CN105550175A - Malicious account identification method and device - Google Patents

Abstract

The invention provides a malicious account identification method and device. The method comprises the following steps: acquiring an account to be identified; according to the fuzzy processing indication information, fuzzifying the account to be identified to obtain a fuzzy account retaining part of information in the account to be identified; wherein the fuzzy processing indication information is used for discovering accounts with the same or similar information in the accounts to be identified; and carrying out malicious account identification on the fuzzy accounts so as to determine a malicious account in the accounts to be identified. The method and the device can improve the accuracy of identifying the malicious account and reduce the misjudgment rate.

Description

Malicious account identification method and device

【Technical field】

The present application relates to the field of Internet technologies, and in particular to a method and device for identifying a malicious account.

【Background technique】

With the development of Internet technology, there are more and more various application systems, such as e-commerce systems. As a user of the application system, the user generally needs to register an account, such as an electronic mailbox (email), the account can be used as the user's virtual identity information, and the user can log in to the application system through the account to use the resources provided by the application system or carry out related activities, etc. .

In practical applications, some malicious users will register a large number of accounts in order to steal resources provided by the application system. Taking the e-commerce system as an example, malicious users can log in to the e-commerce system through a large number of registered e-mail addresses, so as to receive red envelopes provided by the e-commerce system multiple times. For application systems, malicious accounts need to be identified.

In the prior art, there is a method of clustering a large number of accounts registered in the same period, and identifying malicious accounts according to the clustering results. For the clustering algorithm, some parameters need to be set, such as the number of categories, distance radius, etc. For the special object of account, due to too much uncontrollability, for example, it is impossible to predict how many users will register accounts in the same period, It is also impossible to predict how many different types of accounts will be generated, so the parameters required for the clustering algorithm cannot be well set. Therefore, the existing method is prone to misjudgment, and the accuracy of identifying malicious accounts is not high.

【Content of invention】

Various aspects of the present application provide a method and device for identifying malicious accounts, which are used to improve the accuracy of identifying malicious accounts and reduce the misjudgment rate.

In one aspect of the present application, a malicious account identification method is provided, including:

Obtain the account to be identified;

According to the fuzzy processing instruction information, perform fuzzy processing on the account to be identified to obtain a fuzzy account that retains part of the information in the account to be identified; wherein, the fuzzy processing instruction information is used to find that the account to be identified has Accounts with the same or similar information;

Malicious account identification is performed on the fuzzy account to determine a malicious account among the accounts to be identified.

Another aspect of the present application provides a malicious account identification device, including:

An acquisition module, configured to acquire an account to be identified;

A fuzzy processing module, configured to perform fuzzy processing on the account to be identified according to the fuzzy processing instruction information, so as to obtain a fuzzy account that retains part of the information in the account to be identified; wherein, the fuzzy processing instruction information is used to find Accounts with the same or similar information among the accounts to be identified;

An identifying module, configured to identify malicious accounts on the fuzzy accounts, so as to determine the malicious accounts among the accounts to be identified.

In this application, the account to be identified is obtained, and the account to be identified is fuzzified according to the fuzzy processing instruction information, and the fuzzy account that retains part of the information in the account to be identified is obtained, wherein the function of the fuzzy processing instruction information is to find the account to be identified Therefore, by comparing fuzzy accounts, you can find unrecognized accounts with the same or similar information. These accounts are usually malicious accounts. Further identification of malicious accounts based on fuzzy accounts can find unrecognized accounts more accurately. Malicious accounts in the network, reducing the misjudgment rate.

【Description of drawings】

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the embodiments or the description of the prior art. Obviously, the accompanying drawings in the following description are of the present application For some embodiments, those of ordinary skill in the art can also obtain other drawings based on these drawings without paying creative efforts.

FIG. 1 is a schematic flowchart of a malicious account identification method provided by an embodiment of the present application;

FIG. 2 is a schematic flowchart of a malicious account identification method provided in another embodiment of the present application;

FIG. 3 is a schematic structural diagram of a malicious account identification device provided by an embodiment of the present application.

【detailed description】

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

FIG. 1 is a schematic flowchart of a method for identifying a malicious account provided by an embodiment of the present application. As shown in Figure 1, the method includes:

101. Obtain an account to be identified.

102. According to the fuzzy processing instruction information, perform fuzzy processing on the account to be identified to obtain a fuzzy account that retains part of the information in the account to be identified, and the fuzzy processing instruction information is used to find accounts with the same or similar information among the accounts to be identified.

