WO2017211157A1 - 关联账户的监控方法及装置 - Google Patents

关联账户的监控方法及装置 Download PDF

Info

Publication number
WO2017211157A1
WO2017211157A1 PCT/CN2017/083761 CN2017083761W WO2017211157A1 WO 2017211157 A1 WO2017211157 A1 WO 2017211157A1 CN 2017083761 W CN2017083761 W CN 2017083761W WO 2017211157 A1 WO2017211157 A1 WO 2017211157A1
Authority
WO
WIPO (PCT)
Prior art keywords
account
accounts
current
associated account
monitoring
Prior art date
Application number
PCT/CN2017/083761
Other languages
English (en)
French (fr)
Inventor
卞志俊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017211157A1 publication Critical patent/WO2017211157A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0633—Lists, e.g. purchase orders, compilation or processing
    • G06Q30/0635—Processing of requisition or of purchase orders
    • G06Q30/0637—Approvals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • the present invention relates to the field of communications, and in particular, to a method and apparatus for monitoring an associated account.
  • the cybercrime group attacks the target merchant by registering a large number of accounts, or by exploiting a large number of real accounts that are greedy and profitable.
  • the embodiment of the invention provides a method and a device for monitoring an associated account, so as to at least solve the problem that the related technology cannot be monitored in the related art, resulting in low control efficiency of the account.
  • a method for monitoring an associated account including: identifying a related account according to a unique feature identifier of a plurality of current accounts and/or behavior characteristics of the current plurality of accounts within a predetermined time; Whether the number of accounts of the associated account exceeds a first predetermined threshold; if the determination result is yes, a monitoring identifier is set for each account in the associated account to monitor the associated account according to the monitoring identifier.
  • the unique feature identifier includes at least one of the following: a mobile phone number bound by the current account when registering, a media access control MAC address when the current account accesses the network, and an IP address of the current account when accessing the network.
  • the identifying the associated account according to the unique feature identifier of the current multiple accounts includes: acquiring the phase a plurality of accounts identified by the unique feature; the plurality of accounts acquired are taken as the associated accounts.
  • the identifying the associated account according to the behavior characteristics of the current plurality of accounts within a predetermined time comprises: acquiring a cumulative number of times that the current plurality of accounts respectively access the plurality of transaction objects within a predetermined time; A plurality of accounts of the second predetermined threshold are used as the associated accounts.
  • the monitoring, by the monitoring identifier, the associated account comprises: periodically monitoring the associated account according to the monitoring identifier.
  • an apparatus for monitoring an associated account comprising: an identification module, configured to identify a unique feature of the current plurality of accounts and/or behavior of the current plurality of accounts within a predetermined time a feature identifying associated account; a determining module, configured to determine whether the number of accounts of the associated account exceeds a first predetermined threshold; and a processing module, configured to set, for each account in the associated account, if the determination result is yes Monitoring the identity to monitor the associated account based on the monitoring identity.
  • the unique feature identifier includes at least one of the following: a mobile phone number bound by the current account when registering, a media access control MAC address when the current account accesses the network, and an IP address of the current account when accessing the network.
  • the identifying module includes: a first acquiring unit, configured to acquire a plurality of accounts having the same unique feature identifier; and a first setting unit, configured to use the acquired multiple accounts as the associated accounts.
  • the identifying module further includes: a second acquiring unit, configured to acquire a cumulative number of times that the current plurality of accounts respectively access the plurality of transaction objects within a predetermined time; and a second setting unit, configured to: the cumulative number of times is greater than A plurality of accounts of the second predetermined threshold are used as the associated accounts.
  • a second acquiring unit configured to acquire a cumulative number of times that the current plurality of accounts respectively access the plurality of transaction objects within a predetermined time
  • a second setting unit configured to: the cumulative number of times is greater than A plurality of accounts of the second predetermined threshold are used as the associated accounts.
  • the processing module is further configured to periodically monitor the associated account according to the monitoring identifier.
  • a computer readable storage medium is also provided.
  • the storage medium is configured to store program code for performing the following steps: identifying an associated account based on a unique feature identifier of the current plurality of accounts and/or behavior characteristics of the current plurality of accounts within a predetermined time; determining the associated account Whether the number of accounts exceeds a first predetermined threshold; if the determination result is yes, a monitoring identifier is set for each account in the associated account to monitor the associated account according to the monitoring identifier.
  • the embodiment of the invention further provides a monitoring device for an associated account, comprising:
  • a memory for storing processor executable instructions
  • processor is arranged to perform the steps in the aforementioned method.
  • the associated account is identified according to the unique feature identifier of the current plurality of accounts and/or the behavior characteristics of the current plurality of accounts within a predetermined time; determining whether the number of accounts of the associated account exceeds a first predetermined threshold; If yes, a monitoring identifier is set for each account in the associated account to monitor the associated account according to the monitoring identifier, which solves the problem that the related technology cannot monitor the associated account and the management efficiency of the account is low. Improve the efficiency of control over the account.
  • FIG. 1 is a flowchart of a method for monitoring an associated account according to an embodiment of the present invention
  • FIG. 2 is a flow chart of a method for identifying an associated account according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a method for identifying an associated account according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another method for identifying an associated account according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of another method for identifying an associated account according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of a method for monitoring an associated account according to an embodiment of the present invention.
  • FIG. 7 is a structural block diagram of a monitoring apparatus for an associated account according to an embodiment of the present invention.
  • FIG. 8 is a structural block diagram of a monitoring apparatus for an associated account according to an embodiment of the present invention.
  • FIG. 9 is a structural block diagram of a monitoring apparatus for an associated account according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for monitoring an associated account according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:
  • Step S102 Identify the associated account according to the unique feature identifier of the current multiple accounts and/or the behavior characteristics of the current multiple accounts within a predetermined time;
  • Step S104 determining whether the number of accounts of the associated account exceeds a first predetermined threshold
  • Step S106 If the determination result is yes, set a monitoring identifier for each account in the associated account to monitor the associated account according to the monitoring identifier.
  • the values of the first predetermined threshold involved in step S104 include, but are not limited to, 3, 5, 10, and the like.
  • the application scenario of the foregoing association account monitoring method includes, but is not limited to, multiple accounts registered by the same terminal respectively launching attack behaviors on multiple merchants in the same time period.
  • the associated account is identified according to the unique feature identifier of the current multiple accounts and/or the behavior characteristics of the current multiple accounts within a predetermined time; determining whether the number of accounts of the associated account exceeds a first predetermined threshold; If the result is YES, a monitoring identifier is set for each account in the associated account, so as to monitor the associated account according to the monitoring identifier, and the related technology cannot monitor the associated account, resulting in low control efficiency of the account. The problem has improved the efficiency of control over the account.
  • the present example is an associated account identification and monitoring method based on big data analysis, which helps to accurately identify the associated account and its malicious behavior.
  • the present example provides a management method for identifying an associated account, including the following steps:
  • Information about the account activity includes device hardware information, event time, location, duration, and content used during the event.
  • Some information in the account activity related information has unique characteristics, including but not limited to one of the following: the mobile phone number bundled during registration, registration, login, transaction, MAC address at the time of evaluation, IP attribution area, hard disk serial number, and receipt Goods location, receiving mobile phone number;
  • the unique key feature is used as the key Key to retrieve the distributed key-value Key-Value storage system, and check whether the obtained value contains the account, and if not, add the account to the Value. .
  • this example also provides an associated account identification method with highly overlapping transaction behaviors, including the following steps:
  • the account A with a large number of evaluation comments is evaluated, and the account A with an extreme opinion is put into an ordered set Q (for example, the account A B C) of the trading account within a certain period of time before and after the trading time;
  • the ordered collection Q does not contain duplicates, but each item in the collection contains a score attribute, which is incremented by 1 each time a duplicate account is inserted.
  • An implementation of the ordered set Q such as an ordered set of Redis.
  • the example also provides a monitoring method for abnormal transactions, including the following steps:
  • the above ordered set S does not contain duplicates, but each item in the set (the unique feature) contains a score attribute, and each time a duplicate is inserted, the score is incremented by one.
  • An implementation of the ordered set S such as an ordered set of Redis.
  • the ordered set S can be divided according to time segments, for example, by month, by week, and the transactions occurring in January are put into the ordered set S1 belonging to the first month;
  • the ordered set S is detected periodically. If the uniqueness of a particular feature is particularly high, it indicates that the associated account is frequently traded and suspected of malicious transactions.
  • the unique feature identifier involved in the foregoing step S102 includes at least one of the following: a mobile phone number bound by the current account when registering, a media access control MAC address of the current account when accessing the network, and a current The area to which the IP address of the account when the account is accessed, the hard disk serial number of the terminal that registered the current account, and the account information of the current account when the transaction occurs.
  • Identifying the associated account according to the unique feature identifier of the current plurality of accounts involved in the above step S102 includes the following steps:
  • Step S11 acquiring a plurality of accounts having the same unique feature identifier
  • step S12 the acquired plurality of accounts are used as the associated accounts.
  • This example provides an associated account identification method, as shown in Figure 2, including the following steps:
  • Step S201 the user registers, browses, trades, and evaluates
  • Step S202 collecting user equipment hardware information, where part of the information includes a unique feature.
  • a unique feature such as hard disk serial number, MAC address;
  • Step S203 Searching the big data platform with the unique feature value as a keyword, and if the value can be retrieved, adding the registered account name to the value set;
  • Step S204 if the retrieval is not available, the unique account value is a keyword, and the registered account name is a value, and is saved to the big data platform;
  • Step S205 multiple accounts active on the same user equipment are associated by unique feature values to form an associated account.
  • the identifying the associated account according to the behavior characteristics of the current plurality of accounts within the predetermined time involved in the above step S102 includes the following steps:
  • Step S21 Acquire a cumulative number of times that the current plurality of accounts respectively access multiple transaction objects within a predetermined time
  • Step S22 using a plurality of accounts whose accumulated number of times is greater than the second predetermined threshold as the associated account.
  • the value of the second predetermined threshold involved in step S22 includes, but is not limited to, 3, 5, and 7.
  • a plurality of accounts in which the current plurality of accounts respectively access the plurality of transaction objects for a predetermined number of times greater than the second predetermined threshold are used as the associated accounts, and the plurality of accounts can also be registered for the same terminal.
  • the account is effectively identified.
  • This example also provides an associated account identification method with highly overlapping transaction behaviors, as shown in Figure 4, including the following steps:
  • Step S401 the target account X is screened for a large number of evaluation words, and the account A with an extreme opinion is evaluated;
  • Step S402 the trading account A B C near the account A trading period is placed in the ordered set Q;
  • Step S403 searching for other transactions of the account A, assuming that there is a merchant Y Z;
  • Step S404 in the merchant Y Z transaction list, put the trading account near the trading period of the account A into the ordered set Q. There are duplicates whose score is incremented by 1;
  • step S405 finally, the scores greater than 5 belong to the transaction behavior with a high degree of coincidence. These accounts constitute an associated account.
  • the step S106 involved in monitoring the associated account according to the monitoring identifier includes the following steps:
  • Step S31 periodically monitoring the associated account according to the monitoring identifier.
