[go: up one dir, main page]

WO2014066171A1 - Détermination de groupe caractéristique - Google Patents

Détermination de groupe caractéristique Download PDF

Info

Publication number
WO2014066171A1
WO2014066171A1 PCT/US2013/065683 US2013065683W WO2014066171A1 WO 2014066171 A1 WO2014066171 A1 WO 2014066171A1 US 2013065683 W US2013065683 W US 2013065683W WO 2014066171 A1 WO2014066171 A1 WO 2014066171A1
Authority
WO
WIPO (PCT)
Prior art keywords
objects
candidate group
value
characteristic
group
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2013/065683
Other languages
English (en)
Inventor
Zhiqiang Chen
Haijie Gu
Jidong SHAO
Guli LIN
Shui Liu
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201210407962.XA external-priority patent/CN103778151B/zh
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2014066171A1 publication Critical patent/WO2014066171A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Qualifying participants for shopping transactions
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing

Definitions

  • the present application involves the field of transaction information processing.
  • the present application describes techniques for determining characteristic groups.
  • Pre-registration prevention is generally accomplished by adding a verification code input step during the website user registration process. To a certain extent, this technique is able to prevent automated programs from registering false accounts.
  • Post-registration processing targets maliciously registered accounts which have already been generated when pre-registration prevention has been ineffective. For example, post-registration processing may target a particular type of user identifier, such as cookies. If the number of account number logins associated with the same cookie exceeded a predetermined value, then it may be determined that these account numbers associated with the same cookie are maliciously registered account numbers.
  • Determining that multiple account numbers are malicious because they are linked to the same user identifier is only able to discover a minority of maliciously registered accounts because the majority of maliciously registered accounts will not necessarily share a common user identifier.
  • the cookie example if the same website user uses an account number at different times on different devices, the associated cookies are very likely to be different and so checking the number of account numbers associated with one cookie is not an effective way to discover abnormal information.
  • FIG. 1 is a diagram showing an embodiment of a system for determining a characteristic group.
  • FIG. 2 is a flow diagram showing an embodiment of a process for determining a characteristic group.
  • FIG. 3 is a schematic diagram that shows the relationships among several first objects and second objects.
  • FIG. 4 is a schematic diagram that shows the relationships among several first objects and second objects of a candidate group.
  • FIG. 5 is a flow diagram showing an embodiment of a process for determining a candidate group.
  • FIG. 6 is a flow diagram showing an embodiment of a process for determining a characteristic group.
  • FIG. 7 is a flow diagram showing an embodiment of a process for determining directly associated first objects for a first object.
  • FIG. 8 is a schematic diagram that shows the relationships among several first objects and second objects of a candidate group.
  • FIG. 9 is a flow diagram showing an embodiment of a process for searching for a characteristic group.
  • FIG. 10 is a diagram showing an embodiment of a system for determining a characteristic group.
  • FIG. 11 is a diagram showing an embodiment of a system for determining a characteristic group.
  • FIG. 12 is a diagram showing an embodiment of a system for searching for characteristic groups.
  • the invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor.
  • these implementations, or any other form that the invention may take, may be referred to as techniques.
  • the order of the steps of disclosed processes may be altered within the scope of the invention.
  • a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task.
  • the term 'processor' refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.
  • mapping relationship data is retrieved, wherein the mapping relationship data describes connections between first objects and second objects.
  • first objects comprise user account numbers associated with a website (e.g., alphanumeric account numbers assigned by the website's server) and second objects comprise user identifiers associated with the website (e.g., cookies or the like used to identify users who access the website).
  • a candidate group of first objects and second objects is determined based at least in part on the mapping relationship data. In the candidate group, any two objects are either directly associated or indirectly associated via one or more other first or second objects of the candidate group. At least one characteristic value is determined for the candidate group and the at least one characteristic value is used to determine whether the candidate group comprises a characteristic group.
  • a "characteristic group" refers to a candidate group that is suspected to include at least one malicious user account number (a first object).
  • FIG. 1 is a diagram showing an embodiment of a system for determining a characteristic group.
  • system 100 includes device 102, device 104, device 106, network 108, web server 110, user action logs 114, characteristic group determination server 112, and mapping relationship data 116.
  • Network 108 includes high-speed data networks and/or telecommunications networks.
  • Device 102, device 104, device 106, web server 110, and characteristic group determination server 112 are configured to communicate with each other via network 108.
  • Web server 110 is configured to host a website at which user accounts may be registered. For example, to register a user account at the website, a user is required to submit information solicited by the website over a user interface.
  • a registered user account is associated with a user account number.
  • users using any of devices 102, 104, and 106 may access the website and register one or more user accounts. While each of devices 102, 104, and 106 is shown as a laptop computer, other examples of devices 102, 104, and 106 include desktop computers, smart phones, tablet devices, mobile devices, and/or any computing device.
  • characteristic group determination server 112 is configured to determine a characteristic group, which is a group of user account numbers associated with the website that potentially includes maliciously registered user accounts.
  • Characteristic group determination server 112 is configured to determine a characteristic group based on mapping relationship data stored at mapping relationship data 116.
  • Mapping relationship data stores the connections between user account numbers (which are also referred to as "first objects") associated with the website and user identifiers (which are also referred to as "second objects") associated with the website.
  • the stored mapping relationship data may be determined based on analyzing user action logs stored at user action logs 114.
  • a user action log stored at user action logs 114 tracks actions at the website by a user (e.g., using devices 102, 104, or 106) who has logged onto the website via a user account number.
