereof is logical to a certain extent (i.e., the real audience user 1 operates), and when the terminal device 2b interacts with the live broadcast room, although a large number of false audience accounts are prevented from being detected by modifying or hiding own login IP through technical means, behavior data of each audience account cannot be hidden, and various operations in the live broadcast room by the false audience user 2 through the plug-in means are different from operations performed by the real audience user 1 in the live broadcast room .
Based on this, the embodiment of the present application provides a plug-in identification method, which is applied to a computer device, where the computer device may be the server 3 in fig. 2, or may also be a newly added independent hardware device, and the computer device is in communication connection with a database server storing user behavior data, specifically, fig. 4 is a flowchart of the plug-in identification method provided in the embodiment of the present application, and as shown in fig. 4, the method includes steps 201 to 204.
The user behavior data may be operation behavior data on the APP page after the audience user logs in the corresponding account in fig. 1, for example, opening the APP, selecting an interest tag, giving a gift, adding attention, editing the barrage content, sending the barrage content, and the like, and may be understood as an operation that the audience can appear when watching.
Wherein the behavior characteristic value is used for representing the execution state of the user behavior data, which can be understood as whether the audience account makes a certain operation behavior, the user behavior data may be, for example, a gift, which may be presented to the viewer's account after the gift has been presented in the target live broadcast room, the data about the gift in the user behavior data can obtain a behavior characteristic value after characteristic construction, the behavior of presenting gifts in the target live broadcast room by the audience account is indicated, if the audience account does not present any gifts in the target live broadcast room, after the characteristic construction is carried out on the data about the gift in the user behavior data, another behavior characteristic value can be obtained, the behavior characteristic value can be distinguished from a behavior characteristic value constructed in the case of gift giving, and is used for indicating that the audience account does not have gift giving behavior in the target live broadcast room.
So as to judge whether the user behavior data is matched with the plug-in based false user behavior data according to the execution state of the user behavior data.
Specifically, the pre-constructed detection model can judge whether the user behavior data is matched with the plug-in based false user behavior data according to the execution state of the user behavior data; the plug-in based false user behavior data is different from the real viewer user behavior data, so that the detection can be carried out through a detection model.
And step 204, when the user behavior data is matched with the plug-in based false user behavior data, judging that the plug-in based false user exists in the target live broadcast room.
When the user behavior data are matched with the plug-in based false user behavior data, it can be judged that the plug-in based false user exists in the target live broadcast room where the user behavior data are located, and the popularity value (e.g., sending a barrage, giving a gift, etc.) brought by the false user is the false popularity.
The plug-in identification method provided by the embodiment of the application can reliably screen the account in the live broadcast room, and by judging whether the user behavior data is matched with the plug-in-based false user behavior data instead of taking the modifiable IP address as a judgment basis, whether a large number of audience accounts are logged in the same terminal equipment or not can not be distinguished immediately, and the plug-in audience accounts can also be reliably identified.
In addition to that the user behavior data can be used as a basis for determining whether the operation behavior data of the operation behavior data account of the audience account is normal, when the audience account performs various interactions in the live broadcast room, the server in the target live broadcast room can also respond to the service end behavior data corresponding to the user behavior data feedback and can also be used as a basis for determining whether the operation behavior data of the audience account is normal, therefore, in order to improve the accuracy of identification, the user behavior data and/or the service end behavior data can be used as a basis for determining whether the operation behavior data of the operation behavior data account of the audience account is normal, specifically, a possible implementation manner is provided as follows, on the basis of fig. 4, fig. 5 is a flowchart of another plug-in identification method provided by the embodiment of the present application, and referring to fig. 5, step 202 includes:
step 202-1, server behavior data corresponding to the user behavior data is obtained.
The server side behavior data is operation behavior data which is carried out by a server where the target live broadcast room is located and responding to the user behavior data.
For example, the user behavior data may be a hit of a guess lottery icon in a live broadcast room, and the corresponding server behavior data may be the obtained guess lottery content and the displayed guess lottery content. The user behavior data can also be the icon concerned by clicking the live broadcast room, and the corresponding server behavior data can replace the icon concerned by the icon concerned for obtaining. The user behavior data can also be APP opening, and the corresponding server behavior data can be APP main menu information and displayed.
And step 202-2, carrying out feature construction on the user behavior data to obtain a user behavior feature value.
The user behavior characteristic value is used for representing the execution state of the audience account corresponding to the user behavior data, as described above, the user behavior data may be a gift, and the user behavior characteristic value obtained by constructing the data of the gift may represent whether the audience account performs the act of gift presentation in the target live broadcast room.
