CN103559210B - The ranking fraud detection method and ranking fraud detection system of application program - Google Patents

Abstract

The invention provides a kind of ranking fraud detection method of application program and ranking fraud detection system.Methods described includes：Active period detecting step, the active period of the application program is detected based on history ranking information；Ranking fraud detection step, is detected based at least one evidence related to ranking to the active period, obtains ranking fraud detection result.The method and system of the present invention can automatically identify the ranking fraud relevant with application program, so that application user obtains real application program ranking information.

Description

Ranking fraud detection method and ranking fraud detection system for applications

technical field

The invention relates to the network field, in particular to a ranking fraud detection method for application programs and a ranking fraud detection system.

Background technique

User applications, especially mobile applications installed and run on mobile terminals have developed rapidly in recent years. In order to make it easier for users to select and install applications, many application websites or application stores will provide services such as application query, download, and evaluation in a centralized manner, and will also publish application leaderboards (Application Leaderboard) on a regular basis, for example, every day. ) to reflect some applications that are currently popular with users. In fact, the leaderboard is one of the most important means of promoting an application, and a high ranking of an application on the leaderboard usually stimulates users to download the application in large numbers and brings huge economic benefits to the application developer. Therefore, app developers would very much like their apps to occupy higher positions on the leaderboards.

Ranking Fraud of an application is a fraudulent behavior aimed at improving the ranking of an application on the application leaderboard. In fact, instead of relying on traditional marketing methods to improve app rankings, it has become more and more common for app developers to commit ranking fraud by exaggerating their product sales or posting false product reviews, such as hiring "human trolls". water armies)” to increase the number of app downloads and reviews in a short period of time.

The industry has realized the importance of preventing ranking fraud so that app users can obtain real app ranking information. In order to prevent application ranking fraud, the existing method is to infer the existence of ranking fraud based on the degree of increase in the ranking of the application within a day, and directly lock the ranking of the entire application when it is judged that ranking fraud occurs. This method is too Simple and rude, it is difficult to accurately judge ranking fraud and hurt the ranking rise of normal applications. It can be seen that the understanding and research on the problem of ranking fraud detection of application programs in this field is still very limited, and there is no relevant technology for effectively detecting ranking fraud of application programs so far.

Contents of the invention

The purpose of the present invention is to provide a detection technology for application ranking fraud, so as to automatically and effectively identify the ranking fraud related to application programs, so that application program users can obtain real application program ranking information.

In order to solve the above technical problems, according to one aspect of the present invention, a ranking fraud detection method for an application program is provided, the method comprising:

The active period detection step is to detect the active period of the application program based on historical ranking information;

The ranking fraud detection step is to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

According to another aspect of the present invention, there is also provided a ranking fraud detection system for applications, the system comprising:

An active period detection unit, configured to detect the active period of the application based on historical ranking information;

A ranking fraud detection unit, configured to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

According to another aspect of the present invention, there is also provided a ranking fraud detection method for an application, the method comprising:

The active period of the application program is detected based on at least one ranking-related evidence, and a ranking fraud detection result is obtained.

According to another aspect of the present invention, there is also provided a ranking fraud detection system for applications, the system comprising:

The ranking fraud detection unit is configured to detect the active period of the application program based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

The method and system of the present invention can automatically and effectively identify ranking fraud related to application programs, so that application program users can obtain real application program ranking information.

Description of drawings

Fig. 1 is a flow chart of the ranking fraud detection method of the application program in the specific embodiment of the present invention;

Figure 2a is an example of an active event in an application leaderboard;

Figure 2b is an example of an active period in an application leaderboard;

Fig. 3 is a schematic diagram of different ranking stages in an active event of the application;

Figure 4a is a schematic diagram of a ranking record of an application suspected of ranking fraud;

Figure 4b is a schematic diagram of a ranking record of a normal application;

Fig. 5 is a system structural diagram of the ranking fraud detection system of the application program in the specific embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a ranking fraud detection system for an application program in another embodiment of the present invention.

detailed description

The specific implementation manners of the present invention will be described in further detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

The present invention studies the technical issues related to the ranking of application programs. Therefore, those skilled in the art should have a broad understanding of the "application program" in the present invention, which includes various applications that can be published on the Internet and available for users to download, evaluate, and execute. Programs or files include traditional applications running on personal computers, mobile applications running on mobile terminals, and multimedia files such as pictures, audio, and video that can be downloaded and played.

There are several important issues that need to be addressed when detecting ranking fraud for apps. First of all, ranking fraud does not always occur in the entire life cycle of the application, so it is first necessary to detect the time when ranking fraud may occur; second, due to the huge number of applications, it is difficult to manually identify each application that has ranking fraud Therefore, it is necessary to provide a technology for automatically detecting ranking fraud; thirdly, in the prior art, it is not sure what basis can be used to detect the existence of ranking fraud.

A specific embodiment of the present invention conducts overall analysis and research on the ranking fraud of the application program, and provides a technology for detecting the ranking fraud of the application program, which can be detected by analyzing the historical ranking information of the application program. Detect the "active period" of the application, aim at the ranking characteristics of the application in the active period, and detect ranking fraud based on the evidence related to the ranking.

According to the analysis of the inventors, it is found that applications with ranking fraud do not occupy a high ranking on the ranking list for a long time, and the high ranking is only concentrated in a relatively short period of time as some independent events. Indicating that ranking fraud occurred during this period. In the present invention, the period in which the application continues to rank higher can be called the "Leading Event" of the application, and the period in which active events occur frequently can be called the "Leading Session" of the application . Therefore, the detection of ranking fraud first needs to detect the active event and the active period in which ranking fraud may exist in each application.