103. Perform malicious account identification on the above fuzzy accounts, so as to determine the malicious account among the accounts to be identified.

This embodiment provides a method for identifying a malicious account, which can be executed by a device for identifying a malicious account. The device for identifying malicious accounts may be any device that needs to identify malicious accounts, for example, it may be an application server or an application client.

When identifying a malicious account, the device for identifying a malicious account first obtains an account to be identified. The account to be identified may include a registered account that has not been identified as a legal account, and may also include a newly registered account. For example, the device for identifying a malicious account may acquire at least one account newly registered within a specified time interval as an account to be identified at a specified time. More specifically, the device for identifying a malicious account may periodically obtain at least one account newly registered within this period as an account to be identified. The period can be one day, two days, one week or longer.

It is worth noting that the account in this embodiment may be various accounts used for login, such as but not limited to an email address. The account in this embodiment generally has two parts, a prefix and a suffix. For e-mail, the prefix of e-mail is the part before it, and the rest is used as the suffix of e-mail.

Considering that malicious accounts generally have some obvious rules, such as account names have obvious regularities, for example, have a fixed prefix and exactly the same suffix; use numbers or letters as a sequence of self-incrementing; include fixed characters with symbolic meaning, etc. Taking e-mail as an example, malicious users may register the following e-mails when registering, luha001163.com, luha002163.com, ..., luha007163.com, etc. It can be seen that malicious accounts generally have the same or similar information, which are relatively similar. Therefore, similar characteristics between malicious accounts can be used to identify malicious accounts.

In order to find accounts with the same or similar information among the accounts to be identified, the fuzzy processing instruction information can be pre-configured for this purpose, that is to say, the accounts with the same or similar information among the accounts to be identified can be found through the obfuscation processing instruction information. The blurring indication information mainly includes some information for defining the blurring position, the blurring object, and how to perform the blurring operation.

The malicious account identification device performs fuzzy processing on the account to be identified according to the instruction information of the obfuscation processing, so as to obtain an obfuscated account that retains part of the information in the account to be identified. To put it simply, the fuzzy account retains part of the information in the account to be identified, and another part of the information in the account to be identified is blurred. The so-called fuzzy actually means abstraction, that is, to abstract specific accounts to be identified into fuzzy accounts.

For example, taking the accounts luha3902163.com and luha244163.com as examples, the obfuscation instruction information can instruct to obfuscate the numbers in the account and keep the number of obfuscated numbers, then the obfuscated account luha can be obtained after the obfuscation process ^^^^163.com and luha^^^163.com, where "^" represents the blurred number, and the number of "^" indicates the number of blurred numbers. The suffixes of the two fuzzy accounts are exactly the same, and the rest of the characters in the prefix are also the same, the difference is that the number of blurred numbers is different. This means that the accounts to be identified corresponding to these two fuzzy accounts have the same initial character "luha" and the same suffix "163.com", which belong to similar accounts.

As another example, taking the accounts luha3902163.com and luha3903163.com as examples, the obfuscation instruction information can instruct to obfuscate the numbers in the account and keep the number of obfuscated numbers, then the obfuscated account can be obtained after the obfuscation process luha^^^^163.com and luha^^^^163.com, where "^" represents the blurred number, and the number of "^" represents the number of blurred numbers. The suffixes of the two fuzzy accounts are exactly the same, the remaining characters in the prefix are also the same, and the number of numbers that are blurred out is also the same, that is, the two fuzzy accounts are completely the same. This means that the accounts to be identified corresponding to the two fuzzy accounts have the same initial character "luha", the same suffix, and the same number of numbers, and belong to similar accounts.

It can be seen from the above that by performing fuzzy processing on the account to be identified, information that may be different in the account to be identified is blurred, thereby generating a fuzzy account. The fuzzy account is simpler and retains the same or similar information in the account to be identified. Therefore, the account with the same or similar information in the account to be identified can be directly found through the fuzzy account, and it is not easy to misjudgment. Therefore, the malicious account identification device can perform malicious account identification on fuzzy accounts, so as to determine the malicious account among the accounts to be identified.

In an optional implementation manner, the device for identifying malicious accounts may directly compare fuzzy accounts, find identical fuzzy accounts, and determine the account to be identified corresponding to the identical fuzzy accounts as malicious accounts. Alternatively, the malicious account identification device may also directly compare fuzzy accounts, find fuzzy accounts whose similarity meets the preset similarity index, and use the accounts to be identified corresponding to the fuzzy accounts whose similarity meets the similarity index as malicious accounts. The similarity index can be adaptively set according to different application scenarios. For example, the similarity index can have the same initial character, the same suffix, and the same number of blurred numbers; or the similarity index can also have the same initial character, the same suffix, and the same number of blurred numbers. The number of dropped numbers differs by one, and so on.

