CN111552717A - Method, device, server and storage medium for identifying disguised object - Google Patents
Method, device, server and storage medium for identifying disguised object Download PDFInfo
- Publication number
- CN111552717A CN111552717A CN202010326592.1A CN202010326592A CN111552717A CN 111552717 A CN111552717 A CN 111552717A CN 202010326592 A CN202010326592 A CN 202010326592A CN 111552717 A CN111552717 A CN 111552717A
- Authority
- CN
- China
- Prior art keywords
- score
- object node
- node
- disguised
- camouflage
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 71
- 238000003860 storage Methods 0.000 title claims abstract description 25
- 230000007613 environmental effect Effects 0.000 claims abstract description 51
- 238000005457 optimization Methods 0.000 claims abstract description 33
- 230000008569 process Effects 0.000 claims description 29
- 230000000694 effects Effects 0.000 claims description 10
- 238000004422 calculation algorithm Methods 0.000 claims description 5
- 238000005295 random walk Methods 0.000 claims description 4
- 238000004590 computer program Methods 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 15
- 230000000644 propagated effect Effects 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 238000012804 iterative process Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000005065 mining Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 238000007635 classification algorithm Methods 0.000 description 1
- 230000007123 defense Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2465—Query processing support for facilitating data mining operations in structured databases
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/285—Clustering or classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/01—Social networking
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Business, Economics & Management (AREA)
- Databases & Information Systems (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Marketing (AREA)
- General Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Economics (AREA)
- Health & Medical Sciences (AREA)
- Human Resources & Organizations (AREA)
- Entrepreneurship & Innovation (AREA)
- Development Economics (AREA)
- Computing Systems (AREA)
- Finance (AREA)
- General Health & Medical Sciences (AREA)
- Accounting & Taxation (AREA)
- Primary Health Care (AREA)
- Tourism & Hospitality (AREA)
- Fuzzy Systems (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the invention discloses a method, a device, a server and a storage medium for identifying a disguised object. Wherein, the method comprises the following steps: generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts; iteratively optimizing the disguised score of each object node in the object topological graph based on the disguised score of the object node, the disguised influence score of the object node under the disguised score of the associated object node and the disguised suspicious score of the object node under the object topological graph; and identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization. The technical scheme provided by the invention can accurately analyze the propagation degree of the disguise influence of each object node to the surrounding associated object nodes in the object topological graph, ensure the accuracy of the disguise state of each object node under the influence of the disguise score of the associated object node, simultaneously avoid the identification omission of the disguise object and improve the comprehensiveness and the accuracy of the identification of the disguise object.
Description
Technical Field
The embodiment of the invention relates to the technical field of internet, in particular to a method, a device, a server and a storage medium for identifying a disguised object.
Background
With the recent increasing competition of the internet industry, a great number of black industry chains for pulling a great amount of illegal gains through batch registration, number raising, number selling, single swiping and the like appear in the network. Nowadays, the network black products (black industry chain) increasingly forge network Protocol (Internet Protocol, IP) addresses, mobile phone numbers, environment factors such as adopted equipment or wireless networks and the like associated with user accounts, and different account environments are forged in a mode of breaking protocols or group control and the like, so that the existing defense of frequency control is avoided, and the fake objects (such as the environment factors forged by the network black products and the user accounts generated by the forged environment factors) in the network black products are increased.
At this time, since the network is in a black production and limited in counterfeiting of the IP address, the mobile phone number, the adopted device, the wireless network, and other environmental factors associated with the user account, when the user account is counterfeited in a large batch by the counterfeit environmental factors, a brand-new account environment cannot be counterfeited for each user account, so that the same environmental factor inevitably exists among different user accounts, for example, different user accounts can log in on the same device, or access webpages under the same IP address, and the like, and at this time, the user accounts can be connected into a community through the association among the environmental factors of the different user accounts.
Currently, the masquerading account existing in each community is generally detected in two ways: 1) continuously learning the characteristics of the existing disguised account numbers through a machine learning classification algorithm so as to predict other disguised account numbers in a community, but if a user forges a plurality of account numbers and does not adopt a certain disguised account number to execute illegal income operation, the disguised account number cannot be predicted, and the problem of identification omission of the disguised account number exists; 2) the same environmental factors among a plurality of detected disguised accounts are mined through a graph algorithm, so that a community where the disguised account is located is determined, the community is directly used as a disguised community, and if the normal account and the disguised account access a webpage under the same IP address, the normal account is identified as the disguised account, and the identification accuracy of the disguised account cannot be guaranteed.
Disclosure of Invention
The embodiment of the invention provides a method, a device, a server and a storage medium for identifying a disguised object, which improve the comprehensiveness and accuracy of identification of the disguised object.
In a first aspect, an embodiment of the present invention provides a method for identifying a camouflaged object, where the method includes:
generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts, wherein object nodes in the object topological graph comprise the user accounts and the environmental factors of the user accounts;
iteratively optimizing the disguise score of each object node in the object topological graph based on the disguise score of the object node, the disguise influence score of the object node under the disguise score of the associated object node and the disguise suspicious score of the object node under the object topological graph;
and identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
In a second aspect, an embodiment of the present invention provides an apparatus for identifying a camouflaged object, including:
the topological graph generating module is used for generating a corresponding object topological graph according to the superposition relation of the environmental factors among different user accounts, and object nodes in the object topological graph comprise the user accounts and the environmental factors of the user accounts;
the disguised score iteration module is used for iteratively optimizing the disguised score of each object node in the object topological graph based on the disguised score of the object node, the disguised influence score of the object node under the disguised score of the associated object node and the disguised suspicious score of the object node under the object topological graph;
and the disguised object identification module is used for identifying the corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
In a third aspect, an embodiment of the present invention provides a server, where the server includes:
one or more processors;
storage means for storing one or more programs;
when the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying a disguised object according to any of the embodiments of the present invention.
