Behavior detection and model training method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to a behavior detection and model training method and device, electronic equipment and a storage medium, and aims to improve the detection accuracy of abnormal behaviors of objects. The method comprises the following steps: dividing resource transfer source data according to a to-be-detected object and a time window to obtain at least one resource transfer behavior sequence; for each resource transfer behavior sequence, respectively executing the following operations: aiming at each resource transfer behavior contained in the resource transfer behavior sequence, respectively coding according to a corresponding behavior attribute to obtain a coding sequence; a trained behavior feature extraction model is adopted, behavior features of all sequence elements contained in the coding sequence are extracted respectively, and each behavior feature is obtained by combining the embedded feature obtained after conversion of the corresponding sequence element and the behavior feature of the previous sequence element; and combining the obtained behavior features into a sequence fusion feature, and inputting the sequence fusion feature into a trained abnormal behavior analysis model to obtain a more accurate behavior detection result.

Description

Background Art

[0002] With the expansion of various resource transfer businesses (such as online payment), malicious industrial chains are becoming more and more active. Therefore, abnormal resource transfer behaviors often occur, affecting the security of the resource transfer environment and need to be controlled in a timely manner.

[0003] Taking abnormal behaviors such as social fraud as an example, there are two common methods for analyzing whether the object to be detected has fraud risk:

[0004] (I) The strategy of rule combination is to mine the suspicious fraud features of the object to be detected by analyzing fraud cases, and then obtain an effective feature rule combination based on business experience or decision tree model. If the features of the object to be detected meet the rule combination, it is considered that the object to be detected has a fraud risk.

[0005] However, the rule combinations learned by this method are relatively simple, prone to overfitting problems, and insufficient generalization ability, making them inapplicable to fraud risk detection in a variety of environments. Moreover, simple rule combinations are easy to be attacked, broken through, and bypassed, resulting in poor detection stability and inaccurate detection results.

[0006] (II) The scoring card model based on logistic regression (LR) quantifies the object features, converts them into scores, and summarizes them to obtain the model score. The higher the score, the greater the fraud risk of the object to be detected.

[0007] However, logistic regression is essentially a simple linear model with limited ability to fit complex resource transfer behaviors. It cannot effectively fit complex and nonlinear resource transfer behaviors, such as high-dimensional and sophisticated resource transfer patterns, which leads to inaccurate detection results.

[0008] In summary, how to more accurately detect whether the object resource transfer behavior is abnormal is an urgent problem to be solved. Summary of the invention

[0009] The embodiments of the present application provide a behavior detection method, device, electronic device and storage medium to improve the accuracy of detecting abnormal behavior of an object.

[0010] An embodiment of the present application provides a behavior detection method, including:

[0011] Divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors of the same object to be detected occurring within a time window;

[0012] For each resource transfer behavior sequence, perform the following operations:

[0013] For each resource transfer behavior included in the resource transfer behavior sequence, encode according to the corresponding behavior attribute to obtain a coding sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element included in the coding sequence, wherein each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element;

[0014] The obtained behavior features are combined into sequence fusion features, which are input into the trained abnormal behavior analysis model to obtain behavior detection results, which represent the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

[0015] A model training method provided in an embodiment of the present application includes:

[0016] Acquire multiple training samples, each training sample being: a sequence of resource transfer behaviors of a preset number of times occurring for the same sample object within a sample time window;

[0017] For each training sample, for each resource transfer behavior contained in the training sample, encode according to the corresponding behavior attribute to obtain a coding sequence; use the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the conversion of the corresponding sequence element and the behavior features of the previous sequence element; merge the obtained behavior features into sequence fusion features, input them into the abnormal behavior analysis model to be trained, and obtain the target behavior detection result, which represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window;

[0018] According to the obtained target behavior detection results and corresponding sample labels, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted; the trained behavior feature extraction model and abnormal behavior analysis model are used to predict abnormal behavior risks of the detected objects.

[0019] An embodiment of the present application provides a behavior detection device, comprising:

[0020] A sequence generation unit is used to divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors occurring within a time window for the same object to be detected;

[0021] The detection unit is used to perform the following operations for each resource transfer behavior sequence:

[0022] For each resource transfer behavior included in the resource transfer behavior sequence, encode according to the corresponding behavior attribute to obtain a coding sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element included in the coding sequence, wherein each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element;

[0023] The obtained behavior features are combined into sequence fusion features, which are input into the trained abnormal behavior analysis model to obtain behavior detection results, which represent the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

[0024] Optionally, the detection unit is specifically used for:

[0025] For each resource transfer behavior included in the resource transfer behavior sequence, mapping the resource transfer behavior to a behavior parameter in a preset behavior parameter set according to a behavior attribute of the resource transfer behavior, wherein resource transfer behaviors with different attributes correspond to different behavior parameters;

[0026] The sequence composed of the obtained behavior parameters is used as the encoding sequence, wherein each behavior parameter is a sequence element in the encoding sequence.

[0027] Optionally, the behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence;

[0028] The detection unit is specifically used for:

[0029] For each sequence element in the encoding sequence, perform the following operations respectively:

[0030] Using the embedding layer, embedding the sequence elements to obtain embedding features of the sequence elements;

[0031] The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

[0032] Optionally, the detection unit is specifically used for:

[0033] Inputting the embedding features of the sequence element and the behavioral features of its previous sequence element into the recurrent neural network layer corresponding to the sequence element respectively;

[0034] Adding the corresponding positions in the embedded feature and the behavior feature to obtain an element fusion feature;

[0035] The recurrent neural network layer is used to extract the element fusion features to obtain the behavioral features of the sequence elements.

[0036] Optionally, the detection unit is specifically used for:

[0037] For each sequence element, the sequence element is represented as an embedding feature according to an embedding feature table obtained by pre-training the embedding layer, and the embedding feature table contains the embedding feature corresponding to each possible sequence element.

[0038] Optionally, the abnormal behavior analysis model includes a transformer and a fully connected layer; and the detection unit is specifically used for:

[0039] Merge the obtained behavioral features into sequence fusion features;

[0040] Using the transformer to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features;

[0041] The fully connected layer is used to perform feature mapping on the attention weighted features to obtain the behavior detection result.

[0042] Optionally, the device further comprises:

[0043] The risk prevention and control unit is used to take the obtained behavior detection results that are higher than a preset parameter threshold or within a preset sorting range as target behavior detection results;

[0044] Based on the determined detection results of each target behavior, a risk prevention and control strategy for the corresponding object is determined, and risk prevention and control processing is performed on the corresponding object according to the risk prevention and control strategy.

[0045] A model training device provided in an embodiment of the present application includes:

[0046] A sample acquisition unit is used to acquire multiple training samples, each training sample is: a sequence of resource transfer behaviors of a preset number of times occurring in a sample time window for the same sample object;

[0047] The detection unit is used to encode, for each training sample, each resource transfer behavior contained in the training sample according to the corresponding behavior attribute to obtain a coding sequence; use the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; merge the obtained behavior features into a sequence fusion feature, input the trained abnormal behavior analysis model, and obtain a target behavior detection result, wherein the target behavior detection result represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window;

[0048] A parameter adjustment unit is used to adjust the parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and corresponding sample labels; the trained behavior feature extraction model and abnormal behavior analysis model are used to predict the abnormal behavior risk of the object to be detected.

[0049] Optionally, the behavior feature extraction model includes a first fully connected layer; and the detection unit is further used for:

[0050] For each training sample, the first fully connected layer is used to perform feature mapping on the behavior feature of the last sequence element in the corresponding coding sequence to obtain a pre-behavior detection result, wherein the pre-behavior detection result indicates: a predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window;

[0051] The parameter adjustment unit is specifically used for:

[0052] According to the obtained target behavior detection results and pre-behavior detection results and corresponding sample labels, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted.

[0053] Optionally, the parameter adjustment unit is specifically used to:

[0054] In the first training stage, a first loss value is determined according to the difference between each of the pre-behavior detection results and the corresponding sample label; and parameters of the behavior feature extraction model are adjusted according to the first loss value;

[0055] In the second training stage, a second loss value is determined based on the difference between each of the target behavior detection results and the corresponding sample label; and parameters of the abnormal behavior analysis model are adjusted based on the second loss value.

[0056] Optionally, the parameter adjustment unit is specifically used to:

[0057] Determining a second loss value according to the difference between each of the target behavior detection results obtained and the corresponding sample label;

[0058] According to the second loss value, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted synchronously.

[0059] Optionally, the detection unit is specifically used for:

[0060] For each resource transfer behavior included in the training sample, according to the behavior attribute of the resource transfer behavior, mapping the resource transfer behavior to a behavior parameter in a preset behavior parameter set, wherein resource transfer behaviors with different attributes correspond to different behavior parameters;

[0061] The sequence composed of the obtained behavior parameters is used as the encoding sequence, wherein each behavior parameter is a sequence element in the encoding sequence.

[0062] Optionally, the behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence;

[0063] The detection unit is specifically used for:

[0064] For each sequence element in the encoding sequence, perform the following operations respectively:

[0065] Using the embedding layer, embedding the sequence elements to obtain embedding features of the sequence elements;

[0066] The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

[0067] Optionally, the detection unit is specifically used for:

[0068] Using the embedding layer, randomly mapping the sequence elements to obtain embedding features corresponding to the sequence elements;

[0069] When adjusting the parameters of the behavior feature extraction model, the parameter adjustment unit is further used to:

[0070] The embedded features obtained by randomly mapping each sequence element are synchronously adjusted, and after the training is completed, the embedded features corresponding to each possible sequence element are formed into an embedded feature table, so that in the model application part, the embedded features of each sequence element are determined according to the embedded feature table.

[0071] Optionally, the abnormal behavior analysis model includes a transformer and a second fully connected layer; and the detection unit is specifically used for:

[0072] Merge the obtained behavioral features into sequence fusion features;

[0073] Using the transformer to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features;

[0074] The second fully connected layer is used to perform feature mapping on the attention weighted features to obtain the target behavior detection result.

[0075] An electronic device provided in an embodiment of the present application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned behavior detection methods.

[0076] An embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any one of the above-mentioned behavior detection methods.

[0077] An embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any one of the above-mentioned behavior detection methods.

[0078] The beneficial effects of this application are as follows:

[0079] Embodiments of the present application provide a behavior detection method, device, electronic device, and storage medium. Since the present application divides the resource transfer behavior of each object to be detected into at least one resource transfer behavior sequence according to the time window, wherein the resource transfer behavior of the same object to be detected can be divided into resource transfer behavior sequences corresponding to one or more time periods, and since the behavior of the object naturally has a timing feature and contains richer information about the object, subsequent processing based on this can make full use of the timing information. On this basis, these resource transfer behaviors are represented by behavioral attributes to obtain a coding sequence containing timing information and attribute information. In the present application, behavior encoding is performed based on various behavior attributes, and resource transfer behaviors of different attributes may correspond to different coding results, which ensures that the model can carefully distinguish and understand the characteristics of various resource transfer behaviors when processing diverse resource transfer behaviors, and improve the behavior ability and generalization ability of the model in complex scenarios.

[0080] Then, combined with the temporal dependency, the corresponding behavioral features are extracted for each sequence element in the coding sequence. Each behavioral feature obtained in this way integrates the relevant information of its previous resource transfer behavior, which strengthens the model's understanding of time dependency, thereby facilitating the understanding of behavioral evolution and improving prediction accuracy.