  • step S102 By periodically monitoring the associated account identified in step S102, the problem that the related account cannot be monitored in the related art leads to low control efficiency of the account, and the control efficiency of the account is improved.
  • This example provides a method for monitoring an abnormal transaction of an embodiment, as shown in FIG. 6, including the following steps:
  • Step S601 when the transaction activity occurs, adding the feature value to the ordered set of feature values
  • Step S602 the score of the feature value in the ordered set of feature values is increased by 1;
  • Step S603 the ordered set of feature values are sorted by score
  • Step S604 as the transaction activity continues to occur, there is a feature value of the intensive transaction activity, and the score thereof exceeds the normal transaction level;
  • step S605 the feature value exceeding the reasonable level of the score is periodically checked, and the control process is performed.
  • the associated account identification method provided by the present invention is implemented based on an ordered set sorted set, and an implementation example of the ordered set sorted set is a zset of redis.
  • Redis is a distributed Key-Value (key-value) storage system.
  • the capacity of storing data is expanded, and when the number of transactions increases, the storage capacity of transaction data can be smoothly expanded.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a monitoring device for an associated account is further provided, and the device is used to implement the foregoing embodiment and Preferred embodiments, which have already been described, are not described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 7 is a structural block diagram of a monitoring apparatus for an associated account according to an embodiment of the present invention. As shown in FIG. 7, the apparatus includes:
  • the identification module 72 is configured to identify the associated account according to the unique feature identifier of the current multiple accounts and/or the behavior characteristics of the current multiple accounts within a predetermined time;
  • the determining module 74 is configured to determine whether the number of accounts of the associated account exceeds a first predetermined threshold
  • the processing module 76 is configured to: when the determination result is yes, set a monitoring identifier for each account in the associated account, to monitor the associated account according to the monitoring identifier.
  • the values of the first predetermined threshold involved in the foregoing apparatus include, but are not limited to, 3, 5, 10, and the like.
  • the application scenario of the monitoring device of the associated account includes, but is not limited to, multiple accounts registered by the same terminal respectively launching an attack behavior to multiple merchants in the same time period.
  • the associated account is identified according to the unique feature identifier of the current multiple accounts and/or the behavior characteristics of the current multiple accounts within a predetermined time; determining whether the number of accounts of the associated account exceeds a first predetermined threshold; If the result is YES, a monitoring identifier is set for each account in the associated account, so as to monitor the associated account according to the monitoring identifier, and the related technology cannot monitor the associated account, resulting in low control efficiency of the account. The problem has improved the efficiency of control over the account.
  • the foregoing unique feature identifier includes at least one of the following: a mobile phone number bound by the current account when registering, a media access control MAC address when the current account accesses the network, and a current account when accessing the network.
  • FIG. 8 is a structural block diagram of a monitoring device for an associated account according to an embodiment of the present invention.
  • the identification module 72 includes:
  • a first obtaining unit 82 configured to acquire multiple accounts having the same unique feature identifier
  • the first setting unit 84 is configured to use the acquired multiple accounts as the associated account.
  • FIG. 9 is a diagram of a monitoring device for an associated account in accordance with an embodiment of the present invention.
  • Block diagram (2) as shown in FIG. 9, the identification module 72 further includes:
  • a second obtaining unit 92 configured to acquire a cumulative number of times that the current plurality of accounts access the plurality of transaction objects respectively within a predetermined time
  • the second setting unit 94 is configured to use, as the associated account, a plurality of accounts whose accumulated number of times is greater than the second predetermined threshold.
  • a plurality of accounts in which the current plurality of accounts respectively access the plurality of transaction objects for a predetermined number of times greater than the second predetermined threshold are used as the associated account, and the plurality of accounts registered by the same terminal can also be effectively identified.
  • the processing module 76 is further configured to periodically monitor the associated account according to the monitoring identifier.
  • the related account identified by the above device further solves the problem that the related technology cannot monitor the associated account, resulting in low control efficiency of the account, and improves the control efficiency of the account.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • a monitoring identifier is set for each account in the associated account to monitor the associated account according to the monitoring identifier.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs the above steps S1, S2, and S3 according to the stored program code in the storage medium.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • Each of the above modules may be implemented by one or more digital signal processors (DSPs), application specific integrated circuits (ASICs), processors, microprocessors, controllers, microcontrollers, field programmable arrays (FPGAs). Implemented by a programmable logic device or other electronic unit or any combination thereof. Some of the functions or processes described in this application embodiment may also be implemented by software executing on a processor.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable arrays
  • an embodiment of the present invention further provides a monitoring device for an associated account, including:
  • a memory for storing processor executable instructions
  • processor is configured to:
  • a monitoring identifier is set for each account in the associated account to monitor the associated account according to the monitoring identifier.
  • the processor can also be configured to perform various steps in the above methods.
  • the associated account is identified according to the unique feature identifier of the current multiple accounts and/or the behavior characteristics of the current plurality of accounts within a predetermined time; determining whether the number of accounts of the associated account exceeds a first predetermined threshold; If the judgment result is yes, a monitoring identifier is set for each account in the associated account, so as to monitor the associated account according to the monitoring identifier, and solve the problem.
  • the problem that the related account cannot be monitored leads to the low efficiency of controlling the account, and the control efficiency of the account is improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本发明提供了一种关联账户的监控方法及装置。其中，该方法包括：根据当前多个账户的唯一特征标识和／或该当前多个账户在预定时间内的行为特征识别关联账户；判断该关联账户的账户数量是否超过第一预定阂值；在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户。通过本发明，解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。