In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the identification method of a disguised object according to any embodiment of the present invention.
According to the identification method, the device, the server and the storage medium of the disguised object provided by the embodiment of the invention, firstly, according to the overlapping relation of environmental factors among different user account numbers, the user account numbers and the environmental factors are used as object nodes to generate corresponding object topological graphs, then, by analyzing the current disguise scores of each object node, the current disguise scores of the associated object nodes of each object node have disguise influence scores on the object nodes, and the doubtful scores of each object node under the object topological graph, the disguise scores of each object node are subjected to iterative optimization, so that the propagation degree of the disguise influence of each object node to the surrounding associated object nodes in the object topological graph is accurately analyzed, the accuracy of the disguise state of each object node under the influence of the disguise scores of the associated object nodes of each object node is ensured, and the identification omission of the disg, the comprehensiveness and accuracy of the identification of the camouflaged object are improved.
Drawings
Other features, objects and advantages of the invention will become more apparent upon reading of the detailed description of non-limiting embodiments made with reference to the following drawings:
fig. 1A is a flowchart of a method for identifying a disguised object according to an embodiment of the present invention;
fig. 1B is a schematic structural diagram of an object topology diagram in a method according to an embodiment of the present invention;
fig. 1C is a schematic diagram of an identification process of a disguised object according to an embodiment of the present invention;
fig. 2A is a flowchart of a method for identifying a disguised object according to a second embodiment of the present invention;
fig. 2B is a schematic diagram illustrating a calculation process of a disguised influence score and a disguised suspicion score of an object node in the method according to the second embodiment of the present invention;
fig. 3 is a flowchart of a method for identifying a disguised object according to a third embodiment of the present invention;
fig. 4 is a schematic structural diagram of an apparatus for recognizing a camouflaged object according to a fourth embodiment of the present invention;
fig. 5 is a schematic structural diagram of a server according to a fifth embodiment of the present invention.
Detailed Description
The present invention will be described in further detail with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention. It should be further noted that, for the convenience of description, only some of the structures related to the present invention are shown in the drawings, not all of the structures. In addition, the embodiments and features of the embodiments in the present invention may be combined with each other without conflict.
Example one
Fig. 1A is a flowchart of a method for identifying a disguised object according to an embodiment of the present invention, which is applicable to mining a user account and an environmental factor adopted by the user account for network black product counterfeiting in the internet field. The method for identifying a disguised object provided in this embodiment may be performed by the device for identifying a disguised object provided in the embodiment of the present invention, and the device may be implemented in a software and/or hardware manner, and is integrated in a server for performing the method, where the server may be a backend server for various applications related to the forgery of a user account.
Specifically, referring to fig. 1A, the method may include the steps of:
and S110, generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts.
Specifically, when a user logs in a corresponding user account on various application programs, the user account is in a corresponding device environment, that is, the corresponding user account in the application program is operated by adopting various environment factors such as a corresponding network IP address, a device model, a mobile phone number, a wireless network and the like, at this time, the environment factors used by different user accounts are correspondingly different, a large number of environment factors are forged by a network black product in the internet field, so as to provide different device environments for various disguised accounts, at this time, the number of forged environment factors by the network black product is limited, so that a brand new device environment cannot be provided for each disguised account when registering or logging in a large number of disguised accounts in batches, the environment factors used by different disguised accounts are inevitably repeated, for example, the network IP address is adopted in the same batch, and the environment factors used by the different disguised accounts are repeated, When various environmental factors such as equipment model, mobile phone number, wireless network and the like respectively operate a plurality of disguised account numbers, the mobile phone number and the wireless network of a specific disguised account number are changed, but the network IP address and the equipment model are not changed; in addition, even for the normal account, there may be a problem that the used environmental factors are repeated, for example, a user additionally registers a private user account in addition to a general user account, and at this time, the two user accounts can be respectively registered on the same device, so that the device models used by the two normal accounts are the same. Therefore, in the embodiment, the user accounts can be connected into different communities by analyzing whether each environmental factor used by different user accounts is repeated, at this time, both a normal account and a masquerading account may exist in each community, and a topological graph is adopted to represent the corresponding community in the embodiment.
In this embodiment, a large number of user accounts registered in an application program with a disguised account mining requirement are obtained, various environmental factors such as network IP addresses, device models, mobile phone numbers, wireless networks and the like used by the user accounts are analyzed, whether the environmental factors used by different user accounts are repeated is further judged, an environmental factor coincidence relation between different user accounts is obtained, meanwhile, the user accounts are connected through the coincided environmental factors between the different user accounts, and a corresponding object topological graph is generated, as shown in fig. 1B, at this time, an object node in the object topological graph can include the user account and two types of environmental factors used by the user account.
S120, based on the disguise score of the object node, the disguise influence score of the object node under the disguise score of the associated object node and the disguise suspicious score of the object node under the object topological graph, the disguise score of each object node in the object topological graph is optimized in an iterative mode.
Optionally, in order to prevent network blackout from adopting a large number of disguised accounts to extract a large amount of illegal gains, it is required to analyze the security of each user account in the application program, and therefore it is necessary to determine whether the user account or an environmental factor used by the user account is forged by the network blackout, and a manner of scoring the user account or the environmental factor used by the user account can well reflect the security level of the user account or the environmental factor used by the user account.