And step 202-3, performing characteristic construction on the server behavior data to obtain a server behavior characteristic value. The server behavior characteristic value is used for representing the execution state of a server where a target live broadcast room is located, the user behavior data can be gifted gifts, the server behavior data can be used for obtaining gift details and displaying the gift details to the target live broadcast room, characteristic construction is carried out according to the server behavior data, whether the server where the live broadcast room is located obtains the gift details or not can be represented, and the gift details are displayed to the target live broadcast room.
Specifically, when an accident occurs in the server behavior data acquisition process, or the server behavior data cannot be acquired (for example, a hot event occurs in a current live broadcast platform, for example, live broadcast hot competition, which causes a rapid increase in the number of viewers in a short time, the server is temporarily paralyzed, and server behavior data may not be acquired in time), the user behavior feature value for detection may also be acquired by performing feature construction by separately using the user behavior data, that is, step 202-2 may be executed separately, and when only the server behavior data can be acquired, the feature of the user behavior data may also be reflected, that is, step 202-3 may be executed separately. When the user behavior data and the server behavior data are both obtained, step 202-2 and step 202-3 may be performed to ensure the diversity of the data and to improve the reliability of the final model calculation result.
By adopting the steps, abstract user behavior data and server behavior data can be converted into user behavior characteristic values and server behavior characteristic values which can be used for calculation, and meanwhile, the accuracy and reliability of a final calculation result are also ensured due to more than one source of a data channel.
On the basis, please refer to table one, the user behavior data includes a plurality of event identifications and occurrence times corresponding to each event identification.
| User behavior data | Event identification | Time of day |
| Opening APP | 100000 | 18:00:01 |
| Selecting interest tags | 100001 | 18:00:50 |
| Enter the live broadcast room | 100002 | 18:05:20 |
| Gift for gift | 100004 | 18:20:15 |
| …… | …… | …… |
Watch 1
On the basis of fig. 4, fig. 6 is a flowchart of another plug-in identification method provided in the embodiment of the present application, and referring to fig. 6, the embodiment of the present application provides an example of obtaining a behavior feature value by performing feature construction according to user behavior data. This can be achieved by the following steps.
Step 202-4, sequencing the event identifications according to the occurrence time corresponding to each event identification to obtain a behavior sequence.
The behavior sequence can be obtained by arranging event identifications corresponding to specific behaviors in the user behavior data according to corresponding time, for example, it can be known from the content in the table one, the user behavior data includes opening an APP, selecting an interest tag, entering a live broadcast room and presenting a gift, wherein according to the occurrence time of each behavior, the sequence of the audience account performing each behavior is that the APP is opened first, then the interest tag is selected, then the interested live broadcast entry is selected from the live broadcast room list corresponding to the interest tag, and when the live broadcast is watched, the gift presenting operation is performed, and the like. The event identifier for opening the APP may be set to 100000, the event identifier for selecting the interest tag may be set to 100001, the event identifier for entering the live broadcast room may be set to 100002, the event identifier for paying attention to the live broadcast room may be set to 100003, and the event identifier for giving away the gift may be set to 100004, according to the foregoing flow, it may be known that the viewer account may have performed the foregoing operation (that is, does not pay attention to the behavior of the live broadcast room) when the target live broadcast room has been paid attention to, and therefore, a behavior sequence may be obtained from the foregoing behavior and the event identifier corresponding to each behavior: [100000,100001,100002,100004, … … ].
And step 202-5, performing characteristic construction on the behavior sequence according to the N-gram model to obtain a behavior characteristic value.
And then, performing characteristic construction on the behavior sequence through an N-gram model to obtain a behavior characteristic value. It should be understood that, in the embodiment of the present application, N-gram models are used for feature construction, and in the process of the feature construction of the N-gram models, one event identifier only takes the first several event identifiers of the event identifier as references, that is, there is a certain logical relationship between one event identifier and the first several (one, two, three, etc.) event identifiers, and in the embodiment of the present application, even if the habits of each viewer in watching live broadcast are different, when the viewer-side live broadcast APP is operated, a small amount of misoperation is excluded, and there is a certain logical relationship between adjacent operations, based on which, the feature construction by using N-gram models can be accurately processed according to the scheme in the embodiment of the present application.
