阅读说明：本技术 异常账号检测模型训练方法和异常账号检测方法 (Abnormal account detection model training method and abnormal account detection method ) 是由 黎寅 余赢超 于 2021-07-15 设计创作，主要内容包括：本申请提供异常账号检测模型训练方法和异常账号检测方法,其中异常账号检测模型训练方法包括：接收训练样本,包括目标账号和任务路线；将各目标账号和各任务路线输入至异常账号检测模型,根据第一相似度阈值对各任务路线进行聚类,得到任务路线聚类簇；统计异常任务路线聚类簇中异常账号对应的任务路线的第一数量；识别异常任务路线聚类簇中未标注账号的账号状态,统计异常任务路线聚类簇中账号状态为异常的未标注账号的第二数量和账号状态为正常的未标注账号的第三数量；根据第一数量、第二数量、第三数量调整第一相似度阈值和异常阈值,返回执行聚类步骤,直至达到训练停止条件,保存异常任务路线聚类簇的簇心。可以提高检测异常账号的效率。(The application provides an abnormal account detection model training method and an abnormal account detection method, wherein the abnormal account detection model training method comprises the following steps: receiving a training sample, including a target account and a task route; inputting each target account and each task route into an abnormal account detection model, and clustering each task route according to a first similarity threshold to obtain a task route cluster; counting a first number of task routes corresponding to abnormal accounts in the abnormal task route clustering cluster; identifying account states of the unmarked accounts in the abnormal task route cluster, and counting a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route cluster; and adjusting the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, returning to the step of clustering until the training stopping condition is reached, and storing the cluster center of the abnormal task route clustering cluster. The efficiency of detecting abnormal account numbers can be improved.)

1. A training method for an abnormal account detection model is characterized by comprising the following steps:

receiving a training sample, wherein the training sample comprises at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is marked as an abnormal account number;

inputting each target account and each task route into an abnormal account detection model, and clustering each task route according to a first similarity threshold to obtain at least one task route clustering cluster;

under the condition that the number of task routes in an abnormal task route clustering cluster is larger than or equal to an abnormal threshold value, counting a first number of task routes corresponding to the abnormal account in the abnormal task route clustering cluster, wherein the abnormal task route clustering cluster is any one of the at least one task route clustering cluster;

identifying account states of the unmarked accounts in the abnormal task route clustering cluster, and counting a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster;

and adjusting the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, returning to the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster, and storing the cluster center of the abnormal task route clustering cluster until the training stopping condition is reached.

2. The method of claim 1, wherein the clustering the task routes according to a first similarity threshold to obtain at least one task route cluster, comprises:

selecting an ith task route from at least two task routes, and determining the ith task route as a cluster center of an ith task route cluster, wherein i is a natural number greater than or equal to 1;

calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and a j-th task route clustering cluster, wherein j is a positive integer less than or equal to i;

adding the task route to the jth task route cluster under the condition that the similarity is smaller than a first similarity threshold, and generating an i +1 th task route cluster by taking the task route as a cluster center under the condition that the similarity is larger than or equal to the first similarity threshold;

and judging whether the task routes in the at least two task routes are clustered, if not, increasing 1 by itself and continuously calculating the similarity of any non-clustered task route in the at least two task routes and the cluster center of the j task route cluster, and if so, outputting a clustering result.

3. The method according to claim 2, wherein after adding the task route to the j-th task route cluster if the similarity is less than a first similarity threshold, further comprising:

and comparing the length of the task route with the length of the cluster center of the jth task route clustering cluster, and if the length of the task route is shorter than the length of the cluster center, determining the task route as the cluster center of the jth task route clustering cluster.

4. The method according to claim 2, wherein the calculating the similarity of the cluster center of any one of the at least two task routes which is not clustered with the j-th task route cluster comprises:

sequencing the i task route cluster clusters according to the number of the included task routes;

and calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and the j-th task route clustered cluster according to the sequencing order.

5. The method according to claim 2, wherein the calculating the similarity of the cluster center of any one of the at least two task routes which is not clustered with the j-th task route cluster comprises:

determining the length of each unclustered task route in the at least two task routes and the length of a cluster center of the i task route cluster;

merging the n-th task route which is not clustered in the at least two task routes and the j-th cluster center in the i cluster centers to generate a merged route of the n-th task route and the j-th cluster center shortest track, wherein the n-th task route is any one of the at least two task routes which is not clustered, the j-th cluster center is a cluster center of a j-th task route clustered cluster, and n is a natural number greater than or equal to 1;

and determining the similarity between the nth task route and the jth cluster center according to the length of the merging route, the length of the nth task route and the length of the jth cluster center.

6. The method of claim 1, wherein prior to receiving the training samples, further comprising:

determining at least two target account numbers for completing a target task, and acquiring a task route corresponding to the target task of each of the at least two target account numbers to obtain at least two task routes.

7. The method according to claim 6, wherein the obtaining of the task route corresponding to the target task for each of the at least two target account numbers to obtain at least two task routes comprises:

acquiring track data, corresponding to the target task, of each of the at least two target account numbers to obtain at least two sets of track data;

and sequencing and removing the duplicate of each group of track data in the at least two groups of track data according to a time sequence to obtain at least two task routes.

8. An abnormal account detection method is characterized by comprising the following steps:

acquiring an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task;

obtaining at least one reference route, and calculating the similarity between the task route to be evaluated and each reference route;

and under the condition that at least one of the similarity of the task route to be evaluated and each reference route is smaller than a second similarity threshold, marking the account to be evaluated corresponding to the task route to be evaluated as an abnormal account.

9. The method according to claim 8, wherein the obtaining of the account to be evaluated and the task route to be evaluated of the account to be evaluated under the target task comprises:

determining an account number to be evaluated for completing a target task;

acquiring to-be-evaluated track data corresponding to the to-be-evaluated account and the target task;

and sequencing the trajectory data to be evaluated according to a time sequence and removing duplication to obtain a task route to be evaluated.

10. The method of claim 8, wherein the obtaining at least one reference route comprises:

acquiring at least one cluster center saved in an abnormal account detection model, and determining the at least one cluster center as at least one reference route, wherein the abnormal account detection model is obtained by training according to any one of the training methods of claims 1 to 7.

11. An abnormal account detection model training device is characterized by comprising:

the system comprises a receiving module, a processing module and a processing module, wherein the receiving module is configured to receive a training sample, the training sample comprises at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is marked as an abnormal account number;

the clustering module is configured to input each target account and each task route into the abnormal account detection model, and cluster each task route according to a first similarity threshold to obtain at least one task route clustering cluster;

the counting module is configured to count a first number of task routes corresponding to the abnormal account in an abnormal task route clustering cluster under the condition that the number of the task routes in the abnormal task route clustering cluster is greater than or equal to an abnormal threshold, wherein the abnormal task route clustering cluster is any one of the at least one task route clustering cluster;

the identification module is configured to identify account states of the unmarked accounts in the abnormal task route clustering cluster, and count a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster;

and the adjusting module is configured to adjust the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, and return to execute the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster until a training stop condition is reached, and store the cluster center of the abnormal task route clustering cluster.

12. An abnormal account number detection device, comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is configured to acquire an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task;

the calculation module is configured to acquire at least one reference route and calculate the similarity between the task route to be evaluated and each reference route;

the marking module is configured to mark the account to be evaluated corresponding to the task route to be evaluated as an abnormal account when at least one of the similarity of the task route to be evaluated and each reference route is smaller than a second similarity threshold.

13. A computing device comprising a memory, a processor, and computer instructions stored on the memory and executable on the processor, wherein the processor implements the steps of the method of any of claims 1-7 or 8-10 when executing the computer instructions.

14. A computer-readable storage medium storing computer instructions, which when executed by a processor implement the steps of the method of any one of claims 1 to 7 or 8 to 10.

Technical Field

The application relates to the technical field of computers, in particular to an abnormal account detection model training method and an abnormal account detection method.

Background

With the rapid development of computer technology, a variety of games are emerging. In the field of gaming, massively multiplayer online role-playing games are most popular, and many studios, such as gold studios, scouring studios, have emerged for such games. In these studios, high-end players or fans in the game use a large number of high-level configuration computers to run plug-in scripts to play the game so as to collect real money to help the players earn game coins and practice substitutes, and both businesses can do upgrade course tasks by using a large number of target account numbers of the plug-in scripts. Such actions can directly have negative effects on other normal players, and destroy the game environment and economic balance.

In the prior art, the abnormal account using the plug-in script is generally judged by using some numerical characteristics of an account login device or a game role, such as login IP, speaking content, speaking frequency, fighting capacity, online duration, recharging and the like. However, the method has high labor cost, and the frequent failure of judgment by using the numerical characteristics due to the change of the plug-in script causes low efficiency and low accuracy of detecting the abnormal account. Therefore, it is desirable to provide a method for detecting an abnormal account with high detection efficiency and high accuracy.

Disclosure of Invention

In view of this, the embodiment of the present application provides a method for training an abnormal account detection model. The application also relates to an abnormal account detection model training device, an abnormal account detection method, an abnormal account detection device, a computing device and a computer readable storage medium, so as to solve the defects in the prior art.