Description

关联账户的监控方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种关联账户的监控方法及装置。
背景技术
进入二十一世纪，互联网经济兴起，对网络商家及其出售的物品进行的信誉度评价变得十分重要。网络犯罪集团接受不法商家委托，对其商品虚假吹捧，提高其信誉度。或者讹诈守法商家，对其商品恶意诋毁，降低其信誉度。
网络犯罪集团通过注册大量账户，或者通过利益诱惑发展大量贪图小利的真实账户，对目标商户发起攻击。
这些账户构成了关联账户，虽然不是所有的关联账户都会发起恶意攻击行为，但通过监控关联账户，可以有针对性地及时识别其恶意行为，进而采取管控措施。
针对相关技术中，无法对关联账户进行监控导致对账户的管控效率较低的问题，尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种关联账户的监控方法及装置，以至少解决相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题。
根据本发明的一个实施例，提供了一种关联账户的监控方法，包括：根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；判断所述关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
可选地，所述唯一特征标识包括以下至少之一：当前账户在注册时绑定的手机号、当前账户在访问网络时的媒体访问控制MAC地址、当前账户在访问网络时的IP地址所归属的区域、注册当前账户的终端的硬盘序列号以及当前账户在发生交易时的账户信息。
可选地，所述根据当前多个账户的唯一特征标识识别关联账户包括：获取具有相 同唯一特征标识的多个账户；将获取到的所述多个账户作为所述关联账户。
可选地，所述根据所述当前多个账户在预定时间内的行为特征识别关联账户包括：获取所述当前多个账户在预定时间内分别访问多个交易对象的累计次数；将累计次数大于第二预定阈值的多个账户作为所述关联账户。
可选地，所述根据所述监控标识监控所述关联账户包括：根据所述监控标识定时监控所述关联账户。
根据本发明的另一个实施例，提供了一种关联账户的监控装置，包括：识别模块，用于根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；判断模块，用于判断所述关联账户的账户数量是否超过第一预定阈值；处理模块，用于在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
可选地，所述唯一特征标识包括以下至少之一：当前账户在注册时绑定的手机号、当前账户在访问网络时的媒体访问控制MAC地址、当前账户在访问网络时的IP地址所归属的区域、注册当前账户的终端的硬盘序列号以及当前账户在发生交易时的账户信息。
可选地，所述识别模块包括：第一获取单元，用于获取具有相同唯一特征标识的多个账户；第一设置单元，用于将获取到的所述多个账户作为所述关联账户。
可选地，所述识别模块还包括：第二获取单元，用于获取所述当前多个账户在预定时间内分别访问多个交易对象的累计次数；第二设置单元，用于将累计次数大于第二预定阈值的多个账户作为所述关联账户。
可选地，所述处理模块还用于根据所述监控标识定时监控所述关联账户。
根据本发明的又一个实施例，还提供了一种计算机可读存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；判断所述关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
本发明实施例还提供一种关联账户的监控装置，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，所述处理器被设置为执行前述方法中的步骤。
通过本发明，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；判断该关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户，解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的关联账户的监控方法流程图；
图2是根据本发明实施例的一种关联账户的识别方法流程图；
图3是根据本发明实施例的一种关联账户的识别方法场景示意图；
图4是根据本发明实施例的另一种关联账户的识别方法流程图；
图5是根据本发明实施例的另一种关联账户的识别方法场景示意图；
图6是根据本发明实施例的一种关联账户的监控方法流程图；
图7是根据本发明实施例的关联账户的监控装置的结构框图；
图8是根据本发明实施例的关联账户的监控装置的结构框图；
图9是根据本发明实施例的关联账户的监控装置的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
在本实施例中提供了一种关联账户的监控方法，图1是根据本发明实施例的关联账户的监控方法流程图，如图1所示，该流程包括如下步骤：
步骤S102，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；
步骤S104，判断该关联账户的账户数量是否超过第一预定阈值；
步骤S106，在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户。
可选地，在本实施例中，步骤S104中涉及到的第一预定阈值的取值包括但并不限于：3、5、10等。