Meanwhile, by analyzing the common pretended suspicion among different object nodes, for example, assuming that a certain mobile phone number is determined to be forged by network black products, a user account registered by using the mobile phone number is very likely to be a pretended account, or assuming that a certain user account is detected to be a pretended account, other user accounts logged in or actively jumped on the same device as the user account are also very likely to be pretended accounts, so that the pretended characteristics of the object nodes in the object topological graph can be determined to be continuously transmitted outwards through other object nodes which are directly or indirectly connected.
Specifically, in this embodiment, the factors that may affect the masquerading characteristics of the object nodes are divided into three categories, namely, the current masquerading score of the object node itself, the masquerading influence score of the object node by the associated object node directly connected to the object node in the object topological graph, and the masquerading doubtful score of the object node under the influence of the object topological graph, at this time, for each object node in the object topological graph, the current masquerading score of each object node itself is determined continuously and iteratively, and according to the current masquerading score of each associated object node in the object topological graph, the masquerading influence score of each associated object node after the associated object node propagates the current masquerading characteristics to the object node is calculated, and meanwhile, because the attributes of the communities corresponding to different object topological graphs are different, the represented masquerading doubtful degrees, in addition, the activity of each object node in the object topological graph is different, and the degrees of being influenced by masquerading are also different, so that in this embodiment, the attribute of the object topological graph and the activity of the object node in the object topological graph need to be analyzed, the masquerading suspicion score of the object node in the object topological graph is calculated, and then the masquerading score, the masquerading influence score and the masquerading suspicion score of each object node in the object topological graph are continuously adopted, and the masquerading score of each object node in the object topological graph is iteratively optimized, as shown in fig. 1C, until the masquerading score of each object node tends to be stable, iteration is completed, so that the masquerading score of each object node after iterative optimization is used as a score representing the final masquerading characteristic of the object node.
It should be noted that, in the iteration process, the masquerading score of each object node in the object topological graph is continuously optimized, so that the masquerading score of the object node is different in each iteration, and since the masquerading score of each associated object node of the object node is continuously changed in the iteration process, the masquerading influence score of the object node under the masquerading score of each associated object node is also changed in the iteration process, only the suspicion score of the object node under the object topological graph is kept unchanged in the iteration process, the situation that the masquerading score of the object node becomes very low after being iterated for several times under the influence propagation of the associated object nodes is avoided, and the basic stable change of the masquerading score of the object node in the iteration process is ensured.
And S130, identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
Optionally, after the iterative optimization of the masquerading score of each object node in the object topological graph is completed, the object node with the higher masquerading score after the iterative optimization is directly screened out from each object node to be used as the identified masquerading object, and at this time, the masquerading object may include both a masquerading user account and each environmental factor of network black product counterfeiting.
For example, in this embodiment, identifying a corresponding masquerading object according to the masquerading score of each object node after iterative optimization in the object topology map may specifically include: and identifying the object nodes with the camouflage scores exceeding the preset camouflage threshold value after the iterative optimization in the object topological graph as corresponding camouflage objects. Specifically, the camouflage scores of the object nodes after the iterative optimization are divided by a preset camouflage threshold, and the object nodes of which the iterative optimization exceeds the preset camouflage threshold are directly used as the camouflage objects in the embodiment, where the camouflage objects may include camouflage account numbers and camouflage environmental factors.
According to the technical scheme provided by the embodiment, firstly, according to the superposition relationship of the environmental factors among different user accounts, the user accounts and the environmental factors are used as object nodes to generate corresponding object topological graphs, further analyzing the current masquerading score of each object node, the current masquerading score of the related object node of each object node to the object node and the masquerading doubtful score of each object node under the object topological graph, iterative optimization is carried out on the camouflage scores of all the object nodes, so that the camouflage influence propagation degree of all the object nodes to the surrounding associated object nodes in the object topological graph is accurately analyzed, the accuracy of the camouflage state of each object node under the influence of the camouflage scores of the associated object nodes is ensured, meanwhile, the identification omission of the disguised object is avoided, and the comprehensiveness and accuracy of the identification of the disguised object are improved.
Example two
Fig. 2A is a flowchart of a method for identifying a disguised object according to a second embodiment of the present invention, and fig. 2B is a schematic diagram of a principle of a process of calculating a disguised influence score and a disguised suspicion score of an object node according to the second embodiment of the present invention. The embodiment is optimized on the basis of the embodiment. Specifically, as shown in fig. 2A, this embodiment explains in detail a specific calculation process of the masquerading influence score of the object node under the masquerading score of the associated object node and the masquerading suspicion score of the object node under the object topology map.
Optionally, as shown in fig. 2A, the present embodiment may include the following steps:
and S210, generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts.
And S220, determining a corresponding topology suspicious score according to the number of the nodes in the object topology graph and the topology camouflage upper limit.
Optionally, after the corresponding object topological graph is generated according to the overlapping relationship of the environmental factors between different user accounts, the object topological graph is usually unchanged, so that the masquerading suspicion score of each object node under the object topological graph is also fixed and unchanged in the iteration process of the object node. At this time, the masquerading suspicion score of each object node can be represented by the overall masquerading degree of the object topology graph in which the object node is located and the individual activity degree of the object node in the object topology graph in which the object node is located.