  • Each user action log records the logged on user account number and one or more types of user identifiers that were used in connection with the user account number. For example, an email address that is submitted to the website by a user may be determined as a user identifier that is connected with the user account number that was used to log onto the website.
  • characteristic group determination server 112 is configured to determine a candidate group of first and second objects. In the candidate group, each (first or second) object is associated with each other (first or second) object via one or more other objects, as will be further explained below. Then the characteristic group determination server 112 is configured to determine whether the candidate group comprises a characteristic group based at least in part on one or more characteristic values associated with the candidate group.
  • processing may be performed with respect to the user account numbers and/or user identifiers included in the characteristic group. For example, at least some of the user account numbers in a characteristic group may be prevented from performing future actions (e.g., logging in, making purchases, or submitting feedback) at the website.
  • FIG. 2 is a flow diagram showing an embodiment of a process for determining a characteristic group.
  • process 200 is implemented at system 100 of FIG. 1.
  • mapping relationship data for first objects and second objects is retrieved, wherein the mapping relationship data describes connections between the first objects and the second objects.
  • the first objects comprise user account numbers associated with a website.
  • a user account number is associated with a registered account at a website.
  • a registered account may be created by a user or an automated program through submission of the requisite information via a user interface associated with the website.
  • a user or automated program may register one or more user accounts, which correspond to an equal number of user account numbers.
  • the second objects may be user identifiers. User identifiers comprise any information associated with the account (e.g., such as information associated with the user of the account as the user was browsing the website) and is able to determine user identity.
  • Examples of user identifiers include cookies generated upon login, email addresses and mobile phone numbers tied to the account, a value computed by a defined algorithm using a variety of information, etc.
  • One user account number may correspond to multiple user identifiers and one user identifier may also be used for multiple user account numbers.
  • the mapping relationship data comprises data that indicates which one or more first objects are connected with each second object and which one or more second objects are connected with each first object.
  • the mapping relationship data may comprise a mapping relationship list for each user account number that indicates all user identifiers connected with it, as well as a mapping relationship list for each user identifier that indicates all user account numbers connected with it.
  • the mapping relationship data that documents connections between user account numbers and user identifiers may be stored in an initialized database.
  • mapping relationship data may be associated with time indications. In some embodiments, mapping relationship data associated with a specified period of time (e.g., three months) is retrieved from the initialized database.
  • Mapping relationship data may be regarded as the adjacency list that is used to represent a graph in graph theory.
  • FIG. 3 is a schematic diagram that shows the relationships among several first objects and second objects.
  • Al, A2, and A3 respectively represent three first objects (e.g., user account numbers) and Bl, B2, and B3 respectively represent three second objects (e.g., user identifiers).
  • the mapping relationship data shown in the schematic diagram of FIG. 3 may also be expressed as (Al, Bl), (Al, B2), (A2, B2), (A2, B3), and (A3, B3), where each pair represents a first object and a second object that are connected with each other in the mapping relationship data.
  • the graph expressed by an adjacency list has the following characteristics: the vertices in the graph are all either user account numbers or user identifiers, with each edge only connecting to one user account number and one user identifier, indicating the existence of a determined relationship or correspondence between a particular user account number and a particular user identifier.
  • mapping relationship data can be obtained by analyzing the website's action logs. For example, logs of the actions of users logged into the website are recorded over time. Each action log includes one or more user account numbers and one or more corresponding user identifiers. The connections between user account numbers and user identifiers can be obtained by analyzing the recorded action logs. For example, when a user with a certain account number logs onto the website, the connection between the user account number and a user identifier (e.g., cookie) can be obtained.
  • a user identifier e.g., cookie
  • an account number may be associated with multiple user identifiers (e.g., cookies) when a user logs on with the same account number from different devices.
  • a user identifier e.g., a cookie
  • a candidate group including at least some of the first objects and at least some of the second objects is determined based at least in part on the mapping relationship data, wherein any first object included in the candidate group is associated with another first object included in the candidate group via one or more other first object(s) or second object(s) included in the candidate group.
  • a subset of all the first objects and the second objects described by the retrieved mapping relationship data is determined to be included in a candidate group.
  • a candidate group of first objects and second objects there are two possible types of associations between any two objects: any two objects are either "directly associated” by both being connected with the same other first or second object (e.g., the two objects are associated via one other object) or "indirectly associated” through two or more other first objects and/or second objects (e.g., the two objects are associated via these two or more other objects).
  • each candidate group is evaluated to determine whether it potentially includes maliciously registered user account numbers, as will be further described below.
  • FIG. 4 is a schematic diagram that shows the relationships among several first objects and second objects of a candidate group.
  • Al, A2, A3, and A4 are first objects (e.g., user account numbers), Bl, B2, and B3 are second objects (e.g., user identifiers), and connecting lines between the objects represent the existence of a connection.
  • user account number Al is respectively connected with user identifiers Bl and B2;
  • user identifier Bl is respectively connected with user account numbers Al, A2, and A3;
  • user identifier B2 is respectively connected with user account numbers Al, A3, and A4;
  • user account number A4 is respectively connected with user identifiers B2 and B3.
  • any one user account number or user identifier can be either directly associated or indirectly associated via one or more user account numbers or user identifiers with any other user account number or user identifier.