For example, the terminal device 2a logs in the viewer account, executes "open APP", performs an operation of "select interest tag" after browsing as shown in fig. 7a, enters a live broadcast list corresponding to the interest tag as shown in fig. 7b, then selects an interested live broadcast room to perform an operation of "enter live broadcast room", performs an operation of "give present" after watching for a period of time as shown in fig. 7c, and there is a contact relationship between adjacent operations in a normal operation flow of the real viewer. For another example, the terminal device 2b logs in the audience account, executes an operation of "entering a live broadcast room", then executes an operation of "giving a gift", and then executes an operation of "opening an APP", which is obviously an operation flow that a real user cannot perform, and it can be considered that an operation of "entering a live broadcast room" and an operation of "giving a gift" related to increase of popularity in the live broadcast room are executed in the background of the terminal device 2b by being externally hung, and the logic between each adjacent operation is abnormal and is matched with the false user behavior data based on the externally hung operation.
It should be understood that the characteristic value of the behavior of the server may also be used as an input of a pre-constructed detection model, the specific process is similar to the operation related to the user behavior data, and is not described herein again, and reference may be made to table two, where "obtaining card content" may refer to responding to the server behavior data corresponding to the user behavior data "give card transaction", and may show the rights and interests of the audience user after giving the card transaction; the step of obtaining the user daemon list can be that the server-side behavior data corresponding to the user behavior data entering the attention list is responded, and after the audience user clicks the attention list collected by the audience user, the live broadcast room collected by the audience user is displayed in a list form.
| Server side behavioral data | Event identification | Time of day |
| Obtaining card content | queryCardPackage | 18:00:05 |
| Obtaining a user watch list | GetUserAllGuardian | 18:00:55 |
| …… | …… | …… |
Watch two
On the basis of fig. 6, an example of obtaining a behavior feature value by performing feature construction on a behavior sequence according to an N-gram model according to the embodiment of the present application can be implemented by the following steps, please refer to fig. 8.
Step 202-5-1, compare the behavior sequence with a preset behavior combination.
The preset behavior combination comprises a plurality of preset event identifications, and the preset event identifications are arranged according to a preset sequence.
In this embodiment of the present application, a ternary model (trigrammodel) in the N-gram model may be taken for processing, and as described above, in this embodiment of the present application, the behavior sequence may be: [100000,100001,100002,100004, … … ], the preset event identification in the preset behavior combination can be: [ 100000; 100001; 100002; 100003; 100004, respectively; … …, respectively; 100000,100001, respectively; 100001, 100002; 100002, 100003; 100003, 100004; … …, respectively; 100000,100001, 100002; 100001,100002, 100003; 100002, 100003, 100004; … … ].
Step 202-5-2, when the event identifier included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 1, and obtaining an effective value.
An alignment may be performed, for example, if the first bit "100000" in the preset behavior combination appears in the behavior sequence, a valid value "1" may be recorded at the position, that is, the behavior "open APP" corresponding to the event identifier 100000 exists.
Step 202-5-3, when an event identifier which is not included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 0, and obtaining an invalid value.
The fourth bit "100003" in the preset behavior combination does not appear in the behavior sequence, so an invalid value "0" can be recorded in this position, that is, the behavior "focus live room" corresponding to the event identifier 100003 does not exist. For another example, "100002, 100003" in the preset behavior combination does not appear in the behavior sequence, and therefore, an invalid value "0" may be recorded at this position, that is, the behavior "select interest tag" corresponding to the event identifier 100002 and the behavior "focus live room" corresponding to the event identifier 100003 do not exist at the same time.
And step 202-5-4, obtaining the behavior characteristic value according to the effective value and the invalid value.
On the basis, at the position where the valid value "1" appears, it indicates that the viewer account corresponding to the user behavior data corresponds to executing the behavior, and at the position where the invalid value "0" appears, it may be considered that the viewer account corresponding to the user behavior data corresponds to not executing the behavior. By analogy, a behavior characteristic value of "11101 … … 1100 … … 100 … …" can be obtained. Through the operation, the execution state of the abstract user behavior data can be accurately expressed through the behavior characteristic value. In addition, when only valid values or only invalid values are present, the behavior feature values, that is, all "1" and all "0" may be acquired.
On the basis of the foregoing, the detection model may be constructed based on the detection coefficients and a logistic regression model.
The detection model may be a classification model, for example, a logistic regression model:
the detection coefficients may be obtained based on inputting sample behavior feature values into a logistic regression model, the sample behavior feature values being used to characterize the execution state of the sample user behavior data.
The sample behavior characteristic value is constructed based on the sample user behavior data, for example, a gift giving behavior is performed in the sample user behavior data, and the sample behavior characteristic value constructed based on the sample user behavior data, namely the gift giving behavior, can represent that a sample audience account corresponding to the sample user behavior data has the gift giving behavior in a live broadcast room.