According to a first aspect of the embodiments of the present application, a method for training an abnormal account detection model is provided, including:

receiving a training sample, wherein the training sample comprises at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is marked as an abnormal account number;

inputting each target account and each task route into an abnormal account detection model, and clustering each task route according to a first similarity threshold to obtain at least one task route clustering cluster;

under the condition that the number of task routes in an abnormal task route clustering cluster is larger than or equal to an abnormal threshold value, counting a first number of task routes corresponding to the abnormal account in the abnormal task route clustering cluster, wherein the abnormal task route clustering cluster is any one of the at least one task route clustering cluster;

identifying account states of the unmarked accounts in the abnormal task route clustering cluster, and counting a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster;

and adjusting the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, returning to the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster, and storing the cluster center of the abnormal task route clustering cluster until the training stopping condition is reached.

According to a second aspect of the embodiments of the present application, there is provided an abnormal account detection method, including:

acquiring an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task;

obtaining at least one reference route, and calculating the similarity between the task route to be evaluated and each reference route;

and under the condition that at least one of the similarity of the task route to be evaluated and each reference route is smaller than a second similarity threshold, marking the account to be evaluated corresponding to the task route to be evaluated as an abnormal account.

According to a third aspect of the embodiments of the present application, there is provided an abnormal account detection model training apparatus, including:

the system comprises a receiving module, a processing module and a processing module, wherein the receiving module is configured to receive a training sample, the training sample comprises at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is marked as an abnormal account number;

the clustering module is configured to input each target account and each task route into the abnormal account detection model, and cluster each task route according to a first similarity threshold to obtain at least one task route clustering cluster;

the counting module is configured to count a first number of task routes corresponding to the abnormal account in an abnormal task route clustering cluster under the condition that the number of the task routes in the abnormal task route clustering cluster is greater than or equal to an abnormal threshold, wherein the abnormal task route clustering cluster is any one of the at least one task route clustering cluster;

the identification module is configured to identify account states of the unmarked accounts in the abnormal task route clustering cluster, and count a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster;

and the adjusting module is configured to adjust the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, and return to execute the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster until a training stop condition is reached, and store the cluster center of the abnormal task route clustering cluster.

According to a fourth aspect of the embodiments of the present application, there is provided an abnormal account detection apparatus, including:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is configured to acquire an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task;

the calculation module is configured to acquire at least one reference route and calculate the similarity between the task route to be evaluated and each reference route;

the marking module is configured to mark the account to be evaluated corresponding to the task route to be evaluated as an abnormal account when at least one of the similarity of the task route to be evaluated and each reference route is smaller than a second similarity threshold.

According to a fifth aspect of the embodiments of the present application, there is provided a computing device, including a memory, a processor, and computer instructions stored on the memory and executable on the processor, where the processor implements the abnormal account detection model training method or the steps of the abnormal account detection method when executing the computer instructions.

According to a sixth aspect of the embodiments of the present application, there is provided a computer-readable storage medium storing computer instructions, which when executed by a processor, implement the abnormal account detection model training method or the steps of the abnormal account detection method.

According to the abnormal account detection model training method, training samples are received, target accounts and task routes are input into an abnormal account detection model, clustering is conducted on the task routes according to a first similarity threshold, task route clustering clusters are obtained, under the condition that the number of the task routes in the abnormal task route clustering clusters is larger than or equal to the abnormal threshold, a first number, a second number and a third number are determined, the first similarity threshold and the abnormal threshold are further adjusted, training is continued until a training stop condition is met, and at the moment, the cluster centers of the abnormal task route clustering clusters are stored. The speed of clustering the task routes can be increased, the calculated amount is reduced, the accuracy of determining abnormal task route clustering clusters and clustering centers by the samples can be improved, and the speed and the accuracy of detecting abnormal account numbers are improved. In addition, the cluster center of the task route cluster is saved, so that the account number can be detected in real time, and the abnormal account number can be sealed in real time.

Drawings

Fig. 1 is a flowchart of an abnormal account detection model training method according to an embodiment of the present disclosure;

fig. 2A is a schematic diagram of a task route merging process according to an embodiment of the present application;

fig. 2B is a schematic diagram of a processing result obtained by clustering task routes according to an embodiment of the present application;

fig. 3 is a flowchart of an abnormal account detection method according to an embodiment of the present application;

FIG. 4 is a flowchart of a process applied to a breakthrough game according to an embodiment of the present disclosure;

fig. 5 is a schematic structural diagram of an abnormal account detection model training apparatus according to an embodiment of the present disclosure;

fig. 6 is a schematic structural diagram of an abnormal account detection apparatus according to an embodiment of the present application;

fig. 7 is a block diagram of a computing device according to an embodiment of the present application.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. This application is capable of implementation in many different ways than those herein set forth and of similar import by those skilled in the art without departing from the spirit of this application and is therefore not limited to the specific implementations disclosed below.

The terminology used in the one or more embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of the present application. As used in one or more embodiments of the present application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used in one or more embodiments of the present application refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It will be understood that, although the terms first, second, etc. may be used herein in one or more embodiments of the present application to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first aspect may be termed a second aspect, and, similarly, a second aspect may be termed a first aspect, without departing from the scope of one or more embodiments of the present application. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.

First, the noun terms to which one or more embodiments of the present application relate are explained.

A gold-plating working chamber: the special game studio obtains the virtual props and the gold coins by continuously playing strangers or doing tasks, and the virtual props and the gold coins are sold to required players through the game trading platform to be exchanged with real money.

A practice-replacing working room: it refers to a game studio which serves others instead of operating in order to earn a certain profit in the game, and earns real money by helping employers to realize a certain level of experience and equipment in the game.

The Single-Pass algorithm is also called a Single channel method or a Single Pass method and is a classic method for clustering streaming data. For the data streams arriving in sequence, the method processes one data at a time according to the input sequence, judges the data as the existing class or creates a new data class according to the matching degree of the current data and the existing class, and realizes the increment and dynamic clustering of the stream data.

Abnormal account number: the game account number is a game account number which does not do tasks according to the game running rule.

The present application relates to an abnormal account detection model training method and an abnormal account detection device, a computing device, and a computer-readable storage medium, which are described in detail in the following embodiments one by one.

Fig. 1 shows a flowchart of an abnormal account detection model training method according to an embodiment of the present application, which specifically includes the following steps:

step 102: receiving a training sample, wherein the training sample comprises at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is marked as an abnormal account number.

Specifically, the training sample is a sample for training an abnormal account detection model, and the training sample includes at least two target accounts and a task route corresponding to each target account in the at least two target accounts and the target task; the target task is a task which is selected from a plurality of tasks according to preset conditions and is used for detecting an abnormal account number, such as a certain breakthrough task, and can be selected manually or by a machine; the target account number is an account number corresponding to a game role for completing a target task, namely an account number for determining an abnormal route; the task route refers to a route where a game role corresponding to a target account number finishes a target task, namely a route sample for determining an abnormal route; the abnormal account refers to an account using the plug-in script in the target account. It should be noted that the target account number is associated with the corresponding task route, or the target account number is an attribute mark of the task route.

In practical application, in order to train the abnormal account detection model, a large number of training samples are used to train the abnormal account detection model so as to reach a certain training standard, that is, a large number of target accounts and task routes of each target account under a target task are received, wherein one target account corresponds to one task route. It should be noted that some of the received target account numbers are known to have abnormality, and these part of account numbers are labeled as abnormal account numbers. Whether other target accounts except the abnormal account in the received target accounts are abnormal or not is unknown, that is, whether other target accounts are abnormal or not is not determined, and the other target accounts may be abnormal accounts or normal accounts.

For example, 500 sets of samples are received, where each set of samples includes a target account and a task route corresponding to the target account, that is, there are 500 target accounts and 500 task routes. Among the 500 target account numbers, if 20 target account numbers are known to be abnormal, the 20 target account numbers are marked as abnormal account numbers, and the remaining 480 target account numbers are unknown, wherein there are unknown abnormal account numbers and unknown normal account numbers.

In order to ensure that the training is performed smoothly, before receiving the training sample, the target account numbers and the task routes are determined, that is, before receiving the training sample, at least two target account numbers for completing the target task are determined, and the task route corresponding to the target task of each of the at least two target account numbers is obtained, so as to obtain at least two task routes.

Specifically, as the same target account may complete the target task for multiple times, at least a plurality of task routes corresponding to the target account and the target task may be provided, and at this time, only one of the task routes needs to be selected (either randomly or according to a preset condition) to ensure that the obtained task routes correspond to the target account one to one.

In practical applications, the target account number that completes the target task may be further determined according to the determined target task, where in order to effectively detect the abnormal route, the number of samples needs to be large enough, that is, the number of target account numbers cannot be too small, and therefore there may be a plurality of target account numbers. After the plurality of target account numbers are determined, a plurality of task routes corresponding to the target tasks need to be determined according to the target account numbers. It should be noted that the target account numbers correspond to the task routes one to one, that is, there are several target account numbers and several task routes.