  • user account numbers Al and A2 (which are not connected with each other) are directly associated via user identifier Bl
  • user account number Al and user identifier B3 (which are not connected with each other) are indirectly associated via user identifier B2 and user account number A4.
  • any two objects can be directly related via one other object or indirectly related via more than one other object. Determining a candidate group helps to reveal the direct and even indirect associations between any two objects described in the mapping relationship data. Such direct and indirect associations may uncover related user account numbers (or user identifiers) that were not previously thought to be related.
  • a candidate group may be determined using any manner appropriate such that any two objects in the candidate group are associated via one or more other first objects or second objects included in the same candidate group. Therefore, each candidate group includes user account numbers, each of which is directly associated with another user account number or even indirectly associated with another user account number. As a result, a candidate group as described herein includes user account numbers that are indirectly associated with each other, which could represent potential maliciously registered user accounts that were not previously detected as being potentially malicious.
  • a first characteristic value associated with the candidate group is determined based at least in part on a number of first objects that are included in the candidate group.
  • the number of first objects that are included in the candidate group is used as the first characteristic value associated with the candidate group. For example, if there are three first objects that are included in the candidate group, then the first characteristic value of the candidate group is three.
  • characteristic group based at least in part on the first characteristic value, wherein the characteristic group is associated with malicious user accounts.
  • the candidate group comprises a characteristic group is determined based at least in part on its first characteristic value. If a candidate group is determined to be a characteristic group, then the characteristic group is determined to potentially include one or more malicious user accounts.
  • the first characteristic value of the candidate group is the number of first objects (e.g., user account numbers) that are included in the candidate group.
  • first objects e.g., user account numbers
  • the candidate group is a characteristic group. For example, a large number of user account numbers in the group may indicate that at least some of the user account numbers are falsely registered and therefore, the candidate group may comprise a characteristic group.
  • the value of the first threshold value may be predetermined based on the nature and size of the website and specific criteria for malicious registration actions. For example, the value of the first threshold value may be changed over time. In some embodiments, the value assigned to the first threshold value can be from the hundreds to the thousands.
  • FIG. 5 is a flow diagram showing an embodiment of a process for determining a candidate group.
  • process 500 is implemented at system 100 of FIG. 1.
  • process 500 is used to implement at least a portion of step 204 of process 200 of FIG. 2.
  • Process 500 shows an example of a process to determine an updated attribute value corresponding to a first object and a second object in a set of first and second objects (e.g., the first and second objects described by the retrieved mapping relationship data) from which one or more candidate groups are to be determined. Process 500 may be performed for each first object and each second object.
  • first and second objects e.g., the first and second objects described by the retrieved mapping relationship data
  • second objects connected with the first object are determined or first objects connected with the second object are determined.
  • a data structure such as graphs shown in FIG. 3 or FIG. 4 is used to track the objects, connection relationships, and association relationships.
  • the second objects e.g., user identifiers
  • first object Al e.g., a user account number
  • the first objects e.g., user account numbers
  • the first objects e.g., user account numbers
  • attribute values corresponding to the second objects connected with the first object are obtained or attribute values corresponding to the first objects connected with the second object are obtained.
  • each of the first objects and the second objects possesses at least one attribute value.
  • an initial value of the attribute value of a first object may be the user account number ID character string corresponding to the first object. For example, if the name of the first object user account number is "Amy,” and the corresponding user account number ID is "12345,” then the corresponding attribute value for the first object user account number associated with the name "Amy" is "12345.”
  • the initial values of the attribute values of the second objects may be identical to the user identifiers or the user identifier character strings.
  • the initial value of the attribute value of the second object can be "2123144155" or "amy@123.com.”
  • a first attribute value of the attribute values corresponding to the second objects connected with the first object is selected to use as a correction value of the first object or a second attribute value of the attribute values corresponding to the first objects connected with the second object is selected to use as a correction value of the second object.
  • the correction value selected for the first object is used to update the attribute value of the first object and the correction value selected for the second object is used to update the attribute value of the second object.
  • the correction value is an attribute value from the attribute values corresponding to the connected second objects for the first object selected based on one or more criteria, or an attribute value from the attribute values corresponding to the connected first objects for the second object selected based on one or more criteria. For example, the smallest attribute value from the attribute values corresponding to the connected second objects for the first object is selected to use as a correction value of the first object and the smallest attribute value from the attribute values corresponding to the connected first objects for the second object is selected to use as a correction value of the second object.
  • the attribute values corresponding to the connected second objects are compared using the lexicographic ordering of character strings. For example, for the two character strings SI and S2, SI and S2 are respectively converted into the two byte arrays CI and C2 using any encoding method (e.g., using UTF8 encoding). The first elements of CI and C2 are compared. If the first two elements are not equal, the array having the smaller first element comes earlier (before) in the lexicographic order. Otherwise, if the first elements are equal, the second elements of the two arrays are compared.
  • the attribute value for the first object is updated to be the correction value for the first object and control returns to 502 such that 502, 504, and 506 may be repeated for at least each of the first objects whose attribute values did not correspond to their respective correction values.
  • control is transferred to 510.