The sample user behavior data is obtained in advance, and may be data written by the user or known data obtained from an actual context. Besides, as for fig. 4 in the above embodiment, the embodiment of the present application further provides an implementation manner for constructing the foregoing detection model, and as shown in fig. 9, the implementation manner can be implemented through the following steps.
The detection model may be a classification model, for example, a logistic regression model:
wherein y is the probability of the user behavior data having the plug-in behavior, n is the number of the sample characteristic values, x is the sample behavior characteristic value, and α is the detection coefficient.
And step 302, performing feature construction according to the sample user behavior data to obtain a sample behavior feature value.
The sample behavior characteristic value is used for representing the execution state of the sample user behavior data.
And step 303, inputting the behavior characteristic value of the sample into a logistic regression model, and training to obtain a detection coefficient.
When model training is performed, the output y and the input x are known, and the values of the detection coefficients α can be obtained after a large amount of training.
And step 304, constructing a detection model according to the detection coefficient and the logistic regression model.
In the trained logistic regression model, α indicates that the detection coefficient is known, and the probability y that the plug-in behavior exists in the user behavior data corresponding to the current behavior feature value can be obtained by inputting x, namely the behavior feature value.
On the basis of the aforementioned fig. 9, the sample user behavior data may include preset plug-in behavior data and preset normal behavior data. Referring to fig. 10, an example of obtaining a sample behavior feature value by performing feature construction according to sample user behavior data according to the embodiment of the present application may be implemented by the following steps.
And step 302-1, obtaining a first sample behavior characteristic value when the characteristic construction is carried out according to the preset plug-in behavior data.
And step 302-2, obtaining a second sample behavior characteristic value when the characteristic construction is carried out according to the preset normal behavior data.
The data source of the sample user behavior data can be set by the user, can also be obtained from real data, and can be divided into preset plug-in behavior data and preset normal behavior data.
The embodiment of the present application further provides an example of inputting the behavior feature values of the samples into a logistic regression model, and training to obtain the detection coefficients, please refer to fig. 10 again, which can be implemented by the following steps.
And 303-1, when the first sample behavior characteristic value is used as the input of the logistic regression model, taking 1 as the output of the logistic regression model, and performing the training of the first sample behavior characteristic value.
As described above, during training, the first sample behavior feature value is taken as the input x of the logistic regression model, and the first sample feature value is obtained from the plug-in behavior data, so that the output of the logistic regression model can be determined to be "1", that is, the first sample behavior feature value training is performed when the plug-in behavior exists.
And 303-2, when the behavior characteristic value of the second sample is used as the input of the logistic regression model, taking 0 as the output of the logistic regression model, and performing behavior characteristic value training on the second sample.
And taking the second sample behavior characteristic value as the input x of the logistic regression model, wherein the second sample characteristic value is obtained from the normal behavior data, so that the output of the logistic regression model can be determined to be 0, namely the first sample behavior characteristic value training is carried out when normal behavior exists.
And 303-3, training according to the first sample behavior characteristic value and the second sample behavior characteristic value to obtain a detection coefficient.
And (3) obtaining a final detection coefficient α through the training of the behavior characteristic value of the first sample and the training of the behavior characteristic value of the second sample, and then placing α in a logistic regression model to finish the training.
In addition, when the user behavior data matches with the plug-in based false user behavior data, the embodiment of the present application further provides an example of obtaining sample user behavior data, which can be completed through the following steps.
And judging that the external hanging exists in the audience account corresponding to the user behavior data, and taking the user behavior data corresponding to the external hanging existing in the audience account as sample user behavior data.
In the embodiment of the application, a plug-in probability threshold value of 0.5 can be set, that is, when the probability y of plug-in behavior existing in the calculated user behavior data is less than 0.5, the user behavior data is judged to be not matched with the plug-in based false user behavior data, and when the probability y of plug-in behavior existing in the calculated user behavior data is greater than 0.5, the user behavior data is judged to be matched with the plug-in based false user behavior data, by setting the threshold value, the fault tolerance rate of the model can be increased, after a certain time of use or training, the threshold value can be adjusted upwards, and finally a more accurate detection model can be obtained, for example, when the plug-in recognition method provided by the embodiment of the application is initially adopted to detect a certain live broadcast room, the probability y of plug-in behavior existing in the certain user behavior data is found to be greater than 0.5, and the plug-in behavior can, meanwhile, the user behavior data is used as sample user behavior data to train the detection model, the accuracy of the detection model is improved along with continuous use of the detection model, the plug-in probability threshold value can be set to be 0.8, and plug-in identification can be carried out more accurately.
Through the steps, the model can be continuously perfected in the normal processing process by utilizing the self-updating characteristic of machine learning, and the cost of manual development is reduced.