The application store operator has the historical ranking information of the application, which is obtained directly from the application store operator, or through the analysis and analysis of the application ranking information continuously released by the application store operator in a long historical period. processing, and historical ranking information for applications can also be obtained. Since the historical ranking information of the application program records the historical information about the ranking of the application program and related user evaluation information, in the specific implementation manner of the present invention, the active events and active events of each application program can be carried out based on the historical ranking information. Periodic detection, and then realize the detection of ranking fraud. By analyzing the ranking behavior of applications, it is found that compared with normal applications, applications with ranking fraud will show different ranking characteristics during active events and active periods. Therefore, it is possible to extract some ranking-related evidence for judging ranking fraud from the historical ranking information of the application program, and obtain these evidences, so as to realize the detection of ranking fraud.

As shown in FIG. 1 , a specific embodiment of the present invention provides a ranking fraud detection method for an application, the method comprising:

The active period detection step S10 is to detect the active period of the application program based on historical ranking information; the ranking fraud detection step S20 is to detect the active period based on at least one ranking-related evidence to obtain a ranking fraud detection result.

In the following, the procedures and functions of the steps and functions of the ranking fraud detection method in the specific embodiments of the present invention will be described with reference to the accompanying drawings.

Since historical ranking information is the data basis for detecting application ranking fraud in the present invention, as a preferred embodiment of the present invention, the ranking fraud detection method may also include a historical ranking information acquisition step, obtaining the application program in the application Historical ranking information on the program leaderboard.

The application leaderboard can usually display the top K most popular applications, such as the top 1000 and so on. Moreover, application leaderboards are usually updated regularly, for example, daily. Therefore, for each application a, there is its historical ranking information, which can be expressed as a ranking sequence corresponding to the discrete time series The intervals between the time points in the discrete time series are fixed, that is, the update cycle of the application leaderboard. Among them, r _i ^a is the ranking of the application a at time t _i , r _i ^a ∈ {1,…,K…,+∞}, +∞ means that the application a is not in the top K ranking list; n represents the total number of time points corresponding to all historical ranking information. For example, when the leaderboard is updated every day, t _i represents the i-th day in the history, and n is the total number of days corresponding to the historical ranking information. It can be seen that the smaller the value of r _i ^a , the higher the ranking of application a on the leaderboard on the i-th day.

After an application is published, any downloaded user can rate it. In fact, user reviews are one of the most important characteristics for app promotion. An app with a higher rating attracts more users to download it and leads to a higher ranking of the app on the leaderboard. Therefore, the historical ranking information may also include evaluation information made by users of the application program in various historical time periods for the application program.

In the step of obtaining historical ranking information, the historical ranking information can be obtained in various ways. For example, the historical ranking information may be obtained directly from the operator of the application store, or may be extracted from data continuously released by the application store in a long historical period.

S10: Active period detection step, detecting the active period of the application program based on historical ranking information.

The active period means that an application ranks high on the application leaderboard, that is, a period of time when users pay more attention. Therefore, ranking fraud that will have a greater impact on the application market will only occur during these active periods. Therefore, in the specific embodiment of the present invention, the detection of ranking fraud must first detect the active period of the application program from the historical ranking information of the application program.

In a preferred embodiment of the present invention, the active period detection step may further include an active event detection step of detecting active events of the application program based on the historical ranking information.

Since application developers hope that their applications will occupy a higher ranking on the leaderboard, the application developer may make use of ranking fraud to make their application rank in the top of the leaderboard. Through the analysis, it is found that the application does not always occupy a high ranking on the ranking list, and the period of continuous high ranking is an "active event". Figure 2a shows an example of an application's active event. The horizontal axis represents the time series (Date Index) corresponding to the historical ranking information, and the vertical axis represents the ranking (Ranking) of the application. Event 1 (Event1) and Event 2 (Event2) in the figure represent the occurrences in the ranking history of the application The two active events of , whose contours are respectively connected by the ranking points during the active events.

In a specific embodiment of the present invention, the standard for an application to rank higher on the application leaderboard is that the ranking of the application is not greater than a ranking threshold K*. Since the ranking of the application in the top K* ranks of the rankings is considered to be higher, the time period in which the ranking of the application continues to be in the top K* ranks can be considered as an active event, and the active event should start from The app begins when it enters the top K* rankings and continues until the app falls out of the top K* rankings.

Preferably, the method in the embodiment of the present invention may further include a step of setting the ranking threshold K*, so as to determine the standard for an application to be ranked higher on the application leaderboard. Since the total number K of applications on the leaderboard is usually very large, for example, 1000, etc., the above ranking threshold K* is usually smaller than the K value. According to factors such as the total number K of applications in the application leaderboard and the analysis requirements of those skilled in the art, the ranking threshold K* may be, for example, an integer between 1 and 500. Those skilled in the art can understand that the smaller the value of K*, the higher the standard for the application program to be considered to be ranked higher. In FIG. 2a, the value of K* is 300.

According to the above textual expression of active events, the active event e of application a can be formulated as follows:

Given a ranking threshold K* as a higher ranking standard, where K*∈[1,K]; the active event e of application a includes a time range from a start time to an end time The ranking of the corresponding application a satisfies and and Satisfied

According to the above statement, it can be seen that the important thing for the detection of active events is to detect the start time and end time of a period of time when the ranking of the application continues to be in the top K* position, and combine a pair of start time and end time period identified as an active event. Therefore, in a specific embodiment of the present invention, the active event detection step may further include the following steps:

Start time identification step S101: In this step, the start time of active events is identified from historical ranking information. Specifically, in the start time identification step, the application ranking at each time point in the historical ranking information can be sequentially searched, when the ranking at the current time point is not greater than the ranking threshold K* and the ranking at the previous time point is greater than the ranking threshold When K*, identify the current time point as the start time of the active event. Those skilled in the art can understand that since the application ranking history may include multiple active events, multiple start time points may be identified in the step of identifying start time.

End time identification step S102: In this step, the end time of the active time is identified from the historical ranking information. Specifically, in the end time identification step, the application ranking at each time point in the historical ranking information can be sequentially searched, when the ranking at the current time point is greater than the ranking threshold K* and the ranking at the previous time point is not greater than the ranking threshold When K*, identify the last time point as the end time of the active event. Those skilled in the art can understand that since the application ranking history may include multiple active events, multiple end time points may be identified in the end time identifying step.