  • the attribute value for the second object is updated to comprise the correction value for the second object and control returns to 502 such that 502, 504, and 506 may be repeated for at least each of the second objects whose attribute values did not correspond to their respective correction values.
  • control is transferred to 510.
  • first object Al has a corresponding attribute value of al (e.g., al is the initial attribute value).
  • the connected corresponding second objects to first object Al are determined to be Bl, B2, B3,..., Bn.
  • the attribute values bl, b2, b3,..., bn corresponding to these second objects are obtained.
  • bl, b2, b3,..., bn are compared for size, and the smallest value among them, for example, b2, is selected to use as the correction value for the first object Al .
  • the same technique is used to determine the correction value corresponding to each second object.
  • each first object or second object are compared against their corresponding correction values to determine whether they correspond (e.g., are identical). For example, for first object Al, a determination is made as to whether or not the attribute value of the first object, al, equals the first object's correction value of b2. If attribute value al is different from the correction value of b2, then correction value b2 is used as the updated attribute value al of first object Al . Put another way, once it is determined that attribute value al of the first object is not the same as the correction value of b2 for the first object, attribute value al of the first object is set to equal correction value b2. The same process may be applied to each other first object and each second object. Steps 502 through 508 described above are repeated for each first object and/or each second object until their respective updated attribute value for each first object and second object are identical to their corresponding correction values.
  • one or more first objects and one or more second objects are included in a candidate group based at least in part on attributes values corresponding to the one or more first objects and the one or more second objects.
  • One or more first objects and one or more second objects may be selected to be included in the same candidate group based on the updated attribute values corresponding to the first objects and second objects. For example, the one or more first objects and/or one or more second objects whose updated attribute values are the same are sorted into the same candidate group, regardless of whether the attribute values which are the same are the attribute values of the first objects or the attribute values of the second objects. For example, any second objects that are connected with any first objects that are included in a candidate group are also included in the candidate group. Also, for example, any first objects that are connected with any second objects that are included in a candidate group are also included in the candidate group.
  • each user account number and each user identifier is a vertex in the corresponding graph.
  • Process 500 as described above for determining a candidate group is an example application of the general graph theory process of label propagation to find connected subgraphs, which is described as follows:
  • Step 1 one or more vertices connected with a vertex are determined.
  • Step 2 label values corresponding to the one or more vertices are obtained.
  • a label value may comprise an attribute value of a vertex, such as those described above.
  • Step 3 if the smallest value among the label values corresponding to the one or more vertices connected to the vertex is different from a current label value of the vertex, then the smallest label value replaces the current label value of the vertex, and control returns to Step 1 and if the smallest value among the label values corresponding to the one or more vertices connected to the vertex is the same as the current label value, then the vertices having the same label are retrieved to serve as connected subgraphs.
  • the connected subgraphs obtained here are similar to the candidate group as described above. Every two vertices in the connected subgraph are associated via one or more other vertices, i.e., any two objects (any two first objects, any two second objects, or any pair of a first object and a second object) in the candidate group are either directly associated or indirectly associated via one or more other first objects or second objects in the candidate group.
  • two first objects that are connected to the same second object are referred to as directly associated user account numbers
  • two first objects that are associated via two or more first object(s) or second object(s) are referred to as indirectly associated user account numbers.
  • Using the connected subgraph technique to find candidate groups not only identifies user account numbers having direct associations, but also identifies multiple account numbers that have indirect associations.
  • FIG. 6 is a flow diagram showing an embodiment of a process for determining a characteristic group.
  • process 600 is implemented at system 100 of FIG. 1.
  • Process 600 shows a technique of determining whether a candidate group comprises a characteristic group based on criteria slightly different from the example described with process 200 of FIG. 2. Whereas in the example described above with process 200 of FIG. 2, the determination of whether a candidate group comprises a characteristic group is based on only one characteristic value associated with the candidate group, in the example of process 600, the determination of whether a candidate group comprises a characteristic group is based on both the first characteristic value and a second characteristic value associated with the candidate group.
  • mapping relationship data for first objects and second objects is retrieved, wherein the mapping relationship data describes connections between the first objects and the second objects.
  • step 602 may be performed in a manner similar to step 202 of process 200 of FIG. 2.
  • a candidate group including at least some of the first objects and at least some of the second objects is determined based at least in part on the mapping relationship data, wherein any first object included in the candidate group is associated with another first object included in the candidate group via one or more other first object(s) or second object(s) included in the candidate group.
  • step 604 may be performed in a manner similar to step 204 of process 200 of FIG. 2.
  • a first characteristic value associated with the candidate group is determined based at least in part on a number of first objects that are included in the candidate group.
  • step 606 may be performed in a manner similar to step 206 of process 200 of FIG. 2.
  • the first characteristic value comprises the number of first objects that are included in the candidate group.
  • first object Al and first object A3 are each connected to second object B2 in the candidate group. Because first object Al and first object A3 are each connected to second object B2, first object Al is a directly associated first object of first object A3 and similarly, first object A3 is a directly associated first object of first object Al .
  • first object and one of its directly associated first objects may comprise two user account numbers that share the same user identifier.