For example, a grain and grass transporting task is selected as a target task from a plurality of tasks, and further, the target account number for completing the grain and grass transporting task is determined. And determining that the target account comprises an account X, an account Y and an account Z according to the record of the server, so as to obtain a task route X corresponding to the account X and the grain and grass transporting task, a task route Y corresponding to the account Y and the grain and grass transporting task, and a task route Z corresponding to the account Z and the grain and grass transporting task.

According to the method and the device, the target account is determined according to the target task, then the task route corresponding to the target account and the target task is determined, the task route obtaining process is simplified, meanwhile, the accuracy of obtaining the task route can be improved, and the task route obtaining speed is improved to a certain extent.

In one or more embodiments of this embodiment, the specific implementation process of obtaining the task route corresponding to the target task for each of the at least two target account numbers to obtain at least two sets of trajectory data may be as follows:

acquiring track data, corresponding to the target task, of each of the at least two target account numbers to obtain at least two sets of track data;

and sequencing and removing the duplicate of each group of track data in the at least two groups of track data according to a time sequence to obtain at least two task routes.

Specifically, the trajectory data refers to data representing the coordinate position of the game character in the game, for example, the trajectory data may be represented by P₁，P₂，…，P_nData of composition, P_iIs (x)_i，y_i) A representation in which the trajectory data is typically stored in a database of the server; the sorting refers to a process of adjusting a group of unordered track data according to the sequence of time; the duplication elimination refers to eliminating adjacent and same data, namely repeated data, in the sequenced track data, and reserving one data.

In practical application, after at least two target account numbers completing a target task are determined, a plurality of sets of trajectory data corresponding to a plurality of target account numbers and the target task are searched and extracted from a database of a server, and one target account number corresponds to one set of trajectory data. In general, the amount of trajectory data (including all trajectory data in the process of completing the target task) is very large, so that the calculation pressure of the server is very large, and therefore, the trajectory data in the process of the game character can be obtained. Because the acquired track data may be unordered, an effective task route cannot be generated, and in order to avoid this problem, each group of track data may be sorted according to the time sequence, that is, according to the frame number sequence. After a game character receives a target task, the game character may be stationary in place, which may cause a plurality of adjacent repeated data in the track data in time sequence and result in a large amount of data in subsequent calculation. Therefore, duplicate data can be removed, that is, multiple pieces of data which are adjacent and identical in the sorted time series are deduplicated, and only one of the pieces of data is retained. And after the duplication elimination is finished, generating a task route according to the processed track data.

For example, the target account number of the account number "123456" corresponds to the trajectory data "P₁，P₁₀，P₁₀，P₈，P₈，P₉，P₅，P₁，P₄，P₆，P₇，P₆，P₂，P₃Firstly, the trajectory data is sequenced according to the time sequence and then is P₁，P₁，P₂，P₃，P₄，P₅，P₆，P₆，P₇，P₈，P₈，P₉，P₁₀，P₁₀"P" is obtained by performing deduplication processing on the sorted trajectory data₁，P₂，P₃，P₄，P₅，P₆，P₇，P₈，P₉，P₁₀", and finally, may be in accordance with" P₁，P₂，P₃，P₄，P₅，P₆，P₇，P₈，P₉，P₁₀"generate" 123456 "the task route corresponding to the target account number.

According to the method and the device, the follow-up generated task route can be more accurate through sequencing the track data, and the accuracy and the effectiveness of obtaining the task route are improved. In addition, redundant calculation is reduced to a certain extent by carrying out deduplication processing on the sequenced track data, so that the calculation pressure of the server is reduced.

It should be noted that, in order to avoid the problem that the training of the abnormal account detection model cannot be successful due to the wrong selection of the target task, before receiving the training sample, it is also necessary to detect whether the target task is available, and whether the target task meets the detection condition of the abnormal account can be determined according to the at least two task routes; if not, replacing the target task, determining at least two target account numbers of the replaced target task, and acquiring at least two task routes of the at least two target account numbers corresponding to the replaced target task; if so, training samples are received.

Step 104: and inputting each target account and each task route into an abnormal account detection model, and clustering each task route according to a first similarity threshold to obtain at least one task route clustering cluster.

On the basis of receiving the training samples, further inputting the received samples to an abnormal account detection model, and starting training, namely clustering at least two task routes.

Specifically, the clustering refers to a process of dividing a plurality of task routes into a plurality of clusters consisting of task routes with similar distances; the task route clustering cluster refers to a result of a plurality of clusters formed by clustering task routes, and distances between the task routes in the task route clustering cluster are very similar.

In practical application, the clustering algorithm can be various, the at least two task routes are clustered according to different clustering algorithms, the clustering results are different, and the obtained at least one task route is different in clustering. In the application, a Single-pass algorithm is selected to cluster the at least two task routes to obtain at least one task route cluster, and the specific implementation process can be as follows:

selecting an ith task route from at least two task routes, and determining the ith task route as a cluster center of an ith task route cluster, wherein i is a natural number greater than or equal to 1;

calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and a j-th task route clustering cluster, wherein j is a positive integer less than or equal to i;

adding the task route to the jth task route cluster under the condition that the similarity is smaller than a first similarity threshold, and generating an i +1 th task route cluster by taking the task route as a cluster center under the condition that the similarity is larger than or equal to the first similarity threshold;

and judging whether the task routes in the at least two task routes are clustered, if not, increasing 1 by itself and continuously calculating the similarity of any non-clustered task route in the at least two task routes and the cluster center of the j task route cluster, and if so, outputting a clustering result.

The practical rule of the clustering algorithm in the process is as follows: and clustering the task routes in sequence according to a certain sequence, comparing the task route of each clustering with the cluster center of the existing task route clustering cluster, if the similarity between the task route and a certain cluster center is smaller than a first similarity threshold value, adding the task route to the task route clustering cluster corresponding to the cluster center, and if the similarity between the task route and all the cluster centers is larger than or equal to the first similarity threshold value, regarding the task route as a new task route clustering cluster, and regarding the task route as the cluster center of the new task route clustering cluster. And repeating the steps until all the task routes are clustered, and clustering each task route only once in the whole process.

Specifically, first, a first task route may be selected from the at least two task routes, and a first task route cluster may be created with the first task route as a cluster center. Then, selecting a second task route from the at least two task routes, and calculating the similarity of the cluster centers of the second task route and the first task route cluster, namely calculating the similarity of the second task route and the first task route: adding the second task route to the first task route cluster under the condition that the similarity between the second task route and the first task route is smaller than a first threshold value; and under the condition that the similarity between the second task route and the first task route is greater than or equal to a first threshold value, creating a second task route cluster by taking the second task route as a cluster center. And then, repeating the process until all the task routes are added into the corresponding task route cluster.

It should be noted that each non-clustered task route is subjected to similarity calculation with the cluster center of each created task route cluster, and when the similarity between a certain task route and the cluster centers of a plurality of task route cluster clusters is smaller than a first similarity threshold, the task route can be added to the task route cluster with the minimum similarity. And the task routes in the task route clustering cluster can be arranged according to a certain sequence or can be unordered.

For example, there are three task routes, namely task route one, task route two, and task route three, and in order to ensure the naturalness of the clustering result, the sequence of the three task routes is randomly disturbed before clustering, and at this time, the sequence of the three task routes is: task route two, task route three, task route one, the first similarity threshold is 1. Firstly, a first task route clustering cluster is created by taking a task route II as a cluster center to obtain a task route II; then, selecting a third task route, calculating the similarity between the third task route and a second task route, wherein the calculation result is shown in table 1, the similarity is 1.3, 1.3 is greater than 1, namely the similarity is greater than a first similarity threshold value, and then establishing a second task route cluster by taking the third task route as a cluster center to obtain [ third task route ]; and finally, selecting a first task route, calculating to obtain the similarity of the first task route and the cluster center of the first task route cluster, wherein the similarity is 0.9, the similarity of the first task route and the cluster center of the second task route cluster is 0.8, both 0.9 and 0.8 are smaller than a first similarity threshold value 1, and as 0.9 is larger than 0.8, the first task route is added into the second task route cluster to obtain a task route III and a task route I. Therefore, the three task routes are clustered to obtain two task route clustering clusters, namely [ task route two ] and [ task route three ] and task route one ].

TABLE 1 similarity between three task routes

In the application, the at least two task routes are clustered by adopting the method, a large number of task routes can be clustered rapidly, namely the clustering speed can be increased, and the speed for detecting abnormal account numbers is increased to a certain extent. In addition, the clustering is carried out through the relation between the first similarity threshold and the similarity, the reliability of clustering results can be effectively improved, and the reliability of abnormal account detection results can also be improved.

In one or more embodiments of this embodiment, when a number of task routes in a task route cluster is increased, in order to enable a cluster center to more accurately represent the characteristics of the task route cluster, the cluster center of the task route cluster needs to be adjusted, that is, when the similarity is smaller than a first similarity threshold, after the task route is added to the jth task route cluster, the cluster center of the task route cluster needs to be detected, and a specific implementation process may be as follows:

comparing the length of the task route with the length of the cluster center of the jth task route clustering cluster, and if the length of the task route is shorter than the length of the cluster center, determining the task route as the cluster center of the jth task route clustering cluster; and if the length of the task route is longer than that of the cluster center, the cluster center of the j-th task route cluster is not changed.