Active event identification step S103: In this step, the time period between each start time and its adjacent end time is identified as an active event, thus detecting all active events of the application program in the ranking history.

It is worth noting that, as a special case, if at the first point in time of the analyzed and processed historical period, for example, on the first day in the history, the ranking of the application is in the top K* position of the leaderboard In this case, in the start time identifying step S101, the first time point is defined as a start time. Similarly, if at the last point in time of the analyzed and processed historical period, such as today, the ranking of the application program is still in the top K* position of the leaderboard, at this time, in the end time identification step S102, the The last time point is defined as an end time.

The method for detecting active events in the application program is introduced above. On this basis, in a preferred embodiment of the present invention, adjacent active events may be combined in the active period detection step to form the active period.

Through further research, it is found that some application programs will have multiple active events adjacent to each other in a period of time, and this period is the "active period" of the application program in the present invention. It can be seen that the combination of adjacent active events constitutes an active period. Specifically, the time interval between two adjacent active events is less than an interval threshold φ as the criterion for merging two active events into the same active period, while the time interval between two adjacent active events refers to the The interval between the end time of the previous active event and the start time of the next active event in an active event.

Preferably, the method in the embodiment of the present invention may further include a step of setting the interval threshold φ, so as to determine the criteria for combining two active events into the same active period. According to factors such as analysis requirements of those skilled in the art, the value of the interval threshold φ may be an integer value of 2 to 10 times the update period of the application leaderboard. Those skilled in the art can understand that the smaller the value of the interval threshold φ, the higher the standard for merging two active events into the same active period.

Figure 2b shows an example of the active period of the application program. The horizontal axis in the figure represents the time series (Date Index) corresponding to the historical ranking information, and the vertical axis represents the ranking (Ranking) of the application program. Period 1 (Session1) in the figure and Session 2 (Session2) represent two active sessions that appear in the ranking history of the application, and each active session consists of multiple active events.

According to the above textual expression of the active period, the active period s of application a can be formulated as follows:

The active period s of application a includes a time range and n adjacent active events {e ₁ ,…,e _n }, which satisfy and there is no other active period s* such that also, have Among them, φ is the preset active event interval threshold, which is used to judge the degree of adjacency between active events so as to include them in the same active period.

According to the above expression, it can be seen that the most important thing for the detection of active periods is to combine adjacent active events in the application ranking history based on the interval threshold φ to form active periods. Specifically, in the active period detection step of the specific embodiment of the present invention, each detected active event is sequentially searched from the initial time point in the historical ranking information, when the time interval between the current active event and the previous active event is less than the When the interval threshold φ, the two active events are merged into the same active period until all detected active events are searched to detect all active periods of the application in the ranking history.

It is worth noting that, as a special case, if an active event is not adjacent to any other active event, the active event itself can also be considered to constitute an active period. In this case, in the active period detection step, when the time interval between an active event and the previous active event is not less than the interval threshold φ, and the time interval between the active event and the next active event is not less than the When the interval threshold φ, the active event itself is detected as an active period.

As mentioned above, the above-mentioned active period detected indicates that an application ranks high on the application ranking list, that is, a period of time when it is popular with users. The data foundation for various application services. Therefore, after detecting the active period of the application program, as a preferred embodiment of the present invention, the detected active period information of the application program can also be sent to the application program developer, the application program store operator or the terminal of the application program user.

For application program developers, they can analyze the development trend of relevant technical fields or the needs of application program users according to the active period information, so as to guide the development and operation of application programs; The active period information further analyzes ranking frauds that use fraudulent means to obtain false high rankings on the leaderboard, so as to improve the operation of the application store; and for end users of the application, they can judge by themselves based on the active period information The application has the possibility of ranking fraud or chooses an application that meets one's own needs.

In addition, as a specific implementation of detecting active events and active periods of an application, the following Algorithm 1 shows an example of a program code for detecting active periods in the historical ranking information of a given application a.

In Algorithm 1 above, each active event e is defined as Define the active period s as where E _s is the set of active events in the active period s. In particular, firstly, each active event e of application a is extracted from the start time of the historical ranking information (steps 2-5 in Algorithm 1). For each active event e extracted, the time interval between e and the previous active event e* is detected to determine whether they belong to the same active period. Specifically, if Active event e is considered to belong to a new active period (steps 7-13 in Algorithm 1). In this way, the above Algorithm 1 can identify active events and active periods by scanning the historical ranking information of application a.

The ranking fraud detection step S20 is to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

Just as the introduction of historical ranking information above, it includes a ranking sequence corresponding to a discrete time series, each element in the ranking sequence corresponds to a discrete time point in the time series, indicating that the application is in the discrete time series Ranking at a point in time. At the same time, the active period is a period in which ranking fraud may occur in the application. Therefore, the ranking characteristics of the historical ranking information in the active period of the application program can be analyzed, and some ranking-related information can be extracted as evidence for detecting ranking fraud.

As a preferred embodiment of the present invention, the ranking fraud detection step may further include an evidence verification step, which verifies the active period based on at least one ranking-related evidence and obtains a fraud parameter. In this way, after the evidence related to the ranking is extracted, the fraud parameter corresponding to the evidence can be calculated, and the fraud parameter itself can be used as the ranking fraud detection result of the ranking fraud detection method in this embodiment. Due to the complex factors affecting the ranking characteristics of an application, relying on one or more ranking-related evidence may not be able to accurately determine whether an application has ranking fraud, but only a reference detection value (fraud parameter), but Those skilled in the art can judge the possibility of ranking fraud in the application program according to the fraud parameter.

Since an active period may include one or more active events, in order to extract evidence for detecting ranking fraud during the active period, as a preferred embodiment of the present invention, the ranking fraud detection step may further include an active event analysis step, To analyze some basic ranking characteristics of each active event in the active period, such as identifying the rising phase, maintaining phase and declining phase of active events.

