Abnormal application data detection method, device, electronic device and storage medium

Abstract

This invention provides an abnormal application data detection method, apparatus, electronic device, and storage medium. The method includes: acquiring application data matching a target user; classifying the acquired application data matching the target user to determine the data type; triggering a first abnormal application data detection process when the data type is tabular; triggering a second abnormal application data detection process when the data type is time-series; and processing the time-series application data through the second abnormal application data detection process to determine abnormal application data in the target user's application data. This enhances the generalization and data processing capabilities of the abnormal application data detection process, adapts to different usage environments, reduces the robustness of the abnormal application data detection process, and improves detection accuracy.

Description

Technical Field

[0001] The present invention relates to user application data detection technology, and in particular to an abnormal application data detection method, device, electronic device and storage medium. Background Art

[0002] The anti-cheating processing in related technologies mainly involves extracting and analyzing the features of the original data through complex feature engineering, and then training the extracted and analyzed features using the traditional Autoregressive Integrated Moving Average Model (ARIMA) or Isolation Forest Algorithm, and detecting abnormal application data based on the trained model. However, this process requires different experts for different industries and different scenarios. It is difficult for a single expert to be proficient in anti-cheating strategies in different scenarios such as aviation, e-commerce, and finance, marketing activities, ticket booking, seat reservation, and transactions. At the same time, the cheating mode will be continuously iterated and updated. The thresholds set earlier can no longer intercept the latest cheating methods and cannot adapt to the changing usage environment.

[0003] When cheating is intercepted through deep learning using a neural network model, some important features may be ignored when the feature dimension is high, resulting in poor prediction results. At the same time, when using a deep learning model for processing, the model training process is complex and time-consuming. If there are too many network layers, the parameters will also increase, which will eventually lead to a larger model and increased prediction time, which cannot meet online latency and TPS requirements. Poor interpretability also cannot meet the usage needs of different users. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide an abnormal application data detection method, device, electronic device and storage medium, which can determine the abnormal application data in the target user application data, so that the generalization ability and data processing ability of the abnormal application data detection process are stronger, adapt to different usage environments, reduce the robustness of the abnormal application data detection process, and improve the detection accuracy.

[0005] The technical solution of the embodiment of the present invention is achieved as follows:

[0006] An embodiment of the present invention provides a method for detecting abnormal application data, including:

[0007] Acquire application data matching the target user;

[0008] Classifying the acquired application data that matches the target user to determine the data type of the application data;

[0009] When the data type of the application data is a table data type, triggering a first abnormal application data detection process;

[0010] Processing the application data of the table data type through the first abnormal application data detection process to determine abnormal application data in the target user application data;

[0011] When the data type of the application data is a time series data type, triggering a second abnormal application data detection process;

[0012] The second abnormal application data detection process processes the application data of the time series data type to determine abnormal application data in the target user application data.

[0013] An embodiment of the present invention further provides a device for detecting abnormal application data, the device comprising:

[0014] An information transmission module, used to obtain application data matching the target user;

[0015] An information processing module, used to classify the acquired application data matching the target user and determine the data type of the application data;

[0016] The information processing module is used to trigger a first abnormal application data detection process when the data type of the application data is a table data type;

[0017] The information processing module is used to process the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the target user application data;

[0018] The information processing module is used to trigger a second abnormal application data detection process when the data type of the application data is a time series data type;

[0019] The information processing module is used to process the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data.

[0020] In the above scheme,

[0021] The information processing module is used to trigger a corresponding application program interface based on the application data usage scenario of the target user, and establish an application data transmission link matching the target user through the application program interface;

[0022] The information processing module is used to obtain application data matching different application processes transmitted by the application program interface through an application data transmission link established by the application program interface;

[0023] The information processing module is used to obtain noise parameters matching the application data usage scenario of the target user based on the application data usage scenario of the target user;

[0024] The information processing module is used to perform noise removal on the application data matched with different application processes transmitted by the acquired application program interface based on the noise parameters, so as to form user application data matched with the target user.

[0025] In the above scheme,

[0026] The information processing module is used to parse the data type identifier carried by the acquired application data matching the target user, wherein the data type identifier includes at least one of the following: a user portrait data identifier and a transaction flow data identifier;

[0027] The information processing module is used to determine the data type of the application data based on the data type identifier.

[0028] In the above scheme,

[0029] The information processing module is used to determine the account profile information of the target user based on the account parameter information transmitted by the application program interface;

[0030] The information processing module is used to determine the IP address profile of the target user based on the user IP address information transmitted by the application program interface;

[0031] The information processing module is used to determine the device portrait information of the target user based on the user operation timestamp information transmitted by the application interface.

[0032] In the above scheme,

[0033] The information processing module is used to perform probability distribution detection on application data of the table data type through the first abnormal application data detection process to determine a probability distribution model of the application data of the table data type;

[0034] The information processing module is used to determine the probability that the application data of the table data type obeys the probability distribution model, and the corresponding anomaly detection threshold;

[0035] The information processing module is used to determine abnormal data points in the application data of the table data type based on the probability that the application data of the table data type obeys the probability distribution model and the corresponding abnormality detection threshold.

[0036] In the above scheme,

[0037] The information processing module is used to trigger an anomaly detection process based on the association structure when the probability distribution model of the application data of the table data type cannot be determined;

[0038] The information processing module is used to predict the tail probability of each data point in the application data of the table data type by using the correlation function between empirical variables through the anomaly detection process based on the association structure;

[0039] The information processing module is used to determine abnormal data points in the application data of the table data type based on the tail probability of each data point in the application data of the table data type.

[0040] In the above scheme,

[0041] The information processing module is used to obtain a data set that matches the anomaly detection process of the association structure;

[0042] The information processing module is used to calculate the empirical cumulative distribution function corresponding to the abnormal detection process of the association structure according to the acquired data set;

[0043] The information processing module is used to determine the correlation function between the empirical variables based on the empirical cumulative distribution function.

[0044] In the above scheme,

[0045] The information processing module is used to perform time series decomposition processing on the application data of the time series data type through the second abnormal application data detection process to form long-term trend parameters, periodic trend parameters and residual parameters;

[0046] The information processing module is used to convert the application data of the time series data type into application data of the table data type based on the long-term trend parameter, the periodic trend parameter and the residual parameter.

[0047] In the above scheme,

[0048] The information processing module is used to perform Fourier transform processing on the application data of the time series data type through the second abnormal application data detection process to determine the amplitude-frequency characteristics of the application data of the time series data type;

[0049] The information processing module is used to determine corresponding periodic trend parameters based on the amplitude-frequency characteristics of the application data of the time series data type.

[0050] In the above scheme,

[0051] The information processing module is used to send the target user identification, the application data matching the target user and the abnormal application data to the blockchain network so that

[0052] The nodes of the blockchain network fill the target user identifier, application data matching the target user, and abnormal application data into a new block, and when a consensus is reached on the new block, the new block is appended to the end of the blockchain.