In an optional implementation, the malicious account identification device can group fuzzy accounts to group the same or similar fuzzy accounts into one group; evaluate the fuzzy accounts in each group according to the evaluation parameters, and obtain the corresponding After that, it is determined that the account to be identified corresponding to the group whose evaluation result satisfies the preset malicious condition is a malicious account.

Wherein, the accounts to be identified corresponding to the groups whose evaluation results meet the preset malicious conditions refer to the accounts to be identified corresponding to the fuzzy accounts in the group whose evaluation results meet the preset malicious conditions.

Optionally, a similarity index may be preset, and whether two fuzzy accounts are similar is judged according to the similarity index, and then the fuzzy accounts are divided into different groups.

Among them, in addition to having the same or similar information, malicious accounts will have more obvious characteristics in terms of registration time, number of registrations, and information sharing. For example: the registration time of the same batch of malicious accounts is often relatively concentrated, such as registration within the same day. The registration time interval of the same batch of malicious accounts has a certain regularity, for example, the registration time interval between the two accounts before and after does not exceed 2 hours. The number of malicious accounts is generally relatively large, for example, it may be more than 100. In addition, malicious users generally use some of the same information when registering malicious accounts, for example, malicious accounts will share the same device Internet Protocol IP, MAC, UMID, TID, ID number, phone number and/or contact address, etc.

Based on the above, evaluation parameters may include but not limited to at least one of the following: average registration time interval, registration time regularity, number of fuzzy accounts in the group, characteristics of the group, posterior probability of the group, static sharing breadth index, dynamic sharing breadth index , static sharing intensity index and dynamic sharing intensity index.

Wherein, the average registration time interval refers to the average interval of registration time of fuzzy accounts in the same group. The registration time of the fuzzy account is also the registration time of the account to be identified corresponding to the fuzzy account. For each group, the malicious account identification device can sort the registration time of the fuzzy accounts according to the registration time of the fuzzy accounts in the group to form a time series, and obtain the time interval between the registration times of the two fuzzy accounts before and after, and then according to the obtained The number of total time intervals and time intervals to obtain the registration average time interval.

If the average registration time interval corresponding to a group is shorter, it means that the vague accounts in this group are more likely to be registered collectively, which means that the risk of being a malicious account is higher.

Among them, the regularity of registration time refers to the regularity between the registration times of fuzzy accounts in the same group. For each group, the malicious account identification device can sort the registration time of the fuzzy accounts in the group according to the registration time of the fuzzy accounts in the group to form a time series, and then obtain the regularity of the time series according to the standard deviation of the time series.

If the registration time corresponding to a group has a strong regularity, it means that the vague accounts in this group are more likely to be maliciously registered, which means that the possibility of being a malicious account is higher.

Wherein, the number of fuzzy accounts in a group refers to the number of fuzzy accounts in the same group. In practical applications, the possibility of the same or similar accounts registered by different users is small, and the possibility of a large number of identical or similar accounts appearing at the same time is even smaller. Therefore, if there are more fuzzy accounts in the group, it means that they are malicious accounts. more likely.

Among them, the characteristics of the group refer to the common characteristics of the fuzzy accounts in the same group, that is, the characteristics of the group, for example, the beginning characters of the fuzzy accounts in the group are the same, for example, they are all luha, and/or, the Fuzzy accounts within a group have the same number of characters. Among them, the more features of a group, it means that the fuzzy accounts in the group have more identical features, indicating that the similarity of the fuzzy accounts in the group is higher, which in turn means that the possibility of being a malicious account is higher.

Among them, the posterior probability of a group refers to the probability of an ambiguous account belonging to the registered account of the same period as the previously determined malicious account in the same group. Since the probability of legitimate users and malicious users registering accounts at the same time is low, that is to say, in actual applications, when legitimate users register legitimate accounts, the probability of malicious users registering malicious accounts is low. The account belongs to the fuzzy account of the account registered in the same period, indicating that these same or similar fuzzy accounts in this group are highly likely to be malicious accounts.

Among them, the static sharing breadth index is used to represent how much static information is shared between fuzzy accounts within a group. The static information here mainly refers to some information that is not easy to change when the user registers an account. For example, it can be the device information used during registration, such as the IP, MAC, UMID and/or TID of the device; it can also be the user during registration. Information, such as the user's ID number, phone number, name and/or contact address, etc.; it can also be registration channel information, such as registration source, registration business source and/or registration source website and other information.

