WO2017084521A1 - 一种订单聚类方法及装置，以及反恶意信息的方法及装置 - Google Patents

一种订单聚类方法及装置，以及反恶意信息的方法及装置 Download PDF

Info

Publication number
WO2017084521A1
WO2017084521A1 PCT/CN2016/105137 CN2016105137W WO2017084521A1 WO 2017084521 A1 WO2017084521 A1 WO 2017084521A1 CN 2016105137 W CN2016105137 W CN 2016105137W WO 2017084521 A1 WO2017084521 A1 WO 2017084521A1
Authority
WO
WIPO (PCT)
Prior art keywords
order
cluster
content
information
clustering
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/105137
Other languages
English (en)
French (fr)
Inventor
黎久希
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to EP16865698.1A priority Critical patent/EP3379427A4/en
Priority to KR1020187017252A priority patent/KR102151328B1/ko
Priority to JP2018526215A priority patent/JP6594543B2/ja
Priority to AU2016355767A priority patent/AU2016355767A1/en
Priority to SG11201804174TA priority patent/SG11201804174TA/en
Priority to PH1/2018/501058A priority patent/PH12018501058B1/en
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to MYPI2018701895A priority patent/MY186818A/en
Publication of WO2017084521A1 publication Critical patent/WO2017084521A1/zh
Priority to US15/980,171 priority patent/US11200615B2/en
Anticipated expiration legal-status Critical
Priority to US16/721,824 priority patent/US11100567B2/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0633—Managing shopping lists, e.g. compiling or processing purchase lists
    • G06Q30/0635—Managing shopping lists, e.g. compiling or processing purchase lists replenishment orders; recurring orders
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/35—Clustering; Classification
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/33—Querying
    • G06F16/3331—Query processing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/907—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/018—Certifying business or products
    • G06Q30/0185—Product, service or business identity fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing

Definitions

  • the present application relates to the field of network communication technologies, and in particular, to an order clustering method and apparatus, and a method and apparatus for anti-malicious information.
  • each transaction is regarded as an “order”.
  • the “I want to collect payment” service in the Alipay application forms an order, and each remittance business also constitutes an order.
  • There may be malicious information in the order such as the “I want to collect payment” service in the Alipay application.
  • the malicious user sends a “I want to collect payment” request to a large number of Alipay users, and corrects the consumption record corresponding to each order.
  • those phishing websites are mostly slogans such as “Taobao Seventh Anniversary”. The user found that he jumped from Alipay's official website and was relatively trustworthy and recruited. This caused a large loss of funds for the customer and affected Alipay's reputation.
  • keywords are generally used to filter and identify malicious information, but there are certain deficiencies.
  • a keyword filtering scheme only when the keyword is clearly known as spam can function, and when a malicious user does The adjustment will be carried out to modify the keywords in the malicious information.
  • the keyword filtering scheme will be invalid, and it will not play the role of actively discovering malicious information.
  • the endless stream of malicious information in various means and forms only The ability to add keywords to human monitoring to continuously improve the filtering of malicious information, so passive response makes the cost of identifying these malicious information higher.
  • an order clustering method and device and a method and device for anti-malicious information are proposed, and the order is carried out in the technical solution of the present application.
  • the clustering operation can be used to classify the order more accurately, and the degree of human participation can be greatly reduced, and the corresponding anti-malicious information method and device can quickly respond to the orders in the entire malicious information classification cluster. deal with.
  • An embodiment of the present application provides a method for order clustering in an electronic transaction, including
  • the clustering operation is performed according to the order unique identifier and the order vector, and the result of the cluster to which the order belongs is obtained.
  • the embodiment of the present application further provides an anti-malicious information method based on order clustering, including,
  • the representative order contents in all the clusters are analyzed, and if the representative order content is malicious information, all the orders in the cluster are processed accordingly.
  • the embodiment of the present application further provides an order clustering device in an electronic transaction, including
  • a generating unit configured to generate an order unique identifier and an order content according to the order information
  • a vector conversion unit configured to convert the order content into an order vector
  • the clustering operation unit is configured to perform a clustering operation according to the order unique identifier and the order vector to obtain a result of the cluster to which the order belongs.
  • the embodiment of the present application further provides an anti-malicious information device based on order clustering, including
  • a generating unit configured to generate an order unique identifier and an order content according to the order information
  • a vector conversion unit configured to convert the order content into an order vector
  • a clustering operation unit configured to perform a clustering operation according to the order unique identifier and the order vector, to obtain a result of the classification cluster to which the order belongs;
  • the processing unit is configured to analyze the representative order content in all the clusters, and if the representative order content is malicious information, all the orders in the cluster are processed accordingly.
  • the order in the electronic transaction is automatically classified by the clustering algorithm, and the new classification can be obtained according to the real-time content analysis of the order, and the classification of the obtained malicious information is correspondingly performed. Processing reduces the degree of human involvement and allows automatic processing of new clusters.
  • FIG. 1 is a flowchart of a method for order clustering in an electronic transaction according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of an order clustering apparatus in an electronic transaction according to an embodiment of the present application
  • FIG. 3 is a flowchart of an anti-malicious information method based on order clustering according to an embodiment of the present application
  • FIG. 4 is a schematic structural diagram of an anti-malicious information device based on order clustering according to an embodiment of the present application
  • FIG. 5 is a specific flowchart of an anti-malicious information method based on order clustering in an electronic transaction according to an embodiment of the present application
  • FIG. 6 is a flowchart of a method for quickly classifying an order after clustering processing according to an embodiment of the present application.
  • the embodiment of the present application provides an order clustering method and device, and a method and device for anti-malicious information.
  • FIG. 1 is a flowchart of a method for order clustering in an electronic transaction according to an embodiment of the present application.
  • a part of the promotion and dissemination information belongs to normal information, and a part of the promotion and propagation information belongs to malicious information, due to user propagation.
  • the promotion information is forwarded by the server of the electronic transaction system, so the method in this embodiment runs in the server of the electronic transaction system, and all the promotion and propagation information can be automatically classified by a clustering algorithm, such as the meanshift clustering algorithm.
  • the figure specifically includes a step 101 of generating an order unique identifier and an order content based on the order information.
  • Step 102 Convert the order content into an order vector.
  • Step 103 Perform a clustering operation according to the order unique identifier and the order vector to obtain a result of the cluster to which the order belongs.
  • the order shift operation may be performed on the order by using the meanshift clustering algorithm to obtain the result of the classification cluster to which the order belongs.
  • the meanshift clustering operation is a nonparametric multi-model segmentation method, its basic calculation
  • the module adopts the traditional pattern recognition program, which is to analyze the image's feature space and clustering method to achieve the purpose of segmentation. It obtains the density pattern of the unknown category by directly estimating the local maximum of the feature space probability density function, and determines the location of the pattern, and then clusters it into the categories related to this mode.
  • a suitable clustering algorithm can be selected or adopted as needed.
  • the method further includes: mapping the order content in the classification cluster to a feature string, when the mapping string of the order content of the order to be analyzed is the same as the feature string, directly The analysis analysis order is included in the classification cluster.
  • the method before the generating the order unique identifier and the order content according to the order information, the method further includes: importing the order into the hdfs (distributed file system).
  • the subsequent steps of the present application can be performed in the hdfs, so that the processing efficiency can be improved.
  • the other steps of the present invention are optional in the distributed file system, and all the other distributed systems can be performed. The steps can also achieve the purpose of improving efficiency, and will not be described here.
  • the generating the order unique identifier and the order content according to the order information further comprises: generating the order unique identifier according to the user ID, the order ID, and the service type in the order information, according to the order information
  • the order title or order note generates the order content.
  • the user ID and the order ID may be arbitrarily combined.
  • the order unique identifier is generated with the business type, or may also include the contents of other fields (eg, an external order number) to generate an order unique identifier.
  • the order title may include a description of the item, and the description of the order, for example, the order title of the payment service may include a business name, a payee, a message, etc., and the order note may include promotion information of the originating order user. , for example, a URL address, a promotional text, or a promotional image.
  • the converting the order content into an order vector comprises converting the order content into a tf-idf (term frequency – inverse document frequency) vector.
  • the order in the electronic transaction can be automatically classified by a clustering algorithm such as meanshift, and the new classification can be obtained according to the real-time content analysis of the order; when processing the order to be analyzed, Transcoding the order to be analyzed, and then determining whether the reordered order is the same as the feature string of the order content in a certain cluster, thereby further improving the efficiency of the order classification; by importing the order into the distributed file of hdfs
  • the system can take advantage of the characteristics of the distributed system to further improve the efficiency of order classification.
  • FIG. 2 is a schematic structural diagram of an order clustering apparatus in an electronic transaction according to an embodiment of the present application.
  • the apparatus may be disposed in a server of an electronic transaction system, or a high performance server may be separately set.
  • the apparatus of the present embodiment can be implemented by a dedicated CPU or a single-chip microcomputer or an FPGA, or by executing a control logic of each functional module by a general-purpose processor.
  • the function module in the apparatus of this embodiment performs a clustering operation such as meanshift, effectively classifies the order, and can obtain a newly created cluster according to the content of the order, and the developer does not need to preset the number of clusters. This can improve the self-identification degree of order clustering anti-malicious information, improve the accuracy of classification, and reduce the degree of human participation and improve work efficiency.
  • the apparatus of this embodiment includes a generating unit 201 for generating an order unique identifier and an order content based on the order information.
  • the vector conversion unit 202 is configured to convert the order content into an order vector.
  • the clustering operation unit 203 is configured to perform a clustering operation according to the order unique identifier and the order vector to obtain a result of the cluster to which the order belongs.
  • a conversion unit 204 is further connected between the generating unit and the clustering operation unit, and is configured to map an order content in the classification cluster into a feature string, to be analyzed.
  • the mapping string of the order content of the order is the same as the feature string, the to-be-analyzed order is directly included in the cluster.
  • an import unit 205 is further included for importing an order into hdfs (distributed file system).
  • the generating unit is further configured to: generate the order unique identifier according to a user ID, an order ID, and a service type in the order information, and generate the according to an order title or an order remark in the order information.
  • Order content is further configured to: generate the order unique identifier according to a user ID, an order ID, and a service type in the order information, and generate the according to an order title or an order remark in the order information.
  • the vector conversion unit is further configured to convert the order content into a tf-idf vector.
  • an order in an electronic transaction can be automatically classified by a clustering algorithm such as meanshift, and a new classification can be obtained according to real-time content analysis of the order; when processing the order to be analyzed, Transcoding the order to be analyzed, and then determining whether the reordered order is the same as the feature string of the order content in a certain cluster, thereby further improving the efficiency of the order classification; by importing the order into the distributed file of hdfs
  • the system can take advantage of the characteristics of the distributed system to further improve the efficiency of order classification.
  • FIG. 3 is a flowchart of an anti-malicious information method based on order clustering according to an embodiment of the present application.
  • the generated clusters are judged, so that which clusters contain malicious information (such as garbage orders), and all the orders in the cluster can be processed to avoid the risk of electronic transactions.
  • malicious information such as garbage orders
  • step 301 is included to generate an order unique identifier and an order content according to the order information.
  • Step 302 converting the order content into an order vector.
  • Step 303 Perform a clustering operation according to the order unique identifier and the order vector to obtain a result of the classification cluster to which the order belongs.
  • Step 304 Analyze the content of the representative order in all the clusters. If the content of the representative order is malicious information, all the orders in the cluster are processed accordingly.
  • a method in the prior art may be used, for example, determining whether the order content of an order in the cluster is malicious information according to a keyword, or manually
  • the content of the order is filtered.
  • the corresponding processing may include recording a user ID in the cluster, sending the user ID to the administrator to perform a user ID or issuing a warning message to the user ID.
  • the method further includes: mapping the order content in the classification cluster to a feature string, when the mapping string of the order content of the order to be analyzed is the same as the feature string, directly The analysis analysis order is included in the classification cluster.
  • mapping character string of the to-be-analyzed order is identical to the feature character string, further comprising: when the classification cluster has been calibrated as a garbage class, the malicious information that can directly be used to analyze the order to be analyzed is directly Processing, such as freezing transactions, blocking accounts, etc.
  • the order content refers to the order content of an order selected by any of the classification clusters.
  • the order to be analyzed can be directly classified according to the clustering clustering operation, because most of the information in the promotion and dissemination information (order) initiated by a certain user is the same, which classification clusters of the promotion propagation information have been obtained by the above algorithm, and the feature samples (ie, the most representative promotion propagation information) in the classification cluster are converted into MD5 codes, and only when the promotion propagation information to be analyzed is received, only By converting the promotion and propagation information into the MD5 code, it can be determined whether the promotion and propagation information to be analyzed belongs to the classification cluster by comparing whether the two are the same. Those skilled in the art can imagine that other types of transformation can be obtained by the above technical solutions. The code is also feasible and will not be described here.