[0081] On this basis, these behavioral features are merged into sequence fusion features, and abnormal behavior is predicted based on this. The characteristics in the resource transfer behavior can be comprehensively analyzed and processed. At the same time, the accuracy and robustness of detection can be improved through deep mining of time series features, thereby achieving more accurate detection of whether the object has abnormal behavior during resource transfer.

[0082] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0084] Figure 1 A schematic diagram of an application scenario in an embodiment of the present application;

[0085] Figure 2 This is a flowchart for implementing a model training method in an embodiment of the present application;

[0086] Figure 3 A schematic diagram of a behavior attribute and its attribute value in an embodiment of the present application;

[0087] Figure 4 A schematic diagram of a mapping relationship between a description string and a behavior parameter set in an embodiment of the present application;

[0088] Figure 5 A schematic diagram of a transaction behavior sequence and its corresponding coding sequence in an embodiment of the present application;

[0089] Figure 6 A schematic diagram of a feature processing process of a behavior feature extraction model in an embodiment of the present application;

[0090] Figure 7 It is a schematic diagram of a feature processing process of an abnormal behavior detection model provided in an embodiment of the present application;

[0091] Figure 8A model schematic diagram of a behavior feature extraction model and an abnormal behavior analysis model in an embodiment of the present application;

[0092] Fig. 9 A schematic diagram of the structure of a behavior feature extraction model in an embodiment of the present application;

[0093] Fig.10 A schematic diagram of a phased training process of a behavior feature extraction model and an abnormal behavior analysis model in an embodiment of the present application;

[0094] Fig.11 A flowchart of an implementation of a behavior detection method provided in an embodiment of the present application;

[0095] Fig.12 A schematic diagram of a resource transfer behavior sequence obtained by dividing resource transfer source data in an embodiment of the present application;

[0096] Fig.13 A processing logic diagram of a behavior feature extraction model in an embodiment of the present application;

[0097] Fig.14 A schematic diagram of the interaction logic between a terminal device and a server in an embodiment of the present application;

[0098] Fig.15 A schematic diagram of the structure of a behavior detection device in an embodiment of the present application;

[0099] Fig.16 A schematic diagram of the structure of a model training device in an embodiment of the present application;

[0100] Fig.17 A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0101] Fig.18 A schematic diagram of the hardware structure of another electronic device to which the embodiments of the present application are applied. DETAILED DESCRIPTION

[0102] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0103] The following is an introduction to some concepts involved in the embodiments of the present application.

[0104] Resource transfer behavior: refers to the process of transferring a specific resource from one entity or location to another entity or location. Among them, resources can refer to any type of electronic resources (such as digital assets, electronic certificates, etc.), physical resources (such as physical goods, material inventory, equipment, etc.) and information resources (such as data packets, files, sensitive information, etc.), etc. Transfer can refer to the process of transferring resources from one account to another, from one location to another, or from one server to another. Therefore, resource transfer behavior can specifically be the payment and transfer of funds, the transmission and backup of data, the scheduling and transportation of materials, the allocation and distribution of assets, etc. This article does not make specific restrictions on this.

[0105] Resource transfer source data: refers to the original data related to resource transfer behavior, which provides basic support for subsequent analysis, processing and decision-making. Resource transfer source data includes but is not limited to account information (such as account identification, account type, account balance, etc. in financial security scenarios), resource transfer amount (such as transaction amount, exchange rate, handling fee, etc. in online transaction scenarios), resource transfer type (such as payment, transfer, allocation, scheduling, etc.), transmission path (such as network nodes, server location, transmission protocol, etc. through which data flows), file content (such as file name, file size, file format, file encryption status, etc. in IoT security management scenarios), and any other source data related to resource transfer behavior. These source data are usually collected from one or more terminal devices or servers. Through comprehensive analysis of these data, the resource transfer process can be accurately detected and abnormal or suspicious transfer behaviors can be identified.

[0106] Time window: A specific time length selected when analyzing resource transfer behavior, used to focus on analyzing resource transfer behavior that occurs within a specific time length. The specific selection method is not specifically limited in this article. In the embodiment of the present application, the time window can help identify abnormal activities within a specific period of time, such as frequent resource transfers or large-scale data transmissions in a short period of time.

[0107] Resource transfer behavior sequence: refers to a collection of multiple resource transfer behaviors arranged in chronological order within a preset time window. For example, in a financial security scenario, a resource transfer behavior sequence can show the flow of funds in an account within a certain time window. By analyzing these sequences, abnormal behaviors such as frequent small payments and abnormal fund flow paths can be discovered. For another example, in an IoT security management scenario, a resource transfer behavior sequence can show the data transmission and instruction execution between server devices. Through sequence analysis, abnormal data traffic or unauthorized operation instructions can be detected.

[0108] Coding sequence: refers to the conversion of the resource transfer behavior sequence as a whole into a numerical or symbolic form suitable for model processing, thereby forming sequence data that can be input into the analysis model. In the encoding process, each resource transfer behavior is converted into a corresponding coding value (such as a behavior parameter) as an element in the sequence, and these coding values ​​constitute a complete coding sequence. Among them, the coding value can be a combination of one or more numbers, letters, symbols, etc. For example, in a financial security scenario, a series of fund transfer behaviors can be encoded in sequence into numerical forms such as "1_2_3_4", and each number represents a specific fund transfer behavior. For another example, in the IoT security management scenario, data transmission and instruction execution information between servers can be encoded into symbolic forms such as "a_b_c_d", and each symbol corresponds to a specific transmission or operation behavior, and so on.

[0109] Sequence elements and behavior parameters: Sequence elements refer to the basic units in the coding sequence, representing the characteristics or attributes of a single resource transfer behavior; behavior parameters are a form of sequence elements, that is, each element in the coding sequence is essentially a parameter representing a behavior of a certain attribute.

[0110] Behavioral features and fusion features: Behavioral features refer to features extracted from resource transfer behaviors for analysis and prediction. These features can represent the relationship between a resource transfer behavior and its previous resource transfer behavior, and can reflect the key attributes and time changes of the behavior, such as changes in transfer amounts, length of time intervals, consistency of transmission paths, types of accounts involved, geographical locations of transfers, and frequency of transfer behaviors; fusion features refer to more complex features generated by combining multiple behavioral features, which are used to capture more complex behavioral patterns and relationships to improve the accuracy of risk prediction.

[0111] Behavior feature extraction model: used to extract the features of each resource transfer behavior from the encoded resource transfer behavior sequence (ie, the encoding sequence). In an embodiment of the present application, the model includes but is not limited to an embedding layer and a recurrent neural network (RNN). In the model training part, it may also include a first fully connected layer. The role of the embedding layer is to map the input sequence elements (ie, the encoded resource transfer behavior) into low-dimensional dense vectors. RNN is used to process sequence data. In the model application part, the extracted behavior features will eventually be merged to form a sequence fusion feature to prepare for subsequent abnormal behavior analysis. In addition, in the model training part, the pre-behavior detection results can be obtained through the first fully connected layer to adjust the model parameters. This pre-training process helps the model to learn more accurately how to extract effective behavior features from the encoding sequence in the model training part, thereby improving the accuracy of abnormal behavior detection in the model application part.

[0112] RNN: A type of neural network model that can process and generate sequential data. It enables the network to have a "memory" function by retaining the previously input information at each step of data processing, so that it can effectively capture the temporal dependencies and contextual information in the data. This structure is particularly suitable for processing tasks with strong sequentiality such as time series, text, speech, and video.

[0113] Abnormal behavior analysis model: used to determine whether the behavior is abnormal based on the extracted sequence fusion features. In the embodiment of the present application, the model includes but is not limited to two parts: a transformer and a fully connected layer. Among them, the transformer is a neural network model for processing sequence data, which is good at capturing the dependencies between different elements in the sequence. The fully connected layer maps these high-dimensional features to a final prediction result (i.e., the various behavior detection results in this article).

[0114] Transformer: An attention-based neural network model originally designed for processing sequence data (such as natural language processing). Unlike traditional RNNs, transformers rely entirely on attention mechanisms without processing data sequentially. It is able to simultaneously focus on all positions in a sequence in a single pass, thereby capturing long-range dependencies and processing sequence data more efficiently. The core component of the transformer is the self-attention mechanism, which dynamically adjusts the representation of each position by calculating the correlation (attention weight) between different positions in the input sequence. By stacking multiple levels of this mechanism, transformers are able to effectively learn complex patterns and relationships.

[0115] Risk prevention and control strategy: A strategy formulated based on the results of model analysis to prevent and control risks in the resource transfer process. In the embodiments of this application, the risk prevention and control strategy includes but is not limited to: real-time detection, anomaly detection, triggering multiple verification measures, automated alarms or limiting the occurrence of suspicious behavior, etc., to ensure resource security and prevent fraud, data leakage or other forms of risks.

[0116] The following is a brief description of the design concept of the embodiment of the present application:

[0117] With the rapid development of digital business, various resource transfer businesses play an increasingly important role in the global economic system. However, this also provides more opportunities for online fraud, especially in the fields of finance, e-commerce, social networks, etc., where fraud activities have become more complex and difficult to prevent. If not effectively curbed, these fraudulent activities will not only undermine the confidence of the target, but may also pose a serious threat to the security and stability of the entire system.

[0118] Currently, most anti-fraud systems still rely on rule matching and expert experience. These methods usually identify potential risk accounts by detecting known fraud patterns or combinations of suspicious behavior attributes. For example, when an account's transaction behavior repeatedly shows a certain suspicious pattern, the system will mark the account as high risk. However, this approach is often unable to cope with the ever-changing new fraud methods, especially those frauds that are manipulated in complex and covert ways.

[0119] In summary, traditional anti-fraud methods usually focus more on static behavioral characteristics, while dynamic behavioral patterns, especially the time series characteristics of transaction behaviors, are often overlooked in detection. This leads to many fraudulent behaviors with significant time series patterns not being identified in a timely manner, thereby increasing the risks to platforms and objects.

[0120] In view of this, the embodiments of the present application propose a behavior detection method, device, equipment and medium. Since the present application divides the resource transfer behavior of each object to be detected into at least one resource transfer behavior sequence according to the time window, wherein the resource transfer behavior of the same object to be detected can be divided into resource transfer behavior sequences corresponding to one or more time periods, the timing information is fully utilized. On this basis, these resource transfer behaviors are represented by behavioral attributes to obtain a coding sequence containing timing information and attribute information. In the present application, behavior encoding is performed based on various behavior attributes, and resource transfer behaviors of different attributes may correspond to different coding results, which ensures that the model can carefully distinguish and understand the characteristics of various resource transfer behaviors when processing diverse resource transfer behaviors, and improve the behavior ability and generalization ability of the model in complex scenarios.

[0121] Then, combined with the temporal dependency, the corresponding behavioral features are extracted for each sequence element in the coding sequence. Each behavioral feature obtained in this way integrates the relevant information of its previous resource transfer behavior, which strengthens the model's understanding of time dependency, thereby facilitating the understanding of behavioral evolution and improving prediction accuracy.

[0122] On this basis, these behavioral features are merged into sequence fusion features, and abnormal behavior is predicted based on this. The characteristics in the resource transfer behavior can be comprehensively analyzed and processed. At the same time, the accuracy and robustness of detection can be improved through deep mining of time series features, thereby achieving more accurate detection of whether the object has abnormal behavior during resource transfer.