As long as any one or more of the same static information is used by two ambiguous accounts, the static information is considered to be shared between the two ambiguous accounts. For each group, the malicious account identification device can obtain the static information used by each fuzzy account in the group, and by comparing the static information used by each fuzzy account, it can be found whether the static information is shared among fuzzy accounts.

Since the accounts registered by different users have a low probability of using the same static information, if there are more instances of shared static information between fuzzy accounts in the same group, it means that the fuzzy accounts in this group have a higher probability of being malicious accounts.

Among them, the dynamic sharing breadth index is used to represent how much dynamic information is shared among fuzzy accounts within a group. The dynamic information here refers to the information related to the account and will change over time, for example, it can be the update of the device information used when registering the account, such as updating the IP, MAC, UMID and/or TID of the device; it can also be the user Behavior information about the use of accounts, such as login events, transaction events, events audited by CTU, changes to passwords, and/or changes to other registration information, etc.; it can also be transaction information generated by using fuzzy accounts for transactions, such as transaction active party information , transaction passive party information, transaction product information (especially high-risk product information), delivery address, information of the active party receiving goods and/or information of the passive party receiving goods.

As long as two fuzzy accounts generate any one or more of the same dynamic information due to their use, it is considered that the dynamic information is shared between the two fuzzy accounts. For each group, the malicious account identification device can obtain the dynamic information corresponding to each fuzzy account in the group, and by comparing the dynamic information corresponding to each fuzzy account, it can find out whether the dynamic information is shared among fuzzy accounts.

Further, it is also possible to limit whether dynamic information is shared between two fuzzy accounts within a specified time, for example, the same dynamic information is shared within the same day.

Since the probability that different users use accounts to produce the same behavior is low, if there are more dynamic information shared between fuzzy accounts in the same group, it means that the fuzzy accounts in this group have a higher probability of being malicious accounts.

Among them, the static sharing intensity index is used to characterize how much static information is shared between fuzzy accounts that share static information appearing in the group. The definition of the static information here is the same as that of the previous static information, and will not be repeated here.

Among them, the more static information shared by the fuzzy accounts that share static information, the more similar the two fuzzy accounts are, the greater the possibility of belonging to malicious accounts. For example, if the first fuzzy account and the second fuzzy account share information such as device IP, user ID number, and contact address at the same time, but the first fuzzy account and the third fuzzy account only share the static information of the device IP, it means The first fuzzy account is more similar to the second fuzzy account. For each group, the device for identifying malicious accounts may first obtain fuzzy accounts that share static information, and then count the amount of static information shared by these fuzzy accounts.

Among them, the dynamic sharing intensity index is used to characterize how much dynamic information is shared among the fuzzy accounts that share dynamic information appearing in the group. The definition of the dynamic information here is the same as that of the previous dynamic information, and will not be repeated here.

Among them, the more dynamic information shared by the fuzzy accounts that share dynamic information, the more similar the two fuzzy accounts are, the greater the possibility of belonging to malicious accounts. For example, if the first fuzzy account and the second fuzzy account log in, change the password, and both purchase the same high-risk commodity on the same day, but the first fuzzy account and the third fuzzy account only log in on the same day, then means that the first fuzzy account is more similar to the second fuzzy account. For each group, the device for identifying malicious accounts may first obtain fuzzy accounts that share dynamic information, and then count the amount of dynamic information shared by these fuzzy accounts.

It is worth noting that, based on the above evaluation parameters, there may be multiple ways to evaluate the fuzzy accounts in each group to obtain the evaluation results corresponding to each group. For example, the device for identifying a malicious account may independently use any of the above evaluation parameters to evaluate the fuzzy accounts in each group, so as to obtain the evaluation results corresponding to each group. For another example, the malicious account identification device can use multiple evaluation parameters at the same time, assign different weights to each evaluation parameter, use each evaluation parameter to evaluate the fuzzy accounts in the group, obtain the evaluation value corresponding to each evaluation parameter, and then Numerical processing is performed according to the evaluation value of each evaluation parameter and the weight of each evaluation parameter to obtain the final evaluation result.