An embodiment of the present application further provides a plug-in identification device 110, which is applied to a computer device, where the plug-in identification device 110 is an entity device for executing the aforementioned plug-in identification method, as shown in fig. 11, the plug-in identification device 110 includes:
the obtaining module 1101 is configured to obtain user behavior data, where the user behavior data is operation behavior data of any viewer account in the target live broadcast room.
The calculating module 1102 is configured to perform feature construction according to the user behavior data to obtain a behavior feature value, where the behavior feature value is used to represent an execution state of the user behavior data.
The detecting module 1103 is configured to input the behavior feature value into a pre-constructed detection model, so as to determine whether the user behavior data matches with the plug-in based false user behavior data according to the execution state of the user behavior data.
And the judging module 1104 is used for judging that the plug-in-based false user exists in the target live broadcast room when the user behavior data is matched with the plug-in-based false user behavior data.
Further, the behavior characteristic value comprises a user behavior characteristic value and a server behavior characteristic value;
the calculation module 1102 is specifically configured to:
acquiring server behavior data corresponding to the user behavior data, wherein the server behavior data is operation behavior data performed by a server 2 in a target live broadcast room in response to the user behavior data; performing characteristic construction on the user behavior data to obtain a user behavior characteristic value, wherein the user behavior characteristic value is used for representing the execution state of the audience account corresponding to the user behavior data; and/or performing characteristic construction on the server behavior data to obtain a server behavior characteristic value, wherein the server behavior characteristic value is used for representing the execution state of the server 2 where the target live broadcast room is located.
Further, the user behavior data comprises a plurality of event identifications and occurrence time corresponding to each event identification;
the calculation module 1102 includes:
the calculation submodule is used for sequencing the event identifications according to the occurrence time corresponding to each event identification to obtain a behavior sequence; and carrying out characteristic construction on the behavior sequence according to the N-gram model to obtain a behavior characteristic value.
Further, the calculation submodule is specifically configured to: comparing the behavior sequence with a preset behavior combination, wherein the preset behavior combination comprises a plurality of preset event identifications which are arranged according to a preset sequence; when an event identifier included in a behavior sequence appears in a preset behavior combination, configuring the position of a corresponding preset event identifier to be 1 to obtain an effective value; when an event identifier which is not included in the behavior sequence appears in a preset behavior combination, configuring the position of a corresponding preset event identifier to be 0 to obtain an invalid value; and obtaining the behavior characteristic value according to the effective value and/or the invalid value.
Further, the apparatus further comprises:
the training module is used for acquiring sample user behavior data; performing feature construction according to the sample user behavior data to obtain a sample behavior feature value, wherein the sample behavior feature value is used for representing the execution state of the sample user behavior data; inputting the behavior characteristic value of the sample into a logistic regression model, and training to obtain a detection coefficient; and constructing a detection model according to the detection coefficient and the logistic regression model.
Further, the sample user behavior data comprises preset plug-in behavior data and preset normal behavior data;
the training module is specifically configured to:
when feature construction is carried out according to preset plug-in behavior data, a first sample behavior feature value is obtained; when feature construction is carried out according to preset normal behavior data, a second sample behavior feature value is obtained;
the training module is specifically further configured to:
when the first sample behavior characteristic value is used as the input of the logistic regression model, 1 is used as the output of the logistic regression model, and the first sample behavior characteristic value is trained; when the second sample behavior characteristic value is used as the input of the logistic regression model, taking 0 as the output of the logistic regression model, and performing second sample behavior characteristic value training; and training according to the first sample behavior characteristic value and the second sample behavior characteristic value to obtain a detection coefficient.
Further, when the user behavior data matches with the plug-in based false user behavior data, the determining module 1104 is further specifically configured to:
and judging that the external hanging exists in the audience account corresponding to the user behavior data, and taking the user behavior data corresponding to the external hanging existing in the audience account as sample user behavior data.
In the embodiment of the present application, the implementation principle of the plug-in identification device 110 may refer to the implementation principle of the aforementioned plug-in identification method, and is not described herein again.
The embodiment of the present application provides a computer device 100, where the computer device 100 includes a processor and a non-volatile memory storing computer instructions, and when the computer instructions are executed by the processor, the computer device 100 executes the aforementioned plug-in identification method. As shown in fig. 12, fig. 12 is a block diagram of a computer device 100 according to an embodiment of the present application. The computer apparatus 100 includes a plug-in recognition device 110, a memory 111, a processor 112, and a communication unit 113.