[0123] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0124] like Figure 1 As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes a terminal device 110 and a server 120.

[0125] In the embodiment of the present application, the terminal device 110 includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals and other devices; a client related to behavior detection can be installed on the terminal device, which can be software (such as a browser, security detection software, etc.), or a web page, a small program, etc. The server 120 is a background server corresponding to the software or web page, small program, etc., or a server specifically used for behavior detection, which is not specifically limited in this application. The server 120 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0126] It should be noted that the behavior detection method in each embodiment of the present application can be executed by an electronic device, which may be a terminal device 110 or a server 120, that is, the method can be executed by the terminal device 110 or the server 120 alone, or can be executed jointly by the terminal device 110 and the server 120.

[0127] For example, when the terminal device 110 and the server 120 execute together, a behavior detection-related client can be installed on the terminal device 110, and the object can perform some resource transfer behaviors based on the client. The corresponding source data will be sent to the server 120 through the terminal device 110 for storage. The server 120 has pre-deployed trained behavior feature extraction models and abnormal behavior analysis models. Furthermore, the server 120 adopts the behavior detection method in the embodiment of the present application, based on the behavior feature extraction model and the abnormal behavior analysis model, to identify the behavior detection results of the resource transfer behavior sequence extracted based on the resource transfer source data, and finally returns the identified behavior detection results to the terminal device 110, which is presented to the object by the terminal device 110 through the client. Among them, the specific identification process on the server 120 side is as follows:

[0128] After encoding the resource transfer behavior sequence and obtaining the corresponding encoding sequence, each sequence element in the encoding sequence is embedded and processed based on the trained behavior feature extraction model to obtain the behavior feature, which integrates the key information in the embedding feature of the current sequence element and the behavior feature of the previous sequence element. On this basis, the behavior feature of each sequence element in the encoding sequence is integrated to obtain the sequence fusion feature. Subsequently, based on the trained abnormal behavior analysis model, the sequence fusion feature is processed to generate the behavior detection result, which is used to identify whether the object to be detected has abnormal behavior within a certain time window.

[0129] In an optional implementation, the terminal device 110 and the server 120 may communicate with each other via a communication network.

[0130] In an optional implementation, the communication network is a wired network or a wireless network.

[0131] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0132] In the embodiment of the present application, when there are multiple servers, the multiple servers can form a blockchain, and the servers are nodes on the blockchain; as in the behavior detection method disclosed in the embodiment of the present application, the resource transfer behavior-related data involved can be stored on the blockchain. For example, each resource transfer behavior sequence, the relevant features extracted from the resource transfer behavior, the sample label, the behavior feature extraction model and the model parameters of the abnormal behavior analysis model, etc.

[0133] In addition, the embodiments of the present application can be applied to various scenarios, including not only online transaction scenarios, but also including but not limited to artificial intelligence, Internet of Things, blockchain technology, network security and other application scenarios.

[0134] Specifically, behavior detection technology can be implemented through algorithms such as machine learning to analyze the object's resource transfer behavior data and extract key features, thereby greatly improving the accuracy and real-time performance of detection, and then being applied to multiple fields. For example, this technology can be used in scenarios such as fraud identification, logistics detection and optimization, smart contract execution assurance, and network content filtering to improve the efficiency of risk prevention and control and operational management. The following are some specific application scenario examples:

[0135] (i) Online transactions: Online trading platforms can use the behavior detection method in this application to analyze the transaction behaviors of objects (such as users, accounts logged in by users, etc.) in real time, extract behavioral features, and identify abnormal transactions or potential fraudulent activities. For example, the platform can quickly detect suspicious transactions by analyzing features such as transaction frequency, abnormal amounts, and transaction time periods, so that the platform can take timely measures to ensure the safety of the object's funds and reduce platform risks.

[0136] (II) Financial security: Banks and financial institutions can use the behavior detection method in this application to detect customer account activities and transaction behaviors. For example, by analyzing the account login mode, capital flow, transaction frequency and other characteristics, potential fraudulent behaviors such as account theft or internal fraud can be identified in advance. The behavior detection method in the embodiment of this application can automatically mark abnormal behaviors and issue alarms, helping financial institutions to take timely actions to prevent financial losses.

[0137] (III) Supply Chain Management Optimization: In supply chain management, the behavior detection technology of this application can be used to detect dynamic changes in logistics and inventory. By real-time analysis of behavioral data such as transportation process, inventory turnover, and cargo scheduling, and extracting abnormal features, the behavior detection method in the embodiment of this application can discover potential problems such as cargo delays, inventory shortages, or abnormal scheduling. This detection capability helps optimize the efficiency of the supply chain, improve resource utilization, and reduce supply chain risks.

[0138] In addition to the above scenarios, behavior detection can also be applied to:

[0139] (IV) Smart contract execution detection: In blockchain and smart contract applications, behavior detection technology can ensure the correct execution of contract terms. By detecting the behavior data of each operation during the contract execution process, extracting features and identifying abnormal situations, the behavior detection method in the embodiment of the present application can ensure that the execution of the contract is consistent with expectations and prevent tampering or illegal operations. For example, in a financial smart contract, unauthorized fund transfers can be detected and immediate measures can be taken to ensure the integrity of the contract.

[0140] (V) Content review and management: Social media platforms and online content distribution networks can use the behavior detection method of this application to automatically review and manage the content generated by the object. By analyzing the behavior data such as the frequency of the object's posting content, interaction patterns, topic characteristics, etc., the behavior detection method in the embodiment of this application can identify potential illegal content or false information, and take timely removal, blocking or warning measures, thereby maintaining the content quality of the platform and the object experience.

[0141] (VI) Internet of Things Security Management: In an Internet of Things environment, the behavior detection method of the present application can be used to detect and manage tens of thousands of connected devices. The behavior detection method in the embodiment of the present application can identify abnormal activities or security threats, such as device hijacking, illegal access attempts, or abnormal data traffic, by analyzing the operation logs, communication patterns, and data transmission behaviors of the devices. Through timely detection and response, the security of the Internet of Things network and the stable operation of the devices can be ensured.

[0142] It should be noted that the application scenarios listed above are just simple examples. In addition, other application scenarios are also applicable to the embodiments of the present application and will not be described one by one here.

[0143] In addition, it should be emphasized that in the specific implementation of this application, the relevant data of resource transfer, such as resource transfer behavior and its behavior attributes, etc. When the above embodiments of this application are applied to specific products or technologies, the object's permission or consent is required, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0144] The following describes the behavior detection method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0145] The solution provided by the embodiment of the present application mainly involves the application of artificial intelligence in behavior detection. When performing behavior detection, the present embodiment adopts an artificial neural network model based on deep learning, that is, the embodiment of the present application combines machine learning and methods related to the behavior detection architecture to obtain a behavior feature extraction model and an abnormal behavior analysis model. The key feature extraction method in the behavior feature extraction model and the abnormal behavior analysis model is achieved by performing a time series feature analysis based on machine learning on the resource transfer data, and then in actual scenarios, the purpose of performing behavior detection on the target resource transfer data can be achieved through the behavior feature extraction model and the abnormal behavior analysis model.

[0146] Specifically, the behavior detection process in the embodiment of the present application can be divided into two parts, including a model training part and a model application part. Among them, the model training part involves the technical field of machine learning, and the embodiment of the present application can adopt a staged training method. First, in the first training stage, the labeled resource transfer behavior generated by the sample object within the sample time window is used as a training sample to pre-train the behavior feature extraction model to be trained, focusing on mining the timing features in the resource transfer behavior sequence. In the second training stage, the labeled resource transfer behavior is also used as a training sample to train the abnormal behavior analysis model to be trained, so as to enhance the model's ability to capture timing features and recognize complex behavior patterns. In addition, the behavior feature extraction model and the abnormal behavior analysis model can also be trained synchronously, which will not be described in detail here.

[0147] The model application part is used to use the trained behavior feature extraction model to extract the sequence fusion features corresponding to the resource transfer behavior sequence, and then input the trained abnormal behavior analysis model to detect the resource transfer sequence of the object to be detected, and analyze whether the resource transfer behavior of the object to be detected within a certain time window is abnormal. Through this detection process, the suspiciousness of the object's resource transfer behavior can be evaluated in real time, and potential fraud can be effectively detected and prevented in practical applications.

[0148] In addition, it should be noted that the artificial neural network model in the embodiment of the present application can be trained online or offline, which is not specifically limited here. In this article, offline training is used as an example to illustrate that through offline training, the model can better perform feature learning and parameter optimization when processing a large amount of historical data, ensuring a higher detection accuracy in the application.

[0149] Below, the model training part in the embodiment of the present application is first described:

[0150] Before training the behavior feature extraction model and the abnormal behavior analysis model, it is first necessary to construct a training sample set related to resource transfer behavior. The training sample set in the embodiment of the present application includes multiple training samples, each of which is a sequence of resource transfer behaviors that occur a preset number of times for the same sample object within a sample time window, and the sequence can be referred to as a sample resource transfer behavior sequence; in addition, each training sample also includes a sample label corresponding to the sample resource transfer behavior sequence, and the sample label indicates whether the corresponding sample object has abnormal behavior within the corresponding sample time window.

[0151] It should be noted that the sample resource transfer behavior sequence of the model training part and the resource transfer behavior sequence of the model application part in the embodiment of the present application can be any set of resource transfer behaviors that describe a preset number of times that the same object occurs within a certain time range. Specifically, these sequences may include various types of resource transfer behaviors on the resource transfer platform. Divided according to the time dimension, the resource transfer behavior sequence can be composed of daily, weekly or monthly resource transfer behaviors, and can also be composed of resource transfer behaviors during specific events; divided according to the type of resource transfer, the resource transfer behavior sequence can cover various forms of resource transfer behaviors such as fund transfer, material allocation, and data transmission.

[0152] For example, in an online transaction scenario, a resource transfer behavior sequence usually refers to a series of transaction behaviors of an object on a transaction platform, such as a collection of multiple payments, refunds, transfers, and other operations. These behaviors may occur in a short period of time, such as multiple payments within a few minutes, or gradually accumulate over a longer period of time, such as multiple transactions within a month. Such sequences can help identify abnormal transaction patterns, such as frequent small payments that may indicate some automated fraud.

[0153] In the financial security scenario, a resource transfer behavior sequence can be a series of operations on a bank account, such as account login, fund transfer, and cash withdrawal. These operations may occur during the normal use of the object, but may also include abnormal behaviors, such as multiple login attempts or frequent large fund transfers in unusual time periods. By analyzing these sequences, possible risk behaviors can be detected, such as account theft or internal fraud, thereby triggering an early warning mechanism to protect the object's financial security.

[0154] In addition, in the supply chain management scenario, the resource transfer behavior sequence can be a dynamic change in logistics and inventory, such as a collection of operations such as the transportation path of goods, inventory replenishment and scheduling, etc. Through the time series analysis of these behaviors, abnormal situations in the supply chain can be identified, such as cargo delays, abnormal inventory fluctuations, or logistics scheduling errors, so that adjustment measures can be taken in time to optimize the operational efficiency of the supply chain.