Specifically, by analyzing the historical ranking information of applications, it can be seen that the ranking behavior of applications in active events usually satisfies specific ranking characteristics, that is, each includes three different ranking stages: rising stage, maintaining stage and falling stage. In each active event, the application's ranking first rises to a peak range of the leaderboard (that is, the rising phase, Raising Phase), and then remains within the peak range for a period of time (that is, the maintaining phase, Maintaining Phase), and finally the ranking drops Until the end of the active event (that is, the decline phase, Recession Phase). Fig. 3 shows an example of different ranking stages in an active event, the horizontal axis in the figure represents the time series (DateIndex) corresponding to the historical ranking information, and the vertical axis represents the ranking (Ranking) of the application program.

Based on the above textual expression, the following is a formulaic description of the above three stages of active events:

For a given application a, in the time range of its active event e In , the highest ranking position for application a is It falls within the ΔR range. The rising phase of the active event e refers to the time frame in and Satisfy The hold phase of an active event e refers to the time frame in and Satisfy The falling phase of an active event refers to the event range in

It is worth noting that in the above description, ΔR is the ranking range that determines the start time and end time of the hold phase, with are the first time and the last time when the ranking of application a is within the ranking range ΔR, respectively. Those skilled in the art can set the range of ΔR according to the analysis requirements so as to divide the active events into stages. For example, the range of ΔR in FIG. 3 is that the application ranks in the top 70 of the leaderboard. In a preferred embodiment of the present invention, the way to identify the above three stages in the active event analysis step is: determine the first time and the last time when the ranking of the application program in the active event is within the peak range ΔR, and the first time The time period between one time and this last time is identified as the hold phase, the time period in the active event before the hold phase is identified as the rising phase, and the time period in the active event after the hold phase is identified as the falling phase.

For an application, even if there is ranking fraud, it is impossible to always maintain the same peak position, such as always ranking first on the leaderboard, but within a peak range, such as top 25 on the leaderboard, etc. . If there is ranking fraud in an active period s of application a, the ranking behavior in these three stages of its active event will be different from those of normal application active periods. In fact, every application with ranking fraud always has a desired ranking goal, such as maintaining the top 25 in the leaderboard for a week, etc., and will also give the person hired to carry out the ranking fraud according to the ranking goal. Pay money (e.g. $1000 per day for staying in the top 25, etc.). So, the sooner they reach that ranking goal, the faster they can make money, both for the app developer and for the person being hired. Also, after reaching and maintaining that ranking goal for a desired period of time, the ranking cheating stops and the app's ranking plummets. It can be seen that active events with ranking fraud will show a very short rising phase and a very short falling phase. At the same time, since ranking fraudulently earning an app a high leaderboard position is very expensive, a rank fraudulent app typically only has a short hold period per active event for the app to be at the top of the leaderboard .

Fig. 4a shows a ranking record of an application suspected of ranking fraud. In the figure, it can be seen that there are multiple pulsed active events for the application. On the contrary, for normal applications, the ranking behavior in its active events is quite different. For example, Figure 4b shows a ranking record of a normal application that is very popular with users, which includes an active event with a long time range (longer than 1 year), especially in the decline phase. In fact, once a normal app climbs to a higher ranking in the chart, it usually has a large group of loyal fans and may attract more and more users to download, so this app will occupy the chart for a long time higher ranking. Based on the above analysis, the present invention can extract some ranking-related identification marks to construct evidence (ranking-related evidence) during the active period of the application program, and use these evidences to detect the existence of ranking fraud.

According to the above-mentioned analysis of the three phases of active events, active events with ranking fraud will show a very short rising phase and a very short falling phase. Therefore, in a preferred implementation, the evidence related to the ranking can be based on the active Based on some ranking characteristics reflected in the rising stage and/or falling stage of the active events within the period, an evidence value is calculated based on the constituted evidence as a fraud parameter for judging ranking fraud.

For example, since the rising stage and falling stage of each active event in the active period have been identified in the active event analysis step, the average value of the time range of the rising stage of all active events in the active period can be calculated (for example, the active period includes 3 active events, the average is the sum of the time ranges of the 3 rising phases of the 3 active events and divided by 3), or the average of the time ranges of the falling phases of all active events, or the time range of the rising phases of all active events The mean of the sum of the time range and the time range of the decline phase is used as this fraud parameter.

For another example, it is also possible to calculate the average of the acute angles formed by the curves of the rising phase of all active events in the active period and the time axis, or the angle of the acute angles formed by the curves of the falling phase of all active events intersecting the time axis , or the average of the sum of the acute angles formed by the intersection of the rising phase curve and the falling phase curve of all active events with the time axis, as the fraud parameter. As shown in Figure 3, the two acute angle parameters θ ₁ and θ ₂ respectively show the rising phase curve (the curve formed by connecting adjacent ranking value points in the rising phase) and the declining phase curve in an active event e of application a (the curve formed by connecting adjacent ranking value points in the descending stage) and the acute angle formed by the intersection of the time axis. According to the formulaic description of the three stages in the active event in the previous active event analysis step, those skilled in the art can calculate the above parameters θ ₁ and θ ₂ through the following formulas:

where K* is the rank threshold representing a higher rank.

It can be seen that a larger value of θ ₁ means that the ranking of application a has risen to a higher ranking in a short period of time; a larger value of θ ₂ indicates that application a has dropped from a higher ranking in a short period of time to the bottom of the ranking. Therefore, for an active period, if it contains more active events with larger θ ₁ value or larger θ ₂ value, it indicates that there is a greater possibility of ranking fraud. For example, when the average value of the acute angle sum formed by the intersection of the curves of the rising phase and the curves of the falling phase of all active events in the active period with the time axis is used as the fraud parameter, the fraud parameter can be further described here as follows:

where |Es| is the total number of active events contained in the active period _s . It can be seen that, compared with the active periods of other applications on the leaderboard, if the active period s of an application contains significantly larger value, there is a high probability that the application has ranking fraud.

According to the above-mentioned analysis of the three phases of the active event, it can be seen that the application program with ranking fraud usually only has a short maintenance period in each active event so that the application program is at the top of the leaderboard, so in a preferred embodiment of the present invention In , the evidence related to the ranking can be constructed based on some ranking characteristics reflected in the maintenance stage of the active event in the active period, and based on the constituted evidence, an evidence value is calculated as a fraud parameter for judging ranking fraud .