For example, after the above evaluation process, the device for identifying malicious accounts may determine that the accounts to be identified corresponding to the groups whose average registration time interval is relatively small and whose registration time is relatively regular are malicious accounts. Alternatively, after the above-mentioned evaluation process, the malicious account identification device may determine that the accounts to be identified corresponding to groups with a shorter average registration time interval, stronger registration time regularity, and a large number of fuzzy accounts in the group are malicious accounts. Or, after the above evaluation process, the malicious account identification device can determine that the average registration time interval is small, the registration time regularity is strong, the number of fuzzy accounts in the group is large, the static sharing breadth index is high, and the dynamic sharing breadth index is high, etc. The account to be identified corresponding to the group of is a malicious account.

To sum up, in this embodiment, the account to be identified is obtained, and the account to be identified is fuzzified according to the fuzzy processing instruction information, and the fuzzy account that retains part of the information in the account to be identified is obtained, wherein the fuzzy processing instruction information The function is to find accounts with the same or similar information among the accounts to be identified. Therefore, by comparing fuzzy accounts, we can find accounts to be identified with the same or similar information. These accounts are usually malicious accounts. Further identification of malicious accounts based on fuzzy accounts can be more Accurately discover malicious accounts among the accounts to be identified, reducing the false positive rate.

FIG. 2 is a schematic flowchart of a method for identifying a malicious account provided by another embodiment of the present application. As shown in Figure 2, the method includes:

201. Acquire an account to be identified.

202. Perform fuzzy processing on the account to be identified according to the fuzzy parameters of at least one fuzzy granularity included in the fuzzy processing instruction information, so as to obtain a fuzzy account that retains part of the information in the account to be identified at each fuzzy granularity.

203. Determine a target granularity from at least one fuzzy granularity according to a business scenario.

204. From all fuzzy accounts, select fuzzy accounts under the target granularity.

205. Group the fuzzy accounts at the target granularity, so as to group the same or similar fuzzy accounts into one group.

206. Evaluate the fuzzy accounts in each group according to the evaluation parameters, so as to obtain the evaluation results corresponding to each group.

207. Determine that the account to be identified corresponding to the group whose evaluation result satisfies the preset malicious condition is a malicious account.

In this embodiment, the blurring indication information includes at least one blurring parameter of a blurring granularity. Different fuzzy granularity means that the information to be fuzzed out in the account to be identified is different. For example, the fuzzy parameters of at least one fuzzy granularity may include but not limited to: the fuzzy parameters of the first fuzzy granularity, the fuzzy parameters of the second fuzzy granularity, the fuzzy parameters of the third fuzzy granularity, and the fuzzy parameters of the fourth fuzzy granularity. A fuzzification parameter and a fuzzification parameter of a fifth fuzzing granularity.

Wherein, the obfuscation parameter of the first fuzzy granularity is used to indicate: obfuscate all digits in the account prefix, and retain the number of obfuscated digits.

The fuzzing parameter of the second fuzzing granularity is used to indicate: to fuzz all the numbers in the account prefix, ignore the number of fuzzed numbers, and mark the fuzzed part as a number.

The fuzzing parameter of the third fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz the non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, and keep the number of non-numeric characters that are blurred out.

The fuzzing parameter of the fourth fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz all non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, and ignore the number of non-numeric characters that are blurred out.

The fuzzy parameter of the fifth fuzzy granularity is used to indicate: to fuzz out all character combinations in the account prefix, the character combination refers to any combination of characters except the splitting characters used for segmentation, and ignore the fuzzy characters The number of characters in the combination.

After the account to be identified is obtained, the account to be identified can be fuzzified for each fuzzy granularity, so that the fuzzy account under each fuzzy granularity can be obtained. Since different business scenarios require different fuzzy granularities, the required target granularity can be determined from all fuzzy granularities according to the business scenario, and then the fuzzy account under the target granularity can be selected from all fuzzy accounts. It should be noted that the target granularity may be one or more fuzzy granularities.

Afterwards, malicious account identification is carried out for fuzzy accounts under each target granularity. For the identification process, reference may be made to the description of the foregoing embodiments, and details are not repeated here. For the description of the evaluation parameters, reference may also be made to the foregoing embodiments, and details are not repeated here.

Taking the accounts luha3902163.com and luh244163.com as examples, the fuzzy accounts obtained after fuzzy processing according to the fuzzy parameter of the first fuzzy granularity are: luha^^^^163.com and luh^^^163.com; After the fuzzy parameters of the second fuzzy granularity are fuzzified, the fuzzy accounts obtained are: luha^163.com and luh^163.com; after the fuzzy parameters of the third fuzzy granularity are fuzzy processed, the fuzzy accounts obtained are: lucc^ 163.com and luc^163.com, where the non-numeric characters at the specified position refer to the first two non-numeric characters; the fuzzy account obtained after fuzzing with the fuzzy parameter of the fourth fuzzy granularity is: luc^163. com and luc^163.com; the fuzzy accounts obtained after fuzzy processing by the fuzzy parameter of the fifth fuzzy granularity are: x163.com and x163.com. Among them, "^", "c" and "x" in the above-mentioned fuzzy account are identifiers used to replace the original characters after fuzzy processing.