[0155] Specifically, each resource transfer behavior sequence will correspond to a sample label to identify whether the sequence is abnormal. Specifically, these labels can help determine whether a behavior should be paid attention to or further processed. For example, a resource transfer behavior sequence in which a bank account attempts to log in multiple times in a short period of time may be labeled "abnormal" because such behavior may indicate that the account has been stolen or there is a potential risk of fraud. This label can guide further detection of the behavior or take preventive measures, such as triggering additional identity verification or freezing the account to prevent potential losses.

[0156] In an optional embodiment, the sample label can be a binary classification label, such as "normal" or "abnormal". Among them, "normal" means that the sequence of resource transfer behavior is in line with expectations, no abnormal behavior occurs, and the operation process is consistent with the historical behavior pattern, which can be marked as "0". For example, in a financial transaction scenario, the object conducts transactions according to the usual amount and frequency, and factors such as time and location are within the expected range. It is suitable for most operations that conform to business logic and normal behavior of objects; for example, an object makes small payments every day, regular bill payments, or inventory scheduling that occurs in an expected pattern.

[0157] "Abnormal" indicates suspicious behavior or behavior that significantly deviates from historical patterns in the sequence of resource transfer behaviors, which may indicate fraud, illegal operations, or system failures, and can be marked as "1". For example, sudden large-scale fund transfers, operations performed at unconventional times or locations (such as multiple large transfers at night), or transactions that do not conform to common patterns. Specifically, this label is used to identify behaviors that may pose risks. These behaviors usually significantly deviate from the normal operating mode of the object and may involve fraud, account theft, internal violations, etc.

[0158] In another optional embodiment, the sample label can also be a multi-classification label, which can be classified according to the risk level, such as "low risk", "medium risk" and "high risk". Among them, "low risk" means that the transaction behavior sequence is in line with expectations, with only minor anomalies, and no immediate action is required, such as the subject occasionally making small payments during non-peak hours, which can be marked as "1"; "medium risk" means that the transaction behavior shows certain abnormal characteristics, which may indicate potential risks, and the system can recommend further detection or preventive measures, such as the subject making multiple transactions in an uncommon time period, or logging in and initiating payment operations through multiple devices in a short period of time, which can be marked as "2"; "high risk" means that the transaction behavior sequence contains significant abnormal characteristics, which is very likely to indicate fraud, account theft or other high-risk events, and the system can take immediate measures, which can be marked as "3", for example, if the subject suddenly makes large payments, and these payments occur on devices that the subject does not often use or are made in different geographical locations, it can trigger additional identity verification, freeze the account or directly intercept the transaction.

[0159] In an optional implementation, these sample labels can be obtained by manual labeling. Considering that there may be errors in manual labeling, the manual labeling results of multiple people can be obtained, and then the final sample labels can be obtained by combining the labeling results of multiple people.

[0160] In another optional implementation, it is also possible to refer to the annotation of historical resource transfer data, or to identify through other existing models, or to determine by those skilled in the art based on experience, and so on.

[0161] For example, there are a large number of payment transactions on some online payment platforms, and a large number of these payment transactions are normal transactions, such as friend transfers, offline QR code payment, etc. For these objects, a portion of them can be randomly sampled as normal samples, and the sample label is 0. At the same time, there are some malicious fraud objects that have been complained about. These fraud objects are regarded as fraud samples, and the sample label is 1.

[0162] The determination of each sample label is based on a comprehensive evaluation of multiple factors, including but not limited to the frequency, quantity, time factor, geographical location and equipment used of resource transfer, etc. This article does not make specific restrictions on this.

[0163] It should be emphasized that the data related to resource transfer required to construct the above-mentioned training sample set has been obtained with the permission or consent of the subject, and the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0164] In an embodiment of the present application, after obtaining a training sample set, the behavior feature extraction model and the abnormal behavior analysis model to be trained can be iteratively trained based on the training sample set to obtain a trained behavior feature extraction model and an abnormal behavior analysis model.

[0165] It should be noted that the behavior feature extraction model and the abnormal behavior analysis model in the embodiment of the present application can be two independent models or integrated into the same large model, that is, the behavior feature extraction model and the abnormal behavior analysis model are two sub-models in a large model, and this article does not make specific limitations for comparison.

[0166] In addition, the behavior feature extraction model and the abnormal behavior analysis model in the embodiment of the present application can be trained in stages or synchronously. The training process of the model is briefly described below:

[0167] See also Figure 2 As shown, it is an implementation flow chart of a model training method provided in an embodiment of the present application. Taking the server as the execution subject as an example, the specific implementation process of the method is as follows S21-S23:

[0168] S21: Acquire multiple training samples, each training sample being a sequence of resource transfer behaviors occurring a preset number of times for the same sample object within a sample time window.

[0169] The time window refers to a specific time length selected when analyzing resource transfer behavior, which is used to focus on analyzing the resource transfer behavior of an object within a specific time length. In the embodiment of the present application, selecting an appropriate time window helps capture the temporal and periodic characteristics of the object's behavior, ensuring that the acquired resource transfer behavior data is representative and valuable for analysis.

[0170] In an optional implementation, the time window may be fixed, such as one week, one month, etc.; or it may be dynamically adjusted according to specific events, for example, a time window may be set according to marketing activities, holidays, special dates, etc.

[0171] It should be noted that the sample time window is a distinguishing description of the time window in the model training part, which is essentially a time window and is consistent with the time window of the model application part, such as one week, one month, etc.; in addition, it should be noted that the setting of the time window can refer to experience, the periodicity of object behavior, the complexity of the pattern, etc., and this application does not make specific limitations.

[0172] In an embodiment of the present application, the preset number refers to the number of object resource transfer behaviors expected to be obtained within a time window, that is, the preset number is used to define the length of the resource transfer behavior sequence of each object (such as a sample object, an object to be detected), so that the resource transfer behavior sequences of different objects remain consistent in length, thereby facilitating subsequent data processing and analysis.

[0173] It should be noted that the preset times of the model training part and the model application part are consistent, such as 10, 15 times, etc.; in addition, it should be noted that the setting of the preset times can refer to experience, the periodicity of the object behavior, the complexity of the pattern, etc. In addition, the setting of the preset times can also consider the size of the time window. For example, when the time window is large, the preset times are also set to be large. When the time window is small, the preset times are also set to be small, so as to capture a more complete behavior sequence, etc. This application does not make specific limitations.

[0174] In actual processes, the actual resource transfer behavior of a sample object in a sample time window may be exactly the preset number of times, or may exceed the preset number of times, or be less than the preset number of times. In the latter two cases, certain adjustments need to be made. The specific implementation methods are as follows:

[0175] (1) The actual number of resource transfers exceeds the preset number.

[0176] In this case, the most suitable resource transfer behavior construction sequence can be selected through screening to maintain the consistency of the sample. In the embodiment of the present application, the time-based screening method includes but is not limited to one or more of the following:

[0177] (1) Select the earliest resource transfer behaviors to capture the initial trend of the behaviors;

[0178] (2) Select the latest resource transfer behaviors to reflect the latest trend of the behaviors;

[0179] (3) Select several resource transfer behaviors at intervals in time sequence to reflect the behavior evolution of the entire time series;

[0180] (4) Randomly select resource transfer behaviors to avoid time deviation and ensure sample diversity.

[0181] In addition to the time factor, weighted selection can also be made based on the quantity, importance or risk of resource transfers, giving priority to retaining resource transfer behaviors with higher risks or more important and representative behaviors, thereby highlighting the key features in the sample; or screening can be based on object feedback, such as suspicious or erroneous resource transfer behaviors reported by other objects, which need to be investigated and corrected in a timely manner to maintain service quality and trust between objects.

[0182] It should be noted that the above-mentioned screening methods are just simple examples, and this article does not make any specific restrictions on the specific screening methods.

[0183] (2) The actual number of resource transfers is less than the preset number.

[0184] In this case, the missing behaviors can be filled in through a variety of supplementary methods to ensure the integrity and length consistency of the sample sequence.

[0185] In the embodiments of the present application, the supplementary methods include but are not limited to one or more of the following:

[0186] (1) Add zero behaviors at the end of the sequence to maintain the length of the sequence without introducing new behaviors;

[0187] (2) Repeating certain resource transfer behaviors, such as repeating the latest resource transfer behavior to continue the current behavior pattern and maintain temporal consistency;

[0188] (3) Generate additional behaviors through linear interpolation to smooth the transition and maintain the continuity of samples.

[0189] In addition, behaviors similar to the current sequence can be selected from the object's historical data for supplementation, thereby using existing data to fill in the gaps and ensure the rationality and authenticity of the sample.

[0190] It should be noted that the several supplementary methods listed above are just simple examples, and this article does not make any specific limitations on the specific supplementary methods.

[0191] In addition, it should be noted that in the embodiments of the present application, a batch processing method can be used when selecting training samples. Several training samples can be selected at a time, for example, 32 or 64, and the specific number can be adjusted according to the batch size (BatchSize). The selection of batch size depends on the available computing resources and memory size. A larger batch size can improve training efficiency. Batch Size is not specifically limited in this article.

[0192] After obtaining the training samples, a series of operations can be performed on the training samples, which are described in detail below:

[0193] S22: For each training sample, encode each resource transfer behavior contained in the training sample according to the corresponding behavior attribute to obtain a coding sequence; use the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; merge the obtained behavior features into a sequence fusion feature, input the trained abnormal behavior analysis model, and obtain the target behavior detection result, which represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window.

[0194] In the above process, two main models are involved: behavior feature extraction model and abnormal behavior analysis model. For each training sample, that is, each sample resource transfer behavior sequence, the input of the behavior feature extraction model is each sequence element contained in the encoding sequence (that is, the encoded sample resource transfer behavior sequence), which is used to extract the features of each resource transfer behavior from the encoded sample resource transfer behavior sequence, recorded as behavior features.

[0195] In this way, each behavior feature is merged into a sequence fusion feature corresponding to the sample resource transfer behavior sequence, and then input into the abnormal behavior analysis model. The abnormal behavior analysis model is used to analyze whether there is an abnormality in the resource transfer behavior of the sample object within the sample time window based on this sequence fusion feature, and output the target behavior detection result.

[0196] The following first introduces the encoding process of the sample resource transfer behavior sequence:

[0197] In the embodiment of the present application, the unit of the sample resource transfer behavior sequence refers to the resource transfer behavior of the sample object, each resource transfer behavior can be regarded as an action node, and a sample resource transfer behavior sequence includes multiple action nodes. The encoding of the sample resource transfer behavior sequence is implemented based on the behavior attribute, specifically, for each action node in the sequence, based on the specific way of implementing the action, the action is converted into a coded value, and the coded value can be a combination of one or more numbers, letters, symbols, etc., which is not specifically limited in this document.

[0198] Specifically, the behavior attributes of resource transfer behavior refer to the key features that can describe and distinguish different resource transfer behaviors. These features can be selected based on specific business backgrounds and domain knowledge, including but not limited to the following:

[0199] Resource transfer direction, resource transfer scenario, resource transfer method, relationship between the two parties of resource transfer, resource transfer time, resource transfer quantity, resource transfer channel, resource transfer type, and resource transfer geographical location.

