Granted Patent B2

US 12,615,414 · App. 18/694,844 · Granted Apr 28, 2026

Inventor: Yuanyuan Sun (Shanghai, CN)

Assignee: SHANGHAI BILIBILI TECHNOLOGY CO., LTD.

H04N21/44213H04N21/2187

Abstract

Claims (91)

1 . A method of detecting and controlling abnormal online content access, the method implemented by a computing device and the method comprising:

obtaining, by the computing device, user attribution information of a target object in a predetermined duration of time from network-based user activity data, wherein the user activity data includes machine-generated telemetry comprising freezing reports generated by client devices during content access;

storing the user attribution information in a memory accessible to the computing device;

processing the user attribution information by the computing device to determine attribution types;

determining a distribution of users accessing the target object in the predetermined duration of time based on the attribution types and the user attribution information;

determining a distribution of users with freezing reporting about the target object in the predetermined duration of time based on the attribution types and the user attribution information;

calculating, by the computing device, a distribution of freezing rates in the predetermined duration of time based on the distribution of users accessing the target object and the distribution of users with freezing reporting about the target object;

determining, by the computing device based on the distribution of freezing rates, whether abnormal access indicative of fraudulent activity exists; and

in response to determining that the abnormal access indicative of fraudulent activity exists, automatically initiating a system-level action to manage abnormal access conditions.

2 . The method according to claim 1 , further comprising:

determining time periods in the predetermined duration of time;

determining a quantity of users accessing the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining a quantity of users with freezing reporting about the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining the distribution of users accessing the target object in the predetermined duration of time based on the quantity of users accessing the target object in each of the attribution types during each of the time periods; and

determining the distribution of users with freezing reporting about the target object in the predetermined duration of time based on the quantity of users with freezing reporting in each of the attribution types during each of the time periods.

3 . The method according to claim 2 , wherein the calculating a distribution of freezing rates in the predetermined duration of time based on the distribution of users accessing the target object and the distribution of users with freezing reporting about the target object comprises:

calculating a freezing rate corresponding to each of the attribution types in each of the time periods based on the quantity of users accessing the target object and the quantity of users with freezing reporting in each of the attribution types during each of the time periods; and

calculating the distribution of freezing rates in the predetermined duration of time based on the freezing rate corresponding to each of the attribution types in each of the time periods.

4 . The method according to claim 3 , wherein the determining a detection result of the target object based on the distribution of freezing rates comprises:

calculating an average value of freezing rates and a standard deviation of freezing rates that correspond to each of the attribution types based on the freezing rate corresponding to each of the attribution types in each of the time periods;

selecting abnormal freezing rates from the freezing rates corresponding to each of the attribution types in the predetermined duration of time based on the average value of the freezing rates and the standard deviation of the freezing rates that correspond to each of the attribution types; and

determining the detection result of accessing the target object based on a total quantity of the freezing rates corresponding to each of the attribution types and a quantity of the abnormal freezing rates corresponding to each of the attribution types.

5 . The method according to claim 4 , wherein the selecting abnormal freezing rates from the freezing rates corresponding to each of the attribution types in the predetermined duration of time based on the average value of the freezing rates and the standard deviation of the freezing rates that correspond to each of the attribution types comprises:

calculating an abnormality detection interval corresponding to each of the attribution types based on the average value of the freezing rates and the standard deviation of the freezing rates that correspond to each of the attribution types; and

selecting, from the freezing rates corresponding to each of the attribution types in the predetermined duration of time, freezing rates that are not in the abnormality detection interval corresponding to each of the attribution types as the abnormal freezing rates corresponding to each of the attribution types.

6 . The method according to claim 4 , wherein the determining the detection result of accessing the target object based on a total quantity of the freezing rates corresponding to each of the attribution types and a quantity of the abnormal freezing rates corresponding to each of the attribution types comprises:

calculating a ratio of the quantities of the abnormal freezing rates corresponding to each of the attribution types to the total quantity of the freezing rates corresponding to each of the attribution types;

determining whether the ratio corresponding to each of the attribute types is greater than a preset ratio threshold; and

in response to determining that the ratio is greater than the preset ratio threshold, determining that the detection result of the target object comprises abnormal access.

7 . The method according to any one of claim 4 , wherein before the calculating an average value of freezing rates and a standard deviation of freezing rates that correspond to each of the attribution types based on the freezing rate corresponding to each of the attribution types in each of the time periods, the method further comprises:

determining a first freezing rate quantity that is a quantity of the freezing rates corresponding to each of the attribution types in the predetermined duration of time;

determining a second freezing rate quantity based on the first freezing rate quantity and a preset quantity proportion;

ranking the freezing rates corresponding to each of the attribution types in the predetermined duration of time to obtain a ranking result; and

updating the freezing rates corresponding to each of attribution types by removing the second quantity of freezing rates based on the ranking result.

8 . The method according to claim 1 , wherein before obtaining the user attribution information of a target object in a predetermined duration of time, the method further comprises:

receiving user information of users associated with the target object; and

determining the user attribution information of the target object based on the user information.

9 . The method according to claim 8 , wherein the determining the user attribution information of the target object based on the user information comprises:

parsing the user information to obtain address identifiers; and

querying location information and network information that correspond to the address identifiers and identifying the location information and the network information as the user attribution information of the target object, or querying the location information corresponding to the address identifiers and identifying the location information as the user attribution information of the target object.

10 . The method according to claim 8 , wherein the receiving user information of users associated with the target object comprises:

receiving access user information and freezing user information of the users associated with the target object, wherein the access user information comprises information about the users of accessing the target object, and the freezing user information comprises information about the users with freezing reporting about the target object;

determining access user attribution information of the target object based on the access user information, and determining freezing user attribution information of the target object based on the freezing user information; and

identifying the access user attribution information and the freezing user attribution information as the user attribution information.

11 . The method according to claim 10 , wherein before determining the attribution types of the user attribution information, the method further comprises:

determining whether an information quantity of the access user attribution information in the predetermined duration of time is greater than a preset quantity threshold; and

in response to determining that the information quantity of access user attribution information in the predetermined duration of time is greater than the preset quantity threshold, performing operations of determining the attribution types of the user attribution information and determining the distribution of users accessing the target object and the distribution of users with freezing reporting about the target object in the predetermined duration of time based on the attribution types and the user attribution information.

12 . A computing device, comprising a memory, a processor, and computer instructions stored in the memory and executable by the processor, wherein when the computer instructions, when executed by the processor, cause the processor to implement operations comprising:

obtaining user attribution information of a target object in a predetermined duration of time from network-based user activity data, wherein the user activity data includes machine-generated telemetry comprising freezing reports generated by client devices during content access;

processing the user attribution information to determine attribution types;

determining a distribution of users accessing the target object in the predetermined duration of time based on the attribution types and the user attribution information;

determining a distribution of users with freezing reporting about the target object in the predetermined duration of time based on the attribution types and the user attribution information;

calculating a distribution of freezing rates in the predetermined duration of time based on the distribution of users accessing the target object and the distribution of users with freezing reporting about the target object;

determining based on the distribution of freezing rates, whether abnormal access indicative of fraudulent activity exists; and

automatically initiating a system-level action to manage abnormal access conditions in response to determining that the abnormal access indicative of fraudulent activity exists.

13 . The computing device according to claim 12 , the operations further comprising:

determining time periods in the predetermined duration of time;

determining a quantity of users accessing the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining a quantity of users with freezing reporting about the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining the distribution of users accessing the target object in the predetermined duration of time based on the quantity of users accessing the target object in each of the attribution types during each of the time periods; and

determining the distribution of users with freezing reporting about the target object in the predetermined duration of time based on the quantity of users with freezing reporting in each of the attribution types during each of the time periods.

14 . The computing device according to claim 13 , the operations further comprising:

calculating a freezing rate corresponding to each of the attribution types in each of the time periods based on the quantity of users accessing the target object and the quantity of users with freezing reporting in each of the attribution types during each of the time periods; and

calculating the distribution of freezing rates in the predetermined duration of time based on the freezing rate corresponding to each of the attribution types in each of the time periods.

15 . The computing device according to claim 14 , the operations further comprising:

calculating an average value of freezing rates and a standard deviation of freezing rates that correspond to each of the attribution types based on the freezing rate corresponding to each of the attribution types in each of the time periods;

selecting abnormal freezing rates from the freezing rates corresponding to each of the attribution types in the predetermined duration of time based on the average value of the freezing rates and the standard deviation of the freezing rates that correspond to each of the attribution types; and

determining the detection result of accessing the target object based on a total quantity of the freezing rates corresponding to each of the attribution types and a quantity of the abnormal freezing rates corresponding to each of the attribution types.

16 . The computing device according to claim 12 , wherein before obtaining the user attribution information of a target object in a predetermined duration of time, the operations further comprise:

receiving user information of users associated with the target object; and

determining the user attribution information of the target object based on the user information.

17 . The computing device according to claim 16 , wherein the determining the user attribution information of the target object based on the user information comprises:

parsing the user information to obtain address identifiers; and

querying location information and network information that correspond to the address identifiers and identifying the location information and the network information as the user attribution information of the target object, or querying the location information corresponding to the address identifiers and identifying the location information as the user attribution information of the target object.

18 . A non-transitory computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and wherein the computer instructions, when executed by a processor, cause the processor to implement operations comprising:

obtaining user attribution information of a target object in a predetermined duration of time from network-based user activity data, the user activity data including machine-generated telemetry comprising freezing reports generated by client devices during content access;

processing the user attribution information to determine attribution types;

determining a distribution of users accessing the target object in the predetermined duration of time based on the attribution types and the user attribution information;

determining a distribution of users with freezing reporting about the target object in the predetermined duration of time based on the attribution types and the user attribution information;

calculating a distribution of freezing rates in the predetermined duration of time based on the distribution of users accessing the target object and the distribution of users with freezing reporting about the target object; and

determining based on the distribution of freezing rates, whether abnormal access indicative of fraudulent activity exists; and

automatically initiating a system-level action to manage abnormal access conditions in response to determining that the abnormal access indicative of fraudulent activity exists.

19 . The non-transitory computer-readable storage medium according to claim 18 , the operations further comprising:

determining time periods in the predetermined duration of time;

determining a quantity of users accessing the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining a quantity of users with freezing reporting about the target object in each of the attribution types during each of the time periods based on the user attribution information;

determining the distribution of users accessing the target object in the predetermined duration of time based on the quantity of users accessing the target object in each of the attribution types during each of the time periods; and

determining the distribution of users with freezing reporting about the target object in the predetermined duration of time based on the quantity of users with freezing reporting in each of the attribution types during each of the time periods.

20 . The non-transitory computer-readable storage medium according to claim 19 , the operations further comprising:

calculating a freezing rate corresponding to each of the attribution types in each of the time periods based on the quantity of users accessing the target object and the quantity of users with freezing reporting in each of the attribution types during each of the time periods; and

calculating the distribution of freezing rates in the predetermined duration of time based on the freezing rate corresponding to each of the attribution types in each of the time periods.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (56)