For example, since the holding phase of each active event in the active period has been identified in the active event analysis step, the average value of the time range of the holding phase of all active events in the active period can be calculated as the fraud parameter.

For another example, the fraud parameter may be calculated based on the average rank of the application program in the maintenance phase of all active events in the active period and the time range of the active events. Specifically, as discussed above, applications that exhibit ranking fraud typically have shorter hold periods in active events. Therefore, if you use to denote the time frame of the hold phase of an active event e, and denote the average rank of application a in this hold phase as The fraud parameter X _s of an active period can be defined, for example, as follows:

where K* is the rank threshold representing a higher rank. It can be seen that, compared with the active periods of other applications on the ranking list, if the active period s of an application contains a significantly larger Χ _s value, there is a high possibility of ranking fraud in the application.

In addition, those skilled in the art can understand that the number |E _s | of active events included in the active period s of the application program is also an important indicator of ranking fraud. For a normal application, the decline phase indicates a decrease in popularity, so the end of the active event is unlikely to have another active event in the short term, unless the application launches a newer version or takes other commercial measures. Promotional tools. Therefore, if an active session of an app contains significantly more active events than active sessions of other apps on the leaderboard, the app has a high probability There is ranking fraud.

According to the above analysis of the number of active events in the active period, in a preferred embodiment, the evidence related to the ranking can be formed based on the number of active events in the active period, and the active events in the active period can be determined based on the constituted evidence The number of |E _s |, as a fraud parameter for judging ranking fraud.

A variety of ranking-related evidences have been introduced above. In addition to using one of them alone for ranking fraud detection in each of the above-mentioned preferred embodiments, in a preferred implementation of the evidence verification step, the above-mentioned and A plurality of ranking-related evidences will be weighted and calculated based on the corresponding fraud parameters verified by these evidences, so as to obtain a final fraud parameter. Considering that the above multiple evidences may have different dimensions, those skilled in the art can determine each fraud parameter based on the known normalization method and weight determination method in the prior art according to the degree of emphasis on each evidence in the actual analysis requirements The weight value of , will not be repeated here.

The evidence verification step in the ranking fraud detection step is described above, which can verify the active period based on at least one ranking-related evidence and obtain a fraud parameter, which itself can be used as the ranking of the ranking fraud detection method. Fraud detection results. However, in order to make ranking fraud detection more convenient for those skilled in the art, in a preferred embodiment, the ranking fraud detection step may further include a fraud parameter judgment step, which compares the fraud parameters calculated according to the evidence with a threshold , so as to intuitively judge whether there is ranking fraud in the application program.

Those skilled in the art can understand that based on the various ranking-related evidences described above, those skilled in the art can set corresponding thresholds according to the different properties of the evidence and detection requirements, and determine whether the application program is based on the set thresholds. It is judged that there is ranking fraud, and the final result of the judgment is used as the ranking fraud detection result of the ranking fraud detection method in the specific embodiment of the present invention. For example, for the various ranking-related evidences described above, if the fraud parameter is the average of the time ranges of the rising and/or falling phases of active events, or the average of the time ranges of the holding phases, When the calculated fraud parameter is less than the set threshold, it is judged that the application has ranking fraud; and if the fraud parameter is other situations introduced, when the calculated fraud parameter exceeds the set threshold, it is judged that the application has ranking fraud. The app suffers from ranking fraud.

After the ranking fraud detection result is obtained in the ranking fraud detection step, in a preferred embodiment of the present invention, the obtained ranking fraud detection result can also be sent to the application program store operator or the terminal user of the application program. For application store operators, they can improve the operation of the application store based on the ranking fraud detection results; and for application end users, they can choose applications that meet their own needs based on the ranking fraud detection results, etc. .

As shown in FIG. 5 , a specific embodiment of the present invention also provides a ranking fraud detection system 100 for applications, and the system 100 includes:

The active period detection unit 110 is configured to detect the active period of the application program based on historical ranking information; the ranking fraud detection unit 120 is configured to detect the active period based on at least one ranking-related evidence to obtain a ranking fraud detection result .

Next, the functions of each unit of the above-mentioned detection system will be described in conjunction with the accompanying drawings.

Since historical ranking information is the data basis for detecting ranking fraud of application programs in the present invention, as a preferred embodiment of the present invention, the ranking fraud detection system 100 may also include a historical ranking information acquisition unit for obtaining the application Historical ranking information of the program on the application leaderboard.

The historical ranking information obtaining unit may obtain the historical ranking information in various ways. For example, the historical ranking information may be obtained directly from the operator of the application store, or may be extracted from data continuously released by the application store in a long historical period.

The active period detection unit 110 is configured to detect the active period of the application program based on historical ranking information.

In a preferred embodiment of the present invention, the active period detection unit 110 may further include an active event detection module, configured to detect active events of the application program based on the historical ranking information.

Preferably, the system in the embodiment of the present invention may further include a ranking threshold setting unit, configured to set the value of the ranking threshold K*, so as to determine the standard for an application to rank higher on the application leaderboard. The value of the ranking threshold K* may be an integer between 1 and 500.

In a specific embodiment of the present invention, the active event detection module further includes:

The start time identification module is configured to identify the start time of an active event from historical ranking information. Specifically, the start time identification module may sequentially search for the ranking of the application program at each time point in the historical ranking information, when the ranking at the current time point is not greater than the ranking threshold K* and the ranking at the previous time point is greater than the ranking threshold K* , identifying the current time point as the start time of the active event.

The end time identification module is used to identify the end time of the active time from the historical ranking information. Specifically, the end time identification module may sequentially search for the ranking of the application program at each time point in the historical ranking information, when the ranking at the current time point is greater than the ranking threshold K* and the ranking at the previous time point is not greater than the ranking threshold K* , identifying the last time point as the end time of the active event.