可选地，在本实施例中，上述关联账户的监控方法的应用场景包括但并不限于：同一终端注册的多个账户在同一时间段分别对多个商户发起攻击行为。在该应用场景下，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；判断该关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户，解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。
下面结合具体示例，对本实施例进行举例说明。
需要说明的是，本本示例是基于大数据分析的关联账户识别、监控方法，有助于准确识别关联账户及其恶意行为。
一方面，本示例提供了一种识别关联账户的管理方法，包括如下步骤：
在基于账户的交易平台上，在账户注册、登录、搜索、浏览、交易、评价等活动环节收集和记录账户活动相关信息，并存储在大数据平台中，大数据平台具体实施例之一为分布式键值Key-Value存储***；
该账户活动相关信息包含活动时使用的设备硬件信息、活动时间、地点、时长、内容。
该账户活动相关信息中部分信息具有唯一性特征，包含但不限于下列之一：注册时捆绑的手机号、注册、登录、交易、评价时的MAC地址、IP归属的区域、硬盘序列号、收货地点、收货手机号；
对每个该账户活动，以该唯一性特征作为关键字Key，检索分布式键值Key-Value存储***，检查得到的Value中是否包含该账户，如果不包含，则把该账户加入到Value中。
通过上述步骤把具有相同唯一性特征的不同账户收集到一个集合中。这个集合中的账户构成关联账户。
如果关联账户数量明显大于正常数量，则对关联账户集合中的每个账户设置监控 标识。对该唯一性特征设置监控标识。
另一方面，本示例还提供了一种交易行为高度重合的关联账户识别方法，其中，包括如下步骤：
针对目标商户X，筛选评价字数较多，评价意见极端的账户A，将其交易时间前后一段时间内的交易账户放入一个有序集合Q(例如，账户A B C)；
有序集合Q不包含重复项，但集合中的每一项包含一个评分(score)属性，每***一个重复的账户时，score加1。有序集合Q的一个实施例如Redis的有序集合。
搜索账户A的其他交易，假设有商户Y，商户Z；
逐一搜索商户Y、Z的交易列表，在账户A交易时间前后一段时间内的发生的有评价的交易，其账户加入有序集合Q。
最终，如账户A有10家以上交易商户，则有序集合Q中score大于7的账户属于确凿无疑的关联账户，大于5的属于高度重合的关联账户，大于3的属于轻度疑似关联账户。
进一步，本示例还提供了一种异常交易的监控方法，包括如下步骤：
每个账户交易、评价活动发生时，按发生时间，将该唯一性特征放入一个按时间段划分的有序集合S；
上述有序集合S不包含重复项，但集合中的每一项(该唯一性特征)包含一个score属性，每***一个重复项时，score加1。有序集合S的一个实施例如Redis的有序集合。
该有序集合S可以按时间段划分，比如按月、按周划分，一月份发生的交易放入归属一月份的有序集合S1；
定时检测有序集合S，如果某一项唯一性特征其score特别高，说明有关联账户在频繁交易，有恶意交易的嫌疑。
在一个可选地实施方式中，上述步骤S102中涉及到的唯一特征标识包括以下至少之一：当前账户在注册时绑定的手机号、当前账户在访问网络时的媒体访问控制MAC地址、当前账户在访问网络时的IP地址所归属的区域、注册当前账户的终端的硬盘序列号以及当前账户在发生交易时的账户信息。
上述步骤S102中涉及到的根据当前多个账户的唯一特征标识识别关联账户包括以下步骤：
步骤S11，获取具有相同唯一特征标识的多个账户；
步骤S12，将获取到的该多个账户作为该关联账户。
通过上述步骤S11至步骤S12，将相同唯一特征表示的多个账户设置为关联账户，使得能够对同一终端注册的多个账户进行有效识别。
下面结合具体示例，对本实施例进行举例说明。
本示例提供了一种关联账户识别方法，如图2所示，包括以下步骤：
步骤S201，用户注册、浏览、交易、评估；
步骤S202，收集用户设备硬件信息，其中部分信息包含唯一性特征。如硬盘序号、MAC地址；
步骤S203，以唯一性特征值为关键字检索大数据平台，如果能检索到值，则把注册的账户名加入到值集合中；
步骤S204，如果检索不到，则以唯一性特征值为关键字，注册的账户名为值，保存到大数据平台；
步骤S205，同一台用户设备上活动的多个账户通过唯一性特征值关联在一起，构成关联账户。
需要说明的是，上述步骤S201～步骤S205的场景示意图如图3所示。
上述步骤S102中涉及到的根据该当前多个账户在预定时间内的行为特征识别关联账户包括以下步骤：
步骤S21，获取该当前多个账户在预定时间内分别访问多个交易对象的累计次数；
步骤S22，将累计次数大于第二预定阈值的多个账户作为该关联账户。
可选地，步骤S22中涉及到的第二预定阈值的取值包括但并不限于：3、5、7。
通过上述步骤S21至步骤S22，将当前多个账户在预定时间内分别访问多个交易对象的累计次数大于第二预定阈值的多个账户作为该关联账户，同样也能够对同一终端注册的多个账户进行有效识别。
下面结合具体示例，对本实施例进行举例说明。
本示例还提供了一种交易行为高度重合的关联账户识别方法，如图4所示，包括以下步骤：
步骤S401，目标账户X筛选评价字数较多，评价意见极端的账户A；
步骤S402，账户A交易时段附近的交易账户A B C放入有序集合Q；
步骤S403，搜索账户A的其他交易，假设有商户Y Z；
步骤S404，在商户Y Z交易列表中，把账户A交易时段附近的交易账户放入有序集合Q。有重复项其score累加1；
步骤S405，最终，score大于5的属于交易行为高度重合。这些账户构成关联账户。
需要说明的是，上述步骤S401～步骤S405中涉及到的场景示意图如图5所示。
上述步骤S106中涉及到根据该监控标识监控该关联账户包括以下步骤：
步骤S31，根据该监控标识定时监控该关联账户。