[0053] In the above scheme,

[0054] The information processing module is used to receive data synchronization requests from other nodes in the blockchain network;

[0055] The information processing module is used to verify the authority of the other nodes in response to the data synchronization request;

[0056] The information processing module is used to control data synchronization between the current node and the other nodes when the authority of the other nodes is verified, so that the other nodes can obtain the target user identification, application data matching the target user, and abnormal application data.

[0057] In the above scheme,

[0058] The information processing module is used to respond to the query request and parse the query request to obtain the corresponding object identifier;

[0059] According to the object identifier, obtaining permission information in a target block in the blockchain network;

[0060] Verifying the matching of the permission information and the object identifier;

[0061] When the permission information matches the object identifier, obtaining a corresponding target user identifier, application data matching the target user, and abnormal application data in the blockchain network;

[0062] In response to the query instruction, the acquired corresponding target user identifier, application data matching the target user, and abnormal application data are pushed to the corresponding client, so that the client can acquire the corresponding target user identifier, application data matching the target user, and abnormal application data stored in the blockchain network.

[0063] An embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0064] A memory for storing executable instructions;

[0065] The processor is used to implement the preceding abnormal application data detection method when running the executable instructions stored in the memory.

[0066] An embodiment of the present invention further provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implements the preceding abnormal application data detection method.

[0067] The embodiments of the present invention have the following beneficial effects:

[0068] The embodiment of the present invention obtains application data matching the target user; classifies the obtained application data matching the target user to determine the data type of the application data; triggers a first abnormal application data detection process when the data type of the application data is a table data type; processes the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the target user application data; triggers a second abnormal application data detection process when the data type of the application data is a time series data type; processes the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data, thereby achieving classification processing of user application data, determining the abnormal application data in the target user application data, making the generalization ability and data processing ability of the abnormal application data detection process stronger, adapting to different usage environments, reducing the robustness of the abnormal application data detection process, and improving detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 is a schematic diagram of the use environment of the abnormal application data detection method provided by an embodiment of the present invention;

[0070] Figure 2 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0071] Figure 3 An optional flowchart of the abnormal application data detection method provided in this application;

[0072] Figure 4 A schematic diagram of the data structure of a first abnormal application data detection process and a second abnormal application data detection process for a user in an embodiment of the present invention;

[0073] Figure 5 is a schematic diagram of the architecture of a target object determination device 100 provided in an embodiment of the present invention;

[0074] Figure 6 It is a schematic diagram of the structure of a blockchain in a blockchain network 200 provided in an embodiment of the present invention;

[0075] Figure 7 It is a functional architecture diagram of the blockchain network 200 provided in an embodiment of the present invention;

[0076] Figure 8 A front-end display schematic diagram of the abnormal application data detection method provided by this application;

[0077] Fig. 9 A schematic diagram of the use process of the abnormal application data detection method provided in this application;

[0078] Fig.10 This is a schematic diagram of the smoothing of the game coin activity index in an embodiment of the present invention;

[0079] Fig.11 is a schematic diagram comparing the residual distribution and the normal distribution of the user's behavior in an embodiment of the present invention;

[0080] Fig.12 A schematic diagram of observed data and dynamic thresholds for game coin redemption activities in an embodiment of the present invention;

[0081] Fig.13 Schematic diagram of the amplitude-frequency characteristics of the Fourier transform of the game coin activity hour request amount in an embodiment of the present invention;

[0082] Fig.14 This is a schematic diagram of the time series decomposition result of the game currency activity hourly request volume in an embodiment of the present invention;

[0083] Fig.15 Schematic diagram of abnormal detection results and defined thresholds for the number of game coin activity hourly requests in an embodiment of the present invention. DETAILED DESCRIPTION

[0084] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present invention. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0085] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0086] Before further describing the embodiments of the present invention in detail, the nouns and terms involved in the embodiments of the present invention are described. The nouns and terms involved in the embodiments of the present invention are subject to the following interpretations.

[0087] 1) In response, it is used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or have a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations executed are executed.

[0088] 2) Based on, used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or have a set delay. Unless otherwise specified, there is no restriction on the order of execution of the multiple operations executed.

[0089] 3) API: The full name is Application Programming Interface, which can be translated into application program interface. It is a set of predefined functions or agreements for connecting different components of a software system. The purpose is to provide application programs and developers with the ability to access a set of routines based on certain software or hardware without having to access the original code or understand the details of the internal working mechanism.

[0090] 4) Mini Program is a program developed based on a front-end language (such as JavaScript) to implement services in a Hyper Text Markup Language (HTML) page. It is downloaded by a client (such as a browser or any client with a built-in browser core) via a network (such as the Internet) and interpreted and executed in the client's browser environment, saving the steps of installation in the client. For example, mini programs for various services such as ticket purchase and ride code can be downloaded and run in a social network client.

[0091] 5) Consensus is a process in the blockchain network used to reach agreement on transactions in a block among multiple nodes involved. The agreed blocks will be appended to the end of the blockchain. The mechanisms for achieving consensus include Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof-of-Stake (DPoS), Proof of Elapsed Time (PoET), etc.

[0092] 6) Transaction, which is equivalent to the computer term "transaction". Transaction includes operations that need to be submitted to the blockchain network for execution, and does not only refer to transactions in a business context. In view of the conventional use of the term "transaction" in blockchain technology, the embodiments of the present invention follow this convention.

[0093] For example, the Deploy transaction is used to install the specified smart contract to the nodes in the blockchain network and prepare it to be called; the Invoke transaction is used to append transaction records to the blockchain by calling the smart contract and perform operations on the blockchain's state database, including update operations (including adding, deleting, and modifying key-value pairs in the state database) and query operations (i.e. querying key-value pairs in the state database).

[0094] 7) Blockchain is an encrypted, chained transaction storage structure formed by blocks.

[0095] For example, the header of each block can include the hash value of all transactions in the block as well as the hash value of all transactions in the previous block, thereby achieving tamper-proof and anti-forgery of transactions in the block based on the hash value; newly generated transactions are filled into the block and after consensus among nodes in the blockchain network, they will be appended to the end of the blockchain to form a chain-like growth.

[0096] 8) Blockchain Network: A collection of nodes that incorporate new blocks into the blockchain through consensus.

[0097] 9) Ledger is a general term for blockchain (also called ledger data) and the status database synchronized with the blockchain.

[0098] Among them, the blockchain records transactions in the form of files in the file system; the state database records transactions in the blockchain in the form of different types of key (Key) value (Value) pairs to support fast queries on transactions in the blockchain.

[0099] 10) Smart Contracts, also known as chain code or application code, are programs deployed in the nodes of the blockchain network. The nodes execute the smart contracts called in the received transactions to update or query the key-value data in the ledger database.

[0100] Figure 1 A schematic diagram of a use scenario of the abnormal application data detection method provided in an embodiment of the present invention, referring to Figure 1The terminal (including terminal 10-1 and terminal 10-2) is provided with a client of software capable of displaying corresponding resource transaction data, such as a client or plug-in for financial activities with virtual resources or physical resources or payment through virtual resources. The user can obtain and display resource transaction data through the corresponding client, and trigger the corresponding fraud identification process during the change of virtual resources. In this process, it is necessary to detect the behavior of the target user through the abnormal application data detection deployed on the server to determine the risk level of the target user through the corresponding prediction results; the terminal is connected to the server 200 through the network 300, and the network 300 can be a wide area network or a local area network, or a combination of the two, and a wireless link is used to realize data transmission.