[0200] Among them, the direction of resource transfer refers to the direction in which resources flow from one party to another, such as one-way, two-way, etc. The resource transfer scenario describes the specific situation or background in which resource transfer occurs, such as procurement, sales, investment, payment, donation, lease, repurchase, loan, etc. The resource transfer method involves how resources are transferred from one party to another, such as cash transactions, electronic payments, physical delivery, digital asset transfer, service exchange, etc. The relationship between the two parties of resource transfer refers to the relationship between the participants of resource transfer, such as buyers and sellers, partners, creditors and debtors, and affiliated companies. The time of resource transfer refers to the specific time point or time period when the resource transfer occurs. The amount of resource transfer describes the amount of resources transferred, which can be monetary value, number of items, service units, etc. The resource transfer channel refers to the path or medium through which the resource transfer passes, such as banking system, e-commerce platform, logistics network, blockchain, etc. The resource transfer type is used to classify the nature of resources, such as monetary funds, physical assets, intangible assets, equity, debt, etc. The transfer of different types of resources may be subject to different legal, financial and market rules. The geographical location of resource transfer refers to the location where the resource transfer occurs.

[0201] It should be noted that these attributes together constitute a complete picture of resource transfer behavior, and they have different weights and importance in different industries and business processes. In addition, the behavior attributes in the embodiments of the present application include but are not limited to the above forms, which will not be repeated here one by one.

[0202] According to the various behavioral attributes defined above, each resource transfer behavior can be converted into a standardized coding representation, thereby forming a unified coding sequence to facilitate subsequent model processing.

[0203] Optionally, after converting each resource transfer behavior into a standardized coding representation, the obtained coding value can be recorded as a behavior parameter, which can be a combination of one or more numbers, letters, symbols, etc. Therefore, all possible resource transfer behaviors with different attributes can be considered, thereby pre-building a behavior parameter set, and the subsequent encoding process only needs to find the behavior parameter set.

[0204] There are many ways to construct behavior parameter sets. Here are a few simple examples:

[0205] Construction method 1: predefined combination mapping method.

[0206] In an optional embodiment, the behavior parameter set can represent some predefined behavior attribute combinations, and each behavior parameter represents a predefined behavior attribute combination, that is, a resource transfer behavior sequence of an attribute. In this method, each behavior attribute can be preset to define some possible attribute values, and the behavior parameter set is generated by permuting and combining all predefined possible attribute values. The specific process is as follows:

[0207] First, clearly define all possible behavior attributes and their values ​​(i.e., attribute values); then, arrange and combine all defined behavior attributes and their values ​​to generate all possible behavior attribute combinations, which will cover every theoretically possible resource transfer behavior; finally, map each possible combination into a unique behavior parameter.

[0208] The methods for mapping each possible combination to a unique behavior parameter include but are not limited to: hash mapping, encoding schemes such as binary encoding or index-based mapping, etc. For example, hash mapping can map different combinations to unique hash values; binary encoding can convert combinations into binary strings through bit operations; index-based mapping assigns a unique integer index to each combination; etc. These methods can achieve effective mapping from combinations to unique parameters. Here are just simple examples, and this article will not go into details one by one.

[0209] Taking the online payment scenario as an example, the unit of the sample resource transfer behavior sequence is the transaction behavior of the sample object. For example, the transaction behavior of the sample object includes registration, deregistration, payment, collection, card binding, etc. In fact, a complete description of a single action also requires rich features. For example, a transaction behavior of a sample object can include: transaction direction, transaction scenario, transaction amount and other behavioral attributes. Therefore, for a specific scenario, it is necessary to select some preset behavioral attributes and preset the possible attribute values ​​of each behavioral attribute. Later, the abstract transaction behavior can be mapped to a combination of these behavioral attributes.

[0210] like Figure 3As shown, it is a schematic diagram of a behavior attribute and its attribute value in an embodiment of the present application. Figure 3 The CPC lists six transaction behavior attributes and the predefined attribute values ​​corresponding to each behavior attribute:

[0211] (1) Transaction direction: used to distinguish the basic nature of transactions, such as Figure 3 , assuming that the attribute values ​​are: withdrawal, receipt, cash withdrawal, payment, a total of 4 types.

[0212] (2) Transaction scenario: describes the specific situation in which the transaction occurs and reflects the purpose and method of the transaction, such as Figure 3 , assuming that the attribute values ​​are: ordinary transfer, face-to-face transfer, red envelope, commercial payment, and credit card, a total of 5 types.

[0213] (3) Payment method: describes the means of payment used by the object and reflects the payment channel of the transaction. Assume that the attribute values ​​are: quick payment, balance payment, and zero-balance payment, a total of 3 types.

[0214] (4) Relationship between the two parties in the transaction: such as friendship time (e.g., how long the two parties have been friends), geographical information of the two parties (e.g., whether they are in the same city), etc. This information can reveal the social relationship and geographical relevance of the transaction, such as Figure 3 , assuming that the attribute values ​​are: non-friend and non-same city, friend and same city, friend and non-same city, non-friend and same city, a total of 4 types.

[0215] (5) Transaction time: records the specific time when the transaction occurs. In the embodiment of the present application, the hour is recorded as an example to capture time patterns and anomalies, such as Figure 3 , assuming that the attribute values ​​are: 1 o'clock, 2 o'clock, 3 o'clock, ..., 24 o'clock (24 hours in a day), a total of 24 types.

[0216] (6) Transaction amount: In the embodiments of the present application, the amounts are grouped and discretized according to certain rules to standardize the amounts of different transactions, thereby facilitating analysis and comparison. Figure 3 , assuming that the attribute values ​​are: amount group 1, amount group 2, amount group 3, a total of 3 types.

[0217] In this case, all defined behavior attributes and their values ​​are arranged and combined to generate all possible behavior attribute combinations, which are 4×5×3×4×24×3=17280 in total.

[0218] The following uses the description string to represent the behavior attribute combination as an example to briefly list several behavior attribute combinations:

[0219] If the attribute values ​​of a transaction behavior are "withdrawal", "normal transfer", "balance payment", "non-friend and non-same city", "12 o'clock", and "amount group 1", it can be represented as a description string "withdrawal_normal transfer_balance payment_non-friend and non-same city_12 o'clock_amount group 1", which fully describes the various behavior attributes of the transaction behavior.

[0220] For another example, the attribute values ​​of a transaction behavior are "collection", "face-to-face transfer", "quick payment", "friends in the same city", "13 o'clock", and "amount group 2", which can be represented by the description string "collection_face-to-face transfer_quick payment_friends in the same city_13 o'clock_amount group 2".

[0221] By analogy, other behavior attribute combinations can be obtained, such as "Withdrawal_Commercial Payment_Zero Money_Non-Friend Non-Same City_14:00_Amount Group 3"; "Payment_Red Packet_Credit Card_Non-Friend Same City_10:00_Amount Group 1"; "Receiving_Ordinary Transfer_Zero Money_Friend Same City_11:00_Amount Group 2"; "Withdrawal_Commercial Payment_Quick Payment_Non-Friend Non-Same City_15:00_Amount Group 3"; "Payment_Face-to-face Transfer_Balance_Friend Non-Same City_12:00_Amount Group 1"; ...

[0222] Based on the limited combination of the above-mentioned behavior attributes, trading behaviors of all possible attributes are constituted. By combining all possible trading behavior attributes together, a behavior parameter set can be mapped. Each behavior parameter in this set represents a unique description string. Different behavior parameters represent different trading behavior patterns, that is, trading behaviors of different attributes.

[0223] For example, when constructing a behavior parameter set, each possible description string can be uniformly encoded and mapped to integers between 1 and N, where N represents the number of behavior parameters contained in the behavior parameter set, that is, the number of behavior attribute combinations. The mapping process can be completed by random allocation or based on a certain order to ensure that each description string has a unique integer code, that is, a unique behavior parameter.

[0224] like Figure 4 As shown, it is a schematic diagram of a mapping relationship between a description string and a behavior parameter set in an embodiment of the present application. Specifically, Figure 4 The behavior parameters corresponding to each combination of behavior attributes represented by a description string are listed as follows:

[0225] “Withdrawal_Normal transfer_Balance_Non-friend non-same city_12 o’clock_Amount group 1” is coded as “1”;

[0226] “Receipt_Face-to-face transfer_Quick payment_Friends in the same city_13:00_Amount group 2” is coded as “2”;

[0227] "Withdraw_Commercial Payment_Zero Money_Non-Friend Non-Same City_14:00_Amount Group 3" is coded as "3";

[0228] “Payment_Red Envelope_Credit Card_Non-Friends in the Same City_10 Points_Amount Group 1” is coded as “4”;

[0229] “Receiving_Ordinary Transfer_Zero Money_Friends in the Same City_11:00_Amount Group 2” is coded as “5”;

[0230] “Withdrawal_Commercial Payment_Quick Payment_Non-Friend Non-Same City_15 Points_Amount Group 3” is coded as “6”; and so on…

[0231] Finally, “Payment_Face-to-face transfer_Balance_Friends not in the same city_12 o’clock_Amount group 1” is coded as “N”.

[0232] It should be noted that the above is just a simple example. In addition to encoding as an integer, it can also be in other forms, such as letters, a combination of letters and numbers, etc. Of course, in online payment scenarios, it is not limited to the above-mentioned behavior attributes. This is just a simple example. In actual applications, the above-mentioned behavior attributes can be selectively used or not used as needed, and new behavior attributes can be added according to the business background. For example, the technical implementation method of the transaction behavior and the transaction channel that the object is accustomed to can be reflected. The attribute values ​​can be: mobile application, web platform, third-party payment interface, etc. This article does not make specific restrictions on this.

[0233] The above approach ensures that the behavior parameter set covers all possible situations and is suitable for systems that need to perform extensive adaptive analysis in different scenarios. For example, if the system needs to identify any possible abnormal behavior, regardless of whether it has appeared in historical data, this full coverage approach is very effective.

[0234] Construction method 2: sample-based combination mapping method.

[0235] In another optional embodiment, the behavior parameter set can also be constructed based on the combination of behavior attributes contained in all training samples. In this method, the behavior parameter set is generated based on the combination of attribute values ​​existing in the training samples during actual training. Compared with the above construction method 1, the only difference is the way of determining the behavior attribute combination:

[0236] The sample-based behavior attribute combination method needs to analyze the sample data to determine which behavior attributes and values ​​actually appear in the resource transfer behavior of the sample object. In this way, the generated behavior attribute combination will be determined based on the existing data rather than all possible combinations.

[0237] The above method only generates combinations that have appeared in actual samples, reducing the number of unnecessary combinations and improving the efficiency of encoding and processing. This method is more suitable for analyzing and processing existing behavior patterns, especially when historical data is sufficient and stable, and can quickly generate effective behavior parameter sets.

[0238] It should be noted that the above-mentioned methods for constructing the several behavior parameter sets are just simple examples, and other methods are also applicable to the embodiments of the present application, and this document does not make specific limitations on this.

[0239] Based on the behavior parameter set listed above, an optional encoding method is as follows:

[0240] For each resource transfer behavior contained in a training sample, the resource transfer behavior is mapped to a behavior parameter in a preset behavior parameter set according to the behavior attribute of the resource transfer behavior. Then, the sequence composed of the obtained behavior parameters can be used as the coding sequence corresponding to the training sample, wherein each behavior parameter is a sequence element in the coding sequence.

[0241] Among them, resource transfer behaviors of different attributes correspond to different behavior parameters, so each behavior parameter uniquely identifies a resource transfer behavior of one attribute. It should be noted here that there are many behavior attributes listed above. In the embodiment of the present application, if two resource transfer behaviors differ in one of the behavior attributes (such as the number of resource transfers), the two resource transfer behaviors can be considered to be resource transfer behaviors of two attributes.