Specifically, because the environmental factors used between the normal user accounts are usually operated on the personal devices of the normal users, the contact ratio of the environmental factors used between the normal user accounts is low, so that the number of object nodes in the object topology diagram where the normal user accounts are located is low, and the contact ratio of the environmental factors used between the disguised user accounts is high, so that the number of object nodes in the object topology diagram where the normal user accounts are located is also high, in this embodiment, after the corresponding object topology diagram is generated according to the contact relationship of the environmental factors between different user accounts, the disguising degree of the object topology diagram is determined according to the number of nodes in the object topology diagram. At this time, a topology masquerading upper limit is preset in this embodiment, when the number of nodes in the object topology graph exceeds the topology masquerading upper limit, it may be determined that a community connected to each user account in the object topology graph is a masquerading community, and when the number of nodes in the object topology graph does not exceed the topology masquerading upper limit, a topology suspicious score of the object topology graph adjacent to the masquerading community is analyzed by determining a difference between the number of nodes in the object topology graph and the topology masquerading upper limit.
Illustratively, if the preset upper limit of topology masquerading is 500, if the number of nodes in the object topological graph exceeds 500, the suspicious topology score of the object topological graph is determined to be 1; and if the number N of the nodes in the object topological graph does not exceed 500, determining that the topological suspicious score of the object topological graph is N/500.
And S230, calculating the activity score of the object node under the object topological graph by adopting a random walk algorithm.
Specifically, the activity degree of each object node in the object topological graph is analyzed by judging the connectivity of each object node and other object nodes, at this time, if a user account in the object node is communicated with a large number of environment factors, it is indicated that the user account can log in a plurality of devices or a plurality of mobile phone numbers and the like, and the usage habit of the user account is not normal, and if a certain environment factor in the object node is communicated with a large number of user accounts, it is indicated that the environment factors are used by a plurality of user accounts, and the usage habit of the normal environment factors is not normal; therefore, in the present embodiment, under the condition that the topology suspicious score of the object topology map is determined, the masquerading suspicious score of each object node under the object topology map can be further determined by analyzing the activity degree of each object node in the object topology map.
For example, in the present embodiment, an existing random walk algorithm (PageRank) is used to analyze the activity degree of each object node under the object topology, at this time, a range of PageRank values calculated by the random walk algorithm is usually (0.1,3), so that the activity score of each object node under the object topology designed in the present embodiment may be (PageRank value-0.1)/3.
S240, carrying out weighted summation on the topology suspicious score and the activity score to obtain the disguised suspicious score of the object node under the object topology graph.
Optionally, according to a preset overall weight and an individual active weight under the object topological graph, the topological suspicious score of the object topological graph and the active score of each object node under the object topological graph are weighted and summed respectively, and the disguised suspicious score of the object node under the object topological graph is determined in sequence.
And S250, iteratively optimizing the disguise score of each object node in the object topological graph based on the disguise score of the object node, the disguise influence score of the object node under the disguise score of the associated object node and the disguise suspicious score of the object node under the object topological graph.
Optionally, in the iterative optimization process of each object node in the object topology map, the masquerading score of each object node may change iteratively, that is, the masquerading score of each associated object node of a certain object node also changes iteratively, so that the influence degree of the object node on the masquerading score of each associated object node changes, and therefore, the masquerading influence score of the object node under the masquerading score of the associated object node needs to be calculated once in each iteration process of each object node.
In this embodiment, in each iteration process of each object node, as shown in fig. 2B, a calculation process of the disguise influence score of the object node under the disguise score of the associated object node may specifically include: finding out related object nodes of the object nodes in the object topological graph, and determining the camouflage score of each related object node in the current iteration process of the object nodes; respectively calculating the influence superposition score of the masquerading score of each associated object node of which the masquerading score exceeds a preset masquerading threshold under the propagation weight of the associated object node for the object node and the influence average score of the masquerading score of each associated object node of which the masquerading score does not exceed the preset masquerading threshold under the propagation weight of the associated object node for the object node in the current iteration process of the object node; and taking the maximum value of the influence superposition score and the influence average score as the disguised influence score of the object node under the disguised score of the associated object node in the current iteration process.
Specifically, for each object node in the object topological graph, firstly, each associated object node directly connected with the object node in the object topological graph is found out, and the disguise score of each associated object node in the current iteration process of the object node is determined; at this time, the associated object nodes of each object node include two associated object nodes whose masquerading score exceeds the preset masquerading threshold and two associated object nodes whose masquerading score does not exceed the preset masquerading threshold, and each associated object node whose masquerading score exceeds the preset masquerading threshold transmits a certain extent of masquerading attributes to the object node, so that the object node has a certain superposition property for the influence degree of each associated object node whose masquerading score exceeds the preset masquerading threshold, and each associated object node whose masquerading score does not exceed the preset masquerading threshold transmits a certain extent of normal attributes to the object node, at this time, since the object node whose masquerading score does not exceed the preset masquerading threshold is a normal node, in order to avoid that the transmitted normal attributes exceed the preset masquerading threshold after superposition, in this embodiment, the influence degree of the object node for each associated object node whose masquerading score does not Average of (2).