通过定时监控通过步骤S102识别出的关联账户，进一步解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。
下面结合具体示例，对本实施例进行举例说明。
本示例提供了一种实施例的异常交易的监控方法，如图6所示，包括以下步骤：
步骤S601，交易活动发生时，把特征值加入到特征值有序集合中；
步骤S602，特征值有序集合中该特征值的score加1；
步骤S603，特征值有序集合按score排序；
步骤S604，随着交易活动的持续发生，有密集交易活动的特征值，其score会超出正常交易的水平；
步骤S605，定期检查score超出合理水平的特征值，进行管控处理。
综上，本发明提供的关联账户识别方法，其实现基于有序集合sorted set，有序集合sorted set的一种实现例为redis的zset。redis是一种分布式Key-Value(键-值)存储***，与采用传统存储***的平台相比，存放数据的容量扩大，当交易数量增多时，可平滑扩大交易数据的存储容量。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
实施例2
在本实施例中还提供了一种关联账户的监控装置，该装置用于实现上述实施例及 优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图7是根据本发明实施例的关联账户的监控装置的结构框图，如图7所示，该装置包括：
1)识别模块72，用于根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；
2)判断模块74，用于判断该关联账户的账户数量是否超过第一预定阈值；
3)处理模块76，用于在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户。
可选地，在本实施例中，上述装置中涉及到的第一预定阈值的取值包括但并不限于：3、5、10等。
可选地，在本实施例中，上述关联账户的监控装置的应用场景包括但并不限于：同一终端注册的多个账户在同一时间段分别对多个商户发起攻击行为。在该应用场景下，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；判断该关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户，解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。
在一个可选地实施方式中，上述唯一特征标识包括以下至少之一：当前账户在注册时绑定的手机号、当前账户在访问网络时的媒体访问控制MAC地址、当前账户在访问网络时的IP地址所归属的区域、注册当前账户的终端的硬盘序列号以及当前账户在发生交易时的账户信息。
在一个可选地实施方式中，图8是根据本发明实施例的关联账户的监控装置的结构框图，如图8所示，识别模块72包括：
1)第一获取单元82，用于获取具有相同唯一特征标识的多个账户；
2)第一设置单元84，用于将获取到的该多个账户作为该关联账户。
通过上述装置，将相同唯一特征表示的多个账户设置为关联账户，使得能够对同一终端注册的多个账户进行有效识别。
在一个可选地实施方式中，图9是根据本发明实施例的关联账户的监控装置的结 构框图(二)，如图9所示，识别模块72还包括：
1)第二获取单元92，用于获取该当前多个账户在预定时间内分别访问多个交易对象的累计次数；
2)第二设置单元94，用于将累计次数大于第二预定阈值的多个账户作为该关联账户。
通过上述装置，将当前多个账户在预定时间内分别访问多个交易对象的累计次数大于第二预定阈值的多个账户作为该关联账户，同样也能够对同一终端注册的多个账户进行有效识别。
在一个可选地实施方式中，上述处理模块76还用于根据该监控标识定时监控该关联账户。
通过上述装置识别出的关联账户，进一步解决了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；
S2，判断该关联账户的账户数量是否超过第一预定阈值；
S3，在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述步骤S1、S2以及S3。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
上述装置中的各个模块或单元可以通过一个或多个数字信号处理器(DSP)、专用集成电路(ASIC)、处理器、微处理器、控制器、微控制器、现场可编程阵列(FPGA)、可编程逻辑器件或其他电子单元或其任意组合来实现。在本申请实施例中描述的一些功能或处理也可以通过在处理器上执行的软件来实现。
例如，本发明的实施例还提供了一种关联账户的监控装置，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，所述处理器被配置为：
根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；
判断所述关联账户的账户数量是否超过第一预定阈值；
在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
该处理器还可以被配置为执行上述方法中的各个步骤。
工业实用性
本申请的方法和装置可应用于通信领域中。通过本公开的技术方案，根据当前多个账户的唯一特征标识和/或该当前多个账户在预定时间内的行为特征识别关联账户；判断该关联账户的账户数量是否超过第一预定阈值；在判断结果为是的情况下，对该关联账户中的每一账户设置监控标识，以根据该监控标识监控该关联账户，解决 了相关技术中无法对关联账户进行监控导致对账户的管控效率较低的问题，提高了对账户的管控效率。