For example, for the business scenario of registering an e-mail, the first fuzzy granularity can be selected as the target granularity, then the fuzzy accounts under the target granularity are luha^^^^163.com and luh^^^163.com, and further A fuzzy account is used to identify malicious accounts. Specifically, the malicious account identification device may group the two fuzzy accounts, assuming that the two fuzzy accounts are grouped into one group, and then use the evaluation parameters to perform evaluation processing on the fuzzy accounts in the group to obtain evaluation results. For example, taking the average interval of registration time and the static sharing breadth index as evaluation parameters, the registration time interval of the two fuzzy accounts can be obtained first, and a score is given to the group of the two fuzzy accounts according to the registration time interval; further judgment Whether static information is shared between the two fuzzy accounts, according to the judgment result, a score is assigned to the group where the two fuzzy accounts belong, and the final score of the group is obtained according to the two scores, that is, the evaluation result. Afterwards, the malicious account identification device compares the final score of the group with the score threshold in the preset malicious condition, if it is greater than the threshold, it determines that the account to be identified corresponding to the group, that is, accounts luha3902163.com and luh244163.com belong to Malicious account; otherwise, it is not a malicious account.

In this embodiment, different fuzzy granularities are used to fuzzy the accounts to be identified to obtain fuzzy accounts under different fuzzy granularities; then select fuzzy accounts with required granularity according to business scenarios, group these fuzzy accounts, and then use the evaluation parameters to , evaluate each group, and finally determine the malicious account according to the evaluation result, which can more accurately discover the malicious account among the accounts to be identified, and reduce the misjudgment rate.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by this application.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

FIG. 3 is a schematic structural diagram of a malicious account identification device provided by an embodiment of the present application. As shown in FIG. 3 , the device includes: an acquisition module 31 , a fuzzy processing module 32 and an identification module 33 .

An acquisition module 31, configured to acquire an account to be identified.

The fuzzy processing module 32 is connected with the acquisition module 31, and is used to perform fuzzy processing on the account to be identified obtained by the acquisition module 31 according to the fuzzy processing instruction information, so as to obtain a fuzzy account that retains part of the information in the account to be identified; wherein, the fuzzy The processing instruction information is used to find accounts with the same or similar information among the accounts to be identified.

The identification module 33 is connected with the obfuscation processing module 32, and is used for identifying malicious accounts on the fuzzy accounts obtained by the obfuscation processing module 32, so as to determine the malicious accounts among the accounts to be identified.

In an optional implementation, the identification module 33 can be specifically used to: group fuzzy accounts, so as to group the same or similar fuzzy accounts into one group; evaluate the fuzzy accounts in each group according to the evaluation parameters, to obtain The evaluation results corresponding to each group; it is determined that the accounts to be identified corresponding to the groups whose evaluation results meet the preset malicious conditions are malicious accounts.

In an optional implementation manner, the blurring indication information includes at least one blurring parameter of a blurring granularity. Based on this, the fuzzy processing module 32 can be specifically configured to: according to the fuzzy parameters of each fuzzy granularity in at least one fuzzy granularity, respectively perform fuzzy processing on the accounts to be identified, so as to obtain the remaining part of the account to be identified under each fuzzy granularity An ambiguous account of information.

Optionally, the account to be identified in this embodiment may include: an account prefix and an account suffix.

Then the fuzzy parameters of at least one fuzzy granularity include:

The fuzzing parameter of the first fuzzing granularity is used to indicate: fuzz all the digits in the account prefix and keep the number of fuzzed digits;

The fuzzing parameter of the second fuzzing granularity is used to indicate: fuzz all the numbers in the account prefix, ignore the number of fuzzed numbers, and mark the fuzzed part as a number;

The fuzzing parameter of the third fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz the non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, and retain the number of non-numeric characters that are blurred out;

The fuzzing parameter of the fourth fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz all non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, ignoring the number of non-numeric characters blurred out; and

The fuzzing parameter of the fifth fuzzing granularity is used to indicate: all character combinations in the account prefix are fuzzy, and the character combination refers to any combination of characters except the splitting character used for segmentation, and the fuzzy character combination is ignored the number of characters.