Further, because the characteristics of the environmental factors used between a certain object node and each associated object node are different, so that the degrees of the disguised attribute or the normal attribute propagated to the object node by each associated object node are also different, when the disguised influence score of the object node under the disguised score of the associated object node is calculated, the embodiment also calculates the disguised influence score of the object node under the disguised score of the associated object nodeFor example, because a normal user account almost uses a unique mobile phone number, if two user accounts use the same mobile phone number, the user account is most likely to be a masquerading account, that is, the propagation weight is set to be larger for an environmental factor of the mobile phone number, and for a wireless network, a same wireless network can be used for normal different user accounts, the propagation weight is set to be smaller for the wireless network, therefore, in the embodiment, for the environmental factor characteristics used between each object node and each associated object node of the object node, corresponding propagation weights are respectively set, further, for each associated object node of each object node, firstly, the associated object node with the superposition Score exceeding the preset masquerading threshold is distinguished, and the associated object node with the superposition Score not exceeding the preset masquerading threshold is distinguished, at this time, the propagation property of the associated object node with the superposition Score exceeding the preset masquerading threshold is calculated under the propagation weight of each associated object node exceeding the preset masquerading threshold, and the current propagation weight of the associated object node with the superposition Score exceeding the preset masquerading threshold is calculated as a Score 35min (the superposition Score of each associated object node is calculated as a Score, and the Score of each associated object node is calculated as a Score which exceeds the preset masquerading threshold, and the current propagation weight of the current associated object node, wherein the superposition Score is calculated as a Score of thei*Weighti) 1), where B is the influence superposition Score, ScoreiIs the camouflage score, Weight, of the ith associated object node in the current iteration processiThe propagation weight of the ith associated object node is set, and meanwhile, the highest score set in the embodiment is 1, so that the calculated weighted summation result and the size of 1 are judged; meanwhile, for the propagation averageness of the associated object nodes of which the masquerading scores do not exceed the preset masquerading threshold, the average calculation of the sum of the propagation weights is further carried out on the weighted sum result on the basis of carrying out weighted sum on the masquerading scores of the associated object nodes of which the masquerading scores do not exceed the preset masquerading threshold in the current iteration process of the object nodes by adopting the propagation weights of the associated object nodes, so that the object nodes are obtainedAiming at the influence average score of each associated object node of which the camouflage score does not exceed the preset camouflage threshold value; at this time, the influence superposition score may be used as a camouflage influence degree after the camouflage object is propagated, and the influence average score is used as a normal influence degree after the normal object is propagated, so in this embodiment, the influence superposition score and the influence average score of each object node are compared, and a maximum value of the influence superposition score and the influence average score is used as a camouflage influence score of the object node under the camouflage score of the associated object node in the current iteration process, so that the subsequent iteration optimization is performed on the camouflage score of each object node.
And S260, identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
The technical solution provided in this embodiment is to classify the associated object nodes of each object node, and respectively calculate the influence superposition score representing the masquerading propagation degree and the influence average score representing the normal propagation degree, and further take the maximum value of the influence superposition score and the influence average score as the masquerading influence score of the object node under the masquerading score of the associated object node in the current iteration process, so as to ensure the accuracy of the masquerading influence score of each object node in the iteration process, and simultaneously respectively calculate the masquerading suspicion score of each object node under the object topology map from the topology suspicion score of the object topology map and the active score of each object node under the object topology map, so as to ensure the accuracy of the masquerading score of the object node, thereby accurately implementing the iterative optimization of the masquerading score of each object node, and avoiding the identification omission of, the comprehensiveness and accuracy of the identification of the camouflaged object are improved.
EXAMPLE III
Fig. 3 is a flowchart of a method for identifying a disguised object according to a third embodiment of the present invention. The embodiment is optimized on the basis of the embodiment. Specifically, as shown in fig. 3, this embodiment explains in detail a specific iterative process of masquerading scoring of each object node in the object topology diagram.
Optionally, as shown in fig. 3, the present embodiment may include the following steps:
and S310, generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts.
S320, acquiring the initial disguise score and the disguise suspicion score of each object node in the object topological graph, and calculating the initial disguise influence score of each object node under the initial disguise score of the associated object node.
Optionally, in this embodiment, an existing detection manner of the disguised object may be adopted to determine whether a historical disguise behavior exists before each object node in the object topology map, determine that an initial disguise score of an object node which has been detected as the disguise object is 1, and set an initial disguise score of other object nodes as 0 by taking other object nodes as normal nodes at the beginning; for example, in this embodiment, the obtaining of the initial disguise score of each object node in the object topology map may specifically be: and analyzing the historical disguise behavior of each object node in the object topological graph, and determining the initial disguise score of the object node.
Meanwhile, as the masquerading suspicious score of each object node under the object topological graph is fixed and unchangeable in the iterative process of the object node, the masquerading suspicious score of each object node under the object topological graph can be calculated in advance before the iterative optimization of the masquerading suspicious score of the object node is executed, and the masquerading suspicious score of each object node is calculated historically from two aspects of the topological suspicious score of the object topological graph and the active score of each object node under the object topological graph.
Further, in the iterative process of the masquerading score of each object node, each associated object node of the object node in the object topological graph needs to be found out, and according to the initial masquerading score of each associated object node of the object node and the corresponding propagation weight, the current masquerading characteristic of each associated object node is calculated, namely the initial masquerading influence score of the object node after the initial masquerading score is propagated to the object node, so that the masquerading score of the object node is iterated according to the initial masquerading score, the initial masquerading influence score and the masquerading suspicious score of each object node.
S330, the initial camouflage score, the initial camouflage influence score and the camouflage suspicious score of each object node in the object topological graph are weighted and summed respectively, and the weighted and summed result of each object node is used as a new initial camouflage score of the object node.