  • an order in an electronic transaction can be automatically classified by a clustering algorithm such as meanshift (in practical applications, an appropriate clustering algorithm can also be selected or adopted according to needs), and can be based on an order.
  • a clustering algorithm such as meanshift (in practical applications, an appropriate clustering algorithm can also be selected or adopted according to needs), and can be based on an order.
  • Real-time content analysis gets a new classification; when processing an order to be analyzed, it can be transcoded by the order to be analyzed, and then it is judged whether the reordered order is related to the characteristic character of the order content in a certain cluster.
  • the same string which further improves the efficiency of order classification; by importing orders into the distributed file system of hdfs, the characteristics of the distributed system can be utilized to further improve the efficiency of order classification; only similar orders will be clustered to In a cluster, so by analyzing one of the clusters to represent the content of the order, it is possible to obtain whether the entire cluster is a cluster of malicious information, thereby simplifying the workflow for comparing and determining each order.
  • FIG. 4 is a schematic structural diagram of an anti-malicious information device based on order clustering according to an embodiment of the present application.
  • the device in this embodiment may be set in a server of an electronic transaction system, or a high-performance device may be separately set.
  • the server implements the apparatus of this embodiment.
  • the various functional units and modules of the apparatus of this embodiment may be implemented by a dedicated CPU or a single chip microcomputer or an FPGA, or may be implemented by a general purpose processor executing control logic of each functional module.
  • the function module in the apparatus of this embodiment performs a clustering operation such as meanshift, effectively classifies the order, and can obtain a newly created cluster according to the content of the order, and the developer does not need to preset the number of clusters. This can improve the self-identification degree of order clustering anti-malicious information, improve the accuracy of classification, and reduce the degree of human participation and improve work efficiency.
  • the embodiment of the figure specifically includes a generating unit 401 for generating an order unique identifier and an order content according to the order information.
  • the vector conversion unit 402 is configured to convert the order content into an order vector.
  • the clustering operation unit 403 is configured to perform a clustering operation according to the order unique identifier and the order vector to obtain a result of the cluster of the order to which the order belongs.
  • the processing unit 404 is configured to analyze the representative order content in all the clusters, and if the representative order content is malicious information, all the orders in the cluster are processed accordingly.
  • a conversion unit 405 is further included, which is connected between the generating unit and the clustering operation unit, and is used for mapping an order content in the classification cluster into a feature string, to be analyzed.
  • the mapping string of the order content of the order is the same as the feature string, the to-be-analyzed order is directly included in the cluster.
  • the converting unit is further configured to: when the classification cluster has been calibrated as a garbage class, directly submit the to-be-analyzed order to the processing unit for automated malicious information processing (eg, freeze transaction, banned Account number, etc.).
  • automated malicious information processing eg, freeze transaction, banned Account number, etc.
  • an order in an electronic transaction can be automatically classified by a clustering algorithm such as meanshift (in practical applications, an appropriate clustering algorithm can also be selected or adopted according to needs), and can be based on an order.
  • the real-time content analysis obtains a new classification; when processing the order to be analyzed, the order to be analyzed can be transcoded, and then it is determined whether the re-ordered order is the same as the characteristic string of the order content in a certain cluster, thereby further Improve the efficiency of order classification; by importing orders into the distributed file system of hdfs, The characteristics of the distributed system can be utilized to further improve the efficiency of order classification; since only similar orders will be clustered into one cluster, so by analyzing one of the clusters to represent the order content, the whole can be obtained. Whether the cluster is a cluster of malicious information simplifies the workflow for comparing and determining each order.
  • FIG. 5 is a specific flowchart of an anti-malicious information method based on order clustering in an electronic transaction according to an embodiment of the present application.
  • the entire method is performed based on a Hadoop distributed file system, thereby improving
  • the overall work efficiency is described by taking the meanshift clustering method as an example in the clustering process.
  • the payment service is used as an explanation.
  • the user ID, the order ID, the service type, and the receipt are included.
  • the information such as the ID, date, and amount of the payee also includes the remark information in the order, and the URL of the phishing website (Uniform Resource Locator) is included in the remark information, and the malicious user sends the promotion and dissemination information to many users.
  • Uniform Resource Locator Uniform Resource Locator
  • the method includes the step 501 of importing an order acquired from a database into a distributed file system (hdfs).
  • hdfs distributed file system
  • step 502 the user ID, the order ID, and the service type in the order are combined as a unique identifier of the order.
  • the combination in this step may include splicing the user ID, the order ID, and the service type to form an order unique identifier, or may take the last two digits of the user ID, the last two digits of the order ID, and the service type to form an order.
  • the unique identifier may also be otherwise generated by a unique identifier to uniquely identify the order, such as uniquely identifying the order only by the order ID.
  • step 503 the remark information in the order is taken as the content of the order.
  • the remark information of the order is a part describing the content of the order, for example, the URL address of the phishing website is included in the remark information.
  • the order also includes content such as a consumption record title
  • the content may also be used as an order content, wherein the consumption record title may include a description of the item in the order, and for the collection application, May include information such as business name, recipient, amount, etc.
  • the unique identifier for each order corresponds to the order content of the order.
  • Step 504 converting the order unique identifier and the order content into a sequencefile format.
  • the format of the sequencefile converted in this step is for the data format used by the above hdfs distributed file system. After converting to such a format, the processing method processed by the hdfs system can be applied, thereby improving the processing efficiency.
  • Step 505 converting the above order content into a tf-idf vector.
  • the converted tf-idf vector forms a mapping relationship with the order unique identifier ⁇ key, vector>, where key is the above-mentioned order unique identifier, and vector is the vector formed by the above order content, that is, the mathematical expression of the order content.
  • Step 506 Perform a meanshift clustering operation on the vector to obtain a result of the cluster to which the order belongs.
  • the content of the order is iteratively compared with the cluster, and finally, which cluster belongs to the category or belongs to a newly established cluster, because there is a key that is mapped to the vector (ie, the order unique identifier) Therefore, it can correspond to which particular group belongs to which cluster, and the iterative parameters and convergence parameters in the meanshift clustering operation can be set by the developer according to the actual situation, and the output result is in the sequencefile format.
  • Step 507 converting the clustering result of the order into a text format.
  • the clustering result of the order in the foregoing step is in the sequencefile format, it is not conducive to subsequent judgment and processing of the clustering result, so the clustering result of the order needs to be converted into a text format.
  • Step 508 Determine whether the order content in the classification cluster is malicious information. If it is malicious information, proceed to step 509, otherwise proceed to step 510.
  • the specific judgment of whether the content of the order is malicious information may be determined by a method in the prior art, such as a keyword or a manual method. There may be many orders in a cluster, and only one of the orders may be selected for judgment.
  • the amount of promotion and dissemination information is large, especially the amount of information about the promotion and dissemination of malicious information may be larger, after the clustering operation ends, there are many orders in each classification cluster, and the order will be included.
  • the most up to several clusters are filtered out (for example, the top ten clusters are filtered out) and provided to the monitor for monitoring. It can be used to monitor the orders in the top ten clusters.
  • the content can determine which taxonomic clusters are more likely to be classified as malicious information.
  • step 509 the user who initiated the order is marked, and the monitor is prompted.
  • Step 510 if it is not malicious information, no processing is performed.
  • the orders in the electronic transaction system can be classified by the meanshift clustering operation, and new classifications can be automatically generated, thereby reducing manual participation, and can be adapted to the classification of the ever-changing malicious information in real time.
  • FIG. 6 is a flowchart of a method for quickly classifying an order after clustering processing according to an embodiment of the present application. The method is based on the foregoing embodiment of FIG. 5, each of which has a large number of orders, and the system receives a new one. The order to be analyzed is processed.
  • the Figure 6 includes a step 601 of extracting the order content in each cluster.
  • the extraction in this step refers to random extraction, since the content of the order in each cluster should be similar, Therefore, which order content is extracted can be used as a feature of the cluster.
  • Step 602 Perform MD5 transcoding operation on the extracted order content to obtain a feature string.
  • the feature string of each cluster is obtained.
  • the MD5 transcoding operation is only one of the transcoding operations, and other transcoding methods in the prior art may be used, or A transcoding method is designed by the developer as needed, and is not limited herein.
  • Step 603 Acquire an order to be analyzed.
  • This step can be obtained, for example, from step 503 in the embodiment shown in FIG. 5 above, since the embodiment shown in FIG. 5 is generally used for post-mortem analysis orders, and the embodiment shown in FIG. 6 can be used in the embodiment of FIG. 5.
  • the new orders are analyzed, the real-time performance is higher, and the relatively complicated clustering operations are omitted.
  • this step can also directly obtain the promotion and dissemination information (ie, the order) to be forwarded, and perform real-time comparison analysis on the order to determine the classification cluster to which the order belongs.
  • the promotion and dissemination information ie, the order
  • step 604 the order content of the order to be analyzed is subjected to MD5 transcoding operation to obtain a mapping character string.
  • Step 605 Compare the feature string with the mapping string. If yes, go to step 606. Otherwise, go to step 607.
  • Step 606 The order to be analyzed is directly included in the cluster of the feature string.
  • the classification cluster can then continue to be processed in a regression step 508. If it is malicious information, the promotion of the promotion information can be stopped.
  • mapping string of the to-be-analyzed order is the same as the characteristic string of the cluster of the classified garbage class
  • the process directly proceeds to step 509, and without step 606, the penalty for the order to be analyzed is automatically automated. Processing, such as freezing transactions, blocking accounts, etc.
  • Step 607 returning to step 504 to continue the clustering process.
  • an order in an electronic transaction can be automatically classified by a clustering algorithm such as meanshift, and a new classification can be obtained according to the real-time content analysis of the order;
  • a clustering algorithm such as meanshift
  • a new classification can be obtained according to the real-time content analysis of the order;
  • the order to be analyzed is transcoded, and then it is judged whether the order after the transcoding is the same as the characteristic string of the order content in a certain cluster, thereby further improving the efficiency of order classification; by importing the order into hdfs
  • the distributed file system can take advantage of the characteristics of the distributed system to further improve the efficiency of order classification.
  • Improvements to a technology can clearly distinguish between hardware improvements (eg, improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (for process flow improvements).
  • hardware improvements eg, improvements to circuit structures such as diodes, transistors, switches, etc.
  • software improvements for process flow improvements.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • computer readable program code eg, software or firmware
  • examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding.
  • Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component.
  • a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.
  • the system, device, module or unit illustrated in the above embodiments may be specifically implemented by a computer chip or an entity. Or it can be realized by a product with a certain function.
  • the present application can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present application may be embodied in the form of a software product in essence or in the form of a software product, which may be stored in a storage medium such as a ROM/RAM or a disk. , an optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.
  • This application can be used in a variety of general purpose or special purpose computer system environments or configurations.
  • the application can be described in the general context of computer-executable instructions executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • General Business, Economics & Management (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Library & Information Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computational Linguistics (AREA)
  • Evolutionary Biology (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种订单聚类方法及装置，以及反恶意信息的方法及装置，其中聚类方法包括：根据订单信息生成订单唯一标识符和订单内容（101）；将所述订单内容转换为订单向量（102）；根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果（103）。经过上述聚类后还可以根据分类簇中订单内容得到该分类簇是否为恶意信息的分类簇，如果是则对整个分类簇中的所有订单进行相应处理。通过上述方法及装置可以对电子交易中的订单进行自动的分类，可以根据订单的实时内容分析得到新的分类，并且可以一次性对整个分类簇中的所有订单进行统一处理，提高了反恶意信息的效率。