Claims (8)

  1. 一种关联账户的监控方法，其中，包括：
    根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；
    判断所述关联账户的账户数量是否超过第一预定阈值；
    在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
  2. 根据权利要求1所述的方法，其中，所述唯一特征标识包括以下至少之一：
    当前账户在注册时绑定的手机号、当前账户在访问网络时的媒体访问控制MAC地址、当前账户在访问网络时的IP地址所归属的区域、注册当前账户的终端的硬盘序列号以及当前账户在发生交易时的账户信息。
  3. 根据权利要求2所述的方法，其中，所述根据当前多个账户的唯一特征标识识别关联账户包括：
    获取具有相同唯一特征标识的多个账户；
    将获取到的所述多个账户作为所述关联账户。
  4. 根据权利要求1所述的方法，其中，所述根据所述当前多个账户在预定时间内的行为特征识别关联账户包括：
    获取所述当前多个账户在预定时间内分别访问多个交易对象的累计次数；
    将累计次数大于第二预定阈值的多个账户作为所述关联账户。
  5. 根据权利要求1至4中任意一项所述的方法，其中，所述根据所述监控标识监控所述关联账户包括：
    根据所述监控标识定时监控所述关联账户。
  6. 一种关联账户的监控装置，其中，包括：
    识别模块，设置为根据当前多个账户的唯一特征标识和/或所述当前多个账户在预定时间内的行为特征识别关联账户；
    判断模块，设置为判断所述关联账户的账户数量是否超过第一预定阈值；
    处理模块，设置为在判断结果为是的情况下，对所述关联账户中的每一账户设置监控标识，以根据所述监控标识监控所述关联账户。
  7. 一种关联账户的监控装置，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被设置为执行如权利要求1至5中任一项所述的方法中的步骤。
  8. 一种计算机可读存储介质，用于存储程序，其中所述程序被执行时使得关联账户的监控装置执行如权利要求1到5中任一项所述的方法中的步骤。
PCT/CN2017/083761 2016-06-07 2017-05-10 关联账户的监控方法及装置 WO2017211157A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610398448.2A CN107483381B (zh) 2016-06-07 2016-06-07 关联账户的监控方法及装置
CN201610398448.2 2016-06-07

Publications (1)

Publication Number Publication Date
WO2017211157A1 true WO2017211157A1 (zh) 2017-12-14

Family

ID=60578359

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/083761 WO2017211157A1 (zh) 2016-06-07 2017-05-10 关联账户的监控方法及装置

Country Status (2)

Country Link
CN (1) CN107483381B (zh)
WO (1) WO2017211157A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109766323A (zh) * 2018-12-17 2019-05-17 深圳壹账通智能科技有限公司 贷款交易全链路监控方法、装置、计算机设备和存储介质
CN109903045A (zh) * 2019-01-24 2019-06-18 平安科技（深圳）有限公司 行为轨迹监控方法、装置、计算机设备和介质
CN110347566A (zh) * 2019-06-25 2019-10-18 阿里巴巴集团控股有限公司 用于对注册风控模型进行效能评估的方法及装置
CN110544104A (zh) * 2019-09-04 2019-12-06 北京趣拿软件科技有限公司 帐号的确定方法、装置、存储介质及电子装置
CN113626681A (zh) * 2020-05-08 2021-11-09 北京达佳互联信息技术有限公司 一种账户信息的处理方法、装置、电子设备及存储介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109872234A (zh) * 2019-01-24 2019-06-11 平安科技（深圳）有限公司 交易行为监控方法、装置、计算机设备和介质
CN110968785B (zh) * 2019-11-26 2023-03-14 腾讯科技（深圳）有限公司 目标帐号的识别方法和装置、存储介质及电子装置
CN113704330B (zh) * 2021-09-23 2024-06-07 北京网界科技有限公司 公平评议***及其方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1960345A (zh) * 2006-09-28 2007-05-09 阿里巴巴公司 在即时通信***中创建多账号用户的方法及***
CN101924660A (zh) * 2009-06-09 2010-12-22 阿尔卡特朗讯公司 检测网络恶意行为的方法和装置
CN103440237A (zh) * 2013-03-15 2013-12-11 武汉元宝创意科技有限公司 基于3d模型的微博数据处理可视化***
CN103825879A (zh) * 2013-11-29 2014-05-28 中国科学院信息工程研究所 社交僵尸网络的检测方法及装置
CN103905532A (zh) * 2014-03-13 2014-07-02 微梦创科网络科技（中国）有限公司 微博营销账号的识别方法及***