To facilitate the transfer or interaction of data, the elements of the memory 111, the processor 112 and the communication unit 113 are electrically connected to each other, directly or indirectly. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The plug-in recognition apparatus 110 includes at least one software function module which may be stored in the memory 111 in the form of software or firmware (firmware) or solidified in an Operating System (OS) of the computer device 100. The processor 112 is used for executing executable modules stored in the memory 111, such as software functional modules and computer programs included in the plug-in recognition device 110.
The embodiment of the application provides a readable storage medium, which includes a computer program, and when the computer program runs, the computer program controls a computer device where the readable storage medium is located to execute the aforementioned plug-in identification method.
In summary, by using the plug-in identification method, device, computer equipment and readable storage medium provided by the embodiment of the application, an account using a false plug-in can be reliably found out from audience accounts in a live broadcast room, and simultaneously, all user behavior data are combined and trained in a machine learning manner, so that plug-in developers cannot easily bypass existing rules, and meanwhile, the plug-in identification method can keep a self-updating state during running, continuously learn new plug-in user behavior data, and can reliably complete plug-in identification operation in the live broadcast room.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (9)
1. The plug-in identification method is applied to computer equipment, and comprises the following steps:
acquiring user behavior data, wherein the user behavior data is operation behavior data of any audience account in a target live broadcast room;
performing feature construction according to the user behavior data to obtain a behavior feature value, wherein the behavior feature value is used for representing the execution state of the user behavior data;
inputting the behavior characteristic value into a pre-constructed detection model so as to judge whether the user behavior data is matched with the plug-in based false user behavior data or not according to the execution state of the user behavior data;
and when the user behavior data is matched with the plug-in-based false user behavior data, judging that the plug-in-based false user exists in the target live broadcast room.
2. The method of claim 1, wherein the behavior feature values comprise user behavior feature values and server behavior feature values;
the step of performing feature construction according to the user behavior data to obtain a behavior feature value includes:
acquiring server behavior data corresponding to the user behavior data, wherein the server behavior data is operation behavior data performed by a server where the target live broadcast room is located in response to the user behavior data;
performing feature construction on the user behavior data to obtain a user behavior feature value, wherein the user behavior feature value is used for representing the execution state of the audience account corresponding to the user behavior data; and/or performing characteristic construction on the server behavior data to obtain a server behavior characteristic value, wherein the server behavior characteristic value is used for representing the execution state of a server where the target live broadcast room is located.
3. The method of claim 1, wherein the user behavior data comprises a plurality of event identifications and a corresponding occurrence time for each of the event identifications;
the step of performing feature construction according to the user behavior data to obtain a behavior feature value includes:
sequencing the event identifications according to the occurrence time corresponding to each event identification to obtain a behavior sequence;
and carrying out feature construction on the behavior sequence according to an N-gram model to obtain the behavior feature value.
4. The method according to claim 3, wherein the step of characterizing the behavior sequence according to an N-gram model to obtain a behavior feature value comprises:
comparing the behavior sequence with a preset behavior combination, wherein the preset behavior combination comprises a plurality of preset event identifications which are arranged according to a preset sequence;
when the event identifier included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 1 to obtain an effective value;
when an event identifier which is not included in the behavior sequence appears in the preset behavior combination, configuring the position of the corresponding preset event identifier to be 0, and obtaining an invalid value; and obtaining the behavior characteristic value according to the effective value and/or the invalid value.
5. The method of claim 1, wherein the detection model is constructed based on detection coefficients and a logistic regression model;
the detection coefficient is obtained by inputting a sample behavior characteristic value into the logistic regression model, wherein the sample behavior characteristic value is used for representing the execution state of the sample user behavior data;
the sample behavior characteristic value is obtained based on the sample user behavior data characteristic structure;
the sample user behavior data is pre-acquired.
6. The method of claim 5, wherein when the user behavior data matches plug-in based spurious user behavior data, the method further comprises:
and judging that the audience account corresponding to the user behavior data has a plug-in, and taking the user behavior data corresponding to the audience account having the plug-in as the sample user behavior data.
7. An external hanging identification device applied to computer equipment, the device comprising:
the acquisition module is used for acquiring user behavior data, wherein the user behavior data is operation behavior data of any audience account in a target live broadcast room;
the computing module is used for carrying out feature construction according to the user behavior data to obtain a behavior feature value, and the behavior feature value is used for representing the execution state of the user behavior data;
the detection module is used for inputting the behavior characteristic value into a pre-constructed detection model so as to judge whether the user behavior data is matched with the plug-in-based false user behavior data or not according to the execution state of the user behavior data;
and the judging module is used for judging that the plug-in-based false user exists in the target live broadcast room when the user behavior data is matched with the plug-in-based false user behavior data.