Description

一种订单聚类方法及装置，以及反恶意信息的方法及装置
本申请要求2015年11月18日递交的申请号为201510795161.9、发明名称为“一种订单聚类方法及装置，以及反恶意信息的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信技术领域，特别涉及一种订单聚类方法及装置，以及反恶意信息的方法及装置。
背景技术
在现有的电子商务中，每一次交易行为被视为一笔“订单”，例如支付宝应用软件中的“我要收款”业务发起后构成一笔订单，每笔汇款业务也构成一笔订单。在订单中可能存在恶意信息，例如在支付宝应用软件中的“我要收款”业务，恶意用户向大量支付宝用户发送“我要收款”的请求，并把每笔订单对应的消费记录备注修改为钓鱼网站地址，那些钓鱼网站多半冠上“淘宝七周年庆”之类的标语。用户发现是从支付宝官网跳转过去的，相对较为信任而中招，由此造成了客户较大的资金损失，并且影响了支付宝的声誉。
在现有技术中通常采用关键字对恶意信息进行过滤和识别，但是都存在一定的不足，例如，在关键字过滤方案中只有明确知道关键字是垃圾信息时才能发挥作用，而且当恶意用户做出调整，将传播恶意信息中的关键字进行修改，此时的关键字过滤方案就会失效，没有起到主动发现恶意信息的作用，对于层出不穷的以各种手段和形式出现的恶意信息，只能通过人为监控添加关键字来不断完善恶意信息的过滤，这样被动的应对使得识别这些恶意信息的成本较高。
发明内容
为了解决现有技术中对电子交易中订单分类不准确、不灵活的问题，提出了一种订单聚类方法及装置，以及反恶意信息的方法及装置，在本申请的技术方案中将订单进行初步处理之后，利用聚类运算可以将订单更加准确的进行分类，并且可以大大降低人工参与的程度，并且通过相应的反恶意信息方法及装置可以快速的对整个恶意信息分类簇中的订单进行相应处理。
本申请实施例提供了一种电子交易中订单聚类的方法，包括，
根据订单信息生成订单唯一标识符和订单内容；
将所述订单内容转换为订单向量；
根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
本申请实施例还提供了一种基于订单聚类的反恶意信息方法，包括，
根据订单信息生成订单唯一标识符和订单内容；
将所述订单内容转换为订单向量；
根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果；
分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
本申请实施例还提供了一种电子交易中订单聚类装置，包括，
生成单元，用于根据订单信息生成订单唯一标识符和订单内容；
向量转换单元，用于将所述订单内容转换为订单向量；
聚类运算单元，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
本申请实施例还提供了一种基于订单聚类的反恶意信息装置，包括，
生成单元，用于根据订单信息生成订单唯一标识符和订单内容；
向量转换单元，用于将所述订单内容转换为订单向量；
聚类运算单元，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果；
处理单元，用于分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
由以上本申请实施例提供的技术方案可见，通过聚类算法对电子交易中的订单进行自动的分类，并且可以根据订单的实时内容分析得到新的分类，并且针对得到的恶意信息的分类进行相应处理，降低了人工参与程度，对新的分类簇可以进行自动的处理。
当然实施本申请的任一产品或者方法必不一定需要同时达到以上所述的所有优点。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本 申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1所示为本申请实施例一种电子交易中订单聚类的方法流程图；
图2所示为本申请实施例一种电子交易中订单聚类装置的结构示意图；
图3所示为本申请实施例一种基于订单聚类的反恶意信息方法的流程图；
图4所示为本申请实施例一种基于订单聚类的反恶意信息装置的结构示意图；
图5所示为本申请实施例一种电子交易中基于订单聚类的反恶意信息方法的具体流程图；
图6所示为本申请实施例对订单进行聚类处理后快速分类的方法流程图。
具体实施方式
本申请实施例提供一种订单聚类方法及装置，以及反恶意信息的方法及装置。
为了使本技术领域的人员更好地理解本申请中的技术方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
如图1所示为本申请实施例一种电子交易中订单聚类的方法流程图，在本实施例中，一部分推广传播信息属于正常的信息，一部分推广传播信息属于恶意信息，由于用户传播的推广信息都是经过电子交易系统的服务器进行转发的，因此本实施例中的方法运行于电子交易系统的服务器中，通过聚类算法，例如meanshift聚类算法可以自动将所有的推广传播信息进行分类，而且可以自动的新建分类的簇，开发者不需要预先设定分类簇的个数，这样的分类比较灵活，提高对于订单中内容的自识别程度，提高分类的准确性，并且减少人工参与程度，提高工作效率，并且可以提高后期反恶意信息的处理效率。
该图中具体包括步骤101，根据订单信息生成订单唯一标识符和订单内容。
步骤102，将所述订单内容转换为订单向量。
步骤103，根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
本实施例中，可以采用meanshift聚类算法对订单做聚类运算，得到该订单所属分类簇的结果。其中，meanshift聚类运算是一种非参数化的多模型分割方法，它的基本计算 模块采用的是传统的模式识别程序，即通过分析图像的特征空间和聚类的方法来达到分割的目的。它是通过直接估计特征空间概率密度函数的局部极大值来获得未知类别的密度模式，并确定这个模式的位置，然后使之聚类到和这个模式有关的类别当中。实际应用中，可根据需要选择或采用合适的聚类算法。
根据本申请的一个实施例，还包括将所述分类簇中的订单内容映射为特征字符串的步骤，当待分析订单的订单内容的映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
根据本申请的一个实施例，在所述根据订单信息生成订单唯一标识符和订单内容之前还包括，将订单导入hdfs(分布式文件系统)。本申请后续步骤均可以在该hdfs中进行，从而可以达到提高处理效率的目的，当然在该分布式文件系统中进行本发明的其它步骤是可选的，还可以在其它分布式系统中进行所有步骤，同样也能够达到提高效率的目的，在此不再赘述。
根据本申请的一个实施例，所述根据订单信息生成订单唯一标识符和订单内容进一步包括，根据订单信息中的用户ID、订单ID和业务类型生成所述订单唯一标识符，根据订单信息中的订单标题或者订单备注生成所述订单内容。
其中，除了本实施例中所述的将用户ID、订单ID和业务类型相结合(三个字段的组合)生成所述订单唯一标识符之外，还可以任意的组合所述用户ID、订单ID和业务类型生成订单唯一标识符，或者还可以包括其它字段的内容(例如外部订单号)一起生成订单唯一标识符。
所述订单标题可以包括对商品的描述，对订单的描述，例如收款业务的订单标题可能包括业务名称，被收款人，留言等内容，所述订单备注可以包括发起订单用户的推广传播信息，例如URL地址，宣传文字或者宣传图片等。
根据本申请的一个实施例，所述将所述订单内容转换为订单向量包括，将所述订单内容转换为tf-idf(term frequency–inverse document frequency)向量。
通过上述本申请实施例的方法，可以通过例如meanshift等聚类算法对电子交易中的订单进行自动的分类，并且可以根据订单的实时内容分析得到新的分类；在对待分析订单进行处理时，可以通过对待分析的订单进行转码，然后判断转码后的订单是否与某个分类簇中订单内容的特征字符串相同，从而进一步提高了订单分类的效率；通过将订单导入hdfs这种分布式文件系统，可以利用分布式系统的特点，进一步提高订单分类的效率。
如图2所示为本申请实施例一种电子交易中订单聚类装置的结构示意图，在本实施例中的装置可以设置于电子交易系统的服务器中，或者单独设置一台高性能的服务器来实现本实施例的装置，本实施例装置的各个功能单元、模块可以通过专用的CPU或者单片机或者FPGA来实现，或者通过通用处理器执行各功能模块的控制逻辑来实现。在本实施例装置中的功能模块执行例如meanshift等聚类运算，将订单进行有效的分类，并可以根据订单的内容得到新建立的分类簇，开发者不需要预先设定分类簇的个数，这样可以提高订单聚类反恶意信息的自识别程度，提高分类的准确性，并且减少人工参与程度，提高工作效率。
本实施例装置包括生成单元201，用于根据订单信息生成订单唯一标识符和订单内容。
向量转换单元202，用于将所述订单内容转换为订单向量。
聚类运算单元203，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
根据本申请的一个实施例，还包括转换单元204，连接于所述生成单元和所述聚类运算单元之间，用于将所述分类簇中的订单内容映射为特征字符串，当待分析订单的订单内容的映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
根据本申请的一个实施例，还包括导入单元205，用于将订单导入hdfs(分布式文件系统)。
根据本申请的一个实施例，所述生成单元进一步用于，根据订单信息中的用户ID、订单ID和业务类型生成所述订单唯一标识符，根据订单信息中的订单标题或者订单备注生成所述订单内容。
根据本申请的一个实施例，所述向量转换单元进一步用于，将所述订单内容转换为tf-idf向量。
通过上述本申请实施例的装置，可以通过例如meanshift等聚类算法对电子交易中的订单进行自动的分类，并且可以根据订单的实时内容分析得到新的分类；在对待分析订单进行处理时，可以通过对待分析的订单进行转码，然后判断转码后的订单是否与某个分类簇中订单内容的特征字符串相同，从而进一步提高了订单分类的效率；通过将订单导入hdfs这种分布式文件系统，可以利用分布式系统的特点，进一步提高订单分类的效率。
如图3所示为本申请实施例一种基于订单聚类的反恶意信息方法的流程图，在本实 施例中对生成的分类簇进行判断处理，从而得到哪些分类簇中包括了恶意信息(例如垃圾订单)，对该分类簇中的所有订单进行相应处理就可以避免电子交易的风险。
在本图中具体包括步骤301，根据订单信息生成订单唯一标识符和订单内容。
步骤302，将所述订单内容转换为订单向量。
步骤303，根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
步骤304，分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
其中，对于如何判断所述分类簇中的订单内容是否为恶意信息，可以采用现有技术中的方法，例如根据关键字来判断分类簇中某个订单的订单内容是否为恶意信息，或者人工对订单内容进行筛选。所述相应处理可以包括记录该分类簇中的用户ID，将该用户ID发送给管理者进行封用户ID或者向该用户ID发出警告信息等操作。
根据本申请的一个实施例，还包括将所述分类簇中的订单内容映射为特征字符串的步骤，当待分析订单的订单内容的映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