In practical application, after a new task route is added to the task route cluster, in order to reduce the subsequent calculation amount in calculating the similarity and improve the calculation speed, the task route with the shortest length in the task route cluster can be selected as a cluster center. When a new task route is not added, the cluster center of the task route cluster is the task route with the shortest length in the task route cluster, so that the length of the newly added task route is only required to be compared with the length of the cluster center, and if the newly added task route is longer than the cluster center, the current situation is maintained, namely the cluster center of the task route cluster is not changed; and if the newly added task route is shorter than the cluster center, taking the newly added task route as the cluster center of the task route clustering cluster, namely the cluster center of the task route changing clustering cluster.

It should be noted that, in terms of probability, the more task routes in a task route cluster, the more representative the types of task routes that are not clustered. If there are 8 out of 10 people playing basketball and 1 playing football, then there is a high probability that the remaining people are also playing basketball. Therefore, in order to further improve the clustering speed, the task route clustering clusters can be ranked according to the number of task routes in the task route clustering clusters, and the similarity between any unclustered task route in the at least two task routes and the cluster center of the jth task route clustering cluster is calculated according to the ranking result, and the specific implementation process can be as follows:

sequencing the i task route cluster clusters according to the number of the included task routes;

and calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and the j-th task route clustered cluster according to the sequencing order.

Specifically, the existing task route clustering clusters are sorted from most to few according to the number of task routes in the clusters. For example, there are three task route clusters: A. b, C, if there are 3 task route cluster in A, 5 task route cluster in B and 4 task route cluster in C, the sequencing result is: B. c, A are provided. And further, calculating the similarity of the clustering centers of the non-clustered task routes and the clustering clusters of the task routes according to the sequencing result.

For example, there are five task routes, which are task route one, task route two, task route three, task route four, and task route five, respectively, and the lengths thereof are shown in table 2. In order to ensure the naturalness of the clustering result, the sequence of the five task routes is adjusted or randomly disturbed before clustering, and the sequence of the five task routes is as follows: task route three, task route one, task route four, task route five, task route two and the first similarity threshold is 0.55. Taking the task route three as a cluster center of a first task route clustering cluster to obtain a first task route clustering cluster (task route three); calculating the similarity of the cluster centers of the first task route cluster [ task route three ] and the first task route cluster [ task route three ], wherein the similarity is 0.7, and since 0.7 is larger than a first similarity threshold value of 0.55, the first task route is not added into the first task route cluster [ task route three ], but a new task route cluster is created by taking the first task route as the cluster center, and a second task route cluster [ task route one ] is obtained. The first task route clustering cluster [ task route three ] and the second task route clustering cluster [ task route one ] respectively comprise a task route without sequencing. Calculating the similarity of cluster centers of the task route four and the first task route cluster [ task route three ], wherein the calculation result is shown in table 3, and the similarity is 0.6 and is greater than a first similarity threshold value of 0.55; the similarity of the cluster centers of the task route four and the second task route clustering cluster [ task route one ] is calculated, the calculation result is shown in table 3, the similarity is 0.3 and is smaller than a first similarity threshold value of 0.55, so the task route four is added into the second task route clustering cluster [ task route one ], and at the moment, the existing task route clustering clusters comprise a first task route clustering cluster [ task route three ] and a second task route clustering cluster [ task route one and task route four ]. Since 257 is smaller than 270, that is, the length of the task route one is smaller than the length of the task route four, the cluster center of the second task route cluster [ task route one, task route four ] is still the task route one. Sequencing the existing task route cluster, and changing an original first task route cluster [ task route three ], a second task route cluster [ task route one and task route four ] into a second task route cluster [ task route one, task route four ] and a first task route cluster [ task route three ]. Calculating the similarity of cluster centers of a task route fifth clustering cluster and a second task route clustering cluster (a task route I and a task route IV), wherein the calculation result is shown in table 3, and the similarity is 2.8 and is greater than a first similarity threshold value of 0.55; and calculating the similarity of the cluster centers of the task route five and the first task route cluster [ task route three ], wherein the similarity is 0.4 and is less than a first similarity threshold value of 0.55, so that a second task route cluster [ task route one, task route four ] and a first task route cluster [ task route three and task route five ] are obtained, and because 219 is less than 287, namely the length of the task route five is less than that of the task route three, the cluster centers of the first task route cluster [ task route three and task route five ] are changed into the task route five. Finally, calculating the similarity of cluster centers of the task route two and the second task route cluster (task route one and task route four), wherein the calculation result is shown in table 3, and the similarity is 0.6 and is greater than the first similarity threshold value 0.55; and calculating the similarity of the cluster centers of the second task route and the first task route cluster (the third task route and the fifth task route), wherein the calculation result is shown in table 3, the similarity is 0.8 and is greater than a first similarity threshold value of 0.55, and a new task route cluster is created by taking the second task route as the cluster center to obtain a third task route cluster (the second task route). Namely, the clustering result is: a second task route clustering cluster [ task route one, task route four ], a first task route clustering cluster [ task route three, task route five ], and a third task route clustering cluster [ task route two ].

TABLE 2 Length of five task routes

TABLE 3 similarity between five task routes

It should be noted that, in practical application, because the number of task routes is large and the difference between task route cluster is also large, in order to improve the clustering efficiency, the task route cluster can not be ordered once every time a task route is clustered. A sorting threshold may be set, for example, when the sorting threshold is 200, every 200 task routes are clustered, and then the existing task route cluster is sorted once.

In the method and the device, the cluster center of the task route clustering cluster is properly updated, so that the calculated amount in the clustering process is reduced, the clustering speed is further improved, and the training speed of the abnormal account detection model is effectively improved. In addition, the sequence of the task route clustering clusters is adjusted according to the number of the task routes in the task route clustering clusters, and the clustering speed is effectively improved to a certain extent.

In one or more implementation manners of this embodiment, the specific implementation process of calculating the similarity between any one non-clustered task route in the at least two task routes and the cluster center of the j-th task route clustered cluster may be as follows:

determining the length of each unclustered task route in the at least two task routes and the length of a cluster center of the i task route cluster;

merging the n-th task route which is not clustered in the at least two task routes and the j-th cluster center in the i cluster centers to generate a merged route of the n-th task route and the j-th cluster center shortest track, wherein the n-th task route is any one of the at least two task routes which is not clustered, the j-th cluster center is a cluster center of a j-th task route clustered cluster, and n is a natural number greater than or equal to 1;

and determining the similarity between the nth task route and the jth cluster center according to the length of the merging route, the length of the nth task route and the length of the jth cluster center.

Specifically, the non-clustered task route refers to a task route which is not added to the corresponding task route clustering cluster; the merging processing refers to a process of combining and collecting the n-th task route and the j-th cluster center which are not clustered; the merged route refers to a route formed by combining and collecting the nth task route and the jth cluster center.

In practical application, a Merge Distance algorithm can be adopted to calculate the similarity between the cluster center of any one non-clustered task route of the at least two task routes and the cluster center of the j-th task route cluster: firstly, the lengths of all task routes which are not clustered yet need to be determined, and preparation is made for calculating the similarity subsequently. And then selecting any one task route from the non-clustered task routes, selecting the cluster center of any one task route cluster from the existing task route cluster, and merging the two. Referring to fig. 2A, a task route a is any one non-clustered task route, and a cluster center b is a cluster center of any one task route clustered cluster, wherein the task route a is formed by track data a₁、a₂、a₃、a₄The cluster center b is composed of track data b₁、b₂、b₃Is composed ofTrack data a₁、a₂、a₃、a₄And track data b₁、b₂、b₃And merging to generate a merged route. Since the generated merging route may have a plurality of paths, only one path having the shortest trajectory needs to be selected as the merging route s from the plurality of merging routes. And finally, determining the similarity between the non-clustered task route and the cluster center according to the length of the merged route, the length of the non-clustered task route and the length of the cluster center, namely determining the similarity between the task route a and the cluster center b according to the length of the merged route s, the length of the task route a and the length of the cluster center b, wherein the calculation process of the similarity is shown as a formula 1.

MD (a, b) ═ 2l (s)/[ l (a) + l (b) ] -1 (formula 1)

In formula 1, MD (a, b) indicates the similarity between the task line a and the task line b, l(s) indicates the length of the merging line s, l (a) indicates the length of the task line a, and l (b) indicates the length of the task line b.

For example, there is one non-clustered task route and two task route cluster clusters: the system comprises a task route X, a task route clustering cluster M and a task route clustering cluster N, wherein the cluster center of the task route clustering cluster M is P, and the cluster center of the task route clustering cluster N is Q. Determining the lengths of a task route X, a cluster center P and a cluster center Q, wherein L (X) is 10, L (P) is 15 and L (Q) is 20. Then, the similarity between the task route X and the cluster center P is calculated: merging the task route X and the cluster center P to obtain a merged route S with the shortest track₁Wherein the routes S are merged₁Length of (1), i.e. L (S)₁) 20, namely 10, 15 and 20 are carried into formula 1, and 2 × 20/(10+15) -1 is 0.6, namely the similarity between the task route X and the cluster center P is 0.6; and then calculating the similarity between the task route X and the cluster center Q: merging the task route X and the cluster center Q to obtain a merged route S with the shortest track₂Wherein the routes S are merged₂Length of (1), i.e. L (S)₂) The value is 36, that is, 10, 20 and 36 are taken into formula 1, and 2 × 36/(10+20) -1 is 1.4, that is, the similarity between the task route X and the cluster center Q is 1.4.