  • Directly associated first objects may be determined for each first object in the candidate group in any appropriate manner. One example of determining a candidate group is described with FIG. 7, below.
  • the number of directly associated first objects of the first object is referred to as the degree of the first object.
  • a second characteristic value associated with the candidate group is determined based at least in part on a quantity of directly associated first objects for the first object of the candidate group.
  • the second characteristic value of a candidate group is the group density in graph theory.
  • the first characteristic value the number of first objects (e.g., user account numbers) in the candidate group
  • the second characteristic value of the candidate group is the result of adding together the degrees (the number of directly associated objects) of each first object of the candidate group, then dividing that sum by n(n-l).
  • the resulting range of values for the group density (the second characteristic value) of the candidate group is between 0-1.
  • characteristic group based at least in part on the first characteristic value and the second characteristic value.
  • Whether the candidate group comprises a characteristic group is determined based at least in part on its first characteristic value and second characteristic value. In some embodiments, in the event that the first characteristic value is greater than a first threshold value, and the second characteristic value is also greater than a second threshold value, then the candidate group is a characteristic group.
  • process 200 differs from the example described with process 200 of FIG. 2 because in process 200, only the first characteristic value was used to determine whether a candidate group is a characteristic group, while in process 600, the second characteristic value was used in addition to the first characteristic value to determine whether the candidate group is a characteristic group.
  • the additional use of the second characteristic value may serve to improve the accuracy of detecting a candidate group that may include potentially malicious user account numbers.
  • the values assigned to the first threshold value and the second threshold value may be predetermined based on the nature and size of the website and specific criteria for malicious registration actions. For example, the first threshold value and/or the second threshold value may be changed over time. For example, the value assigned to the first threshold value can be from the hundreds to the thousands, and the value assigned to the second threshold value can be between 0.7 and 0.9.
  • FIG. 7 is a flow diagram showing an embodiment of a process for determining directly associated first objects for a first object.
  • process 700 is implemented at system 100 of FIG. 1.
  • Process 700 shows an example process of determining the directly associated first objects for a first object in a candidate group. Process 700 may be repeated for each first object in the candidate group.
  • second objects connected to a first object of a candidate group are determined. Each second object that is connected with the first object is determined.
  • the other first objects are deduplicated.
  • deduplication refers to identifying unique first objects. For example, if there are two instances of the same first object in the determined other first objects, then after deduplication, the remaining first objects include only one instance of each first object.
  • the deduplicated other first objects are used as directly associated first objects for the first object.
  • FIG. 8 is a schematic diagram that shows the relationships among several first objects and second objects of a candidate group.
  • user account number A (a first object) is connected with user identifier B and user identifier C.
  • User identifier B is connected with user account number D and user account number E
  • user identifier C is connected with user account number D and user account number F.
  • the user account numbers connected with user identifier B and user identifier C are merged to obtain four user account numbers: user account number D, user account number E, user account number D, and user account number F.
  • Deduplication is performed on the four user account numbers to obtain account number D, account number E, and account number F, which are the three directly associated first objects of user account number A.
  • FIG. 9 is a flow diagram showing an embodiment of a process for searching for a characteristic group.
  • process 900 is implemented at system 100 of FIG. 1.
  • a search request to determine one or more characteristic groups is received.
  • mapping relationship data is retrieved and used to determine one or more characteristic groups.
  • the user may submit the request via a user interface associated with a website.
  • process 200 of FIG. 2 or process 600 of FIG. 6 may be used to determine a characteristic group.
  • the search request may specify a time period associated with the mapping relationship data that should be used to determine the characteristic groups.
  • one or more characteristic groups may be determined.
  • Each characteristic group includes one or more user account numbers that are potentially maliciously registered accounts.
  • attribute information associated with the determined one or more characteristic groups is returned.
  • information associated with each determined characteristic group may be returned and displayed for the searching user.
  • the returned information may include a list of user account numbers and a list of user identifiers associated with each characteristic group.
  • a further search may be performed to retrieve attribute information (e.g., logon times, reputation values, transaction history data) associated with each user account number and/or each user identifier that is associated with the characteristic group.
  • attribute information e.g., logon times, reputation values, transaction history data
  • a system administrator associated with a website may submit a search request to determine characteristic groups and then receive information on the determined characteristic groups. The system administrator may review the returned information to determine whether to take further action with respect to a characteristic group. Examples of further actions may include preventing further access to the website by any one or more of the user account numbers that are included in a characteristic group or preventing a new user account associated with any user identifiers included in the characteristic group to be registered at the e-commerce website.
  • FIG. 10 is a diagram showing an embodiment of a system for determining a characteristic group.
  • system 1000 includes mapping relationship data retrieval module 1002, candidate group retrieval module 1004, and first judgment module 1006.
  • the modules, sub-modules, and sub-units can be implemented as software components executing on one or more processors, as hardware such as programmable logic devices and/or Application Specific Integrated Circuits designed to elements can be embodied by a form of software products which can be stored in a nonvolatile storage medium (such as optical disk, flash storage device, mobile hard disk, etc.), including a number of instructions for making a computer device (such as personal computers, servers, network equipment, etc.) implement the methods described in the embodiments of the present invention.