[0242] Specifically, this process involves mapping each resource transfer behavior to a predefined set of behavior parameters according to the behavior attributes listed above, such as transfer direction, method, time, etc., so that each resource transfer behavior can be represented as a parameter. Subsequently, the parameters of each resource transfer behavior in the training sample are concatenated into a sequence to form a coding sequence of the training sample, where each sequence element represents a behavior parameter. This conversion not only retains the details of the resource transfer behavior, but also makes it suitable for model training, helping the algorithm learn and predict complex transaction patterns.

[0243] Still Figure 3 and Figure 4 Taking the enumerated scenario as an example, assuming that the length of the sample resource transfer behavior sequence is 10, then the transaction behavior sequence consisting of 10 transaction behaviors can be encoded into a coding sequence of length 10, where the coding result of each transaction behavior is an integer from 1 to N.

[0244] like Figure 5As shown, it is a schematic diagram of a transaction behavior sequence and its corresponding coding sequence in an embodiment of the present application. Figure 5 The transaction behavior sequence listed on the left contains 10 transaction behaviors. These transaction behaviors are arranged from top to bottom, representing the order in which the transaction behaviors occur. In this way, we can see how the transaction behavior of the object changes over time.

[0245] in, Figure 5 The description strings of the 10 listed transaction behaviors are: "Receipt_Face-to-face transfer_Quick payment_Friends in the same city_13 o'clock_Amount group 2", "Withdrawal_Commercial payment_Zero-Balance_Non-friends and non-same city_14 o'clock_Amount group 3", "Receipt_Ordinary transfer_Zero-Balance_Friends in the same city_11 o'clock_Amount group 2", "Withdrawal_Ordinary transfer_Balance_Non-friends and non-same city_12 o'clock_Amount group 1", "Payment_Red envelope_Credit card_Non-friends in the same city_10 o'clock_Amount group 1", "Payment_Face-to-face transfer_Balance_Friends in non-same city_12 o'clock_Amount group 1", "Receipt_Face-to-face transfer_Quick payment_Friends in the same city_13 o'clock_Amount group 2", "Withdrawal_Commercial payment_Zero-Balance_Non-friends and non-same city_14 o'clock_Amount group 3", "Receipt_Ordinary transfer_Zero-Balance_Friends in the same city_11 o'clock_Amount group 2", "Withdrawal_Commercial payment_Zero-Balance_Non-friends and non-same city_14 o'clock_Amount group 3", combined with the above Figure 4 It can be found from the listed behavioral parameter sets that the behavioral parameters corresponding to these 10 trading behaviors are: 2, 3, 5, 1, 4, 7, 2, 3, 2, 3.

[0246] Depend on Figure 5 It can be seen that when certain transaction behaviors have the same attributes, that is, when the description strings are the same, the corresponding behavior parameters are also the same. For example, the 1st and 7th transaction behaviors occurred on different dates (such as the 1st and the 7th), but the description strings are the same, so their corresponding behavior parameters are both 2. Another example is the 2nd and 8th transaction behaviors. The two transactions still occurred on different dates (such as the 2nd and the 8th), but the description strings are the same, so their corresponding behavior parameters are also 3. This is because in the encoding process, time information only considers the hour position. Therefore, although these transaction behaviors occurred on different dates, they occurred within the same hour and had the same other attributes, so they were encoded as the same behavior parameters.

[0247] In the above implementation, by constructing a behavior parameter set and mapping each resource transfer behavior to a unique code, standardized processing of complex behavior attributes is achieved, allowing subsequent analysis and detection. On this basis, based on a predefined behavior parameter set and the behavior attributes of each resource transfer behavior, each resource transfer behavior can be represented as a unique coding value, which can not only closely associate the various attributes of the resource transfer behavior, but also effectively distinguish different behavior patterns. Through the standardized coding of resource transfer behavior, the behavior feature extraction model and abnormal behavior detection model in the embodiment of the present application can efficiently process large amounts of data, further improving the analysis capability and processing efficiency of the model, and achieving simpler and more efficient feature processing.

[0248] For each training sample, after the sample resource transfer behavior sequence is converted as a whole into a numerical value or symbol suitable for model processing in the above manner, it can be input into the behavior feature extraction model to be trained for feature extraction.

[0249] The input of the behavior feature extraction model is the sequence elements contained in the coding sequence, and the output is the behavior features corresponding to each sequence element.

[0250] Taking into account the temporal dependencies between resource transfer behaviors, the behavior feature extraction model in the embodiment of the present application includes but is not limited to two parts: an embedding layer and a recurrent neural network (RNN), where the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence.

[0251] Still Figure 5 Taking the coding sequence shown as an example, the coding sequence contains ten sequence elements. Correspondingly, the behavior feature extraction model contains ten recurrent neural network layers. Each layer processes the embedded features of a sequence element and combines the behavior features of the previous sequence element to finally extract the complete behavior features of the sequence element for further analysis.

[0252] For another example, if the encoding sequence contains 5 sequence elements, the behavior feature extraction model contains 5 recurrent neural network layers; if the encoding sequence contains 15 sequence elements, the behavior feature extraction model contains 15 recurrent neural network layers; and so on. The following article takes the encoding sequence containing 10 sequence elements as an example.

[0253] It should be noted that in the embodiment of the present application, the length of the encoding sequence is the same as the length of the (sample) resource transfer behavior sequence before encoding. In the model training part, after this length is set, the number of recurrent neural network layers in the feature extraction model is fixed, and the subsequent model application part remains consistent with the model training part.

[0254] Based on the above-listed behavior feature extraction models, when extracting behavior features, an optional implementation method is as follows:

[0255] For each sequence element in the encoding sequence, the behavior feature extraction model embeds the sequence element through the embedding layer to obtain the embedding feature of the sequence element. Then, the corresponding recurrent neural network layer is used to fuse the embedding feature of the sequence element with the behavior feature of the previous sequence element to extract the behavior feature of the sequence element.

[0256] There are many ways to implement the behavior feature extraction model to extract high-dimensional embedding features of each sequence element in the encoding sequence through the embedding layer. The following are a few examples:

[0257] Embedding method 1: Use the embedding layer to randomly map the sequence elements to obtain the embedding features corresponding to the sequence elements.

[0258] In this process, the embedding layer is mainly used to map each sequence element in the encoded resource transfer sequence (i.e., the encoding sequence) into a high-dimensional embedding vector. Specifically, the embedding layer can be used to randomly map the sequence elements to obtain the embedding features corresponding to the sequence elements, which can be an embedding vector of a preset dimension.

[0259] Taking the integers listed above as an example, the original integer encoding is only a simple discrete representation of resource transfer behavior, and the embedding layer maps these integers into richer vector representations through learning, so that each behavior feature can be expressed in a continuous high-dimensional space.

[0260] Under this embedding method, since the initial embedding features are obtained through random mapping, in order to ensure the semantic consistency of the embedded features in the high-dimensional space, when adjusting the parameters of the behavior feature extraction model, it is necessary to synchronously adjust the embedding features obtained by random mapping each sequence element, and after the training is completed, the embedding features corresponding to each possible sequence element are composed into an embedding feature table, so that in the model application part, the embedding features of each sequence element can be determined according to the embedding feature table.

[0261] Taking sequence elements as behavior parameters as an example, "possible sequence elements" refer to all behavior parameters existing in the behavior parameter set.

[0262] It should be emphasized here that since the training process of the behavior feature extraction model requires cyclic iteration, for each sequence element, when the sequence element is embedded, the initial round can be randomly mapped based on the embedding layer, and the subsequent rounds are obtained on the basis of the previous rounds after adjustment.

[0263] For example, for sequence element 2, the initial round randomly maps this sequence element 1 to obtain the embedding vector a1, and then when the parameters are adjusted, a1 is synchronously adjusted to a2. If the sequence element 2 still needs to be embedded in the subsequent rounds, the embedding vector a2 is obtained. Similarly, when the parameters are adjusted, a2 is synchronously adjusted to a3. Then, if the sequence element 2 still needs to be embedded in the later rounds, the embedding vector a3 is obtained, and so on.

[0264] After the training is completed, the embedded features corresponding to each sequence element will no longer change. These sequence elements and their corresponding embedded features can form an embedded feature table, as shown in Table 1 below. The embedded feature table stores the embedded features corresponding to all possible sequence elements (that is, all possible resource transfer behaviors of attributes). In this way, in the subsequent model application part, the embedded features of the sequence elements can be directly determined by table lookup, which reduces the calculation time of the inference stage and improves the prediction efficiency of the model. In addition, this table lookup method can avoid the uncertainty brought by real-time calculation, ensure the consistency and stability of feature mapping, and reduce the resource consumption of the model when processing large-scale data, thereby improving the overall response speed and performance.

[0265] Embedding method 2: Use other algorithms to learn the embedding representation of sequence elements.

[0266] Specifically, some existing networks with embedding representation capabilities can be used as embedding layers to embed sequence elements, such as word vectors (Word to Vector, word2vec), bidirectional encoder representations (Bidirectional Encoder Representations from Transformers, BERT), A Robustly Optimized BERT Pretraining Approach (RoBERTa), and so on.

[0267] Taking Word2Vec as an example, Word2Vec is a model that converts text into numerical vectors. It learns the relationship between words by analyzing a large amount of text. It includes two architectures: the Continuous Bag of Words (CBOW) model and the Skip-gram model. This article can use any architecture to map sequence elements into embedded vectors.

[0268] In this embedding method, when adjusting the parameters of the behavior feature extraction model, the network parameters of the embedding layer will be adjusted to ensure that when the training elements are mapped to the vector space, the vector distances of similar sequence elements are close, effectively capturing the feature information.

[0269] It should be noted that the above two embedding methods are just simple examples. In addition, other embedding methods are also applicable to the embodiments of the present application and will not be described in detail here.

[0270] For a coding sequence, after extracting the embedded features of each sequence element in the coding sequence by any of the above methods, the corresponding recurrent neural network layer can be used to fuse the embedded features of each sequence element with the behavioral features of the previous sequence element to extract the behavioral features of the current element. Among them, the embedded features and the behavioral features are both in the form of vectors, so an optional implementation is as follows:

[0271] For a sequence element, the embedding feature of this sequence element and the corresponding position in the behavioral feature of its previous sequence element are added to obtain the element fusion feature; then, the recurrent neural network layer is used to extract the feature of this element fusion feature to obtain the behavioral feature of this sequence element.

[0272] It should be noted that for the first sequence element in the encoding sequence, since there is no previous sequence element, it is impossible to provide a behavioral feature of a sequence element. Therefore, when extracting the behavioral feature of the first sequence element, the behavioral feature of the previous sequence element corresponding to it can be represented as a zero vector or other fixed non-zero vector. This means that when the model processes the first sequence element, it will not be affected by the previous sequence element, but only depends on the characteristics of the sequence element itself.

[0273] In addition, a special marker or vector is also used to indicate the beginning of the sequence, so that the model can learn how to deal with the beginning of the sequence instead of just relying on the zero vector. Alternatively, the dependency of the first sequence element can be ignored. In this case, the recurrent neural network can be designed as a bidirectional recurrent neural network (Bi-RNN), in which the representation of each sequence element depends on both future sequence elements and past sequence elements, and so on.

[0274] Still Figure 5 Taking the coded sequence listed above as an example, after extracting the embedded features of each sequence element in the coded sequence, the embedded features of each sequence element can be fused with the behavioral features of the previous sequence element to obtain the behavioral features of the sequence element. Figure 6As shown, a schematic diagram of the feature processing process of a behavior feature extraction model in an embodiment of the present application is shown. The input of the behavior feature extraction model is a coding sequence, which contains a total of 10 sequence elements, namely sequence elements 1 to 10. Correspondingly, there are a total of 10 recurrent neural network layers in the behavior feature extraction model, namely recurrent neural network layers 1 to 10.

[0275] First, each sequence element in a coded sequence is input into the embedding layer respectively to extract the embedded features. Then, for each sequence element, its embedded features and the behavioral features of its previous sequence element are input into the recurrent neural network layer corresponding to the current sequence element respectively to extract the corresponding behavioral features.

[0276] Specifically, in each recurrent neural network layer, the input embedding features and the corresponding position elements in the behavioral features of the previous sequence element are added to obtain a new feature vector, called the "element fusion feature". This addition operation can effectively fuse the information of the current transaction with the information of the previous transaction, reflecting the correlation between the previous and subsequent behaviors in the time series. Finally, the recurrent neural network layer is used to extract the obtained "element fusion feature" to finally obtain the behavioral features of the sequence element.

[0277] Based on the above process, the behavior features finally obtained not only contain the characteristic information of the current resource transfer behavior, but also reflect its temporal relationship and context information in the entire resource transfer behavior sequence.

[0278] In another optional embodiment, the backbone network used to fuse time series features in the behavior feature extraction model can also be replaced from a recurrent neural network to a long short-term memory network (Long Short-Term Memory, LSTM). LSTM can better capture long-term dependencies and effectively prevent the gradient vanishing problem by introducing a memory cell (Cell State) and three gate structures (input gate, forget gate, output gate).

[0279] In LSTM, the input of each sequence element includes not only the current embedded features, but also the behavioral features from the previous sequence element. For each sequence element, the specific feature extraction logic is as follows:

[0280] First, LSTM uses the input gate to determine how many new embedded features (i.e., the embedded features of the current sequence element) need to be added to the memory state of the current unit; then, the forget gate determines how many behavioral features from the previous sequence element need to be retained or discarded, thereby selectively remembering or forgetting the information of the previous sequence element. Then, LSTM updates the memory state of the current sequence element, and this memory state is passed to the next sequence element as one of the inputs. Finally, through the output gate, LSTM outputs the behavioral features of the current sequence element.

[0281] Based on the above process, the behavior feature finally obtained combines the embedding feature of the current sequence element with the previous behavior feature, reflecting the feature evolution of the entire sequence at the current sequence element. This process is repeated on each sequence element of the sequence until the entire encoding sequence is traversed, thereby generating the behavior feature of each sequence element.

[0282] In the above implementation, LSTM is used as the backbone network for fusing time series features. LSTM has better stability and effect when processing long sequence data, and can more accurately retain and transmit important behavioral features, so that the system can more accurately perform anomaly detection and behavior prediction when facing complex time series data.

[0283] It should be noted that the network structure of the behavior feature extraction model listed above is just a simple example. In addition, other behavior feature extraction models that can fuse the timing features of adjacent sequence elements are also applicable to the embodiments of the present application. The specific settings of this model are not specifically limited in this article.

[0284] The above introduces in detail the internal processing logic of the behavior feature extraction model. Based on the behavior feature extraction model, the behavior features of each resource transfer behavior in each sample resource transfer behavior sequence can be extracted, and the behavior features are obtained after fusing the embedded features of each sequence element with the behavior features of its previous sequence element. It can reflect the key attributes and time changes of the resource transfer behavior. The behavior feature extraction model trained in this way can effectively capture the temporal dependencies and contextual information of resource transfer behaviors.

[0285] For a sample resource transfer behavior sequence, after obtaining the behavior features of each resource transfer behavior based on the behavior feature extraction model, the obtained behavior features can be merged into sequence fusion features and input into the abnormal behavior analysis model to be trained to obtain the target behavior detection results.

[0286] The target behavior detection result in the embodiment of the present application refers to the detection result output by the abnormal behavior analysis model in the model training part. For the sake of simple distinction, during the staged training, the detection result output by the behavior feature extraction model can be recorded as the pre-behavior detection result; and in the subsequent model application part, it is only necessary for the abnormal behavior analysis model to output the final detection result, which is recorded as the behavior detection result in this article.

[0287] Regardless of which of the above detection results is, it is characterized by the predicted probability that the corresponding object has abnormal behavior within the corresponding time window.

[0288] In the detection process of the abnormal behavior analysis model, its input is a sequence fusion feature formed by merging multiple extracted behavior features. In an embodiment of the present application, the merging of behavior features specifically refers to combining the behavior features of each resource transfer behavior to form a new feature that can comprehensively reflect the characteristics of the entire resource transfer behavior sequence, namely, a "sequence fusion feature". This sequence fusion feature can reflect the overall trend, pattern characteristics, abnormal behaviors, and coherence and consistency between behaviors of the entire resource transfer behavior sequence, which helps to more comprehensively describe the overall characteristics of the resource transfer behavior sequence and improve the accuracy and effectiveness of subsequent analysis (such as anomaly detection, risk assessment, etc.).

[0289] Among them, the behavior features can be merged in a way that multiple behavior vectors are combined into a matrix. As mentioned above, for example, if each embedded feature is an embedded vector, then correspondingly, each behavior feature is also a behavior vector. Then, each behavior vector is regarded as a row, and they can be merged to obtain a matrix with multiple rows, that is, the sequence fusion feature in this article, which is actually a sequence fusion matrix, and the number of rows of the matrix is ​​the same as the length of the resource transfer behavior sequence.

[0290] In addition, the behavior features may also be merged by concatenating multiple behavior vectors, or performing average pooling, maximum pooling, etc. This article does not make specific limitations on this.

[0291] For a sample resource transfer behavior sequence, after obtaining its corresponding sequence fusion feature, it can be input into the abnormal behavior analysis model to be trained for classification, so as to output the target behavior detection result for the sample resource transfer behavior sequence.

[0292] Optionally, the abnormal behavior analysis model includes a transformer and a second fully connected layer. Therefore, when the obtained behavior features are merged into a sequence fusion feature and input into the abnormal behavior analysis model to be trained, the specific processing process is as follows:

[0293] First, the obtained behavior features are merged into sequence fusion features, and then the transformer is used to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features. Figure 7 As shown, it is a schematic diagram of a feature processing process of an abnormal behavior detection model provided in an embodiment of the present application. Figure 7 The transformer listed in the figure contains M transformer layers, each of which is denoted as transformer layer 1, ..., transformer layer M. The input of each layer except the first layer is the output of the previous layer, and the output result of the last layer is the attention weighted feature in this paper. Finally, the second fully connected layer in the abnormal behavior detection model is used to perform feature mapping on the attention weighted feature to obtain the target behavior detection result. The target behavior detection result represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window.

[0294] It should be noted that the second fully connected layer here is to distinguish it from the first fully connected layer in the behavior feature extraction model to be trained during staged training. Since the first fully connected layer in the behavior feature extraction model is no longer needed in the model application part, it is only necessary to use the behavior feature extraction model to extract each behavior feature. Therefore, in the model application part, the fully connected layer is no longer distinguished, and the trained abnormal behavior analysis model can be directly recorded as the fully connected layer.

[0295] See also Figure 8 As shown, it is a model schematic diagram of a behavior feature extraction model and an abnormal behavior analysis model in an embodiment of the present application. Among them, the input of the behavior feature extraction model is a coding sequence, which contains a total of 10 sequence elements, namely sequence elements 1 to 10. Correspondingly, there are a total of 10 recurrent neural network layers in the behavior feature extraction model, namely recurrent neural network layers 1 to 10. Based on the processing of each embedding layer and recurrent neural network layer, the behavior features of the 10 sequence elements can be extracted. The specific processing process will not be repeated here. The input of the abnormal behavior analysis model is the sequence fusion feature obtained by merging the N behavior features output by the above-mentioned behavior feature extraction model, and then the transformer is used to perform attention transformation fusion processing on the sequence fusion feature. Figure 7 same, Figure 8 The transformer shown has M layers, and the output of the last layer is the attention weighted feature in this paper. In this process, the transformer can use the multi-head attention mechanism to assign different weights to different parts of the sequence fusion features, thereby highlighting important behavioral features. Finally, the second fully connected layer is used to perform feature mapping on the attention weighted features to obtain the behavior detection result, which is the target behavior detection result.

[0296] It should be noted that the input of the transformer in the embodiment of the present application is the sequence fusion feature, the sequence fusion feature is subjected to attention transformation fusion processing, and the final output is the attention weighted feature.

[0297] Unlike traditional converters, which only use the position information of the sequence by fusing position coding, the mining degree of position information is relatively weak, while the converter in the embodiment of the present application does not need to calculate the position coding vector and fuse it into the input feature. Because the coding sequence is processed by the recurrent neural network in the above-mentioned behavior feature extraction model, each resource transfer behavior (such as transaction behavior) has been integrated with the information of its previous resource transfer behavior, so that the position information is naturally included in the behavior feature, thus eliminating the process of combining the position coding vector in the traditional converter, making up for the limitation of the converter's weak use of position information, and strengthening the model's mining ability of the temporal features of the object resource transfer behavior sequence. In this case, the model can more effectively capture the temporal dependencies between resource transfer behaviors, thereby improving the accuracy of abnormal behavior detection.

[0298] In the embodiment of the present application, the number of layers of the converter can be one or more layers, and the number of layers M can be flexibly set according to experience or demand, and may also be set according to computing resources, etc., which is not specifically limited herein. For example, the number of layers of the converter can be set to 6 layers.

[0299] In addition, considering that the output of the transformer is an attention-weighted feature, the predicted probability of abnormal behavior of the object in the corresponding sample time window needs to be obtained in the end, so feature mapping can also be performed through the fully connected layer (FC). The fully connected layer maps the attention-weighted feature to a scalar value, which can be between 0 and 1, indicating the predicted probability of abnormal behavior of the sample object. This probability value is used to determine whether the object has abnormal behavior in the specified time window. The larger the probability value, the greater the probability of abnormal behavior, thereby providing a basis for subsequent risk control and decision-making. On this basis, different probability intervals can also be divided according to thresholds, and each probability interval corresponds to a different risk level, and so on.

[0300] Of course, if the above sample labels are multi-classification labels, then the behavior detection results in this article will contain multiple probability values. For example, when classified according to risk levels, such as "low risk", "medium risk" and "high risk", three probabilities will be output, indicating the probability that the object's behavior has "low risk", "medium risk" and "high risk" respectively. The sum of these three probabilities can be 1, and the result corresponding to the highest probability will be taken as the final result, and so on.

[0301] Of course, the same applies to other cases. This article does not make specific restrictions. The following mainly takes binary classification as an example for specific explanation:

[0302] S23: According to the obtained target behavior detection results and corresponding sample labels, the parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted; the trained behavior feature extraction model and abnormal behavior analysis model are used to predict the abnormal behavior risk of the detected object.

[0303] In the embodiment of the present application, in order to ensure that the model can fully learn the sequence features and improve the accuracy of abnormal behavior detection, the training process of the behavior feature extraction model and the abnormal behavior analysis model in the present application can include two main training stages, including pre-training for the behavior feature extraction model in the first training stage, and training for the abnormal behavior analysis model in the second training stage. In these two training stages, the inputs are different, the outputs are different, and the adjusted parameters are also different.