Based on the fuzzification parameters of at least one kind of fuzzy granularity above, the identification module 33 is used to group fuzzy accounts, so as to group the same or similar fuzzy accounts into one group, which may specifically be:

Determine the target granularity from at least one fuzzy granularity according to the business scenario;

From all fuzzy accounts, select fuzzy accounts under the target granularity;

Group fuzzy accounts at the target granularity to group the same or similar fuzzy accounts into one group.

Optionally, the above evaluation parameters may include at least one of the following: average registration time interval, registration time regularity, number of fuzzy accounts in the group, characteristics of the group, posterior probability of the group, static sharing breadth index, dynamic sharing breadth index, Static share-intensity metrics and dynamic share-intensity metrics.

Among them, the static sharing breadth indicator is used to represent how much static information is shared between fuzzy accounts within a group;

The dynamic sharing breadth index is used to characterize how much dynamic information is shared between fuzzy accounts within a group;

The static sharing intensity index is used to characterize the amount of static information shared between the fuzzy accounts that share static information appearing in the group;

The index of dynamic sharing density is used to characterize the amount of dynamic information shared among the fuzzy accounts that share dynamic information appearing in the group.

The malicious account identification device provided in this embodiment obtains the account to be identified, performs fuzzy processing on the account to be identified according to the fuzzy processing instruction information, and obtains a fuzzy account that retains part of the information in the account to be identified, wherein the function of the fuzzy processing instruction information It is to find accounts with the same or similar information among the accounts to be identified. Therefore, by comparing fuzzy accounts, it is possible to find accounts to be identified with the same or similar information. These accounts are usually malicious accounts. Further identification of malicious accounts based on fuzzy accounts can be more accurate. Malicious accounts among the accounts to be identified can be found to reduce the misjudgment rate.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) or a processor (processor) execute the methods described in various embodiments of the present application. partial steps. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-OnlyMemory, ROM), random access memory (RandomAccessMemory, RAM), magnetic disk or optical disk, and various media capable of storing program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limiting them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present application.

Claims (12)