  • the modules, sub-modules, and sub-units may be implemented on a single device or distributed across multiple devices.
  • Mapping relationship data retrieval module 1002 is configured to retrieve from an initialized database first objects, second objects, and the mapping relationship data between the first objects and second objects.
  • first objects comprise user account numbers and second objects comprise user identifiers.
  • Candidate group retrieval module 1004 is configured to determine a candidate group including at least some of the first objects and at least some of the second objects based at least in part on the mapping relationship data.
  • First judgment module 1006 is configured to determine a first characteristic value associated with the candidate group based at least in part on a number of first objects that are included in the candidate group. First judgment module 1006 is also configured to determine whether the candidate group comprises a characteristic group based at least in part on the first characteristic value.
  • candidate group retrieval module 1004 may further include the following:
  • An attribute value updating sub-module that is configured to update the corresponding attribute values of each first object or second object, based on the attribute values corresponding to the respectively connected first objects and connected second objects.
  • a candidate group formation sub-module that is configured to form candidate groups based on first objects and second objects having the same attribute values.
  • the attribute value updating sub-module may further include the following:
  • Sub-unit 1 which is configured to determine second objects connected with each first object and first objects connected with each second object.
  • Sub-unit 2 which is configured to determine the attribute values
  • Sub-unit 3 which is configured to select a first attribute value of the attribute values corresponding to the second objects connected with the first object to use as a correction value of the first object and to select a second attribute value of the attribute values corresponding to the first objects connected with the second object to use as a correction value of the second object.
  • Sub-unit 4 which is configured to determine whether an attribute value of the first object corresponds to the correction value for the first object or whether an attribute value of the second object corresponds to the correction value of the second object.
  • the attribute value for the first object is updated to comprise the correction value for the first object and a message is sent to activate sub-unit 1, sub-unit 2, and sub-unit 3 for at least each of the first objects whose attribute values did not correspond to their respective correction values.
  • the attribute value for the second object is updated to comprise the correction value for the second object and a message is sent to activate sub-unit 1, sub-unit 2, and sub-unit 3 for at least each of the second objects whose attribute values did not correspond to their respective correction values.
  • first judgment module 1006 may further include the following:
  • a first characteristic value judgment sub-module which is configured to determine that in the event the first characteristic value is greater than a first threshold value, the candidate group comprises a characteristic group.
  • FIG. 11 is a diagram showing an embodiment of a system for determining a characteristic group.
  • system 1100 includes: mapping relationship data retrieval module 1102, candidate group retrieval module 1104, directly associated first object determination module 1106, characteristic value generation module 1108, and second judgment module 1110.
  • Mapping relationship data retrieval module 1102 is configured to retrieve from an initialized database first objects, second objects, and the mapping relationship data between the first objects and second objects.
  • Candidate group retrieval module 1104 is configured to determine a candidate group including at least some of the first objects and at least some of the second objects based at least in part on the mapping relationship data.
  • Directly associated first object determination module 1106 is configured to determine one or more directly associated first objects for each first object of the candidate group.
  • Characteristic value generation module 1108 is configured to determine a second characteristic value associated with the candidate group based at least in part on a number of directly associated first objects for each first object of the candidate group.
  • Second judgment module 11 10 is configured to determine a first characteristic value and a second characteristic value associated with the candidate group. Second judgment module 1110 is also configured to determine whether the candidate group comprises a characteristic group based at least in part on the first characteristic value and the second characteristic value.
  • directly associated first object determination module determines whether directly associated first object determination module
  • 1106 is further includes the following:
  • a first object determination sub-module which is configured to determine second objects connected to a first object of a candidate group.
  • a merge sub-module which is configured to merge and deduplicate all other first objects connected to the second objects connected to the first object, and use the deduplicated other first objects as the directly associated first objects for the first object.
  • the first characteristic value may be recorded as n
  • the second characteristic value may be the result of summing the number of directly associated first objects for each first object, then dividing the sum by n(n-l).
  • second judgment module 1110 may further include the following:
  • FIG. 12 is a diagram showing an embodiment of a system for searching for characteristic groups.
  • system 1200 includes: search request receiving module 1202 and information return module 1204.
  • Search request receiving module 1202 is configured to receive a search request to determine one or more characteristic groups.
  • Information return module 1204 is configured to return attribute information associated with the determined one or more characteristic groups.
  • the present application can be used in many general purpose or specialized computer system environments or configurations. For example: personal computers, servers, handheld devices or portable equipment, tablet type equipment, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic equipment, networked PCs, minicomputers, mainframe computers, distributed computing environments that include any of the systems or equipment above, and so forth.
  • the present application can be described in the general context of computer executable commands executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, etc. to execute specific tasks or achieve specific abstract data types.
  • the present application can also be carried out in distributed computing environments; in such distributed computing environments, tasks are executed by remote processing equipment connected via
  • program modules can be located on storage media at local or remote computers that include storage equipment.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Marketing (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Computer Security & Cryptography (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