According to the method and the device, the merging route of the shortest track is determined by merging the cluster centers of any one non-clustered task route and any one task route clustering cluster, and the similarity between the non-clustered task route and the cluster center of the task route clustering cluster is further determined, so that the accuracy of the similarity is improved, and meanwhile, the effectiveness is improved for clustering the task routes according to the similarity.

Step 106: and under the condition that the number of task routes in an abnormal task route clustering cluster is larger than or equal to an abnormal threshold, counting the first number of the task routes corresponding to the abnormal account in the abnormal task route clustering cluster, wherein the abnormal task route clustering cluster is any one of the at least one task route clustering cluster.

Under the condition that each target account and each task route are input into an abnormal account detection model, each task route is clustered according to a first similarity threshold value, and at least one task route clustering cluster is obtained, further, an abnormal route is determined according to the number of the task routes in the task route clustering cluster, and the first number of the task routes corresponding to the abnormal accounts in the abnormal route is determined.

Specifically, the abnormal threshold refers to a critical value used for evaluating the number of task routes in the abnormal task route cluster, and may be a critical value used for evaluating whether a target account corresponding to a task route in the abnormal task route cluster is an abnormal account, and the abnormal threshold may be set according to an actual situation.

In practical application, the number of task routes in the task route clustering cluster can be determined firstly, the number of the task route clustering cluster is compared with an abnormal threshold value respectively, and if the number of the task routes in a certain task route clustering cluster is smaller than the abnormal threshold value, the task route clustering cluster is defaulted to be a normal task route clustering cluster; if the number of the task routes in a certain task route cluster is larger than or equal to the abnormal threshold, determining the task route cluster as an abnormal task route cluster, and determining the number of the task routes corresponding to the abnormal account in the abnormal task route cluster, namely the first number.

For example, two task route cluster clusters are obtained after clustering task routes, wherein 190 task routes are provided in a first task route cluster, and 210 task routes are provided in a second task route cluster. Under the condition that the abnormal threshold value is 200, only the number of the task routes in the second task route clustering cluster is larger than the abnormal threshold value, so that the first task route clustering cluster is a normal task route clustering cluster, and the second task route clustering cluster is an abnormal task route clustering cluster. If 15 target account numbers corresponding to the task routes in the second task route clustering cluster are marked as abnormal account numbers, the first number is 15.

According to the method and the device, the number of the task routes in the task route clustering cluster is detected, so that the abnormal task route clustering cluster can be detected quickly and efficiently, and the speed of detecting the abnormal route is increased. And determining the first number according to the task routes corresponding to the abnormal account numbers in the abnormal task route clustering cluster, laying a foundation for subsequently adjusting the first similarity threshold and the abnormal threshold, and improving the training speed to a certain extent.

Step 108: and identifying account states of the unmarked accounts in the abnormal task route clustering cluster, and counting a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster.

Under the condition that the abnormal task route cluster and the first number are determined, further, account states of other task routes except for the task route corresponding to the abnormal account marked in the abnormal task route cluster are identified, namely, the account states of the task routes corresponding to the account not marked in the abnormal task route cluster are identified, namely, whether the account not marked in the abnormal task route cluster is an abnormal account or not is identified, the number of the account not marked with the abnormal account state in the account not marked is determined as a second number, and the number of the account not marked with the normal account state in the account not marked is determined as a third number.

Along the above example, 210 task routes are provided in the second task route cluster (abnormal task route cluster), wherein target accounts corresponding to 15 task routes are labeled as abnormal accounts, the first number is 15, the number of task routes corresponding to unlabeled accounts is 195, and further, the account states of the 195 unlabeled accounts are determined. After identification, if there are 125 abnormal account numbers and 70 normal account numbers in the 195 un-labeled account numbers, the first number is 15, the second number is 125, and the third number is 70.

It should be noted that, when the account status of the un-labeled account is identified, the determination may be performed according to some numerical characteristics of the login device or the game character corresponding to the un-labeled account, where the numerical characteristics include login IP, speaking content, speaking frequency, fighting power, online duration, recharging, and the like, for example, a certain game character continuously fights, fights for more than ten hours every day and lasts for several days, and the account corresponding to the game character may be determined as an abnormal account. In addition, on the basis of identifying the account number state of the account number not marked in the abnormal task route clustering cluster, the account number not marked with the abnormal account number state in the abnormal task route clustering cluster can be marked as the abnormal account number, so that the data processing amount for identifying the account number state of the account number not marked in the abnormal task route clustering cluster in the subsequent training process can be reduced, and the training speed is further improved.

In the method, the account states of the account numbers which are not marked in the abnormal task route clustering cluster are identified, the second quantity and the third quantity are further determined, preparation work is made for adjusting the first similarity threshold value and the abnormal threshold value, and the accuracy of detecting the abnormal account numbers by the model is improved.

Step 110: and adjusting the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, returning to the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster, and storing the cluster center of the abnormal task route clustering cluster until the training stopping condition is reached.

On the basis of determining the first quantity, the second quantity and the third quantity, further, parameters in the model, namely a first similarity threshold value and an abnormal threshold value, can be adjusted according to the first quantity, the second quantity and the third quantity, then the abnormal account detection model continues to be trained until a training stop condition is reached, and a cluster center of an abnormal task route cluster which is finally obtained is stored.

In one or more implementations of this embodiment, a specific implementation process of adjusting the first similarity threshold and the anomaly threshold according to the first number, the second number, and the third number may be as follows:

determining a ratio of the third quantity to a sum of the first quantity, the second quantity, and the third quantity; or determining a ratio of the third quantity to a sum of the first quantity and the second quantity;

and adjusting the first similarity threshold and the abnormal threshold under the condition that the ratio is larger than an adjustment threshold.

In practical application, the ratio of the third quantity to the sum of the first quantity, the second quantity and the third quantity or the ratio of the third quantity to the sum of the first quantity and the second quantity is compared with the adjustment threshold, and when the ratio is greater than the adjustment threshold, the first similarity threshold and the abnormality threshold are adjusted. When the ratio is smaller than or equal to the adjustment threshold, the training is stopped, and in this case, the training stop condition may be that the ratio of the third number to the sum of the first number, the second number, and the third number or the ratio of the third number to the sum of the first number and the second number is smaller than or equal to the adjustment threshold, or that the ratio of the sum of the first number and the second number to the sum of the first number, the second number, and the third number or the ratio of the third number to the sum of the first number and the second number stops decreasing.

In one or more implementations of this embodiment, a specific implementation process of adjusting the first similarity threshold and the anomaly threshold according to the first number, the second number, and the third number may further be as follows:

determining a ratio of a sum of the first quantity and the second quantity to a sum of the first quantity, the second quantity, and the third quantity;

and adjusting the first similarity threshold and the abnormal threshold under the condition that the ratio is smaller than an adjustment threshold.

In practical application, the ratio is compared with the adjustment threshold, and when the ratio is smaller than the adjustment threshold, the first similarity threshold and the abnormal threshold are adjusted. When the ratio is greater than or equal to the adjustment threshold, the training is stopped, and in this case, the training stop condition may be that the ratio of the sum of the first number and the second number to the sum of the first number, the second number, and the third number is greater than or equal to the adjustment threshold, or that the ratio of the sum of the first number and the second number to the sum of the first number, the second number, and the third number stops increasing.

In one or more implementations of this embodiment, when the number of iterations of the abnormal account detection model reaches a target number of iterations, training of the abnormal account detection model is stopped.

In practical application, after the first similarity threshold and the abnormal threshold are continuously adjusted and finally reach the training stop condition, the task route cluster obtained by the last clustering needs to be analyzed. Referring to fig. 2B, 204 is a set of normal task route cluster clusters, 206 is an abnormal task route cluster, and 202 is a cluster center in the abnormal task route cluster 206.

Because the cluster center is the most representative task route in the task route clustering cluster, the cluster center of the task route clustering cluster is stored under the condition that the number of the task routes in the task route clustering cluster is not less than the abnormal threshold value, namely the cluster center of the abnormal task route clustering cluster is stored. The cluster center of the abnormal task route cluster is the task route closest to the target task using the plug-in script, and the cluster center is used as the standard of the subsequent abnormal account detection, so that the reliability and the credibility of the abnormal route detection can be improved.

It should be noted that, when the iteration number of the abnormal account detection model reaches the target iteration number, if the grouping result is still not ideal, the target task may be replaced, the target account and the task route corresponding to the target task are replaced, and the training of the abnormal account detection model is restarted. And the abnormal account detection model can be trained at intervals so as to update the cluster center of the abnormal task route clustering cluster and ensure that the latest route using the plug-in script can be automatically identified. Meanwhile, the cluster center of the abnormal task route cluster is stored for a period of time, so that target tasks can be prevented from being performed by using various plug-in scripts in turn, and the subsequent abnormal account detection cannot be used and applied.