8. A computer device comprising a processor and a non-volatile memory having computer instructions stored thereon, wherein when the computer instructions are executed by the processor, the computer device performs the plug-in identification method of any one of claims 1-6.
9. A readable storage medium, characterized in that the readable storage medium comprises a computer program, and the computer program controls a computer device of the readable storage medium to execute the plug-in identification method according to any one of claims 1 to 6 when running.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010183780.3A CN111417021B (en) | 2020-03-16 | 2020-03-16 | Plug-in identification method and device, computer equipment and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010183780.3A CN111417021B (en) | 2020-03-16 | 2020-03-16 | Plug-in identification method and device, computer equipment and readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111417021A true CN111417021A (en) | 2020-07-14 |
| CN111417021B CN111417021B (en) | 2022-07-08 |
Family
ID=71493002
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010183780.3A Active CN111417021B (en) | 2020-03-16 | 2020-03-16 | Plug-in identification method and device, computer equipment and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111417021B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113191845A (en) * | 2021-05-07 | 2021-07-30 | 武汉新之扬电子商务有限公司 | Online live shopping platform data analysis processing method, system, equipment and computer storage medium |
| CN113297884A (en) * | 2020-07-29 | 2021-08-24 | 阿里巴巴集团控股有限公司 | Abnormal behavior determination method and device and electronic equipment |
| CN113742719A (en) * | 2021-08-26 | 2021-12-03 | 深圳依时货拉拉科技有限公司 | Order grabbing and plug-in hanging detection method and computer equipment |
| CN114071196A (en) * | 2020-08-03 | 2022-02-18 | 武汉斗鱼鱼乐网络科技有限公司 | Method, system, medium and equipment for identifying target live broadcast room |
Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102163251A (en) * | 2010-02-22 | 2011-08-24 | 深圳市腾讯计算机***有限公司 | Method and device for recognizing game cheating |
| CN105491444A (en) * | 2015-11-25 | 2016-04-13 | 珠海多玩信息技术有限公司 | Data identification processing method and device |
| CN107185243A (en) * | 2017-04-26 | 2017-09-22 | 厦门吉比特网络技术股份有限公司 | A kind of recognition methods of network game external store |
| CN107818344A (en) * | 2017-10-31 | 2018-03-20 | 上海壹账通金融科技有限公司 | The method and system that user behavior is classified and predicted |
| CN108184144A (en) * | 2017-12-27 | 2018-06-19 | 广州虎牙信息科技有限公司 | A kind of live broadcasting method, device, storage medium and electronic equipment |
| CN108268886A (en) * | 2017-01-04 | 2018-07-10 | ***通信集团四川有限公司 | For identifying the method and system of plug-in operation |
| CN108905209A (en) * | 2018-06-11 | 2018-11-30 | 网易（杭州）网络有限公司 | Plug-in detection method and system, electronic equipment and storage medium in game |
| CN109464807A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| KR20190036422A (en) * | 2017-11-08 | 2019-04-04 | 주식회사 알티캐스트 | System and method for detecting abnormal behavior based on unified model |
| US20190205771A1 (en) * | 2017-12-28 | 2019-07-04 | National Taiwan University | Detective method and system for activity-or-behavior model construction and automatic detection of the abnormal activities or behaviors of a subject system without requiring prior domain knowledge |
| CN110075524A (en) * | 2019-05-10 | 2019-08-02 | 腾讯科技（深圳）有限公司 | Anomaly detection method and device |
| CN110347724A (en) * | 2019-07-12 | 2019-10-18 | 深圳众赢维融科技有限公司 | Abnormal behaviour recognition methods, device, electronic equipment and medium |
| CN110876851A (en) * | 2019-11-20 | 2020-03-13 | 腾讯科技（深圳）有限公司 | Plug-in identification method, server, system and storage medium |
-
2020
- 2020-03-16 CN CN202010183780.3A patent/CN111417021B/en active Active
Patent Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102163251A (en) * | 2010-02-22 | 2011-08-24 | 深圳市腾讯计算机***有限公司 | Method and device for recognizing game cheating |
| CN105491444A (en) * | 2015-11-25 | 2016-04-13 | 珠海多玩信息技术有限公司 | Data identification processing method and device |
| CN108268886A (en) * | 2017-01-04 | 2018-07-10 | ***通信集团四川有限公司 | For identifying the method and system of plug-in operation |
| CN107185243A (en) * | 2017-04-26 | 2017-09-22 | 厦门吉比特网络技术股份有限公司 | A kind of recognition methods of network game external store |
| CN107818344A (en) * | 2017-10-31 | 2018-03-20 | 上海壹账通金融科技有限公司 | The method and system that user behavior is classified and predicted |