L'invention se rapporte à la détermination de groupe caractéristique, ledit procédé consistant à : récupérer des données de relation de correspondance stockées pour des premiers objets et des seconds objets, les données de relation de correspondance décrivant des liaisons entre les premiers objets et les seconds objets ; déterminer un groupe candidat comprenant au moins certains des premiers objets et au moins certains des seconds objets en fonction, au moins en partie, des données de relation de correspondance, un quelconque premier objet compris dans le groupe candidat étant associé à un autre premier objet compris dans le groupe candidat par l'intermédiaire d'un ou de plusieurs autres premiers objets ou seconds objets compris dans le groupe candidat ; déterminer une première valeur caractéristique associée au groupe candidat en fonction, au moins en partie, d'un certain nombre de premiers objets qui sont compris dans le groupe candidat ; et déterminer si le groupe candidat comprend un groupe caractéristique en fonction, au moins en partie, de la première valeur caractéristique.
PCT/US2013/065683 2012-10-23 2013-10-18 Détermination de groupe caractéristique Ceased WO2014066171A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201210407962.XA CN103778151B (zh) 2012-10-23 2012-10-23 一种识别特征群体的方法及装置和搜索方法及装置
CN201210407962.X 2012-10-23
US14/056,867 US9785989B2 (en) 2012-10-23 2013-10-17 Determining a characteristic group
US14/056,867 2013-10-17