According to the abnormal account detection model training method, training samples are received, target accounts and task routes are input into an abnormal account detection model, clustering is conducted on the task routes according to a first similarity threshold value, task route clustering clusters are obtained, under the condition that the number of the task routes in the abnormal task route clustering clusters is larger than or equal to the abnormal threshold value, a first number, a second number and a third number are determined, the first similarity threshold value and the abnormal threshold value are further adjusted, training is continued until a training stopping condition is reached, and at the moment, the cluster centers of the abnormal task route clustering clusters are stored. The speed of clustering the task routes can be increased, the calculated amount is reduced, the accuracy of determining abnormal task route clustering clusters and clustering centers by the samples can be improved, and the speed and the accuracy of detecting abnormal account numbers are improved. In addition, the cluster center of the abnormal task route cluster is saved, so that the account number can be detected in real time, and the abnormal account number can be sealed in real time.

Fig. 3 shows a flowchart of an abnormal account detection method according to an embodiment of the present application, which specifically includes the following steps:

step 302: the method comprises the steps of obtaining an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task.

Specifically, the task route to be evaluated refers to a route which needs to be detected and is determined to be an abnormal route; the task route to be evaluated refers to a task route of the account to be evaluated under a target task.

In the embodiment provided by the application, one acquired account to be evaluated and one task route to be evaluated of the account to be evaluated under a target task are acquired each time.

In order to improve the efficiency of obtaining the account number to be evaluated and the task route to be evaluated, the account number to be evaluated can be determined according to the target task, then the track data of the account number to be evaluated, which is used for completing the target task, is obtained from the database, and the task route to be evaluated is further determined. Namely, the specific implementation process of acquiring the account to be evaluated and the task route to be evaluated of the account to be evaluated under the target task may be as follows:

determining an account number to be evaluated for completing a target task;

acquiring to-be-evaluated track data corresponding to the to-be-evaluated account and the target task;

and sequencing the trajectory data to be evaluated according to a time sequence and removing duplication to obtain a task route to be evaluated.

Specifically, the trajectory data to be evaluated refers to all data representing the positions of game characters in the process that the account to be evaluated completes the target task, which is recorded by the server; the sorting means that a group of unordered track data to be evaluated is adjusted into ordered track data to be evaluated; the deduplication refers to deleting other same data after retaining one data in the sequential track data to be evaluated, wherein the data have the same adjacent time.

In practical application, after a target task is clarified, an account to be evaluated for completing the target task needs to be determined. And then acquiring the account to be evaluated and the track data to be evaluated corresponding to the target task from a database of the server. Generally, the amount of the trajectory data to be evaluated (including all trajectory data in the process of completing the target task) is very large, so that the calculation pressure of the server is very large, and therefore the trajectory data to be evaluated in the process of the game role can be obtained. Because the trajectory data to be evaluated may be unordered, an effective task route to be evaluated cannot be generated, and in order to avoid this problem, the trajectory data to be evaluated may be sorted according to the time sequence, that is, according to the frame number sequence. After the game character receives the target task, the game character may be stationary in place, which may cause a plurality of adjacent repeated data in the trajectory data to be evaluated in a time sequence, and may cause a large amount of data in subsequent calculation. Therefore, duplicate data can be removed, that is, multiple pieces of data which are adjacent and identical in the sorted time series are deduplicated, and only one of the pieces of data is retained. And after the duplication elimination is finished, generating a task route to be evaluated according to the processed track data to be evaluated.

For example, the target account number of the account number "112233" corresponds to the trajectory data "P₁，P₈，P₈，P₇，P₇，P₆，P₁，P₆，P₅，P₅，P₇，P₃，P₃，P₂Firstly, the trajectory data is sequenced according to the time sequence and then is P₁，P₁，P₂，P₃，P₃，P₅，P₅，P₆，P₆，P₇，P₇，P₇，P₈，P₈"P" is obtained by performing deduplication processing on the sorted trajectory data₁，P₂，P₃，P₅，P₆，P₇，P₈", and finally, may be in accordance with" P₁，P₂，P₃，P₅，P₆，P₇，P₈"generate" 112233 "the task route corresponding to this target account.

Step 304: and obtaining at least one reference route, and calculating the similarity between the task route to be evaluated and each reference route.

On the basis of obtaining the account to be evaluated and the task route to be evaluated of the account to be evaluated under the target task, further obtaining a reference route, and determining the similarity between the task route to be evaluated and each reference route.

Specifically, the reference route refers to a route used for measuring whether the task route to be evaluated is abnormal or not. In practical application, the similarity between the reference routes of the task route to be evaluated can be calculated through some algorithms for calculating the similarity. Such as euclidean Distance, Merge Distance algorithm, etc.

In the embodiments provided by the present application, two reference routes are obtained: reference route 1 and reference route 2. Then, the similarity between the task route to be evaluated and the reference route 1 and the similarity between the task route to be evaluated and the reference route 2 are calculated.

In practical application, the similarity between the task route to be evaluated and each reference route can be calculated by adopting a Merge Distance algorithm: firstly, the lengths of the task route to be evaluated and each reference route need to be determined, and preparation is made for subsequent similarity calculation. And then selecting any one reference route from the reference routes, and merging the reference task route and the task route to be evaluated. Referring to fig. 2A, a is a reference route, where a is any one of the reference routes, and b is a task route to be evaluated. The reference route a is composed of track data a1, a2, a3 and a4, the task route b to be evaluated is composed of track data b1, b2 and b3, and the track data a1, a2, a3 and a4 are combined with the track data b1, b2 and b3 to generate a combined route. Since the generated merging route may have a plurality of paths, only one path having the shortest trajectory needs to be selected as the merging route s from the plurality of merging routes. And finally, determining the similarity between the reference line a and the task line b to be evaluated according to the length of the merging line s, the length of the reference line a and the length of the task line b to be evaluated, namely adding the length of the reference line a and the length of the task line b to be evaluated to obtain a length sum, calculating the ratio of the length of the two times of the merging line s to the length sum, and finally subtracting one from the obtained ratio to obtain the similarity between the reference line a and the task line b to be evaluated.

It should be noted that the reference route is an abnormal route, that is, a route adopted when the gold-making studio or the scouring studio performs tasks. The specific implementation process of acquiring the at least one reference route is as follows:

and acquiring at least one cluster center saved in an abnormal account detection model, and determining the at least one cluster center as at least one reference route, wherein the abnormal account detection model is obtained by training through the abnormal account detection model training method.

That is to say, the reference route in the present application may be obtained from the abnormal account detection model, and the cluster center of the abnormal task route cluster stored in the abnormal account detection model is the reference route.

Step 306: and under the condition that at least one of the similarity of the task route to be evaluated and each reference route is smaller than a second similarity threshold, marking the account to be evaluated corresponding to the task route to be evaluated as an abnormal account.

And further comparing the similarity with a second similarity threshold value on the basis of determining the similarity between the task route to be evaluated and each reference route, thereby determining the abnormal account.

Specifically, the second similarity threshold may be set manually according to requirements, or a parameter in the abnormal account detection model, that is, a first similarity threshold, may be obtained, and the first similarity threshold is used as the second similarity threshold in this step.

In practical application, the similarity between the task route to be evaluated and each reference route needs to be compared with a second similarity threshold respectively, whether each similarity is greater than or equal to the second similarity threshold is judged, if yes, the task route to be evaluated is normal, namely, the account corresponding to the task route to be evaluated is a normal account; if not, the task route to be evaluated is abnormal, namely the account corresponding to the task route to be evaluated is an abnormal account, and the account to be evaluated is marked as the abnormal account. On the basis, the evaluation account number can be forbidden to ensure the balance of the game environment.

For example, if the second similarity threshold is 0.5, the similarity between the task route to be evaluated and the reference route 1 is 0.3, and the similarity between the task route to be evaluated and the reference route 2 is 0.6, the account corresponding to the task route to be evaluated is an abnormal account, and the account to be evaluated is marked as an abnormal account.

In one or more embodiments of this embodiment, each reference route corresponds to a second similarity threshold, that is, the reference routes correspond to the second similarity thresholds one to one. On this basis, when the similarity is compared with the second similarity threshold, the similarity needs to be compared with the second similarity corresponding to the reference route corresponding to the similarity.

For example, if the second similarity threshold corresponding to the reference route 1 is 0.55, and the second similarity threshold corresponding to the reference route 2 is 0.65, the similarity between the task route to be evaluated and the reference route 1 needs to be compared with 0.55, and the similarity between the task route to be evaluated and the reference route 2 needs to be compared with 0.65. If the similarity between the task route to be evaluated and the reference route 1 is 0.6, and the similarity between the task route to be evaluated and the reference route 2 is 0.8, the task route to be evaluated is normal, and the account corresponding to the task route to be evaluated is a normal account.