The active event identification module is configured to identify the time period between each start time and its adjacent end time as an active event, thus detecting all active events of the application in the ranking history.

It is worth noting that, as a special case, if at the first point in time of the analyzed and processed historical period, for example, on the first day in the history, the ranking of the application is in the top K* position of the leaderboard In this case, the start time identification module defines the first time point as a start time. Similarly, if at the last time point of the analyzed and processed historical period, such as today, the ranking of the application program is still among the top K* positions in the leaderboard, the end time recognition module will use the last time point Defined as an end time.

In a preferred embodiment of the present invention, the active period detection unit 110 is configured to combine adjacent active events to form the active period of the application program.

Preferably, the ranking fraud detection system 100 in the embodiment of the present invention may further include an interval threshold setting unit, configured to set the value of the interval threshold φ, so as to determine the criteria for merging two active events into the same active period. The value of the interval threshold φ may be an integer value of 2-10 times the update period of the application leaderboard.

In a specific embodiment of the present invention, the active period detection unit 110 sequentially searches each detected active event from the initial time point in the historical ranking information, when the time interval between the current active event and the previous active event is less than the interval threshold φ When , these two active events are combined into the same active period until all detected active events are searched to detect all active periods of the application in the ranking history.

It is worth noting that, as a special case, if an active event is not adjacent to any other active event, the active event itself can also be considered to constitute an active period. In this case, the active period detection unit 110 is used when the time interval between an active event and the previous active event is not less than the interval threshold φ, and the time interval between the active event and the next active event is not less than the When the interval threshold φ, the active event itself is detected as an active period.

As a preferred embodiment of the present invention, the ranking fraud detection system 100 may also include an active period sending unit, which sends the detected active period information of the application to the application developer, application store operator or application user.

The ranking fraud detection unit 120 is configured to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

As a preferred embodiment of the present invention, the ranking fraud detection unit 120 may further include an evidence verification module, configured to verify the active period based on at least one ranking-related evidence and obtain a fraud parameter.

Since an active period may include one or more active events, in order to extract evidence for detecting ranking fraud during the active period, as a preferred embodiment of the present invention, the ranking fraud detection unit 120 may further include an active event analysis module , which is used to analyze some basic ranking characteristics of each active event during the active period, such as identifying the rising phase, maintaining phase and declining phase of active events. In a preferred embodiment of the present invention, the method for identifying the above three stages in the active event analysis module is: determine the first time and the last time when the ranking of the application in the active event is within the peak range ΔR, and the first time The time period between the last time and the last time is identified as the hold phase, the time period in the active event before the hold phase is identified as the rising phase, and the time period in the active event after the hold phase is identified as the falling phase.

In a preferred embodiment, the evidence related to the ranking can be formed based on some ranking characteristics reflected in the rising stage and/or falling stage of the active events in the active period, and an evidence is calculated based on the constituted evidence The value is used as a fraud parameter for judging ranking fraud. In another preferred embodiment, the evidence related to the ranking can be formed based on some ranking characteristics reflected in the maintenance stage of the active event in the active period, and an evidence value is calculated based on the constituted evidence as the Fraud parameters for judging ranking fraud. In another preferred embodiment, the evidence related to the ranking can be formed based on the number of active events in the active period, and based on the constituted evidence, the number |E _s | of active events in the active period can be determined as the Fraud parameters for judging ranking fraud.

In addition to using one of them alone for ranking fraud detection in each of the above-mentioned preferred embodiments, the evidence verification module can also comprehensively consider multiple of the above-mentioned ranking-related evidences, and verify the corresponding fraud parameters obtained based on these evidences Weighted calculations are performed to obtain a final fraud parameter.

In order to make ranking fraud detection more convenient for those skilled in the art, in a preferred embodiment, the ranking fraud detection unit 120 may further include a fraud parameter judging module, which compares the fraud parameter calculated according to the evidence with a threshold , so as to intuitively judge whether there is ranking fraud in the application program.

After the ranking fraud detection result is obtained in the ranking fraud detection step, in a preferred embodiment of the present invention, the ranking fraud detection system 100 further includes a ranking fraud detection result sending unit, which sends the obtained ranking fraud detection result to the application store The operator or the end user of the application.

Those skilled in the art can understand that when the active event and active period information of the application program is known, those skilled in the art can directly implement the above steps of ranking fraud detection based on the above active event and active period information, so as to achieve application ranking Fraud detection. Therefore, another specific embodiment of the present invention also provides a ranking fraud detection method for an application, the method comprising: detecting the active period based on at least one ranking-related evidence, and obtaining a ranking fraud Test results. In the application ranking fraud detection method in this specific embodiment, the implemented technical content is the same as the ranking fraud detection steps in the previous specific embodiment, and will not be repeated here.

Correspondingly, another specific embodiment of the present invention also provides a ranking fraud detection system for applications, the system comprising: a ranking fraud detection unit, configured to detect the active period based on at least one ranking-related evidence Perform detection to obtain ranking fraud detection results. In the application program ranking fraud detection system in this specific embodiment, the implemented technical content is the same as that of the ranking fraud detection unit in the previous specific embodiment, and will not be repeated here.

FIG. 6 is a schematic structural diagram of a ranking fraud detection system 600 for an application provided by an embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the ranking fraud detection system 600 . As shown in Figure 6, the ranking fraud detection system 600 may include:

A processor (processor) 610 , a communication interface (Communications Interface) 620 , a memory (memory) 630 , and a communication bus 640 . in:

The processor 610 , the communication interface 620 , and the memory 630 communicate with each other through the communication bus 640 .

The communication interface 620 is used for communicating with network elements such as clients.

The processor 610 is configured to execute the program 632, and may specifically implement related functions of the ranking fraud detection system in the above-mentioned embodiment shown in FIG. 5 .

Specifically, the program 632 may include program codes including computer operation instructions.

The processor 610 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

The memory 630 is used to store the program 632 . The memory 630 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one magnetic disk memory. Program 632 may specifically include:

An active period detection unit, configured to detect the active period of the application based on historical ranking information;

A ranking fraud detection unit, configured to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

Program 632 may specifically include:

The ranking fraud detection unit is configured to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result.