Optionally, in this embodiment, the camouflage score of each object node is iteratively optimized from three aspects, namely the initial camouflage score, the initial camouflage influence score and the camouflage suspected score of each object node, and for the influence degrees of different aspects on the iterative optimization, corresponding feature weights are preset in different aspects in this embodiment, so that in this embodiment, before the camouflage score of each object node in the iterative optimization object topological graph is iteratively optimized, the feature weights preset by the object node for the camouflage score, the camouflage influence score and the camouflage suspected score are also respectively determined, feature weights preset by the object node for the camouflage score, the camouflage influence score and the suspected score for the three aspects, the initial camouflage score, the initial camouflage influence score and the camouflage score of each object node are weighted and summed, and then the weighted and summed result of each object node is used as a new initial camouflage score of the object node, the iterative process continues.
S340, calculating a new initial camouflage influence score of each object node under the new initial camouflage score of the associated object node, continuously carrying out weighted summation on the new initial camouflage score, the new initial camouflage influence score and the camouflage suspicious score of each object node until the new initial camouflage score of each object node in the object topological graph tends to converge, and taking the new initial camouflage score which tends to converge under each object node as the camouflage score of the object node after iterative optimization.
Optionally, after obtaining a new initial masquerading score of each object node, iterating the object nodes again, because the new initial masquerading score of each associated object node of the object node changes in the current iteration process, recalculating the new initial masquerading score of each associated object node of the object node, which is propagated to the new initial masquerading influence score of the object node under the corresponding propagation weight, and further continuing to perform weighted summation on the new initial masquerading score, the new initial masquerading influence score and the suspicion score of each object node, thereby continuously performing the iteration process of each object node until the new initial masquerading score of each object node in the object topological graph tends to converge, that is, the new initial masquerading score of each object node in the iteration process hardly changes, and determining that the iteration process ends, and taking the new initial camouflage score which tends to be converged under each object node as the camouflage score of the object node after iterative optimization, so as to identify the corresponding camouflage object according to the camouflage score of each object node after iterative optimization.
And S350, identifying corresponding disguised objects according to the disguised scores of all object nodes in the object topological graph after iterative optimization.
According to the technical scheme provided by the embodiment, firstly, according to the superposition relationship of the environmental factors among different user accounts, the user accounts and the environmental factors are used as object nodes to generate corresponding object topological graphs, further analyzing the current masquerading score of each object node, the current masquerading score of the related object node of each object node to the object node and the masquerading doubtful score of each object node under the object topological graph, iterative optimization is carried out on the camouflage scores of all the object nodes, so that the camouflage influence propagation degree of all the object nodes to the surrounding associated object nodes in the object topological graph is accurately analyzed, the accuracy of the camouflage state of each object node under the influence of the camouflage scores of the associated object nodes is ensured, meanwhile, the identification omission of the disguised object is avoided, and the comprehensiveness and accuracy of the identification of the disguised object are improved.
Example four
Fig. 4 is a schematic structural diagram of an apparatus for recognizing a disguised object according to a fourth embodiment of the present invention, specifically, as shown in fig. 4, the apparatus may include:
a topological graph generating module 410, configured to generate a corresponding object topological graph according to an environmental factor coincidence relation between different user accounts, where an object node in the object topological graph includes a user account and an environmental factor of the user account;
the masquerading score iteration module 420 is used for iteratively optimizing the masquerading score of each object node in the object topological graph based on the masquerading score of the object node, the masquerading influence score of the object node under the masquerading score of the associated object node and the masquerading suspicious score of the object node under the object topological graph;
and the disguised object identification module 430 is configured to identify a corresponding disguised object according to the disguised score of each object node in the object topology after iterative optimization.
According to the technical scheme provided by the embodiment, firstly, according to the superposition relationship of the environmental factors among different user accounts, the user accounts and the environmental factors are used as object nodes to generate corresponding object topological graphs, further analyzing the current masquerading score of each object node, the current masquerading score of the related object node of each object node to the object node and the masquerading doubtful score of each object node under the object topological graph, iterative optimization is carried out on the camouflage scores of all the object nodes, so that the camouflage influence propagation degree of all the object nodes to the surrounding associated object nodes in the object topological graph is accurately analyzed, the accuracy of the camouflage state of each object node under the influence of the camouflage scores of the associated object nodes is ensured, meanwhile, the identification omission of the disguised object is avoided, and the comprehensiveness and accuracy of the identification of the disguised object are improved.
The identification device for the disguised object provided by the embodiment can be applied to the identification method for the disguised object provided by any embodiment, and has corresponding functions and beneficial effects.
EXAMPLE five
Fig. 5 is a schematic structural diagram of a server according to a fifth embodiment of the present invention, and as shown in fig. 5, the server includes a processor 50, a storage device 51, and a communication device 52; the number of the processors 50 in the server may be one or more, and one processor 50 is taken as an example in fig. 5; the processor 50, the storage device 51 and the communication device 52 in the server may be connected by a bus or other means, and the bus connection is taken as an example in fig. 5.
The storage device 51, which is a computer-readable storage medium, may be used to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the identification method of a disguised object according to any embodiment of the present invention. The processor 50 executes various functional applications of the server and data processing, that is, implements the recognition method of the disguised object, by running software programs, instructions, and modules stored in the storage device 51.
The storage device 51 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the terminal, and the like. Further, the storage 51 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device. In some examples, the storage 51 may further include memory located remotely from the processor 50, which may be connected to the device over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The communication device 52 may be used to enable a network connection or a mobile data connection between the client and the server.
The server provided by the embodiment can be used for executing the identification method of the disguised object provided by any of the above embodiments, and has corresponding functions and beneficial effects.
EXAMPLE six
An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, can implement the method for identifying a disguised object in any of the above embodiments.