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102200987A (zh) * 2011-01-27 2011-09-28 北京开心人信息技术有限公司 一种基于用户账号行为分析的查找马甲账号的方法及***
CN103778151B (zh) * 2012-10-23 2017-06-09 阿里巴巴集团控股有限公司 一种识别特征群体的方法及装置和搜索方法及装置
US20150058219A1 (en) * 2013-08-26 2015-02-26 Bank Of America Corporation System and method for workflow behavior alerts
CN104573017B (zh) * 2015-01-09 2018-09-04 网智天元科技集团股份有限公司 识别网络水军团体的方法及***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1960345A (zh) * 2006-09-28 2007-05-09 阿里巴巴公司 在即时通信***中创建多账号用户的方法及***
CN101924660A (zh) * 2009-06-09 2010-12-22 阿尔卡特朗讯公司 检测网络恶意行为的方法和装置
CN103440237A (zh) * 2013-03-15 2013-12-11 武汉元宝创意科技有限公司 基于3d模型的微博数据处理可视化***
CN103825879A (zh) * 2013-11-29 2014-05-28 中国科学院信息工程研究所 社交僵尸网络的检测方法及装置
CN103905532A (zh) * 2014-03-13 2014-07-02 微梦创科网络科技（中国）有限公司 微博营销账号的识别方法及***

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109766323A (zh) * 2018-12-17 2019-05-17 深圳壹账通智能科技有限公司 贷款交易全链路监控方法、装置、计算机设备和存储介质
CN109903045A (zh) * 2019-01-24 2019-06-18 平安科技（深圳）有限公司 行为轨迹监控方法、装置、计算机设备和介质
CN109903045B (zh) * 2019-01-24 2024-05-03 平安科技（深圳）有限公司 行为轨迹监控方法、装置、计算机设备和介质
CN110347566A (zh) * 2019-06-25 2019-10-18 阿里巴巴集团控股有限公司 用于对注册风控模型进行效能评估的方法及装置
CN110544104A (zh) * 2019-09-04 2019-12-06 北京趣拿软件科技有限公司 帐号的确定方法、装置、存储介质及电子装置
CN110544104B (zh) * 2019-09-04 2024-01-23 北京趣拿软件科技有限公司 帐号的确定方法、装置、存储介质及电子装置
CN113626681A (zh) * 2020-05-08 2021-11-09 北京达佳互联信息技术有限公司 一种账户信息的处理方法、装置、电子设备及存储介质
CN113626681B (zh) * 2020-05-08 2023-09-26 北京达佳互联信息技术有限公司 一种账户信息的处理方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN107483381B (zh) 2021-10-15
CN107483381A (zh) 2017-12-15

Similar Documents

Publication Publication Date Title
WO2017211157A1 (zh) 关联账户的监控方法及装置
US20210326885A1 (en) Method and Apparatus of Identifying a Transaction Risk
EP3319004B1 (en) Incident triage scoring engine
EP3345349B1 (en) Systems and methods for detecting and scoring anomalies
US9223968B2 (en) Determining whether virtual network user is malicious user based on degree of association
CN110351307B (zh) 基于集成学习的异常用户检测方法及***
US11256683B2 (en) Method and apparatus for integrating multi-data source user information
JP5551704B2 (ja) オンライン・マーケティング効率の評価
CN110119428B (zh) 一种区块链信息管理方法、装置、设备及存储介质
US20100161602A1 (en) Grouping similar values for a specific attribute type of an entity to determine relevance and best values
CN110677384B (zh) 钓鱼网站的检测方法及装置、存储介质、电子装置
US20100161603A1 (en) Grouping methods for best-value determination from values for an attribute type of specific entity
CN110149319B (zh) Apt组织的追踪方法及装置、存储介质、电子装置
CN110188538B (zh) 采用沙箱集群检测数据的方法及装置
CN112019519B (zh) 网络安全情报威胁度的检测方法、装置和电子装置
WO2022134471A1 (zh) 区块链节点的管理方法、装置、计算机设备和存储介质
CN111259952A (zh) 异常用户识别方法、装置、计算机设备及存储介质
CN110400080A (zh) 考核数据监控方法、装置、计算机设备和存储介质
JP2006025434A5 (zh)
CN116644952A (zh) 风险评估方法、装置、设备及介质
CN109918189B (zh) 一种资源管理方法及相关设备
CN108257011B (zh) 掉单处理方法和装置
CN109377391A (zh) 一种信息追踪方法、存储介质和服务器
CN111049948B (zh) 域名检测方法和装置
CN114363002A (zh) 一种网络攻击关系图的生成方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17809596

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17809596

Country of ref document: EP

Kind code of ref document: A1