In one or more embodiments of this embodiment, on the basis of acquiring an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task, the account to be evaluated and the task route to be evaluated may also be directly input to an abnormal account detection model for detection, and the specific implementation process is as follows:

inputting the account to be evaluated and the task route to be evaluated into an abnormal account detection model, clustering the task route to be evaluated and at least one cluster center according to a first similarity threshold value to obtain at least one task route cluster, wherein the abnormal account detection model is obtained by training through the abnormal account detection model training method;

and under the condition that the number of the at least one task route clustering cluster is equal to the number of the at least one cluster center, marking the account to be evaluated corresponding to the task route to be evaluated as an abnormal account.

In the embodiment provided by the application, after an account to be evaluated and a corresponding task route to be evaluated are input into a trained abnormal account detection model, the task route to be evaluated and at least one stored cluster center are clustered based on a second similarity threshold value, and a plurality of task route cluster clusters are obtained. Further, the method is carried out. Namely, when N cluster centers exist, N +1 task route cluster clusters are obtained, and the task route to be evaluated is not similar to any cluster center, namely the account number to be evaluated corresponding to the task route to be evaluated is a normal account number; and when N cluster centers exist, obtaining N task route cluster clusters, and showing that the task route to be evaluated is similar to a certain cluster center, namely, the account to be evaluated corresponding to the task route to be evaluated is an abnormal account, and marking the account to be evaluated as an abnormal account. On the basis, the evaluation account number can be forbidden to ensure the balance of the game environment. It should be noted that when N cluster centers are stored, N is any positive integer, and N or N +1 task route cluster clusters can be obtained after clustering; at this time, the second similarity threshold is the first similarity threshold of the abnormal account detection model.

In practical application, whether the task route to be evaluated is the abnormal route or not is determined according to the abnormal route by calculating the similarity. The similarity between the task route to be evaluated and each cluster center can be calculated firstly, and the Merge Distance algorithm can be adopted for calculating the similarity. If the similarity between the task route to be evaluated and each cluster center is greater than or equal to a second similarity threshold, the task route to be evaluated is a normal route, and the account number to be evaluated corresponding to the task route to be evaluated is a normal account number. If the similarity between the task route to be evaluated and a certain cluster center is smaller than a second similarity threshold value, the task route to be evaluated is an abnormal route, and an account to be evaluated corresponding to the task route to be evaluated needs to be marked as an abnormal account. And meanwhile, the detected abnormal account is forbidden in real time.

For example, as shown in table 4, in the case that only one cluster center is determined, two task routes to be evaluated are provided, namely a task route to be evaluated first and a task route to be evaluated second. Under the condition that the second similarity threshold is 3, the similarity between the first task route to be evaluated and the cluster center is 3 and is equal to the second similarity threshold, so that the first task route to be evaluated is a normal route, and the account number to be evaluated corresponding to the first task route to be evaluated is a normal account number; the similarity between the task route II to be evaluated and the abnormal route is 1 and is smaller than a second similarity threshold, so that the task route II to be evaluated is an abnormal route, and the account number to be evaluated corresponding to the task route II to be evaluated is marked as an abnormal account number.

TABLE 4 similarity of task routes to be evaluated and abnormal routes

Degree of similarity	Task route to be evaluated 1	Task route two to be evaluated
			Abnormal route	3	1

It should be noted that, because the abnormal account is an account using the plug-in script, and the game environment balance is damaged by using the plug-in script, the abnormal account can be sealed in real time. In order to improve the accuracy of the prohibition, the results of the similarity of the multiple task routes and some auxiliary indexes can be integrated to judge whether the account to be evaluated is an abnormal account.

According to the abnormal account detection method, the similarity between the task route to be evaluated and each reference route is calculated by acquiring the account to be evaluated, the task route to be evaluated and the reference routes, and further, when at least one of the similarity between the task route to be evaluated and each reference route is smaller than a second similarity threshold value, the account to be evaluated corresponding to the task route to be evaluated is marked as an abnormal account. The method and the device ensure that whether the account to be evaluated is the abnormal account can be quickly and accurately determined, and improve the speed and accuracy of detecting the abnormal account while reducing the calculation amount. In addition, because the reference route is obtained, the account number can be detected in real time, and the abnormal account number can be sealed in real time.

In the following, with reference to fig. 4, the method provided by the present application is used in a breakthrough game as an example to further describe the abnormal account detection model training method and the abnormal account detection method. Fig. 4 shows a processing flowchart applied to a breakthrough game according to an embodiment of the present application, which specifically includes the following steps:

step 402: and determining at least two target account numbers according to the target break-through task.

Step 404: and acquiring at least two sets of track data corresponding to at least two target account numbers and the target break-over task.

And acquiring track data of each of at least two target account numbers corresponding to the target breakthrough task to obtain at least two sets of track data.

Step 406: and sequencing and de-duplicating at least two groups of track data to generate at least two breakthrough task routes.

Step 408: receiving a training sample, wherein the training sample comprises at least two target account numbers and a breakthrough task route of each target account number under a target breakthrough task, and at least one target account number is marked as an abnormal account number.

Step 410: and inputting each target account and each passing task route into an abnormal account detection model, and clustering each passing task route according to a first similarity threshold to obtain at least one passing task route cluster.

Step 412: and under the condition that the number of the breakthrough task routes in the abnormal task route cluster is greater than or equal to an abnormal threshold value, counting the first number of the breakthrough task routes corresponding to the abnormal account number in the abnormal task route cluster, wherein the abnormal task route cluster is any one of the at least one task route cluster.

Step 414: and identifying account states of the unmarked accounts in the abnormal task route clustering cluster, and counting a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route clustering cluster.

Step 416: and adjusting the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity and the third quantity, returning to the step of executing the clustering of each breakthrough task route according to the first similarity threshold to obtain at least one task route clustering cluster until a training stop condition is reached, and storing the cluster center of the abnormal task route clustering cluster.

Step 418: the method comprises the steps of obtaining an account to be evaluated and a to-be-evaluated gateway running route of the account to be evaluated under a target gateway running task.

Step 420: and acquiring at least one reference route, and calculating the similarity between the to-be-evaluated breakthrough route and each reference route.

And acquiring at least one cluster center saved in the abnormal account detection model, and determining the at least one cluster center as at least one reference route.

Step 422: and under the condition that at least one of the similarity of the to-be-evaluated breakthrough route and each reference route is smaller than a second similarity threshold, marking the to-be-evaluated account corresponding to the to-be-evaluated breakthrough route as an abnormal account.

The abnormal account number can be blocked in real time.

According to the abnormal account detection model training method applied to the breakthrough game, the obtained data tracks are sorted and subjected to duplicate removal, so that the calculation pressure of a server is reduced to a great extent, and the calculation speed is increased; inputting each target account and each passing task route into an abnormal account detection model, clustering each passing task route according to a first similarity threshold value to obtain a task route cluster, determining a first quantity, a second quantity and a third quantity under the condition that the quantity of the passing task routes in the abnormal task route cluster is greater than or equal to the abnormal threshold value, further adjusting the first similarity threshold value and the abnormal threshold value, continuing training until a training stopping condition is reached, and storing the cluster center of the abnormal task route cluster. The speed of clustering the task routes can be increased, the calculated amount is reduced, the accuracy of determining abnormal task route clustering clusters and clustering centers by the samples can be improved, and the speed and the accuracy of detecting abnormal account numbers are improved. In addition, the cluster center of the abnormal task route cluster is saved, so that the account number can be detected in real time, and the abnormal account number can be sealed in real time.

According to the abnormal account detection method applied to the pass-through game, the similarity between the pass-through route to be evaluated and each reference route is calculated by acquiring the account to be evaluated and the pass-through task route to be evaluated, and further, when at least one similarity between the pass-through route to be evaluated and each reference route is smaller than a second similarity threshold value, the account to be evaluated corresponding to the pass-through task route to be evaluated is marked as an abnormal account. The method and the device ensure that whether the account to be evaluated is the abnormal account can be quickly and accurately determined, and improve the speed and accuracy of detecting the abnormal account while reducing the calculation amount. In addition, because the reference route is obtained, the account number can be detected in real time, and the abnormal account number can be sealed in real time.

Corresponding to the above embodiment of the abnormal account detection model training method, the present application further provides an embodiment of an abnormal account detection model training device, and fig. 5 shows a schematic structural diagram of an abnormal account detection model training device provided in an embodiment of the present application. As shown in fig. 5, the apparatus includes:

a receiving module 502 configured to receive a training sample, where the training sample includes at least two target account numbers and a task route of each target account number under a target task, and at least one target account number is labeled as an abnormal account number;

a clustering module 504, configured to input each target account and each task route into an abnormal account detection model, and cluster each task route according to a first similarity threshold to obtain at least one task route cluster;

a counting module 506, configured to count a first number of task routes corresponding to the abnormal account in an abnormal task route cluster when the number of task routes in the abnormal task route cluster is greater than or equal to an abnormal threshold, where the abnormal task route cluster is any one of the at least one task route cluster;

an identifying module 508, configured to identify account states of the unmarked accounts in the abnormal task route cluster, and count a second number of the unmarked accounts with abnormal account states and a third number of the unmarked accounts with normal account states in the abnormal task route cluster;

an adjusting module 510, configured to adjust the first similarity threshold and the abnormal threshold according to the first quantity, the second quantity, and the third quantity, and return to perform the step of clustering the task routes according to the first similarity threshold to obtain at least one task route clustering cluster, until a training stop condition is reached, and store a cluster center of the abnormal task route clustering cluster.