The method specifically comprises the following steps:
generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts, wherein object nodes in the object topological graph comprise the user accounts and the environmental factors of the user accounts;
iteratively optimizing the disguised score of each object node in the object topological graph based on the disguised score of the object node, the disguised influence score of the object node under the disguised score of the associated object node and the disguised suspicious score of the object node under the object topological graph;
and identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
Of course, the storage medium provided by the embodiment of the present invention contains computer-executable instructions, and the computer-executable instructions are not limited to the operations of the method described above, and may also perform related operations in the identification method of a disguised object provided by any embodiment of the present invention.
From the above description of the embodiments, it is obvious for those skilled in the art that the present invention can be implemented by software and necessary general hardware, and certainly, can also be implemented by hardware, but the former is a better embodiment in many cases. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which may be stored in a computer-readable storage medium, such as a floppy disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a FLASH Memory (FLASH), a hard disk or an optical disk of a computer, and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device) to execute the methods according to the embodiments of the present invention.
It should be noted that, in the embodiment of the identification apparatus for a disguised object, the included units and modules are only divided according to functional logic, but are not limited to the above division as long as the corresponding functions can be realized; in addition, specific names of the functional units are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present invention.
The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (11)
1. A method of identifying a camouflaged object, comprising:
generating a corresponding object topological graph according to the overlapping relation of the environmental factors among different user accounts, wherein object nodes in the object topological graph comprise the user accounts and the environmental factors of the user accounts;
iteratively optimizing the disguise score of each object node in the object topological graph based on the disguise score of the object node, the disguise influence score of the object node under the disguise score of the associated object node and the disguise suspicious score of the object node under the object topological graph;
and identifying a corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
2. The method of claim 1, wherein iteratively optimizing the masquerading score of each object node in the object topology map based on the masquerading score of the object node, the masquerading impact score of the object node under the masquerading score of an associated object node, and the masquerading suspicion score of the object node under the object topology map comprises:
acquiring an initial disguise score and a disguise suspicion score of each object node in the object topological graph, and calculating an initial disguise influence score of each object node under the initial disguise score of the associated object node;
respectively carrying out weighted summation on the initial camouflage score, the initial camouflage influence score and the camouflage suspicious score of each object node in the object topological graph, and taking the weighted summation result of each object node as a new initial camouflage score of the object node;
calculating a new initial camouflage influence score of each object node under the new initial camouflage score of the associated object node, continuously carrying out weighted summation on the new initial camouflage score, the new initial camouflage influence score and the camouflage suspicious score of each object node until the new initial camouflage score of each object node in the object topological graph tends to converge, and taking the new initial camouflage score which tends to converge under each object node as the camouflage score of the object node after iterative optimization.
3. The method of claim 2, wherein obtaining an initial masquerading score for each object node in the object topology graph comprises:
and analyzing the historical disguise behavior of each object node in the object topological graph, and determining the initial disguise score of the object node.
4. The method of claim 2, further comprising, prior to iteratively optimizing the masquerading score for each object node in the object topology graph:
and respectively determining the preset characteristic weights of the object nodes aiming at the disguise score, the disguise influence score and the disguise doubtful score.
5. The method according to any one of claims 1 to 4, wherein the disguise impact score of the subject node under the disguise score of the associated subject node is calculated by:
finding out related object nodes of the object nodes in the object topological graph, and determining a camouflage score of each related object node in the current iteration process of the object nodes;
respectively calculating influence superposition scores of the camouflage scores of all the associated object nodes of which the camouflage scores exceed a preset camouflage threshold under the propagation weight of the associated object nodes for the object nodes and influence average scores of the camouflage scores of all the associated object nodes of which the camouflage scores do not exceed the preset camouflage threshold under the propagation weight of the associated object nodes for the object nodes in the current iteration process of the object nodes;
and taking the maximum value of the influence superposition score and the influence average score as a disguised influence score of the object node under the disguised score of the associated object node in the current iteration process.
6. The method of claim 5, further comprising, prior to iteratively optimizing the masquerading score for each object node in the object topology graph:
and respectively determining the propagation weight of each object node in the object topological graph for each associated object node.
7. The method according to any one of claims 1-4, wherein the camouflaging suspicion score of the object node under the object topology map is calculated by:
determining a corresponding topology suspicious score according to the number of nodes in the object topology graph and the topology camouflage upper limit;
calculating the activity score of the object node under the object topological graph by adopting a random walk algorithm;
and carrying out weighted summation on the topology suspicious scores and the active scores to obtain the disguised suspicious scores of the object nodes under the object topology graph.
8. The method according to any one of claims 1 to 4, wherein identifying a corresponding masquerading object according to the masquerading score of each object node in the object topology graph after iterative optimization comprises:
and identifying the object nodes with the camouflage scores exceeding the preset camouflage threshold value after the iterative optimization in the object topological graph as corresponding camouflage objects.
9. An apparatus for recognizing a camouflaged object, comprising:
the topological graph generating module is used for generating a corresponding object topological graph according to the superposition relation of the environmental factors among different user accounts, and object nodes in the object topological graph comprise the user accounts and the environmental factors of the user accounts;
the disguised score iteration module is used for iteratively optimizing the disguised score of each object node in the object topological graph based on the disguised score of the object node, the disguised influence score of the object node under the disguised score of the associated object node and the disguised suspicious score of the object node under the object topological graph;
and the disguised object identification module is used for identifying the corresponding disguised object according to the disguised score of each object node in the object topological graph after iterative optimization.