[0101] As an example, the server 200 is used to deploy an abnormal application data detection device encapsulated in a storage medium to implement the abnormal application data detection method provided by the present invention and the present application, so as to obtain application data matching the target user; classify the obtained application data matching the target user to determine the data type of the application data; when the data type of the application data is a table data type, trigger a first abnormal application data detection process; process the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the application data of the target user; when the data type of the application data is a time series data type, trigger a second abnormal application data detection process; process the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the application data of the target user.

[0102] Of course, the abnormal application data detection device provided by the present invention can be applied to virtual resources or physical resources for financial activities or through physical financial resource payment environments (including but not limited to various types of physical financial resource change environments, electronic payment shopping environments, e-commerce shopping environments that can be used for cheating) or social software for information interaction. In various types of physical financial resources for financial activities or through virtual resource payments, financial information from different data sources is usually processed, and finally the user interface (User Interface, UI) is presented with the corresponding financial information corresponding to the target object selected by the target user. The financial information obtained by the user in the current display interface (such as user risk judgment) can also be called by other applications.

[0103] The structure of the abnormal application data detection device of the embodiment of the present invention is described in detail below. The abnormal application data detection device can be implemented in various forms, such as a dedicated terminal with the abnormal application data detection device processing function, or a server provided with the abnormal application data detection device processing function, such as the preceding Figure 1 Server 200 in. Figure 2 The schematic diagram of the structure of the electronic device provided by the embodiment of the present invention can be understood as follows: Figure 2 Only an exemplary structure of the abnormal application data detection device is shown, not all structures, and can be implemented as needed. Figure 2 Partial or complete structure shown.

[0104] The abnormal application data detection device provided in the embodiment of the present invention includes: at least one processor 201, a memory 202, a user interface 203 and at least one network interface 204. The various components in the abnormal application data detection device are coupled together through a bus system 205. It can be understood that the bus system 205 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Figure 2 Various buses are labeled as bus system 205 .

[0105] The user interface 203 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0106] It is understood that the memory 202 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The memory 202 in the embodiment of the present invention can store data to support the operation of the terminal (such as 10-1). Examples of these data include: any computer program for operating on the terminal (such as 10-1), such as an operating system and an application. Among them, the operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application can include various applications.

[0107] In some embodiments, the abnormal application data detection device provided by the embodiment of the present invention can be implemented in a combination of software and hardware. As an example, the abnormal application data detection device provided by the embodiment of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the abnormal application data detection method provided by the embodiment of the present invention. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic components.

[0108] As an example of an abnormal application data detection device provided in an embodiment of the present invention being implemented by a combination of software and hardware, the abnormal application data detection device provided in an embodiment of the present invention can be directly embodied as a combination of software modules executed by a processor 201, and the software module can be located in a storage medium, and the storage medium is located in a memory 202. The processor 201 reads the executable instructions included in the software module in the memory 202, and combines with necessary hardware (for example, including the processor 201 and other components connected to the bus system 205) to complete the abnormal application data detection method provided in an embodiment of the present invention.

[0109] As an example, the processor 201 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0110] As an example of hardware implementation of the abnormal application data detection device provided in an embodiment of the present invention, the device provided in an embodiment of the present invention can be directly executed by a processor 201 in the form of a hardware decoding processor, for example, one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components to implement the abnormal application data detection method provided in an embodiment of the present invention.

[0111] The memory 202 in the embodiment of the present invention is used to store various types of data to support the operation of the abnormal application data detection device. Examples of such data include: any executable instructions for operating on the abnormal application data detection device, such as executable instructions, and the program for implementing the abnormal application data detection method of the embodiment of the present invention can be included in the executable instructions.

[0112] In other embodiments, the abnormal application data detection device provided by the embodiment of the present invention can be implemented in software. Figure 2 The abnormal application data detection device stored in the memory 202 is shown, which can be software in the form of a program and a plug-in, and includes a series of modules. As an example of a program stored in the memory 202, an abnormal application data detection device can be included, and the abnormal application data detection device includes the following software modules: an information transmission module 2081 and an information processing module 2082. When the software modules in the abnormal application data detection device are read into the RAM by the processor 201 and executed, the abnormal application data detection method provided by the embodiment of the present invention will be implemented, wherein the functions of each software module in the abnormal application data detection device include:

[0113] The information transmission module 2081 is used to obtain application data matching the target user.

[0114] The information processing module 2082 is used to classify the acquired application data that matches the target user and determine the data type of the application data.

[0115] The information processing module 2082 is used to trigger a first abnormal application data detection process when the data type of the application data is a table data type.

[0116] The information processing module 2082 is used to process the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the target user application data.

[0117] The information processing module 2082 is used to trigger a second abnormal application data detection process when the data type of the application data is a time series data type.

[0118] The information processing module 2082 is used to process the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data.

[0119] according to Figure 2 The image detection device shown, in one aspect of the present application, the present application also provides a computer program product or a computer program, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the different embodiments and combinations of embodiments provided in various optional implementations of the above-mentioned abnormal application data detection method.

[0120] Before introducing the abnormal application data detection method provided by the present application, the anti-cheating method in the risk control scenario of the relevant technology is first explained. Among them, the anti-cheating processing in the relevant technology is mainly to extract and analyze the original data through complex feature engineering, and then train the extracted and analyzed features using the traditional autoregressive integrated moving average model (ARIMA) or isolation forest algorithm, and perform abnormal application data detection based on the trained model. However, this process requires different experts for different industries and different scenarios. It is difficult for a single expert to be proficient in anti-cheating strategies in different scenarios such as aviation travel, e-commerce, finance, marketing activities, ticket booking, seat occupation, and transactions. At the same time, the cheating mode will be continuously iterated and updated. The threshold set in the early stage can no longer intercept the latest cheating method and cannot adapt to the changing use environment. For the abnormal detection of table data in the risk control scenario, the Isolation Forest of integrated learning, KMeans based on clustering, Birch, DBSCAN and the autoencoder model based on deep learning, GAN model, etc. can be used. Its defects are that IsolationForest is not suitable for high-dimensional data and cannot make full use of the various characteristic dimensions of the data; it has no numerical sensitivity and cannot adaptively control the direction of data anomalies. It will detect both data with small values ​​and data with large values ​​as abnormal data at the same time, which does not meet the needs of risk control business; the clustering-based method has high time complexity, is difficult to process massive data and high-dimensional data, and is not scalable; the deep learning-based method requires a complicated and time-consuming training and fitting process, and the hierarchical architecture and hyperparameters of the neural network need to be carefully adjusted, and the processing efficiency on low-dimensional data is low. For anomaly detection of time series data, a deep unsupervised clustering algorithm can be used. This method maps data from high-dimensional space to low-dimensional space through an autoencoder, and then uses a clustering algorithm to cluster the mapped low-dimensional vectors, and uses the new data distribution after clustering to reversely update the neural network parameters and cluster centers. However, its defect is that it is only applicable to high-dimensional data scenarios in risk control business, and is not applicable to low-dimensional data scenarios. Moreover, this method requires a relatively tedious fitting training and hyperparameter tuning process. It is not applicable to risk control business scenarios with a small amount of initial data (such as marketing resource activities that have just been launched) and new data in the business, and is not real-time online.