1. A malicious account identification method, characterized in that, comprising: Obtain the account to be identified; According to the fuzzy processing instruction information, perform fuzzy processing on the account to be identified to obtain a fuzzy account that retains part of the information in the account to be identified; wherein, the fuzzy processing instruction information is used to find that the account to be identified has Accounts with the same or similar information; Malicious account identification is performed on the fuzzy account to determine a malicious account among the accounts to be identified. 2. The method according to claim 1, wherein the identifying a malicious account on the fuzzy account to determine the malicious account among the accounts to be identified comprises: grouping said ambiguous accounts to group identical or similar said ambiguous accounts; Evaluate the fuzzy accounts in each group according to the evaluation parameters, so as to obtain the evaluation results corresponding to each group; It is determined that the account to be identified corresponding to the group whose evaluation result satisfies the preset malicious condition is a malicious account. 3. The method according to claim 2, wherein the blurring instruction information includes at least one blurring parameter of a blurring granularity; According to the fuzzy processing instruction information, performing fuzzy processing on the account to be identified, so as to obtain a fuzzy account that retains part of the information in the account to be identified, includes: According to the fuzzification parameters of each fuzzy granularity in the at least one fuzzy granularity, respectively perform fuzzy processing on the account to be identified, so as to obtain the fuzzy information that retains part of the information in the account to be identified at each fuzzy granularity. account. 4. The method according to claim 3, wherein the account to be identified comprises: an account prefix and an account suffix; The blurring parameters of the at least one blurring granularity include: The fuzzing parameter of the first fuzzing granularity is used to indicate: fuzz all the digits in the account prefix and keep the number of fuzzed digits; The fuzzing parameter of the second fuzzing granularity is used to indicate: fuzz all the numbers in the account prefix, ignore the number of fuzzed numbers, and mark the fuzzed part as a number; The fuzzing parameter of the third fuzzing granularity is used to indicate: fuzz all the numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz the non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, and retain the number of non-numeric characters that are blurred out; The fuzzing parameter of the fourth fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz all non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, ignoring the number of non-numeric characters blurred out; and The fuzzy parameter of the fifth fuzzy granularity is used to indicate: to fuzz out all character combinations in the account prefix, the character combination refers to any combination of characters except the splitting characters used for segmentation, and ignore the fuzzy characters The number of characters in the combination. 5. The method according to claim 3 or 4, wherein the grouping the fuzzy accounts to group the same or similar fuzzy accounts includes: Determine a target granularity from the at least one fuzzy granularity according to a business scenario; Selecting the fuzzy accounts under the target granularity from all the fuzzy accounts; The fuzzy accounts under the target granularity are grouped, so as to group the same or similar fuzzy accounts. 6. The method according to claim 2, 3 or 4, wherein the evaluation parameters include at least one of the following: average registration time interval, registration time regularity, number of fuzzy accounts in the group, characteristics of the group, group Posterior probability, static sharing breadth index, dynamic sharing breadth index, static sharing intensity index and dynamic sharing intensity index; Wherein, the static sharing breadth index is used to represent how much static information is shared between fuzzy accounts within a group; The dynamic sharing breadth index is used to characterize how much dynamic information is shared between fuzzy accounts within a group; The static sharing intensity index is used to characterize the amount of static information shared between fuzzy accounts that share static information appearing in the group; The dynamic sharing intensity index is used to characterize how much dynamic information is shared between fuzzy accounts that share dynamic information appearing in the group. 7. A malicious account identification device, characterized in that it comprises: An acquisition module, configured to acquire an account to be identified; A fuzzy processing module, configured to perform fuzzy processing on the account to be identified according to the fuzzy processing instruction information, so as to obtain a fuzzy account that retains part of the information in the account to be identified; wherein, the fuzzy processing instruction information is used to find Accounts with the same or similar information among the accounts to be identified; An identifying module, configured to identify malicious accounts on the fuzzy accounts, so as to determine the malicious accounts among the accounts to be identified. 8. The device according to claim 7, wherein the identification module is specifically used for: grouping said ambiguous accounts to group identical or similar said ambiguous accounts; Evaluate the fuzzy accounts in each group according to the evaluation parameters, so as to obtain the evaluation results corresponding to each group; It is determined that the account to be identified corresponding to the group whose evaluation result satisfies the preset malicious condition is a malicious account. 9. The device according to claim 8, wherein the blurring instruction information includes at least one blurring parameter of a blurring granularity; The fuzzy processing module is specifically configured to: perform fuzzy processing on the account to be identified according to the fuzzy parameters of each fuzzy granularity in the at least one fuzzy granularity, so as to obtain the The fuzzy account of part of the information in the account to be identified. 10. The device according to claim 9, wherein the account to be identified comprises: an account prefix and an account suffix; The blurring parameters of the at least one blurring granularity include: The fuzzing parameter of the first fuzzing granularity is used to indicate: fuzz all the digits in the account prefix and keep the number of fuzzed digits; The fuzzing parameter of the second fuzzing granularity is used to indicate: fuzz all the numbers in the account prefix, ignore the number of fuzzed numbers, and mark the fuzzed part as a number; The fuzzing parameter of the third fuzzing granularity is used to indicate: fuzz all the numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz the non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, and retain the number of non-numeric characters that are blurred out; The fuzzing parameter of the fourth fuzzing granularity is used to indicate: fuzz all numbers in the account prefix, ignore the number of numbers to be fuzzed, and fuzz all non-numeric characters in the account prefix except the non-numeric characters at the specified position other non-numeric characters, ignoring the number of non-numeric characters blurred out; and The fuzzy parameter of the fifth fuzzy granularity is used to indicate: to fuzz out all character combinations in the account prefix, the character combination refers to any combination of characters except the splitting characters used for segmentation, and ignore the fuzzy characters The number of characters in the combination. 11. The device according to claim 9 or 10, wherein the identification module is specifically used for: Determine a target granularity from the at least one fuzzy granularity according to a business scenario; Selecting the fuzzy accounts under the target granularity from all the fuzzy accounts; The fuzzy accounts under the target granularity are grouped, so as to group the same or similar fuzzy accounts. 12. The device according to claim 8, 9 or 10, wherein the evaluation parameters include at least one of the following: average time interval of registration, regularity of registration time, number of fuzzy accounts in the group, characteristics of the group, group Posterior probability, static sharing breadth index, dynamic sharing breadth index, static sharing intensity index and dynamic sharing intensity index; Wherein, the static sharing breadth index is used to represent how much static information is shared between fuzzy accounts within a group; The dynamic sharing breadth index is used to characterize how much dynamic information is shared between fuzzy accounts within a group; The static sharing intensity index is used to characterize the amount of static information shared between fuzzy accounts that share static information appearing in the group; The dynamic sharing intensity index is used to characterize how much dynamic information is shared between fuzzy accounts that share dynamic information appearing in the group.