10. A server, characterized in that the server comprises:
one or more processors;
storage means for storing one or more programs;
when executed by the one or more processors, cause the one or more processors to implement a method of identifying a camouflage object as recited in any one of claims 1 to 8.
11. A computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out a method of identifying a disguised object as claimed in any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010326592.1A CN111552717B (en) | 2020-04-23 | 2020-04-23 | Method, device, server and storage medium for identifying disguised object |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010326592.1A CN111552717B (en) | 2020-04-23 | 2020-04-23 | Method, device, server and storage medium for identifying disguised object |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111552717A true CN111552717A (en) | 2020-08-18 |
| CN111552717B CN111552717B (en) | 2023-04-18 |
Family
ID=72002563
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010326592.1A Active CN111552717B (en) | 2020-04-23 | 2020-04-23 | Method, device, server and storage medium for identifying disguised object |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111552717B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114006737A (en) * | 2021-10-25 | 2022-02-01 | 北京三快在线科技有限公司 | Account security detection method and detection device |
| CN115086053A (en) * | 2022-06-23 | 2022-09-20 | 支付宝(杭州)信息技术有限公司 | Method and system for identifying disguised device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106301978A (en) * | 2015-05-26 | 2017-01-04 | 阿里巴巴集团控股有限公司 | The recognition methods of gang member account, device and equipment |
| CN106330837A (en) * | 2015-06-30 | 2017-01-11 | 阿里巴巴集团控股有限公司 | Suspicious network user identification method and device |
| CN110390585A (en) * | 2019-07-25 | 2019-10-29 | ***股份有限公司 | A kind of method and device identifying exception object |
| CN110798467A (en) * | 2019-10-30 | 2020-02-14 | 腾讯科技（深圳）有限公司 | Target object identification method and device, computer equipment and storage medium |
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
-
2020
- 2020-04-23 CN CN202010326592.1A patent/CN111552717B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106301978A (en) * | 2015-05-26 | 2017-01-04 | 阿里巴巴集团控股有限公司 | The recognition methods of gang member account, device and equipment |
| CN106330837A (en) * | 2015-06-30 | 2017-01-11 | 阿里巴巴集团控股有限公司 | Suspicious network user identification method and device |
| CN110390585A (en) * | 2019-07-25 | 2019-10-29 | ***股份有限公司 | A kind of method and device identifying exception object |
| CN110798467A (en) * | 2019-10-30 | 2020-02-14 | 腾讯科技（深圳）有限公司 | Target object identification method and device, computer equipment and storage medium |
| CN111031017A (en) * | 2019-11-29 | 2020-04-17 | 腾讯科技（深圳）有限公司 | Abnormal business account identification method, device, server and storage medium |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114006737A (en) * | 2021-10-25 | 2022-02-01 | 北京三快在线科技有限公司 | Account security detection method and detection device |
| CN114006737B (en) * | 2021-10-25 | 2023-09-01 | 北京三快在线科技有限公司 | Account safety detection method and detection device |
| CN115086053A (en) * | 2022-06-23 | 2022-09-20 | 支付宝(杭州)信息技术有限公司 | Method and system for identifying disguised device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111552717B (en) | 2023-04-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105590055B (en) | Method and device for identifying user credible behaviors in network interaction system | |
| CN109922065B (en) | Quick identification method for malicious website | |
| CN112926990B (en) | Method and device for fraud detection | |
| CN113344562B (en) | Method and device for detecting Etheng phishing accounts based on deep neural network | |
| CN107888606B (en) | Domain name credit assessment method and system | |
| CN108023868B (en) | Malicious resource address detection method and device | |
| CN109600362B (en) | Zombie host recognition method, device and medium based on recognition model | |
| CN108418777A (en) | A kind of fishing mail detection method, apparatus and system | |
| CN111552717B (en) | Method, device, server and storage medium for identifying disguised object | |
| Malaysia | ‘An enhanced online phishing e-mail detection framework based on evolving connectionist system | |
| CN110855716B (en) | Self-adaptive security threat analysis method and system for counterfeit domain names | |
| Vilas et al. | Detection of phishing website using machine learning approach | |
| CN107231383B (en) | CC attack detection method and device | |
| Hostiadi et al. | Hybrid model for bot group activity detection using similarity and correlation approaches based on network traffic flows analysis | |
| CN113965419B (en) | Method and device for judging attack success through reverse connection | |
| Mohanty et al. | MFBFST: Building a stable ensemble learning model using multivariate filter-based feature selection technique for detection of suspicious URL | |
| Vaishnavi et al. | A comparative analysis of machine learning algorithms on malicious URL prediction | |
| CN111885011B (en) | Method and system for analyzing and mining safety of service data network | |
| Sampat et al. | Detection of phishing website using machine learning | |
| Jain | Phishing websites detection using machine learning | |
| Solanki et al. | Website phishing detection using heuristic based approach | |
| CN116886400A (en) | Malicious domain name detection method, system and medium | |
| CN109587248B (en) | User identification method, device, server and storage medium | |
| Thanh et al. | An approach to reduce data dimension in building effective network intrusion detection systems | |
| CN108256327B (en) | File detection method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20231009 Address after: 31a, 15th floor, building 30, maple commercial city, bangrang Road, Brazil Patentee after: Baiguoyuan Technology (Singapore) Co.,Ltd. Address before: 5-13 / F, West Tower, building C, 274 Xingtai Road, Shiqiao street, Panyu District, Guangzhou, Guangdong 510000 Patentee before: GUANGZHOU BAIGUOYUAN INFORMATION TECHNOLOGY Co.,Ltd. |