For the specific implementation of each unit in the program 632, reference may be made to the corresponding units in the above embodiments, which will not be repeated here.

Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the devices and modules described above can refer to the corresponding descriptions in the foregoing device embodiments, and details are not repeated here.

Those skilled in the art can appreciate that the units and method steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

The above embodiments are only used to illustrate the present invention, but not to limit the present invention. Those of ordinary skill in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, all Equivalent technical solutions also belong to the category of the present invention, and the scope of patent protection of the present invention should be defined by the claims.

Claims (57)

1. A ranking fraud detection method for an application, characterized in that the method comprises: The active period detection step is to detect the active period of the application program based on historical ranking information; The ranking fraud detection step is to detect the active period based on at least one ranking-related evidence, and obtain the ranking fraud detection result; The ranking fraud detection step further includes: an active event analysis step, identifying a rise phase, a hold phase, and a decline phase of at least one active event in said active period; The active event is a period during which the continuous ranking of the application program is not greater than the ranking threshold; The active period is a period in which active events with a time interval smaller than the interval threshold φ are combined, or an active event whose time interval with other active events is not less than the interval threshold φ. 2. The method according to claim 1, wherein the ranking fraud detection step further comprises: The evidence verification step is to verify the active period based on at least one ranking-related evidence and obtain a fraud parameter. 3. The method according to claim 2, characterized in that, in the active event analysis step, determine the first time and the last time when the ranking of the application program in the active event is within a peak range ΔR time, identifying the time period between the first time and the last time as the hold phase, identifying the time period in the active event before the hold phase as the ramp-up phase, identifying the The period of time following the hold phase in an active event is identified as the decline phase. 4. The method according to claim 2, wherein the evidence related to the ranking is formed based on an ascending phase and/or a descending phase in active events within the active period. 5. The method of claim 4, wherein, The fraud parameter is the average value of the time range of the rising phase of all active events in the active period, or the average value of the time range of the falling phase of all active events in the active period, or the active The average of the sum of the time ranges for the described up phase and down phase for all active events in the period. 6. The method of claim 4, wherein, The fraud parameter is the average value of the acute angle formed by the intersection of the curves of the rising phase of all active events with the time axis in the active period, or the intersection of the curves of the falling phase of all active events and the time axis. The average value of the angles of the acute angles formed, or the average value of the sum of the angles of the acute angles formed by the intersection of the curves of the rising phase and the curves of the falling phase of all active events with the time axis. 7. The method of claim 2, wherein, The ranking-related evidence is constituted based on a hold phase in active events within the active period. 8. The method of claim 7, wherein, The fraud parameter is an average of the time range of the hold phase of all active events in the active period. 9. The method of claim 7, wherein the fraud parameter is calculated based on an average rank of the application in the hold phase of all active events and a time frame of the hold phase. 10. The method of claim 2, wherein, The ranking-related evidence is based on the number of active events within the active period. 11. The method of claim 10, wherein, The fraud parameter is the number of active events within the active period. 12. The method according to claim 2, characterized in that, in the evidence verification step, comprehensively considering a plurality of the above-mentioned evidences related to the ranking, based on a plurality of the evidences related to the ranking, The corresponding fraud parameters obtained through verification are weighted and calculated to obtain a final fraud parameter. 13. The method according to any one of claims 2-11, wherein the ranking fraud detection step further comprises: The fraud parameter judging step is to compare the fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 14. The method according to claim 12, wherein said ranking fraud detection step further comprises: The fraud parameter judging step is to compare the final fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 15. The method of claim 1, further comprising: The historical ranking information obtaining step is to obtain the historical ranking information of the application on the application leaderboard. 16. The method according to claim 15, characterized in that, in the step of obtaining historical ranking information, the historical ranking information is obtained from an application store operator, or the historical ranking information is extracted from data released by an application store. Historical ranking information. 17. The method according to claim 1, wherein the historical ranking information includes a ranking sequence corresponding to a discrete time series, and each element in the ranking sequence corresponds to an element in the time series A discrete point in time representing the ranking of the application at the discrete point in time. 18. The method according to claim 1, further comprising: sending the detected active period of the application program to application program developers, application program store operators, application program at least one of the users. 19. The method according to claim 1, further comprising: sending the detected ranking fraud detection result to at least one of an application program store operator and an application program user. 20. A ranking fraud detection system for applications, characterized in that the system comprises: An active period detection unit, configured to detect the active period of the application based on historical ranking information; A ranking fraud detection unit, configured to detect the active period based on at least one ranking-related evidence, and obtain a ranking fraud detection result; The ranking fraud detection unit further includes: An active event analysis module, configured to identify a rise phase, a maintenance phase and a decline phase of at least one active event in the active period; The active event is a period during which the continuous ranking of the application program is not greater than the ranking threshold; The active period is a period in which active events with a time interval smaller than the interval threshold φ are combined, or an active event whose time interval with other active events is not less than the interval threshold φ. 21. The system according to claim 20, wherein the ranking fraud detection unit further comprises: The evidence verification module is used to verify the active period based on at least one ranking-related evidence and obtain a fraud parameter. 22. The system according to claim 21, wherein the active event analysis module is configured to determine the first time and the last time when the ranking of the application program in the active event is within a peak range ΔR time, identifying the time period between the first time and the last time as the hold phase, identifying the time period in the active event before the hold phase as the ramp-up phase, identifying the The period of time following the hold phase in an active event is identified as the decline phase. 23. The system according to claim 21, wherein the ranking-related evidence is formed based on rising phases and/or falling phases in active events within the active period. 24. The system of claim 21, wherein the ranking-related evidence is constituted based on a hold phase in active events within the active period. 25. The system of claim 21, wherein: The ranking-related evidence is based on the number of active events within the active period. 26. The system according to claim 21, wherein the evidence verification module is configured to comprehensively consider a plurality of the above-mentioned ranking-related evidences, based on a plurality of the ranking-related evidences, The corresponding fraud parameters obtained through verification are weighted and calculated to obtain a final fraud parameter. 