根据本申请的一个实施例，当待分析订单的映射字符串与所述特征字符串相同后进一步包括，当所述分类簇已经被标定为垃圾类，可以直接将待分析订单做自动化的恶意信息处理，例如冻结交易，封禁帐号等。
其中，所述订单内容是指该分类簇中任意挑选出来的一个订单的订单内容。
通过上述步骤，可以根据经过聚类运算的分类簇，将待分析的订单进行直接分类处理，因为在某个用户发起的推广传播信息(订单)中，绝大部分的信息都是相同的，该推广传播信息属于哪个分类簇已经由上述算法得到，将该分类簇中的特征样本(即最具代表性的推广传播信息)转换为MD5码，再接收到待分析的推广传播信息时，只需要将该推广传播信息转换为MD5码，就可以通过比较两者是否相同来判断待分析的推广传播信息是否属于该分类簇，本领域的技术人员可以通过上述的技术方案想象得到，其它类型的转码也是可行的，在此不再赘述。
通过上述本申请实施例的方法，可以通过例如meanshift等聚类算法对电子交易中的订单进行自动的分类(实际应用中还可根据需要选择或采用合适的聚类算法)，并且可以根据订单的实时内容分析得到新的分类；在对待分析订单进行处理时，可以通过对待分析的订单进行转码，然后判断转码后的订单是否与某个分类簇中订单内容的特征字符 串相同，从而进一步提高了订单分类的效率；通过将订单导入hdfs这种分布式文件系统，可以利用分布式系统的特点，进一步提高订单分类的效率；因为只有相似的订单才会被聚类到一个分类簇中，所以通过分析某个分类簇中的一个代表订单内容，就可以得到该整个分类簇是否为恶意信息的分类簇，从而简化了对每个订单进行比较判断的工作流程。
如图4所示为本申请实施例一种基于订单聚类的反恶意信息装置的结构示意图，在本实施例中的装置可以设置于电子交易系统的服务器中，或者单独设置一台高性能的服务器来实现本实施例的装置，本实施例装置的各个功能单元、模块可以通过专用的CPU或者单片机或者FPGA来实现，或者通过通用处理器执行各功能模块的控制逻辑来实现。在本实施例装置中的功能模块执行例如meanshift等聚类运算，将订单进行有效的分类，并可以根据订单的内容得到新建立的分类簇，开发者不需要预先设定分类簇的个数，这样可以提高订单聚类反恶意信息的自识别程度，提高分类的准确性，并且减少人工参与程度，提高工作效率。
本图实施例具体包括生成单元401，用于根据订单信息生成订单唯一标识符和订单内容。
向量转换单元402，用于将所述订单内容转换为订单向量。
聚类运算单元403，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
处理单元404，用于分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
根据本申请的一个实施例，还包括转换单元405，连接于所述生成单元和所述聚类运算单元之间，用于将所述分类簇中的订单内容映射为特征字符串，当待分析订单的订单内容的映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
根据本申请的一个实施例，所述转换单元还用于当所述分类簇已经被标定为垃圾类，则可以直接将待分析订单交给处理单元做自动化的恶意信息处理(比如冻结交易，封禁帐号等)。
通过上述本申请实施例的装置，可以通过例如meanshift等聚类算法对电子交易中的订单进行自动的分类(实际应用中还可根据需要选择或采用合适的聚类算法)，并且可以根据订单的实时内容分析得到新的分类；在对待分析订单进行处理时，可以通过对待分析的订单进行转码，然后判断转码后的订单是否与某个分类簇中订单内容的特征字符串相同，从而进一步提高了订单分类的效率；通过将订单导入hdfs这种分布式文件系统， 可以利用分布式系统的特点，进一步提高订单分类的效率；因为只有相似的订单才会被聚类到一个分类簇中，所以通过分析某个分类簇中的一个代表订单内容，就可以得到该整个分类簇是否为恶意信息的分类簇，从而简化了对每个订单进行比较判断的工作流程。
如图5所示为本申请实施例一种电子交易中基于订单聚类的反恶意信息方法的具体流程图，在本实施例中将整个方法都基于Hadoop分布式文件系统中进行，从而可以提高整体的工作效率，在聚类过程中以meanshift聚类方法为例进行说明，以收款业务作为说明，在该收款业务发起的订单中，包括了用户ID、订单ID、业务类型、被收款人ID、日期、金额等信息，在该订单中还包括有备注信息，在备注信息中具有钓鱼网站的URL(统一资源定位符)，恶意用户向很多用户发送了该推广传播信息。
具体包括步骤501，将从数据库中获取的订单导入分布式文件系统(hdfs)。
步骤502，将订单中的用户ID、订单ID和业务类型相结合作为该订单的唯一标识符。
在本步骤中的相结合可以包括，将用户ID、订单ID和业务类型拼接起来构成订单唯一标识符，或者可以取用户ID的最后两位、订单ID的最后两位和业务类型相拼接构成订单唯一标识符，还可以采用其它方式生成唯一标识符来唯一的标识该订单，例如仅通过订单ID来唯一标识该订单。
步骤503，将订单中的备注信息作为该订单的内容。
在本实施例中，订单的备注信息是描述该订单内容的部分，例如在该备注信息中包括钓鱼网站的URL地址。在其它实施例中，如果订单中还包括消费记录标题等内容，也可以将这部分内容作为订单内容，其中，所述消费记录标题可能包括该订单中商品的描述，对于收款应用来说，可能包括业务名称、被收款人、金额等信息。
此时，每个订单的唯一标识符相应于该订单的订单内容。
步骤504，将所述订单唯一标识符和订单内容转换成sequencefile格式。
在本步骤中转换的sequencefile格式是针对上述hdfs分布式文件系统所用的数据格式，转换成这样的格式后，才可以应用hdfs系统处理的处理方法，从而达到提高处理效率的目的。
步骤505，将上述订单内容转换为tf-idf向量。
转换完成的tf-idf向量与订单唯一标识符形成映射关系<key，vector>，其中key为上述订单唯一标识符，vector为上述订单内容形成的向量，也就是订单内容的数学表达形式。
步骤506，针对所述向量进行meanshift聚类运算，得到该订单所属分类簇的结果。
在本步骤中，将订单内容与分类簇进行迭代比较，最终输出该订单内容属于哪个分类簇或者属于一个新建立的分类簇，由于有与向量一一映射关系的key(即订单唯一标识符)，因此可以对应到具体哪个订单属于哪个分类簇，其中meanshift聚类运算中的迭代参数、收敛参数等都可以根据实际情况由开发人员设置，输出的结果为sequencefile格式。
至此，基于meanshift聚类运算的订单分类方法结束。
步骤507，将所述订单的分类簇结果转换为文本格式。
由于前述步骤中订单的分类簇结果为sequencefile格式，不利于后继判断、处理该分类簇结果，因此需要将该订单的分类簇结果转换为文本格式。
步骤508，判断所述分类簇中的订单内容是否为恶意信息，如果为恶意信息则进入步骤509，否则进入步骤510。
具体判断订单内容是否为恶意信息可以采用现有技术中的方式，例如关键字或者人工方式判断，一个分类簇中可能有很多订单，判断时可以只选择其中一个订单进行判断。
作为另一个实施例，由于推广传播信息的传播量很大，特别是恶意信息的推广传播信息数量可能更大，因此聚类运算结束后，每个分类簇中都具有很多的订单，将包含订单最多的几个分类簇筛选出来(例如将排名前十的分类簇筛选出来)，提供给监控者进行监控，可以起到很好的监控效果，可以通过判断这些排名前十的分类簇中的订单内容就可以判断出哪些分类簇更可能是恶意信息的分类。
步骤509，标记发起该订单的用户，给监控者以提示。
除了本步骤的处理方法，还具有多种的恶意信息的处理方法，例如冻结交易，封禁帐号等在此不再赘述。
步骤510，如果不是恶意信息，则不作处理。
通过上述实施例，可以通过meanshift聚类运算对电子交易系统中的订单进行分类处理，并且可以自动生成新的分类，从而减少人工参与，并且可以实时的适应于不断变化的恶意信息的分类。
如图6所示为本申请实施例对订单进行聚类处理后快速分类的方法流程图，该方法基于前述图5的实施例，每个分类簇中都具有很多的订单，系统接收到新的待分析的订单进行处理。
该图6包括步骤601，提取每个分类簇中的订单内容。
在本步骤中的提取是指随机提取，由于每个分类簇中的订单内容都应该是相似的， 因此提取哪个订单内容都可以作为该分类簇的特征。
步骤602，将提取的订单内容进行MD5转码运算，得到特征字符串。
在本步骤中可以得到每个分类簇的特征字符串，作为可选的实施例，MD5转码运算只是转码运算的其中一种，还可以采用现有技术中的其它转码方法，或者可以根据需要由开发者自行设计一种转码方式，在此不作限定。
步骤603，获取待分析订单。
本步骤可以从例如上述图5所示实施例中的步骤503中获取，由于上述图5所示实施例通常都是进行事后分析订单所用，而图6所示实施例可以在图5实施例的基础之上进行，即，使用上述方法建立起多个分类簇之后，对新的订单进行分析，实时性更高，并且省却了相对比较复杂的聚类运算等步骤。
或者，本步骤还可以直接获取要转发的推广传播信息(即订单)，实时的对订单进行比对分析，以确定该订单所属分类簇。
步骤604，将待分析订单的订单内容进行MD5转码运算，得到映射字符串。
步骤605，将所述特征字符串和映射字符串进行比较，如果一致则进入步骤606，否则而进入步骤607。
步骤606，将所述待分析订单直接纳入特征字符串所在的分类簇。
然后可以回归步骤508继续处理分类簇，如果为恶意信息，则可以停止转发该推广传播信息。
作为可选的步骤，当待分析订单的映射字符串与某个已经标定位垃圾类的分类簇的特征字符串相同，可以直接进入步骤509，不进行步骤606，将待分析订单做自动化的惩罚处理，例如冻结交易，封禁帐号等。
步骤607，回到步骤504继续进行聚类处理。
通过上述本申请实施例中的方法和装置，可以通过例如meanshift等聚类算法对电子交易中的订单进行自动的分类，并且可以根据订单的实时内容分析得到新的分类；在对待分析订单进行处理时，可以通过对待分析的订单进行转码，然后判断转码后的订单是否与某个分类簇中订单内容的特征字符串相同，从而进一步提高了订单分类的效率；通过将订单导入hdfs这种分布式文件系统，可以利用分布式系统的特点，进一步提高订单分类的效率。
对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术 的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片2。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog2。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。
本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现， 或者由具有某种功能的产品来实现。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本申请可用于众多通用或专用的计算机系统环境或配置中。例如：个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器系统、基于微处理器的系统、置顶盒、可编程的消费电子设备、网络PC、小型计算机、大型计算机、包括以上任何系统或设备的分布式计算环境等等。
本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
虽然通过实施例描绘了本申请，本领域普通技术人员知道，本申请有许多变形和变化而不脱离本申请的精神，希望所附的权利要求包括这些变形和变化而不脱离本申请的精神。

Claims (12)

  1. 一种电子交易中订单聚类的方法，其特征在于，包括，
    根据订单信息生成订单唯一标识符和订单内容；
    将所述订单内容转换为订单向量；
    根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
  2. 根据权利要求1所述方法，其特征在于，将所述分类簇中的订单内容映射为特征字符串，当待分析订单的订单内容映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
  3. 根据权利要求1所述方法，其特征在于，所述根据订单信息生成订单唯一标识符和订单内容进一步包括，根据订单信息中的用户ID、订单ID和业务类型生成所述订单唯一标识符，根据订单信息中的订单标题或者订单备注生成所述订单内容。
  4. 一种基于订单聚类的反恶意信息方法，其特征在于包括，
    根据订单信息生成订单唯一标识符和订单内容；
    将所述订单内容转换为订单向量；
    根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果；
    分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
  5. 根据权利要求4所述方法，其特征在于，将所述分类簇中的订单内容映射为特征字符串，当待分析订单的订单内容映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
  6. 根据权利要求5所述方法，其特征在于，当待分析订单的订单内容映射字符串与所述特征字符串相同后进一步包括，当所述分类簇已经被标定为垃圾类，直接将待分析订单做恶意信息处理。
  7. 一种电子交易中订单聚类装置，其特征在于包括，
    生成单元，用于根据订单信息生成订单唯一标识符和订单内容；
    向量转换单元，用于将所述订单内容转换为订单向量；
    聚类运算单元，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果。
  8. 根据权利要求7所述的装置，其特征在于还包括转换单元，连接于所述生成单元和所述聚类运算单元之间，用于将所述分类簇中的订单内容映射为特征字符串，当待 分析订单的订单内容映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
  9. 根据权利要求7所述的装置，其特征在于，所述生成单元进一步用于，根据订单信息中的用户ID、订单ID和业务类型生成所述订单唯一标识符，根据订单信息中的订单标题或者订单备注生成所述订单内容。
  10. 一种基于订单聚类的反恶意信息装置，其特征在于包括，
    生成单元，用于根据订单信息生成订单唯一标识符和订单内容；
    向量转换单元，用于将所述订单内容转换为订单向量；
    聚类运算单元，用于根据所述订单唯一标识符和订单向量做聚类运算，得到该订单所属分类簇的结果；
    处理单元，用于分析所有分类簇中的代表订单内容，若所述代表订单内容为恶意信息，则对该分类簇中所有的订单进行相应处理。
  11. 根据权利要求10所述的装置，其特征在于还包括转换单元，连接于所述生成单元和所述聚类运算单元之间，用于将所述分类簇中的订单内容映射为特征字符串，当待分析订单的订单内容映射字符串与所述特征字符串相同时，直接将所述待分析订单纳入该分类簇。
  12. 根据权利要求11所述的装置，其特征在于所述转换单元还用于当所述分类簇已经被标定为垃圾类，则直接将待分析订单发送给处理单元进行恶意信息处理。
PCT/CN2016/105137 2015-11-18 2016-11-09 一种订单聚类方法及装置，以及反恶意信息的方法及装置 Ceased WO2017084521A1 (zh)

Priority Applications (9)

Application Number Priority Date Filing Date Title
KR1020187017252A KR102151328B1 (ko) 2015-11-18 2016-11-09 오더 클러스터링 및 악의적인 정보 퇴치 방법 및 장치
JP2018526215A JP6594543B2 (ja) 2015-11-18 2016-11-09 注文クラスタリング方法及び装置並びに悪意の情報に対抗する方法及び装置
AU2016355767A AU2016355767A1 (en) 2015-11-18 2016-11-09 Order clustering method and device, and malicious information rejecting method and device
SG11201804174TA SG11201804174TA (en) 2015-11-18 2016-11-09 Order clustering and malicious information combating method and apparatus
PH1/2018/501058A PH12018501058B1 (en) 2015-11-18 2016-11-09 Order clustering and malicious information combating method and apparatus
EP16865698.1A EP3379427A4 (en) 2015-11-18 2016-11-09 Order clustering method and device, and malicious information rejecting method and device
MYPI2018701895A MY186818A (en) 2015-11-18 2016-11-09 Order clustering and malicious information combating method and apparatus
US15/980,171 US11200615B2 (en) 2015-11-18 2018-05-15 Order clustering and malicious information combating method and apparatus
US16/721,824 US11100567B2 (en) 2015-11-18 2019-12-19 Order clustering and malicious information combating method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510795161.9A CN106709777A (zh) 2015-11-18 2015-11-18 一种订单聚类方法及装置，以及反恶意信息的方法及装置
CN201510795161.9 2015-11-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/980,171 Continuation US11200615B2 (en) 2015-11-18 2018-05-15 Order clustering and malicious information combating method and apparatus

Publications (1)

Publication Number Publication Date
WO2017084521A1 true WO2017084521A1 (zh) 2017-05-26

Family

ID=58717371

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105137 Ceased WO2017084521A1 (zh) 2015-11-18 2016-11-09 一种订单聚类方法及装置，以及反恶意信息的方法及装置

Country Status (10)

Country Link
US (2) US11200615B2 (zh)
EP (1) EP3379427A4 (zh)
JP (1) JP6594543B2 (zh)
KR (1) KR102151328B1 (zh)
CN (1) CN106709777A (zh)
AU (1) AU2016355767A1 (zh)
MY (1) MY186818A (zh)
PH (1) PH12018501058B1 (zh)
SG (1) SG11201804174TA (zh)
WO (1) WO2017084521A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107562853A (zh) * 2017-08-28 2018-01-09 武汉烽火普天信息技术有限公司 一种面向海量互联网文本数据的流式聚类及展现的方法
CN111126629A (zh) * 2019-12-25 2020-05-08 上海携程国际旅行社有限公司 模型的生成方法、刷单行为识别方法、系统、设备和介质
CN115641177A (zh) * 2022-10-20 2023-01-24 北京力尊信通科技股份有限公司 一种基于机器学习的防秒杀预判系统

Families Citing this family (41)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106709777A (zh) 2015-11-18 2017-05-24 阿里巴巴集团控股有限公司 一种订单聚类方法及装置，以及反恶意信息的方法及装置
RU2649793C2 (ru) 2016-08-03 2018-04-04 ООО "Группа АйБи" Способ и система выявления удаленного подключения при работе на страницах веб-ресурса
RU2671991C2 (ru) 2016-12-29 2018-11-08 Общество с ограниченной ответственностью "Траст" Система и способ сбора информации для обнаружения фишинга
RU2637477C1 (ru) * 2016-12-29 2017-12-04 Общество с ограниченной ответственностью "Траст" Система и способ обнаружения фишинговых веб-страниц
RU2689816C2 (ru) 2017-11-21 2019-05-29 ООО "Группа АйБи" Способ для классифицирования последовательности действий пользователя (варианты)
RU2676247C1 (ru) 2018-01-17 2018-12-26 Общество С Ограниченной Ответственностью "Группа Айби" Способ и компьютерное устройство для кластеризации веб-ресурсов
RU2677361C1 (ru) 2018-01-17 2019-01-16 Общество с ограниченной ответственностью "Траст" Способ и система децентрализованной идентификации вредоносных программ
RU2677368C1 (ru) 2018-01-17 2019-01-16 Общество С Ограниченной Ответственностью "Группа Айби" Способ и система для автоматического определения нечетких дубликатов видеоконтента
RU2668710C1 (ru) 2018-01-17 2018-10-02 Общество с ограниченной ответственностью "Группа АйБи ТДС" Вычислительное устройство и способ для обнаружения вредоносных доменных имен в сетевом трафике
RU2680736C1 (ru) 2018-01-17 2019-02-26 Общество с ограниченной ответственностью "Группа АйБи ТДС" Сервер и способ для определения вредоносных файлов в сетевом трафике
RU2681699C1 (ru) 2018-02-13 2019-03-12 Общество с ограниченной ответственностью "Траст" Способ и сервер для поиска связанных сетевых ресурсов
CN109189928B (zh) * 2018-08-30 2022-05-17 天津做票君机器人科技有限公司 一种汇票交易机器人的授信信息识别方法
CN109271483B (zh) * 2018-09-06 2022-03-15 中山大学 基于递进式多判别器的问题生成方法
CN110955890B (zh) * 2018-09-26 2021-08-17 瑞数信息技术（上海）有限公司 恶意批量访问行为的检测方法、装置和计算机存储介质
RU2708508C1 (ru) 2018-12-17 2019-12-09 Общество с ограниченной ответственностью "Траст" Способ и вычислительное устройство для выявления подозрительных пользователей в системах обмена сообщениями
RU2701040C1 (ru) 2018-12-28 2019-09-24 Общество с ограниченной ответственностью "Траст" Способ и вычислительное устройство для информирования о вредоносных веб-ресурсах
EP3842968B1 (en) 2019-02-27 2024-04-24 "Group IB" Ltd. Method and system for identifying a user according to keystroke dynamics
EP3842966B8 (en) 2019-04-10 2026-03-04 Group-Ib Global Private Limited Identifying a user from the sequence of windows opened on a user interface
CN111768258B (zh) * 2019-06-05 2024-09-24 北京京东尚科信息技术有限公司 识别异常订单的方法、装置、电子设备和介质
CN110347888B (zh) * 2019-07-16 2022-02-15 中国联合网络通信集团有限公司 订单数据的处理方法、装置及存储介质
CN110532394B (zh) * 2019-09-11 2023-04-07 携程计算机技术（上海）有限公司 订单备注文本的处理方法及系统
CN111147441A (zh) * 2019-11-12 2020-05-12 恒大智慧科技有限公司 网络购票的舞弊行为自动检测方法、设备及可读存储介质
RU2728498C1 (ru) 2019-12-05 2020-07-29 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система определения принадлежности программного обеспечения по его исходному коду
RU2728497C1 (ru) 2019-12-05 2020-07-29 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система определения принадлежности программного обеспечения по его машинному коду
RU2743974C1 (ru) 2019-12-19 2021-03-01 Общество с ограниченной ответственностью "Группа АйБи ТДС" Система и способ сканирования защищенности элементов сетевой архитектуры
RU2722693C1 (ru) 2020-01-27 2020-06-03 Общество с ограниченной ответственностью «Группа АйБи ТДС» Способ и система выявления инфраструктуры вредоносной программы или киберзлоумышленника
RU2722692C1 (ru) 2020-02-21 2020-06-03 Общество с ограниченной ответственностью «Группа АйБи ТДС» Способ и система выявления вредоносных файлов в неизолированной среде
SG10202001963TA (en) 2020-03-04 2021-10-28 Group Ib Global Private Ltd System and method for brand protection based on the search results
RU2738344C1 (ru) 2020-03-10 2020-12-11 Общество с ограниченной ответственностью «Группа АйБи ТДС» Способ и система поиска схожих вредоносных программ по результатам их динамического анализа
US11475090B2 (en) 2020-07-15 2022-10-18 Group-Ib Global Private Limited Method and system for identifying clusters of affiliated web resources
CN113763077B (zh) * 2020-07-24 2024-07-19 北京沃东天骏信息技术有限公司 用于检测虚假交易订单的方法和装置
RU2743619C1 (ru) 2020-08-06 2021-02-20 Общество с ограниченной ответственностью "Группа АйБи ТДС" Способ и система генерации списка индикаторов компрометации
CN113240480A (zh) * 2021-01-25 2021-08-10 天津五八到家货运服务有限公司 订单处理方法、装置、电子终端及存储介质
US11947572B2 (en) 2021-03-29 2024-04-02 Group IB TDS, Ltd Method and system for clustering executable files
CN113781156B (zh) * 2021-05-13 2024-08-20 北京沃东天骏信息技术有限公司 恶意订单的识别方法、模型的训练方法、设备及存储介质
NL2030861B1 (en) 2021-06-01 2023-03-14 Trust Ltd System and method for external monitoring a cyberattack surface
RU2769075C1 (ru) 2021-06-10 2022-03-28 Общество с ограниченной ответственностью "Группа АйБи ТДС" Система и способ активного обнаружения вредоносных сетевых ресурсов
CN113724037A (zh) * 2021-08-02 2021-11-30 深圳依时货拉拉科技有限公司 非正常订单处理方法、装置、存储介质和计算机设备
NL2031253B1 (en) * 2021-08-19 2023-03-24 Group Ib Tds Ltd Computing device and method of detecting compromised network devices based on dns tunneling detection
CN114220111B (zh) * 2021-12-22 2022-09-16 深圳市伊登软件有限公司 基于云平台的图文批量识别方法及系统
CN116955613B (zh) * 2023-06-12 2024-02-27 广州数说故事信息科技有限公司 一种基于研报数据和大语言模型生成产品概念的方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101860822A (zh) * 2010-06-11 2010-10-13 中兴通讯股份有限公司 垃圾短信监控方法和系统
US8291024B1 (en) * 2008-07-31 2012-10-16 Trend Micro Incorporated Statistical spamming behavior analysis on mail clusters
CN103279868A (zh) * 2013-05-22 2013-09-04 兰亭集势有限公司 一种自动识别欺诈订单的方法和装置
CN104182539A (zh) * 2014-09-02 2014-12-03 五八同城信息技术有限公司 异常信息批量处理的方法及系统

Family Cites Families (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6094643A (en) * 1996-06-14 2000-07-25 Card Alert Services, Inc. System for detecting counterfeit financial card fraud
US7376618B1 (en) * 2000-06-30 2008-05-20 Fair Isaac Corporation Detecting and measuring risk with predictive models using content mining
US7242999B2 (en) * 2001-05-11 2007-07-10 Kenneth Kuk-Kei Wang Method and apparatus for identifying virtual body profiles
JP4744737B2 (ja) * 2001-07-23 2011-08-10 株式会社ブロードリーフ 電子メールによる発注方法
US7725544B2 (en) * 2003-01-24 2010-05-25 Aol Inc. Group based spam classification
CN1798204A (zh) * 2004-12-24 2006-07-05 华为技术有限公司 一种支付系统及其实现方法
US20070027932A1 (en) * 2005-07-29 2007-02-01 Q2 Labs, Llc System and method of creating a single source rss document from multiple content sources
JP4769983B2 (ja) * 2007-05-17 2011-09-07 独立行政法人産業技術総合研究所 異常検出装置および異常検出方法
JP5040718B2 (ja) * 2008-02-21 2012-10-03 日本電気株式会社 スパム・イベント検出装置及び方法並びにプログラム
US8170966B1 (en) * 2008-11-04 2012-05-01 Bitdefender IPR Management Ltd. Dynamic streaming message clustering for rapid spam-wave detection
KR101048159B1 (ko) * 2009-02-27 2011-07-08 (주)다우기술 봇넷 탐지 및 차단 시스템 및 방법
US10394754B2 (en) * 2010-03-08 2019-08-27 International Business Machines Corporation Indexing multiple types of data to facilitate rapid re-indexing of one or more types of data
US9116995B2 (en) * 2011-03-30 2015-08-25 Vcvc Iii Llc Cluster-based identification of news stories
US8955133B2 (en) * 2011-06-09 2015-02-10 Microsoft Corporation Applying antimalware logic without revealing the antimalware logic to adversaries
JP5740228B2 (ja) * 2011-07-01 2015-06-24 Kddi株式会社 代表的なコメント抽出方法およびプログラム
US20130232045A1 (en) * 2012-03-04 2013-09-05 Oracle International Corporation Automatic Detection Of Fraud And Error Using A Vector-Cluster Model
US8935783B2 (en) * 2013-03-08 2015-01-13 Bitdefender IPR Management Ltd. Document classification using multiscale text fingerprints
US8788405B1 (en) * 2013-03-15 2014-07-22 Palantir Technologies, Inc. Generating data clusters with customizable analysis strategies
US20150095247A1 (en) * 2013-10-02 2015-04-02 Eventbrite, Inc. Classifying Fraud on Event Management Systems
US10078861B1 (en) * 2013-10-15 2018-09-18 Dd Ip Holder Llc Methods and apparatus for a centralized customer order processing system with automatic detection of customer arrival
CN103632250A (zh) * 2013-12-06 2014-03-12 湖南御家汇化妆品有限公司 一种销售订单快速排序分组筛选方法
US10038703B2 (en) * 2014-07-18 2018-07-31 The Regents Of The University Of Michigan Rating network security posture and comparing network maliciousness
US20160188733A1 (en) * 2014-12-29 2016-06-30 Quixey, Inc. Generating Recommendations Based on Clustered Application States
US9979748B2 (en) * 2015-05-27 2018-05-22 Cisco Technology, Inc. Domain classification and routing using lexical and semantic processing
US20180268015A1 (en) * 2015-09-02 2018-09-20 Sasha Sugaberry Method and apparatus for locating errors in documents via database queries, similarity-based information retrieval and modeling the errors for error resolution
CN106709777A (zh) 2015-11-18 2017-05-24 阿里巴巴集团控股有限公司 一种订单聚类方法及装置，以及反恶意信息的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8291024B1 (en) * 2008-07-31 2012-10-16 Trend Micro Incorporated Statistical spamming behavior analysis on mail clusters
CN101860822A (zh) * 2010-06-11 2010-10-13 中兴通讯股份有限公司 垃圾短信监控方法和系统
CN103279868A (zh) * 2013-05-22 2013-09-04 兰亭集势有限公司 一种自动识别欺诈订单的方法和装置
CN104182539A (zh) * 2014-09-02 2014-12-03 五八同城信息技术有限公司 异常信息批量处理的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3379427A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107562853A (zh) * 2017-08-28 2018-01-09 武汉烽火普天信息技术有限公司 一种面向海量互联网文本数据的流式聚类及展现的方法
CN107562853B (zh) * 2017-08-28 2021-02-23 武汉烽火普天信息技术有限公司 一种面向海量互联网文本数据的流式聚类及展现的方法
CN111126629A (zh) * 2019-12-25 2020-05-08 上海携程国际旅行社有限公司 模型的生成方法、刷单行为识别方法、系统、设备和介质
CN111126629B (zh) * 2019-12-25 2023-09-19 上海携程国际旅行社有限公司 模型的生成方法、刷单行为识别方法、系统、设备和介质
CN115641177A (zh) * 2022-10-20 2023-01-24 北京力尊信通科技股份有限公司 一种基于机器学习的防秒杀预判系统

Also Published As

Publication number Publication date
EP3379427A4 (en) 2018-11-07
US20180268464A1 (en) 2018-09-20
KR20180085756A (ko) 2018-07-27
JP6594543B2 (ja) 2019-10-23
CN106709777A (zh) 2017-05-24
JP2019504380A (ja) 2019-02-14
SG11201804174TA (en) 2018-06-28
PH12018501058B1 (en) 2023-03-10
KR102151328B1 (ko) 2020-09-03
EP3379427A1 (en) 2018-09-26
MY186818A (en) 2021-08-23
AU2016355767A1 (en) 2018-07-05
US11200615B2 (en) 2021-12-14
PH12018501058A1 (en) 2019-01-28
US11100567B2 (en) 2021-08-24
US20200134702A1 (en) 2020-04-30

Similar Documents

Publication Publication Date Title
WO2017084521A1 (zh) 一种订单聚类方法及装置，以及反恶意信息的方法及装置
CN107436875B (zh) 文本分类方法及装置
CN104598631B (zh) 分布式数据处理平台
WO2020037917A1 (zh) 一种用户行为数据推荐方法、服务器及计算机可读介质
CN107704601A (zh) 大数据检索方法与系统、计算机存储介质及电子设备
WO2019001429A1 (zh) 一种多源数据融合方法和装置
WO2016069065A1 (en) Similarity search and malware prioritization
CN104615715A (zh) 基于地理位置的社交网络事件分析方法及系统
CN108334513A (zh) 一种识别相似文本的处理方法、装置及系统
CN110175281A (zh) 一种用户数据处理、交互方法、装置及系统
CN107368500B (zh) 数据抽取方法及系统
CN115033688A (zh) 识别告警事件类型的方法、装置、设备及存储介质
CN115169468A (zh) 数据处理方法、装置、电子设备及计算机可读存储介质
CN120296754A (zh) 使用人工智能的多模态数据丢失保护
CN107844867A (zh) 数据处理方法、装置及设备
US10262061B2 (en) Hierarchical data classification using frequency analysis
CN111061763A (zh) 用于生成规则引擎的规则执行计划的方法及装置
US20130230248A1 (en) Ensuring validity of the bookmark reference in a collaborative bookmarking system
CN112148979B (zh) 事件关联用户的识别方法、装置、电子设备和存储介质
CN116127106A (zh) 基于区块链的互联网图像大数据智能存储方法与系统
US10296990B2 (en) Verifying compliance of a land parcel to an approved usage
Li et al. The Application of Association Analysis in Mobile Phone Forensics System
US20250328548A1 (en) Inline Nested Data Loss Protection (DLP)
CN105160014A (zh) 数据处理方法及装置
US12443792B2 (en) Reference driven NLP-based topic categorization

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16865698

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201804174T

Country of ref document: SG

Ref document number: 12018501058

Country of ref document: PH

WWE Wipo information: entry into national phase

Ref document number: 2018526215

Country of ref document: JP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20187017252

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020187017252

Country of ref document: KR

Ref document number: 2016865698

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2016355767

Country of ref document: AU

Date of ref document: 20161109

Kind code of ref document: A