In one or more implementations of this embodiment, the clustering module 504 is further configured to:

selecting an ith task route from at least two task routes, and determining the ith task route as a cluster center of an ith task route cluster, wherein i is a natural number greater than or equal to 1;

calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and a j-th task route clustering cluster, wherein j is a positive integer less than or equal to i;

adding the task route to the jth task route cluster under the condition that the similarity is smaller than a first similarity threshold, and generating an i +1 th task route cluster by taking the task route as a cluster center under the condition that the similarity is larger than or equal to the first similarity threshold;

and judging whether the task routes in the at least two task routes are clustered, if not, increasing 1 by itself and continuously calculating the similarity of any non-clustered task route in the at least two task routes and the cluster center of the j task route cluster, and if so, outputting a clustering result.

In one or more implementations of this embodiment, the clustering module 404 is further configured to:

and comparing the length of the task route with the length of the cluster center of the jth task route clustering cluster, and if the length of the task route is shorter than the length of the cluster center, determining the task route as the cluster center of the jth task route clustering cluster.

In one or more implementations of this embodiment, the clustering module 404 is further configured to:

sequencing the i task route cluster clusters according to the number of the included task routes;

and calculating the similarity of the cluster center of any non-clustered task route in the at least two task routes and the j-th task route clustered cluster according to the sequencing order.

In one or more implementations of this embodiment, the clustering module 404 is further configured to:

determining the length of each unclustered task route in the at least two task routes and the length of a cluster center of the i task route cluster;

merging the n-th task route which is not clustered in the at least two task routes and the j-th cluster center in the i cluster centers to generate a merged route of the n-th task route and the j-th cluster center shortest track, wherein the n-th task route is any one of the at least two task routes which is not clustered, the j-th cluster center is a cluster center of a j-th task route clustered cluster, and n is a natural number greater than or equal to 1;

and determining the similarity between the nth task route and the jth cluster center according to the length of the merging route, the length of the nth task route and the length of the jth cluster center.

In one or more implementations of this embodiment, the apparatus further includes a determining module configured to:

determining at least two target account numbers for completing a target task, and acquiring a task route corresponding to the target task of each of the at least two target account numbers to obtain at least two task routes.

In one or more implementations of this embodiment, the determining module is further configured to:

acquiring track data, corresponding to the target task, of each of the at least two target account numbers to obtain at least two sets of track data;

and sequencing and removing the duplicate of each group of track data in the at least two groups of track data according to a time sequence to obtain at least two task routes.

The abnormal account detection model training device provided by the application inputs each target account and each task route into an abnormal account detection model by receiving a training sample, clusters each task route according to a first similarity threshold value, thereby obtaining a task route cluster, determines a first quantity, a second quantity and a third quantity under the condition that the quantity of the task routes in the abnormal task route cluster is greater than or equal to the abnormal threshold value, further adjusts the first similarity threshold value and the abnormal threshold value, continues training until a training stop condition is reached, and at the moment, saves the cluster center of the abnormal task route cluster. The speed of clustering the task routes can be increased, the calculated amount is reduced, the accuracy of determining abnormal task route clustering clusters and clustering centers by the samples can be improved, and the speed and the accuracy of detecting abnormal account numbers are improved. In addition, the cluster center of the abnormal task route cluster is saved, so that the account number can be detected in real time, and the abnormal account number can be sealed in real time.

The above is an illustrative scheme of the abnormal account detection model training apparatus of this embodiment. It should be noted that the technical scheme of the abnormal account detection model training apparatus and the technical scheme of the abnormal account detection model training method belong to the same concept, and details of the technical scheme of the abnormal account detection model training apparatus, which are not described in detail, can be referred to in the description of the technical scheme of the abnormal account detection model training method.

Corresponding to the above abnormal account detection method embodiment, the present application further provides an abnormal account detection device embodiment, and fig. 6 shows a schematic structural diagram of an abnormal account detection device provided in an embodiment of the present application. As shown in fig. 6, the apparatus includes:

the obtaining module 602 is configured to obtain an account to be evaluated and a task route to be evaluated of the account to be evaluated under a target task;

a calculating module 604, configured to obtain at least one reference route, and calculate similarity between the task route to be evaluated and each reference route;

the marking module 606 is configured to mark the account to be evaluated corresponding to the task route to be evaluated as an abnormal account when at least one of the similarities between the task route to be evaluated and each reference route is smaller than a second similarity threshold.

In one or more implementations of this embodiment, the obtaining module 602 is further configured to:

determining an account number to be evaluated for completing a target task;

acquiring to-be-evaluated track data corresponding to the to-be-evaluated account and the target task;

and sequencing the trajectory data to be evaluated according to a time sequence and removing duplication to obtain a task route to be evaluated.

In one or more implementations of this embodiment, the calculating module 604 is further configured to:

and acquiring at least one cluster center saved in an abnormal account detection model, and determining the at least one cluster center as at least one reference route, wherein the abnormal account detection model is obtained by training through the abnormal account detection model training method.

According to the abnormal account detection device, the similarity between the task route to be evaluated and each reference route is calculated by acquiring the account to be evaluated, the task route to be evaluated and the reference routes, and further, when at least one of the similarity between the task route to be evaluated and each reference route is smaller than a second similarity threshold value, the account to be evaluated corresponding to the task route to be evaluated is marked as an abnormal account. The method and the device ensure that whether the account to be evaluated is the abnormal account can be quickly and accurately determined, and improve the speed and accuracy of detecting the abnormal account while reducing the calculation amount. In addition, because the reference route is obtained, the account number can be detected in real time, and the abnormal account number can be sealed in real time.

The above is an illustrative scheme of an abnormal account detection apparatus according to this embodiment. It should be noted that the technical solution of the abnormal account detection apparatus and the technical solution of the abnormal account detection method belong to the same concept, and details of the technical solution of the abnormal account detection apparatus, which are not described in detail, can be referred to the description of the technical solution of the abnormal account detection method.

FIG. 7 illustrates a block diagram of a computing device 700 provided in accordance with one embodiment of the present description. The components of the computing device 700 include, but are not limited to, memory 710 and a processor 720. Processor 720 is coupled to memory 710 via bus 730, and database 750 is used to store data.

Computing device 700 also includes access device 740, access device 740 enabling computing device 700 to communicate via one or more networks 760. Examples of such networks include the Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the internet. Access device 740 may include one or more of any type of network interface, e.g., a Network Interface Card (NIC), wired or wireless, such as an IEEE802.11 Wireless Local Area Network (WLAN) wireless interface, a worldwide interoperability for microwave access (Wi-MAX) interface, an ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a bluetooth interface, a Near Field Communication (NFC) interface, and so forth.

In one embodiment of the present description, the above-described components of computing device 700, as well as other components not shown in FIG. 7, may also be connected to each other, such as by a bus. It should be understood that the block diagram of the computing device architecture shown in FIG. 7 is for purposes of example only and is not limiting as to the scope of the present description. Those skilled in the art may add or replace other components as desired.

Computing device 700 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., tablet, personal digital assistant, laptop, notebook, netbook, etc.), mobile phone (e.g., smartphone), wearable computing device (e.g., smartwatch, smartglasses, etc.), or other type of mobile device, or a stationary computing device such as a desktop computer or PC. Computing device 700 may also be a mobile or stationary server.

When executing the computer instructions, processor 720 implements the steps of the abnormal account detection model training method or the abnormal account detection method.

The above is an illustrative scheme of a computing device of the present embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the abnormal account detection model training method or the abnormal account detection method belong to the same concept, and details of the technical scheme of the computing device, which are not described in detail, can be referred to the description of the technical scheme of the abnormal account detection model training method or the abnormal account detection method.

An embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions, when executed by a processor, implement the steps of the abnormal account detection model training method or the abnormal account detection method as described above.

The above is an illustrative scheme of a computer-readable storage medium of the present embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the abnormal account detection model training method or the abnormal account detection method belong to the same concept, and details of the technical scheme of the storage medium, which are not described in detail, can be referred to the description of the technical scheme of the abnormal account detection model training method or the abnormal account detection method.

The foregoing description of specific embodiments of the present application has been presented. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

The computer instructions comprise computer program code which may be in the form of source code, object code, an executable file or some intermediate form, or the like. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like. It should be noted that the computer readable medium may contain content that is subject to appropriate increase or decrease as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media does not include electrical carrier signals and telecommunications signals as is required by legislation and patent practice.

It should be noted that, for the sake of simplicity, the above-mentioned method embodiments are described as a series of acts or combinations, but those skilled in the art should understand that the present application is not limited by the described order of acts, as some steps may be performed in other orders or simultaneously according to the present application. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required in this application.

In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

The preferred embodiments of the present application disclosed above are intended only to aid in the explanation of the application. Alternative embodiments are not exhaustive and do not limit the invention to the precise embodiments described. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the application and its practical applications, to thereby enable others skilled in the art to best understand and utilize the application. The application is limited only by the claims and their full scope and equivalents.