[0121] To solve the above defects, refer to Figure 3 , Figure 3 This is an optional flow chart of the abnormal application data detection method provided by the present application. It can be understood that: Figure 3The steps shown can be performed by various electronic devices running the abnormal application data detection device to complete the training and deployment of the corresponding user first abnormal application data detection process and the second abnormal application data detection process. Specifically, these electronic devices can be dedicated terminals with financial data processing functions, servers or server clusters with training functions for the user first abnormal application data detection process and the second abnormal application data detection process, so as to realize the training and deployment of the user first abnormal application data detection process and the second abnormal application data detection process adapted for different financial scenarios. Figure 3 The steps shown are explained.

[0122] Step 301: The abnormal application data detection device obtains application data matching the target user.

[0123] Among them, user application data includes but is not limited to: visiting websites, sending and receiving emails, uploading and downloading, instant messaging, forums, online games, streaming videos, advertising, financial payments, coupon collection, full-discount qualification collection, and game currency collection.

[0124] In some embodiments of the present invention, obtaining application data matching the target user may be achieved in the following manner:

[0125] Based on the application data usage scenario of the target user, trigger the corresponding application interface, and establish an application data transmission link that matches the target user through the application interface; obtain the application data that matches different application processes transmitted by the application interface through the application data transmission link established by the application interface; based on the application data usage scenario of the target user, obtain the noise parameters that match the application data usage scenario of the target user; based on the noise parameters, perform noise removal on the application data that matches different application processes transmitted by the acquired application interface to form user application data that matches the target user. Among them, reference Figure 4 , Figure 4 The data structure diagram of the first abnormal application data detection process and the second abnormal application data detection process of the user in the embodiment of the present invention, wherein, in order to realize the real-time judgment of whether the request traffic is malicious by the API interface, and return the judgment result within 100ms, so that the customer can process the request according to the risk value. The more parameters, the more accurate the malicious traffic judgment is. Of course, the application data obtained in the embodiment of the present invention can be flexibly configured according to the different implementation environments of the abnormal application data detection. At the same time, the obtained application data does not involve the user's privacy data. When it is necessary to obtain the user's privacy data to realize abnormal application data detection, it is necessary to detect the user's authorization information to avoid leakage of the user's privacy data.

[0126] Furthermore, since the terminal operating environments of the target users are different, the functions to be executed are also different. Therefore, based on the terminal operating environment of the target user, the communication process information, operation history information and payment information transmitted by the application interface are obtained, and the obtained user characteristics are processed through the user's first abnormal application data detection process and the second abnormal application data detection process to obtain abnormal application data detection results that match the functions to be executed, thereby expanding the scope of application of the user's first abnormal application data detection process and the second abnormal application data detection process.

[0127] Step 302: The abnormal application data detection device classifies the acquired application data that matches the target user and determines the data type of the application data.

[0128] In some embodiments of the present invention, the data type identifier carried by the acquired application data matching the target user can be parsed, wherein the data type identifier includes at least one of the following: a user portrait data identifier, a transaction flow data identifier; based on the data type identifier, the data type of the application data is determined. Specifically, user portrait data is a typical tabular data with static characteristics and will not change significantly over a period of time; transaction flow data is a dynamic time series data that is closely related to time factors. In the processing scenarios of risk control services, such as fraud detection, trumpet (robot) detection, and recharge and payment detection, massive dynamic time series data and a large amount of user portrait data are usually encountered. Based on these data, service providers can use data mining methods to identify the behavior patterns and rules of normal transactions / users and abnormal transactions / users in various business scenarios to achieve risk control.

[0129] Furthermore, the target user's account portrait information can be determined based on the account parameter information transmitted by the application program interface; the target user's IP address portrait can be determined based on the user's IP address information transmitted by the application program interface; and the target user's device portrait information can be determined based on the user's operation timestamp information transmitted by the application program interface. Among them, in actual applications, common network cheating methods can include at least machine cheating and human cheating. Machine cheating can include machine cheating, task distribution, traffic hijacking, etc. Human cheating can include Q groups / water army, direct manual, inducement, etc. Common online cheating methods may at least include: e-commerce cheating methods such as brushing orders, brushing reputation, brushing good reviews, professional bad review writers, payment platform cheating methods such as money laundering, fraud, data falsification, brushing traffic (diversion-ad display-ad click-conversion) and other advertising cheating methods, self-media or social software cheating methods such as brushing fans, brushing clicks, and reading volume, search cheating methods such as using cheating methods to brush rankings, etc. User portraits may also include at least location portraits, account portraits, Internet Protocol Address (IP) portraits, device portraits and other information. User portraits can effectively detect user behavior.

[0130] Step 303: When the data type of the application data is a table data type, the abnormal application data detection device triggers a first abnormal application data detection process.

[0131] Step 304: The abnormal application data detection device processes the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the target user application data.

[0132] In some embodiments of the present invention, processing the application data of the table data type by the first abnormal application data detection process to determine the abnormal application data in the target user application data may be implemented in the following manner:

[0133] Through the first abnormal application data detection process, probability distribution detection is performed on the application data of the table data type to determine the probability distribution model of the application data of the table data type; the probability that the application data of the table data type obeys the probability distribution model and the corresponding abnormal detection threshold are determined; based on the probability that the application data of the table data type obeys the probability distribution model and the corresponding abnormal detection threshold, the abnormal data points in the application data of the table data type are determined. Specifically, in the abnormal detection of tabular data, the COPOD (COPula based Outlier Detection) method can be used, and the probability model is used as an auxiliary. The core idea of ​​the probability model is: construct a probability distribution model based on the data distribution, calculate the probability that the data point obeys the probability distribution; then treat the data points that appear with extremely low probability (set as the hyperparameter of the abnormal detection method) as abnormal data points.

[0134] Further, when the probability distribution model of the application data of the table data type cannot be determined, trigger the anomaly detection process based on the association structure; through the anomaly detection process based on the association structure, use the correlation function between empirical variables to predict the tail probability of each data point in the application data of the table data type; based on the tail probability of each data point in the application data of the table data type, determine the abnormal data points in the application data of the table data type. Wherein, calculating the empirical accumulation distribution function may include:

[0135] The calculation formula of the empirical cumulative distribution function (ECDF) is formula 1:

[0136]

[0137] The process of calculating the empirical Copula function includes:

[0138] To calculate the empirical copula function, you can first calculate the empirical copula observation for each data point in the data set. The formula for calculating the empirical copula observation is shown in Formula 2:

[0139]

[0140] According to Sklar's theorem, the calculation formula of Copula is formula 3:

[0141] C(u)=P(F1(X1)≤u1,...,F d (X d )≤ud )Formula 3

[0142] Then, substitute the empirical Copula observation value into formula (3) to obtain the empirical Copula function, refer to formula 4:

[0143]

[0144] where it is defined on the discrete grid {1 / n,2 / n,....,1} d The empirical Copula function of n data points has discrete marginal distribution variables that obey uniform distribution. That is, it can be decomposed into several independent random variables that obey uniform distribution according to the following formula, refer to formula 5:

[0145]

[0146] Therefore, high-dimensional data can be decomposed into low-dimensional data for processing. At the same time, according to the central limit theorem, experience C(u) can be gradually approached, thus ensuring the accuracy of discrete calculations in practical applications.

[0147] When using the empirical Copula function to approximate the tail probability, the tail probability is some special value of the cumulative distribution function in probability theory. Depending on the value, the tail probability can be further divided into: left tail probability and right tail probability. The definitions of the two are as follows:

[0148] Left tail probability:

[0149] Right tail probability:

[0150] Among them, the tail probability can represent the rarity of the data point. The smaller the tail probability value, the rarer the data point.

[0151] The formula for calculating the left tail probability is:

[0152]

[0153] The calculation of the right tail probability is the same as that of the left tail probability.

[0154] In the process of calculating the tail probability, you may encounter the problem of tail probability disappearance. Because as the dimension d of the data set increases, the tail probability will quickly approach 0. In order to avoid this situation, take the negative logarithm of both sides of the above formula and change the multiplication into addition. In addition, when processing each dimension, you need to choose whether to use the left tail probability or the right tail probability. In practical applications, choose to use the left tail probability or the right tail probability based on the positive and negative values ​​of the skewness coefficient. When the skewness coefficient is less than 0, the data of the current dimension is concentrated on the right end, and the left end presents a long-tail distribution, which is more likely to present anomalies, so the left tail probability is selected; when the skewness coefficient is greater than 0, the data of the current dimension is concentrated on the left end, and the right end presents a long-tail distribution, which is more likely to present anomalies, so the right tail probability is selected.

[0155] The calculation formula of the skewness coefficient of the data in the i-th dimension is as follows:

[0156]

[0157] Step 305: When the data type of the application data is a time series data type, the abnormal application data detection device triggers a second abnormal application data detection process.

[0158] Step 306: The abnormal application data detection device processes the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data.

[0159] In some embodiments of the present invention, processing the application data of the time series data type by the second abnormal application data detection process to determine the abnormal application data in the target user application data can be implemented in the following manner:

[0160] The second abnormal application data detection process performs time series decomposition processing on the application data of the time series data type to form long-term trend parameters, periodic trend parameters and residual parameters; based on the long-term trend parameters, periodic trend parameters and residual parameters, the application data of the time series data type is converted into application data of the table data type. Wherein, the second abnormal application data detection process performs Fourier transform processing on the application data of the time series data type to determine the amplitude-frequency characteristics of the application data of the time series data type; based on the amplitude-frequency characteristics of the application data of the time series data type, the corresponding periodic trend parameters are determined. Wherein, the time series decomposition method can be used to decompose the original observation data into multiple different components, including: long-term trend, periodic trend and residual. Wherein, the periodic trend is optional. In order to determine whether there is a periodic trend in the original data, the proposed anomaly detection framework will first perform Fourier transform on it and observe its amplitude-frequency characteristics. If the amplitude of some frequency components in the amplitude-frequency characteristics is significantly stronger, it means that there is an obvious periodic trend in the original data. Through Fourier transform, the specific size of the period in the periodic trend can also be determined at the same time, and the frequency and the corresponding period are respectively called peak frequency and peak period.

[0161] No periodic trend, refer to formula 7:

[0162] Xt=Tt+It Formula 7

[0163] There is a periodic trend, refer to formula 8:

[0164] Xt=Tt+Ct+ItFormula 8

[0165] In formulas (7)-(8), Xt represents the data at time t, Tt represents the long-term trend, Ct represents the periodic trend, and It represents the residual. Tt and Ct are closely related to the time factor, while the change of It is independent of time. By using the time series decomposition method, dynamic time series data can be converted into static tabular data, so that it can be used Figure 1 The COPOD and other methods in the anomaly detection framework shown in the figure are used for detection. Therefore, the key to this part is how to fit the long-term trend and the periodic trend. Furthermore, the exponential smoothing method can be used when performing trend fitting processing, refer to formula 9:

[0166] Tt=(1-α)T t-1 +αX t-1 ,0≤α≤1 Formula 9

[0167] Among them, the parameter α is the smoothing coefficient.

[0168] The moving average method can also be used when performing trend fitting, refer to formula 10:

[0169]

[0170] The parameter m is the order of the moving average method and is set to the peak period period.

[0171] For the fitting of periodic trends, the method used is: single period trend c′ t From the detrended sequence X′ t =X t -T t The average value in each cycle is

[0172]

[0173] Cycle Trend C t That is the single-period trend C′ t The cycle extension.

[0174] After determining the long-term trend and the periodic trend, the residual I can be obtained. t , [] indicates optional items:

[0175] I t =X t -T t [-C t ]#(12)

[0176] Among them, the embodiments of the present invention can be implemented in combination with cloud technology. Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software and network in a wide area network or a local area network to realize data calculation, storage, processing and sharing. It can also be understood as a general term for network technology, information technology, integration technology, management platform technology and application technology based on cloud computing business model applications. The background services of the technical network system require a large amount of computing and storage resources, such as video websites, picture websites and more portal websites, so cloud technology needs to be supported by cloud computing.

[0177] It should be noted that cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called the "cloud". From the user's point of view, the resources in the "cloud" can be infinitely expanded, and can be obtained at any time, used on demand, expanded at any time, and paid for by use. As a basic capability provider for cloud computing, a cloud computing resource pool platform will be established, referred to as a cloud platform, generally referred to as Infrastructure as a Service (IaaS), and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (which can be virtualized machines, including operating systems), storage devices and network devices.

[0178] Combined with the previous sequence Figure 1 As shown, the data processing method provided in the embodiment of the present invention can be implemented by corresponding cloud devices, for example: the terminal (including the terminal 10-1 and the terminal 10-2) is connected to the server 200 located in the cloud through the network 300, and the network 300 can be a wide area network or a local area network, or a combination of the two. It is worth noting that the server 200 can be a physical device or a virtualized device.

[0179] In some embodiments of the present invention, the data processing method further includes:

[0180] Receive data synchronization requests from other nodes in the blockchain network; verify the permissions of the other nodes in response to the data synchronization requests; when the permissions of the other nodes are verified, control the data synchronization between the current node and the other nodes to enable the other nodes to obtain the target user identifier, application data matching the target user, and abnormal application data.

[0181] In some embodiments of the present invention, the data processing method further includes:

[0182] In response to a query request, the query request is parsed to obtain a corresponding object identifier; according to the object identifier, permission information in a target block in a blockchain network is obtained; the matching of the permission information and the object identifier is verified; when the permission information matches the object identifier, a corresponding target user identifier, application data matching the target user, and abnormal application data are obtained in the blockchain network; in response to the query instruction, the obtained corresponding target user identifier, application data matching the target user, and abnormal application data are pushed to a corresponding instant messaging client, so that the instant messaging client obtains the corresponding target user identifier, application data matching the target user, and abnormal application data stored in the blockchain network, and realizes data migration of the address book data of the same user between different terminals (instant messaging clients).

[0183] See also Figure 5 , Figure 5 It is a schematic diagram of the architecture of the target object determination device 100 provided in an embodiment of the present invention, including a blockchain network 200 (consensus nodes 210-1 to consensus nodes 210-3 are shown as an example), an authentication center 300, a business entity 400 and a business entity 500, which are described below respectively.

[0184] The types of blockchain network 200 are flexible and diverse, for example, it can be any one of a public chain, a private chain or a consortium chain. Taking a public chain as an example, any electronic device of a business subject, such as a user terminal and a server, can access the blockchain network 200 without authorization; taking a consortium chain as an example, after obtaining authorization, the electronic device (such as a terminal / server) under the jurisdiction of the business subject can access the blockchain network 200, and at this time, it becomes a client node in the blockchain network 200.

[0185] In some embodiments, the client node can only be used as an observer of the blockchain network 200, that is, to provide support for business entities to initiate transactions (for example, for storing data on the chain or querying data on the chain). For the functions of the consensus node 210 of the blockchain network 200, such as sorting function, consensus service and account book function, the client node can implement them by default or selectively (for example, depending on the specific business needs of the business entity). Thus, the data and business processing logic of the business entity can be migrated to the blockchain network 200 to the greatest extent, and the credibility and traceability of the data and business processing process can be achieved through the blockchain network 200.

[0186] The consensus nodes in the blockchain network 200 receive information from different business entities (e.g. Figure 1 4 and 500) shown in FIG. Figure 1 The client node 410 belonging to the business entity 400 and the client node 510 belonging to the system 500 of the electronic device shown in the figure) submit transactions, execute transactions to update the ledger or query the ledger, and various intermediate results or final results of the transaction can be returned to the client node of the business entity for display.

[0187] For example, the client node 410 / 510 can subscribe to events of interest in the blockchain network 200, such as transactions occurring in a specific organization / channel in the blockchain network 200, and the consensus node 210 pushes the corresponding transaction notification to the client node 410 / 510, thereby triggering the corresponding business logic in the client node 410 / 510.

[0188] The following uses the example of multiple business entities accessing the blockchain network to achieve the management of target object determination results to illustrate the exemplary application of the blockchain network.

[0189] See also Figure 5, multiple business entities involved in the management link, such as business entity 400 can be a target object determination device based on artificial intelligence, and business entity 500 can be a display system with a target object determination function. They register with the authentication center 300 to obtain their respective digital certificates. The digital certificate includes the public key of the business entity and the digital signature signed by the authentication center 300 on the public key and identity information of the business entity, which is used to attach to the transaction together with the digital signature of the business entity for the transaction, and is sent to the blockchain network for the blockchain network to extract the digital certificate and signature from the transaction, verify the reliability of the message (i.e., whether it has not been tampered with) and the identity information of the business entity sending the message. The blockchain network will verify according to the identity, such as whether it has the authority to initiate a transaction. The client running on the electronic device (such as a terminal or server) under the jurisdiction of the business entity can request access to the blockchain network 200 and become a client node.

[0190] The client node 410 of the business entity 400 is used to obtain resource transaction data corresponding to different objects; determine the level information of the different objects based on the resource transaction data, and determine the basic objects among the different objects based on the level information; determine the difference feature vectors matching the different objects based on the resource transaction data; determine the association relationship network between the different objects based on the difference feature vectors matching the different objects; determine the clustering results of the association relationship network between the different objects in response to the basic objects; determine the target object matching the basic object among the different objects based on the clustering results of the association relationship network between the different objects and the corresponding level information, and send the target user identifier, application data matching the target user, and abnormal application data to the blockchain network 200.

[0191] Among them, the target user identifier, the application data matching the target user, and the abnormal application data are sent to the blockchain network 200. The business logic can be set in advance in the client node 410. When the corresponding target object determination result is formed, the client node 410 automatically sends the target user identifier, the application data matching the target user, and the abnormal application data to the blockchain network 200. The business personnel of the business subject 400 can also log in to the client node 410, manually package the target user identifier, the application data matching the target user, and the abnormal application data, and send them to the blockchain network 200. When sending, the client node 410 generates a transaction corresponding to the update operation according to the target user identifier, the application data matching the target user, and the abnormal application data. The transaction specifies the smart contract to be called to implement the update operation and the parameters passed to the smart contract. The transaction also carries the digital certificate of the client node 410 and the signed digital signature (for example, the summary of the transaction is encrypted using the private key in the digital certificate of the client node 410), and broadcasts the transaction to the consensus node 210 in the blockchain network 200.

[0192] When the consensus node 210 in the blockchain network 200 receives a transaction, it verifies the digital certificate and digital signature carried in the transaction. After successful verification, it confirms whether the business subject 400 has transaction authority based on the identity of the business subject 400 carried in the transaction. Any verification judgment in the digital signature and authority verification will cause the transaction to fail. After successful verification, the node 210 signs its own digital signature (for example, using the private key of node 210-1 to encrypt the summary of the transaction) and continues to broadcast in the blockchain network 200.

[0193] After receiving the successfully verified transaction, the consensus node 210 in the blockchain network 200 fills the transaction into a new block and broadcasts it. When the consensus node 210 in the blockchain network 200 broadcasts a new block, it will perform a consensus process on the new block. If the consensus is successful, the new block will be appended to the end of the blockchain stored by itself, and the state database will be updated according to the result of the transaction, and the transaction in the new block will be executed: for transactions that submit updates to identify the target user, application data matching the target user, and abnormal application data, a key-value pair including the target user identifier, application data matching the target user, and abnormal application data is added to the state database.

[0194] The business personnel of the business entity 500 logs in to the client node 510 and inputs the target object determination result or the target object query request. The client node 510 generates a transaction corresponding to the update operation / query operation according to the target object determination result or the target object query request. The transaction specifies the smart contract to be called to implement the update operation / query operation and the parameters to be passed to the smart contract. The transaction also carries the digital certificate of the client node 510 and the signed digital signature (for example, the transaction summary is encrypted using the private key in the digital certificate of the client node 510), and broadcasts the transaction to the consensus node 210 in the blockchain network 200.

[0195] The consensus node 210 in the blockchain network 200 receives the transaction, verifies the transaction, fills the block and reaches consensus, then appends the filled new block to the end of the blockchain stored in itself, updates the status database according to the transaction result, and executes the transaction in the new block: for a transaction submitted to update a target user identifier, application data matching the target user, and abnormal application data, the key-value pair corresponding to the target object determination result in the status database is updated according to the manual identification result; for a transaction submitted to query a target object determination result, the key-value pair corresponding to the target object determination result is queried from the status database, and the transaction result is returned.

[0196] It is worth noting that in Figure 5 The process of directly uploading the target user identification, the application data matching the target user, and the abnormal application data to the chain is exemplarily shown in FIG. 4 , but in other embodiments, for the case where the data volume of the target object determination result is large, the client node 410 can upload the hash of the target object determination result and the hash of the corresponding target object determination result to the chain in pairs, and store the original target object determination result and the corresponding target object determination result in a distributed file system or database. After the client node 510 obtains the target object determination result and the corresponding target object determination result from the distributed file system or database, it can be verified in combination with the corresponding hash in the blockchain network 200, thereby reducing the workload of the uplink operation.

[0197] As an example of blockchain, see Figure 6 , Figure 6 It is a structural diagram of the blockchain in the blockchain network 200 provided by an embodiment of the present invention. The header of each block can include the hash value of all transactions in the block, and also includes the hash value of all transactions in the previous block. The newly generated transaction records are filled into the block and after the consensus of the nodes in the blockchain network, they will be appended to the end of the blockchain to form a chain growth. The chain structure based on hash values ​​between blocks ensures the anti-tampering and anti-counterfeiting of transactions in the block.

[0198] The following describes an exemplary functional architecture of a blockchain network provided by an embodiment of the present invention. Figure 7 , Figure 7 2 is a functional architecture diagram of a blockchain network 200 provided in an embodiment of the present invention, including an application layer 201, a consensus layer 202, a network layer 203, a data layer 204 and a resource layer 205, which are described below respectively.

[0199] The resource layer 205 encapsulates the computing resources, storage resources, and communication resources of each node 210 in the blockchain network 200.

[0200] The data layer 204 encapsulates various data structures for implementing the ledger, including the blockchain implemented as files in the file system, a key-value state database, and existence proof (such as a hash tree of transactions in a block).

[0201] The network layer 203 encapsulates the functions of point-to-point (P2P) network protocol, data transmission mechanism and data verification mechanism, access authentication mechanism and business subject identity management.

[0202] Among them, the P2P network protocol realizes the communication between the nodes 210 in the blockchain network 200, the data propagation mechanism ensures the propagation of transactions in the blockchain network 200, and the data verification mechanism is used to realize the reliability of data transmission between nodes 210 based on cryptographic methods (such as digital certificates, digital signatures, public / private key pairs); the access authentication mechanism is used to authenticate the identity of the business subject joining the blockchain network 200 according to the actual business scenario, and grant the business subject the right to access the blockchain network 200 when the authentication is passed; the business subject identity management is used to store the identity of the business subject allowed to access the blockchain network 200, and the authority (such as the type of transaction that can be initiated).

[0203] The consensus layer 202 encapsulates the mechanism (i.e., consensus mechanism) for the nodes 210 in the blockchain network 200 to reach a consensus on the blocks, transaction management, and account management functions. The consensus mechanism includes consensus algorithms such as POS, POW, and D POS, and supports pluggable consensus algorithms.

[0204] Transaction management is used to verify the digital signature carried in the transaction received by the verification node 210, verify the identity information of the business subject, and determine whether it has the authority to conduct transactions based on the identity information (read relevant information from the business subject identity management); for business subjects that have obtained authorization to access the blockchain network 200, they all have digital certificates issued by the certification center. The business subject uses the private key in its own digital certificate to sign the submitted transaction, thereby declaring its legal identity.

[0205] Ledger management is used to maintain the blockchain and state database. For the blocks that have reached consensus, they are appended to the end of the blockchain; the transactions in the blocks that have reached consensus are executed, and when the transaction includes an update operation, the key-value pairs in the state database are updated; when the transaction includes a query operation, the key-value pairs in the state database are queried and the query results are returned to the client node of the business subject. Supports query operations on the state database in multiple dimensions, including: querying blocks based on block vector numbers (such as the hash value of transactions); querying blocks based on block hash values; querying blocks based on transaction vector numbers; querying transactions based on transaction vector numbers; querying business subject account data based on business subject accounts (vector numbers); querying blockchains in channels based on channel names.

[0206] The application layer 201 encapsulates various services that can be implemented in the blockchain network, including transaction traceability, evidence storage, and verification.

[0207] The following is an example of predicting the target user who needs to receive game coins in the scenario of paying (or receiving) game coins to illustrate the abnormal application data detection method provided by this application, wherein, see Figure 8 , Figure 8 This is a front-end display diagram of the abnormal application data detection method provided by the present application, wherein the terminal (for example Figure 1 The terminals 10-1 and 10-2 in the example are provided with clients capable of displaying corresponding software for financial payment, such as clients or plug-ins for financial activities with virtual resources or physical resources or game coins for games with virtual resources. Users can obtain game coins for payment from financial institutions or platforms through the corresponding clients (such as WeChat Tenpay payment or WeChat mini-programs to obtain game coins of different amounts); the terminals are connected to the server 200 through the network 300, which can be a wide area network or a local area network, or a combination of the two, using a wireless link to achieve data transmission. The server (e.g. Figure 1 Servers in the client server) Banks, securities, mutual finance, P2P and other companies that provide financial services such as payment, game coins, and wealth management. When users who need to handle related financial services use client devices to access the services provided by the company's client server, the client server can predict the risks of the user's behavior and identify users with abnormal behavior, thereby blocking cheating black market users. Through the first abnormal application data detection process and the second abnormal application data detection process for trained users, it can assist financial platforms or game coin providers in determining whether to provide payment game coins to users, or it can assist different game coin recipients in the financial platform to manage users with different credit risk types differently.

[0208] refer to Fig. 9 , Fig. 9This is a schematic diagram of the use process of the abnormal application data detection method provided by the present application, wherein the abnormal application data detection method provided by the present application includes the following steps:

[0209] Step 901: The server obtains application data matching the target user in the game coin collection scenario.

[0210] Among them, reference Fig.10 / 11 / 12, Fig.10 This is a schematic diagram of the smoothing of the game coin activity index in an embodiment of the present invention. Fig.11 is a schematic diagram comparing the residual distribution and the normal distribution of the user's behavior in an embodiment of the present invention, Fig.12 This is a schematic diagram of the observed data and dynamic threshold of the game coin collection activity in an embodiment of the present invention, wherein the exponential smoothing method can be used to fit the long-term trend, the KS test and kernel density estimation method can be used to test whether the residual conforms to the normal distribution, and finally the one-sided 3-sigma principle is used to set the threshold.

[0211] Step 902: classify the acquired application data that matches the target user to determine the data type of the application data.

[0212] in, Fig.13 Schematic diagram of the amplitude-frequency characteristics of the Fourier transform of the game coin activity hour request amount in an embodiment of the present invention, Fig.14 This is a schematic diagram of the time series decomposition result of the game currency activity hourly request volume in an embodiment of the present invention. Fig.15 The diagram is a schematic diagram of the abnormal detection result and the defined threshold value of the game coin activity hour request volume in an embodiment of the present invention, wherein the threshold value corresponding to the abnormal detection result of the game coin activity hour request volume can be adaptively adjusted according to the peak value of the game type and the number of different users.

[0213] Step 903: Process the application data of the table data type through the first abnormal application data detection process, and process the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data.

[0214] Step 904: Execute a matching processing strategy based on the abnormal application data in the target user application data.

[0215] The processing strategies specifically include: disabling payment or collection functions for high-risk users, and issuing payment game coins to medium and low-risk users, thereby preventing payment game coins from being collected by high-risk users.

[0216] It can be understood that in the embodiments of the present application, when the embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards.

[0217] Beneficial technical effects:

[0218] The embodiment of the present invention obtains the behavior information of the target user, and reads the behavior characteristics matching the target user through the application program interface; determines the user portrait information matching the target user based on the behavior information of the target user; performs risk prediction processing on the behavior characteristics through the user's first abnormal application data detection process and the second abnormal application data detection process to obtain the behavior risk prediction result of the target user; determines the abnormal application data in the target user's application data according to the target user's behavior risk prediction result and the user portrait information. Thus, it is possible to detect the behavior of the target user in real time through the user's first abnormal application data detection process and the second abnormal application data detection process, and execute the matching event execution strategy according to the risk prediction result, so that the generalization ability and data processing ability of the user's first abnormal application data detection process and the second abnormal application data detection process are stronger, adapt to different usage environments, and reduce the robustness of the user's first abnormal application data detection process and the second abnormal application data detection process.

[0219] The above descriptions are merely embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal application data, characterized in that: The method comprises: In response to the information trigger request, obtaining application data matching the target user, wherein the application data is obtained based on the application data usage scenario of the target user, and the application data is data generated during the process of the target user using the application program; Classifying the acquired application data that matches the target user to determine the data type of the application data; When the data type of the application data is a table data type, triggering a first abnormal application data detection process; Processing the application data of the table data type through the first abnormal application data detection process to determine abnormal application data in the target user application data; When the data type of the application data is a time series data type, triggering a second abnormal application data detection process; Processing application data of the time series data type through the second abnormal application data detection process, and converting the application data of the time series data type into application data of the table data type; Based on the application data of the table data type formed after conversion, abnormal application data in the target user application data is determined.

2. The method according to claim 1, characterized in that The acquiring application data matching the target user includes: Based on the application data usage scenario of the target user, trigger a corresponding application program interface, and establish an application data transmission link matching the target user through the application program interface; Acquire application data matching different application processes transmitted by the application program interface through an application data transmission link established by the application program interface; Based on the application data usage scenario of the target user, obtaining noise parameters matching the application data usage scenario of the target user; Based on the noise parameters, the acquired application data transmitted by the application program interface and matching different application processes are subjected to noise removal processing to form user application data matching the target user.

3. The method according to claim 1, characterized in that: The step of classifying the acquired application data matching the target user to determine the data type of the application data includes: Parsing the data type identifier carried by the acquired application data matching the target user, wherein the data type identifier includes at least one of the following: a user portrait data identifier and a transaction flow data identifier; Based on the data type identifier, the data type of the application data is determined.

4. The method according to claim 1, characterized in that: The processing of the application data of the table data type by the first abnormal application data detection process to determine the abnormal application data in the target user application data includes: Performing probability distribution detection on the application data of the table data type through the first abnormal application data detection process to determine a probability distribution model of the application data of the table data type; Determine the probability that the application data of the table data type obeys the probability distribution model, and the corresponding anomaly detection threshold; Based on the probability that the application data of the table data type obeys the probability distribution model and a corresponding anomaly detection threshold, an abnormal data point in the application data of the table data type is determined.

5. The method according to claim 4, characterized in that The method further comprises: When the probability distribution model of the application data of the table data type cannot be determined, the anomaly detection process based on the association structure is triggered; By means of the association structure-based anomaly detection process, using the empirical inter-variable correlation function, predicting the tail probability of each data point in the application data of the table data type; Based on the tail probability of each data point in the application data of the table data type, abnormal data points in the application data of the table data type are determined.

6. The method according to claim 5, characterized in that The method further comprises: Acquire a data set matching the anomaly detection process of the association structure; Calculating the empirical cumulative distribution function corresponding to the anomaly detection process of the association structure according to the acquired data set; Based on the empirical cumulative distribution function, the empirical inter-variable correlation function is determined.

7. The method according to claim 1, characterized in that The processing of the application data of the time series data type by the second abnormal application data detection process to convert the application data of the time series data type into application data of the table data type includes: Performing time series decomposition processing on the application data of the time series data type through the second abnormal application data detection process to form long-term trend parameters, periodic trend parameters and residual parameters; Based on the long-term trend parameter, the periodic trend parameter and the residual parameter, the application data of the time series data type is converted into application data of the table data type.

8. The method according to claim 7, characterized in that The method further comprises: Performing Fourier transform processing on the application data of the time series data type through the second abnormal application data detection process to determine the amplitude-frequency characteristics of the application data of the time series data type; Based on the amplitude-frequency characteristics of the application data of the time series data type, corresponding periodic trend parameters are determined.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: The target user identification, application data matching the target user, and abnormal application data are sent to the blockchain network so that The nodes of the blockchain network fill the target user identifier, application data matching the target user, and abnormal application data into a new block, and when a consensus is reached on the new block, the new block is appended to the end of the blockchain.

10. The method according to claim 9, characterized in that The method further comprises: Receiving data synchronization requests from other nodes in the blockchain network; In response to the data synchronization request, verifying the authority of the other nodes; When the authority of the other nodes is verified, data synchronization is controlled between the current node and the other nodes, so that the other nodes can obtain the target user identifier, application data matching the target user, and abnormal application data.

11. The method according to claim 9, characterized in that The method further comprises: In response to the query request, parsing the query request to obtain a corresponding object identifier; According to the object identifier, obtaining permission information in a target block in the blockchain network; Verifying the matching of the permission information and the object identifier; When the permission information matches the object identifier, obtaining a corresponding target user identifier, application data matching the target user, and abnormal application data in the blockchain network; In response to the query instruction, the acquired corresponding target user identifier, application data matching the target user, and abnormal application data are pushed to the corresponding client, so that the client can acquire the corresponding target user identifier, application data matching the target user, and abnormal application data stored in the blockchain network.

12. An abnormal application data detection device, characterized in that: The device comprises: An information transmission module, used to obtain application data matching the target user, wherein the application data is obtained based on the application data usage scenario of the target user, and the application data is data generated during the process of the target user using the application program; An information processing module, used to classify the acquired application data matching the target user and determine the data type of the application data; The information processing module is used to trigger a first abnormal application data detection process when the data type of the application data is a table data type; The information processing module is used to process the application data of the table data type through the first abnormal application data detection process to determine the abnormal application data in the target user application data; The information processing module is used to trigger a second abnormal application data detection process when the data type of the application data is a time series data type; The information processing module is used to process the application data of the time series data type through the second abnormal application data detection process to determine the abnormal application data in the target user application data.

13. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable instructions; A processor is used to implement the abnormal application data detection method according to any one of claims 1 to 11 when running the executable instructions stored in the memory.

14. A computer-readable storage medium storing executable instructions, characterized in that: When the executable instructions are executed by a processor, the abnormal application data detection method according to any one of claims 1 to 11 is implemented.

15. A computer program product comprising a computer program or computer executable instructions, characterized in that: When the computer program or computer executable instructions are executed by a processor, the abnormal application data detection method according to any one of claims 1 to 11 is implemented.

Images