| KR20190036422A (en) * | 2017-11-08 | 2019-04-04 | 주식회사 알티캐스트 | System and method for detecting abnormal behavior based on unified model |
| CN108184144A (en) * | 2017-12-27 | 2018-06-19 | 广州虎牙信息科技有限公司 | A kind of live broadcasting method, device, storage medium and electronic equipment |
| US20190205771A1 (en) * | 2017-12-28 | 2019-07-04 | National Taiwan University | Detective method and system for activity-or-behavior model construction and automatic detection of the abnormal activities or behaviors of a subject system without requiring prior domain knowledge |
| CN108905209A (en) * | 2018-06-11 | 2018-11-30 | 网易（杭州）网络有限公司 | Plug-in detection method and system, electronic equipment and storage medium in game |
| CN109464807A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| CN110075524A (en) * | 2019-05-10 | 2019-08-02 | 腾讯科技（深圳）有限公司 | Anomaly detection method and device |
| CN110347724A (en) * | 2019-07-12 | 2019-10-18 | 深圳众赢维融科技有限公司 | Abnormal behaviour recognition methods, device, electronic equipment and medium |
| CN110876851A (en) * | 2019-11-20 | 2020-03-13 | 腾讯科技（深圳）有限公司 | Plug-in identification method, server, system and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 刘闯: "网络游戏外挂与反外挂技术的研究与应用", 《中国优秀硕士学位论文全文数据库 信息科技辑》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113297884A (en) * | 2020-07-29 | 2021-08-24 | 阿里巴巴集团控股有限公司 | Abnormal behavior determination method and device and electronic equipment |
| CN114071196A (en) * | 2020-08-03 | 2022-02-18 | 武汉斗鱼鱼乐网络科技有限公司 | Method, system, medium and equipment for identifying target live broadcast room |
| CN113191845A (en) * | 2021-05-07 | 2021-07-30 | 武汉新之扬电子商务有限公司 | Online live shopping platform data analysis processing method, system, equipment and computer storage medium |
| CN113742719A (en) * | 2021-08-26 | 2021-12-03 | 深圳依时货拉拉科技有限公司 | Order grabbing and plug-in hanging detection method and computer equipment |
| CN113742719B (en) * | 2021-08-26 | 2022-04-15 | 深圳依时货拉拉科技有限公司 | Order grabbing and plug-in hanging detection method and computer equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111417021B (en) | 2022-07-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111417021B (en) | Plug-in identification method and device, computer equipment and readable storage medium | |
| US10313726B2 (en) | Distributing media content via media channels based on associated content being provided over other media channels | |
| US9559992B2 (en) | System and method for updating information in an instant messaging application | |
| CN108763579B (en) | Search content recommendation method and device, terminal device and storage medium | |
| WO2022247220A9 (en) | Interface processing method and apparatus | |
| CN108600817B (en) | Smart television and method for facilitating browsing of application installation progress in display device | |
| CN108205408B (en) | Message display method and device | |
| CN108549567B (en) | Animation display method, device, terminal, server and storage medium | |
| US11818428B2 (en) | Identifying viewing characteristics of an audience of a content channel | |
| CN103778174A (en) | Apparatus and method for scene change detection-based trigger for audio fingerprinting analysis | |
| US9204205B1 (en) | Viewing advertisements using an advertisement queue | |
| WO2015149321A1 (en) | Personal digital engine for user empowerment and method to operate the same | |
| CN105824499A (en) | Window control method and mobile terminal | |
| CN107153684A (en) | Display methods, device and the equipment of PUSH message | |
| CN105488109A (en) | Content item configuration method, device and system | |
| CN103918277B (en) | The system and method for the confidence level being just presented for determining media item | |
| CN111159536A (en) | Method and equipment for pushing presentation information in reading application | |
| KR20150019668A (en) | Supporting Method For suggesting information associated with search and Electronic Device supporting the same | |
| CN111083534B (en) | Method and equipment for providing recommended video list | |
| CN112306606A (en) | Method and equipment for presenting control style | |
| CN104657805A (en) | Real Estate Information Analysis Management System And Method | |
| CN112291602B (en) | Video playing method, electronic equipment and storage medium | |
| JP2024505316A (en) | Application testing methods, equipment, electronic equipment and storage media | |
| CN111625737B (en) | Label display method, device, equipment and storage medium | |
| CN114430504A (en) | Recommendation method and related device for media content |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |