Determination of a spammer through social network characterization

1. A method of determining a spammer, comprising:

acquiring, by a processor, short message events associated with a user and dividing them into a plurality of sessions in terms of time, wherein division into a plurality of sessions comprises division into bulk sessions and normal sessions according to a sending behavior of the user, wherein, the bulk session is the duration of a behavior of sending short messages in bulk by the user, and the normal session is the duration of a behavior of sending short messages normally by the user, the division comprising in response to the rate of sending short messages by the user exceeding a preset rate r, marking the start of the bulk session, and in response to the rate of sending short messages by the user being lower than the preset rate r, marking the end of the bulk session, wherein the normal session is a partial period of the adjacent bulk sessions;

building a social network of the user in each of the sessions, and calculating at least one type of social network characteristic in each of the sessions, respectively; and

determining whether the user is a spammer or not according to the social network characteristic by sampling the short message events sent to different receivers by the user to a token bucket;

in response to arrivals of the short message events, supplying the token bucket with an increment T, and then consuming a predetermined number of tokens, wherein the increment T is the product of the time interval between two consecutive pieces of said short message events and the preset rate r;

when the number of available tokens is smaller than 1, determining that the rate of sending short messages by the user exceeds the preset rate r;

when it is determined that the rate of sending short messages is smaller than the preset rate r according to several consecutive pieces of the sampled short message events, determining that the rate of sending short messages by the user is lower than the preset rate r.

2. The method according to claim 1 , further comprising:

sampling the short message events sent to different receivers by the user to a sliding window with a size of m;

when the time interval between the first short message event and the m th short message event of the sliding window is smaller than m/r, determining that the rate of sending short messages by the user exceeds the preset rate r;

when it is determined that the rate of sending short messages is smaller than the preset rate r according to several consecutive pieces of the sampled short message events, determining that the rate of sending short messages by the user is lower than the preset rate r.

3. The method according to claim 1 , wherein the social network characteristics include a coincidence ratio which is the ratio of the number of direct contacts common to a plurality of sessions to the number of direct contacts of the plurality of sessions.

4. The method according to claim 1 , wherein the determining whether the user is a spammer or not according to the social network characteristics comprises:

making a decision on whether the respective sessions involve a spamming behavior or not according to at least one type of the social network characteristics; and

statistically analyzing the decision results for the respective sessions, and determining whether the user is a spammer or not.

5. The method according to claim 1 , wherein the determining whether the user is a spammer or not according to the social network characteristics comprises:

selecting at least one type of the social network characteristics of the plurality of sessions to configure a characteristic sequence of the user;

comparing the characteristic sequence of the user with characteristic sequences of known samples, and determining whether the user is a spammer or not according to the closest known sample, the known samples being users known to be a spammer or not.