Publications (1)

Publication Number Publication Date
WO2014066171A1 true WO2014066171A1 (fr) 2014-05-01

Family

ID=49551752

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2013/065683 Ceased WO2014066171A1 (fr) 2012-10-23 2013-10-18 Détermination de groupe caractéristique

Country Status (1)

Country Link
WO (1) WO2014066171A1 (fr)

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
No relevant documents disclosed *

Similar Documents

Publication Publication Date Title
US9785989B2 (en) Determining a characteristic group
US10178116B2 (en) Automated computer behavioral analysis system and methods
CN109447731B (zh) 跨平台产品推荐方法、装置、计算机设备和存储介质
CN110135978B (zh) 用户金融风险评估方法、装置、电子设备和可读介质
US9275125B1 (en) System for organizing data from a plurality of users to create individual user profiles
US12277105B2 (en) Methods and systems for improved search for data loss prevention
US8396935B1 (en) Discovering spam merchants using product feed similarity
US9886711B2 (en) Product recommendations over multiple stores
GB2555801A (en) Identifying fraudulent and malicious websites, domain and subdomain names
US12204594B2 (en) Method and system for providing alternative result for an online search previously with no result
US20150170248A1 (en) Product and content association
US10474689B1 (en) Model score recall for machine learning systems and applications
CN105989184A (zh) 一种分类方法及装置
US20170272362A1 (en) Data communication systems and methods of operating data communication systems
US20160042478A1 (en) Methods and Systems for Verifying Images Associated With Offered Properties
CN111401959B (zh) 风险群体的预测方法、装置、计算机设备及存储介质
CN113902553A (zh) 基于知识图谱的风险识别方法、装置、计算机设备及介质
US11710137B2 (en) Method and system for identifying electronic devices of genuine customers of organizations
US12052230B2 (en) Machine learning techniques for object authentication
US10007398B2 (en) Integrated supplier information tool
CN103049525A (zh) 一种用于提供对象相关信息的方法和装置
WO2014066171A1 (fr) Détermination de groupe caractéristique
CN113111132B (zh) 一种识别目标用户的方法和装置
US12242557B1 (en) Systems for determining anomalous interactions based on characteristic types
KR102746550B1 (ko) 위조 상품 판매자 탐지 방법 및 그를 위한 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13786793

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13786793

Country of ref document: EP

Kind code of ref document: A1