27. The system according to any one of claims 21-25, wherein the ranking fraud detection unit further comprises: The fraud parameter judging module is used to compare the fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 28. The system according to claim 26, wherein the ranking fraud detection unit further comprises: A fraud parameter judging module, configured to compare the final fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application. 29. The system of claim 20, further comprising: A historical ranking information acquiring unit, configured to acquire the historical ranking information of the application on the application leaderboard. 30. The system according to claim 29, wherein the historical ranking information obtaining unit is configured to obtain the historical ranking information from an application store operator, or extract the historical ranking information from data released by the application store. Historical ranking information. 31. The system according to claim 20, further comprising an active period sending unit, configured to send the detected active period of the application program to the application developer, application At least one of the program store operator and the application user. 32. The system according to claim 20, further comprising a ranking fraud detection result sending unit, configured to send the detected ranking fraud detection result to application store operators, application At least one of the program users. 33. An application ranking fraud detection method, characterized in that the method comprises: Based on at least one ranking-related evidence, the active period of the application is detected to obtain a ranking fraud detection result; The method further comprises: an active event analysis step, identifying a rise phase, a hold phase, and a decline phase of at least one active event in said active period; The active event is a period during which the continuous ranking of the application program is not greater than the ranking threshold; The active period is a period in which active events with a time interval smaller than the interval threshold φ are combined, or an active event whose time interval with other active events is not less than the interval threshold φ. 34. The method of claim 33, further comprising: The evidence verification step is to verify the active period based on at least one ranking-related evidence and obtain a fraud parameter. 35. The method according to claim 34, characterized in that, in the active event analysis step, determine the first time and the last time when the ranking of the application program in the active event is within a peak range ΔR time, identifying the time period between the first time and the last time as the hold phase, identifying the time period in the active event before the hold phase as the ramp-up phase, identifying the The period of time following the hold phase in an active event is identified as the decline phase. 36. The method according to claim 34, wherein the ranking-related evidence is formed based on rising phases and/or falling phases in active events within the active period. 37. The method of claim 36, wherein, The fraud parameter is the average value of the time range of the rising phase of all active events in the active period, or the average value of the time range of the falling phase of all active events in the active period, or the active The average of the sum of the time ranges for the described up phase and down phase for all active events in the period. 38. The method of claim 36, wherein, The fraud parameter is the average value of the acute angle formed by the intersection of the curves of the rising phase of all active events with the time axis in the active period, or the intersection of the curves of the falling phase of all active events and the time axis. The average value of the angles of the acute angles formed, or the average value of the sum of the angles of the acute angles formed by the intersection of the curves of the rising phase and the curves of the falling phase of all active events with the time axis. 39. The method of claim 34, wherein, The ranking-related evidence is constituted based on a hold phase in active events within the active period. 40. The method of claim 39, wherein, The fraud parameter is an average of the time range of the hold phase of all active events in the active period. 41. The method of claim 39, wherein the fraud parameter is calculated based on an average rank of the application in the hold phase of all active events and a time frame of the hold phase. 42. The method of claim 34, wherein, The ranking-related evidence is based on the number of active events within the active period. 43. The method of claim 42, wherein, The fraud parameter is the number of active events within the active period. 44. The method according to claim 42, characterized in that, in the step of verifying evidence, comprehensively considering a plurality of the above-mentioned ranking-related evidences, based on a plurality of the ranking-related evidences, The corresponding fraud parameters obtained through verification are weighted and calculated to obtain a final fraud parameter. 45. The method according to any one of claims 34-43, further comprising: The fraud parameter judging step is to compare the fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 46. The method of claim 44, further comprising: The fraud parameter judging step is to compare the final fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 47. The method according to claim 33, further comprising: sending the detected ranking fraud detection result to at least one of an application program store operator and an application program user. 48. An application ranking fraud detection system, characterized in that the system comprises: A ranking fraud detection unit, configured to detect the active period of the application program based on at least one ranking-related evidence, and obtain a ranking fraud detection result; The ranking fraud detection unit further includes: An active event analysis module, configured to identify a rise phase, a maintenance phase and a decline phase of at least one active event in the active period; The active event is a period during which the continuous ranking of the application program is not greater than the ranking threshold; The active period is a period in which active events with a time interval smaller than the interval threshold φ are combined, or an active event whose time interval with other active events is not less than the interval threshold φ. 49. The system according to claim 48, wherein the ranking fraud detection unit further comprises: The evidence verification module is used to verify the active period based on at least one ranking-related evidence and obtain a fraud parameter. 50. The system according to claim 49, wherein the active event analysis module is configured to determine the first time and the last time when the ranking of the application program in the active event is within a peak range ΔR time, identifying the time period between the first time and the last time as the hold phase, identifying the time period in the active event before the hold phase as the ramp-up phase, identifying the The period of time following the hold phase in an active event is identified as the decline phase. 51. The system of claim 49, wherein the ranking-related evidence is formed based on rising phases and/or declining phases in active events within the active period. 52. The system of claim 49, wherein the ranking-related evidence is constituted based on a hold phase in active events within the active period. 53. The system of claim 49, wherein: The ranking-related evidence is based on the number of active events within the active period. 54. The system according to claim 49, wherein the evidence verification module is configured to comprehensively consider a plurality of the above-mentioned ranking-related evidences, based on a plurality of the ranking-related evidences, The corresponding fraud parameters obtained through verification are weighted and calculated to obtain a final fraud parameter. 55. The system according to any one of claims 49-53, wherein the ranking fraud detection unit further comprises: The fraud parameter judging module is used to compare the fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application program. 56. The system according to claim 54, wherein the ranking fraud detection unit further comprises: A fraud parameter judging module, configured to compare the final fraud parameter with a threshold, so as to judge whether there is ranking fraud in the application. 57. The system according to claim 48, further comprising a ranking fraud detection result sending unit, configured to send the detected ranking fraud detection result to application store operators, application At least one of the program users.