[0304] In the first training stage, the input is the coding sequence obtained based on the coding process, and the output is the behavioral features of each sequence element, and only the parameters of the behavioral feature extraction model are adjusted. In the second training stage, the input is the behavioral features obtained based on the behavioral feature extraction model, and the sequence fusion features obtained by fusion are output as the behavior detection results, and the parameters of the behavioral feature extraction model and the abnormal behavior analysis model are adjusted.

[0305] Specifically, in an embodiment of the present application, the output of the multi-layer recurrent neural network is the behavioral features corresponding to multiple sequence elements. Taking into account that the recurrent neural network has the ability to accumulate contextual information, when pre-training the behavioral feature extraction model, you can choose to use the behavioral features of the last sequence element as the input for subsequent processing. The behavioral features of the last sequence element not only contain the behavioral feature information of the current sequence, but also integrate the historical behavioral feature information in the entire sequence element. Taking into account the need to train the behavioral features of the last sequence element, the embodiment of the present application inputs it into the fully connected layer for feature mapping. The fully connected layer here is recorded as the first fully connected layer.

[0306] Optionally, for each training sample, after extracting the behavioral features of each sequence element contained in the corresponding coding sequence based on the behavioral feature extraction model, it is also necessary to use the first fully connected layer to perform feature mapping on the behavioral features of the last sequence element in the corresponding coding sequence to obtain a pre-behavior detection result. The pre-behavior detection result indicates: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window.

[0307] See also Fig. 9 As shown, it is a structural diagram of a behavior feature extraction model in an embodiment of the present application. Fig. 9The behavior feature extraction model shown also includes a first fully connected layer. The input of the behavior feature extraction model is a coding sequence, which contains a total of 10 sequence elements, namely sequence elements 1 to 10. Correspondingly, there are a total of 10 recurrent neural network layers in the behavior feature extraction model, namely recurrent neural network layers 1 to 10. Based on the processing of each embedding layer and recurrent neural network layer, the behavior features of the 10 sequence elements can be extracted, wherein the output of the recurrent neural network layer 10 will be further input into the first fully connected layer for feature mapping, and the pre-behavior detection result will be output.

[0308] The fully connected layer in the embodiment of the present application, whether it is the first fully connected layer or the second fully connected layer, is responsible for mapping the features extracted by the previous layer to specific categories, and the categories corresponding to the labels are also consistent.

[0309] like Fig. 9 As shown, in the first fully connected layer, the behavior vector output by the recurrent neural network layer 10 is multiplied by the weight matrix in the FC layer, and the bias term is added to generate a new vector. This vector is transformed by an activation function (such as sigmoid or softmax) to obtain one or more scalar values. Taking binary classification as an example, a scalar value is obtained, which represents the predicted probability that the corresponding sample object has abnormal behavior in the corresponding sample time window. It may be a value between 0 and 1, indicating the possibility that the sample object exhibits abnormal behavior in a given time window.

[0310] On this basis, in general, it is necessary to adjust the parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and pre-behavior detection results and the corresponding sample labels. But specifically, the behavior feature extraction model and the abnormal behavior analysis model are adjusted in stages. The following is a detailed description of these two training stages:

[0311] See also Fig.10 As shown, it is a schematic diagram of the phased training process of a behavior feature extraction model and an abnormal behavior analysis model in an embodiment of the present application. The specific implementation process of the method is as follows S101 to S106:

[0312] S101: randomly selecting a plurality of first training samples from a training sample set.

[0313] S102: For each first training sample, encode each resource transfer behavior included in the first training sample according to a corresponding behavior attribute to obtain a coding sequence.

[0314] In this step, the specific sequence encoding process is as described above and will not be repeated here.

[0315] S103: For each first training sample, the obtained coding sequence and its corresponding sample label are input into the behavior feature extraction model to be trained, and the parameters of the behavior feature extraction model are adjusted according to the pre-behavior detection result output by the first fully connected layer in the behavior feature extraction model.

[0316] The above S101 to S103 belong to the first training stage in the embodiment of the present application, which is an iterative training process until the iteration termination condition is met. The training in this stage mainly targets the basic feature extraction capability of the model. By processing the coding sequence, the key behavioral features in the sequence are extracted. For the sample labels, please refer to the above. Taking the binary classification as an example, the sample label is 1, which means that the sample object has abnormal behavior within the sample time window, and the sample label is 0, which means that the sample object does not have abnormal behavior within the sample time window. The main goal of this stage is to enable the behavioral feature extraction model to accurately identify and extract the timing characteristics and contextual association information of each resource transfer behavior from the sequence.

[0317] The training data in this stage uses <sample encoding sequence, sample label> pairs, such as <transaction behavior encoding sequence, sample label> pairs in online transaction scenarios, to generate behavioral features of transaction behavior sequences and pre-train the behavioral feature extraction model. In this way, the model can learn different resource transfer behaviors and their feature representations, providing accurate and effective input for subsequent anomaly detection models.

[0318] Then S103 of the first training stage may include the following steps S1031 to S1033:

[0319] S1031: Using the first fully connected layer, feature mapping is performed on the behavior feature of the last sequence element in the corresponding coding sequence to obtain a pre-behavior detection result.

[0320] Among them, the first fully connected layer is used to further map the behavioral features of the last sequence element extracted by the recurrent neural network into a scalar value, which is recorded as the pre-behavior detection result. The mapping result of the second fully connected layer is the same as the above, and will not be repeated here.

[0321] Specifically, this pre-behavior detection result is used to calculate the loss function during back propagation, so as to adjust the model parameters and optimize the accuracy of feature extraction. By compressing the feature dimension, the complex behavior features are converted into concise numerical outputs, which facilitates the training and optimization of the model. The specific process is as follows:

[0322] S1032: Determine a first loss value according to a difference between a pre-behavior detection result obtained by the first fully connected layer and a corresponding sample label.

[0323] S1033: Adjust parameters of the behavior feature extraction model according to the first loss value.

[0324] Specifically, the difference between the pre-behavior detection results of each coding sequence and the corresponding training labels can be substituted into the preset loss function to calculate the model loss value of the behavior feature extraction model. The model loss value represents the accuracy of the current behavior feature extraction model prediction. Generally speaking, the smaller the model loss value, the higher the accuracy of the model. During the training process, it is necessary to continuously optimize the model loss value so that the model reaches the optimal state.

[0325] In an optional embodiment, the model loss value can be calculated using the following binary classification objective function L:

[0326]

[0327] Among them, L in formula 1 is the first loss value, S is the number of all first training samples selected in this round, and p i is the pre-behavior detection result output by the first fully connected layer for the i-th first training sample. It is a predicted probability value. For example, its value range can be [0, 1], which represents the suspicious degree of the sample object behavior sequence. The larger the value, the higher the suspicious degree. i is the sample label of the first training sample of the i-th order, which is the true probability value and takes the value of 0 or 1.

[0328] In S1033, the parameters that need to be adjusted are the parameters of the behavior feature extraction model, such as the adjustable learning rate, the number of hidden layer units in the RNN, the dropout ratio, etc., to optimize the extraction and classification effects of sequence features. In addition, if the embedded features are obtained by random mapping, the embedded features also need to be adjusted synchronously.

[0329] Of course, when the sample label is a multi-classification label, such as the "low risk", "medium risk" and "high risk" labels listed above, the model loss value can be calculated using any possible loss function, such as the cross entropy loss function (CrossEntropy Loss Function), mean squared error (MSE) loss function, squared absolute error loss function, maximum likelihood loss (Likelihood Loss, LHL) function, etc. Of course, it can also be other possible loss functions, and the embodiments of the present application are not limited to this.

[0330] During the iterative training process of the first training stage, after each execution of S1032 and determining the first loss value, it is necessary to determine whether the current training termination condition is met. If yes, the behavior feature extraction model training ends. If no, the parameters of the behavior feature extraction model are adjusted based on the first loss value.

[0331] In the embodiment of the present application, the training termination condition may include at least one of the following conditions:

[0332] (1) The number of iterations reaches the set threshold.

[0333] (2) The model loss value is less than the set loss threshold.

[0334] Of course, there may be other possible conditions, which are not limited in this article.

[0335] In the embodiment of the present application, when the number of iterations does not exceed the preset number threshold, and the model loss value (i.e., the first loss value) is not less than the set loss threshold, it is determined that the training termination condition has not been met, that is, it is considered that the current behavior feature extraction model does not meet the iteration termination condition, and then the model parameters need to be adjusted to continue training. After the parameter adjustment, the next iterative training process is entered, that is, jump to S101.

[0336] In an optional implementation, when the model still does not meet the convergence conditions, the model weight parameters can be updated by optimization algorithms such as gradient descent and stochastic gradient descent to minimize the above objective function, and training can be continued with the updated model weight parameters, so that the model can better capture the temporal dependencies and contextual information in the sequence.

[0337] When the number of iterations exceeds the preset threshold, or the model loss value is less than the set loss threshold, the determination process of S101 is yes, that is, it is considered that the current behavior feature extraction model has met the convergence conditions, the model training is completed, and the trained behavior feature extraction model is obtained.

[0338] Next, we enter the second training phase to train the abnormal behavior analysis model.

[0339] S104: Randomly select a plurality of second training samples from the training sample set.

[0340] It should be noted that the first training sample in S101 and the second training sample in S104 are simply distinguished for stage-by-stage training. In essence, they are both selected from the training sample set. During stage-by-stage training, the first training sample and the second training sample may be the same or different.

[0341] S105: For each second training sample, after extracting the behavior features of each resource transfer behavior included in the second training sample based on the trained behavior feature extraction model, the behavior features are combined to obtain a sequence fusion feature.

[0342] In the embodiment of the present application, the specific process of extracting features based on the trained behavioral feature extraction model is as described above. In addition, encoding is required before extracting features. The specific encoding process is as described above and will not be repeated here.

[0343] S106: For each second training sample, the obtained sequence fusion features and their corresponding sample labels are input into the abnormal behavior analysis model to be trained, and the parameters of the abnormal behavior analysis model are adjusted according to the target behavior detection result output by the second fully connected layer in the abnormal behavior analysis model.

[0344] The above S104 to S106 belong to the second training stage in the embodiment of the present application, and are also an iterative training process until the iteration termination condition is met. In the embodiment of the present application, the second training stage does not directly input the results of the first training stage, but is based on sequence fusion features as input. These fusion features are merged from the behavioral features of multiple sequence elements extracted by the trained behavioral feature extraction model. The input sequence fusion features can better capture the complex patterns and relationships in the entire behavioral sequence, thereby improving the accuracy of abnormal behavior detection.

[0345] The abnormal behavior analysis model includes a transformer and a fully connected layer. The fully connected layer here is recorded as a second connected layer. The second stage of training may include the following steps S1061 to S1063:

[0346] S1061: The obtained sequence fusion features are input into the abnormal behavior analysis model to be trained, and after the transformer is used to extract the attention weighted features, the second fully connected layer is used to perform feature mapping on the attention weighted features to obtain the target behavior detection results.

[0347] In this step, the specific processing process of the abnormal behavior analysis model is as above and will not be repeated here.

[0348] S1062: Determine a second loss value based on the difference between each target behavior detection result obtained and the corresponding sample label.

[0349] S1063: Adjust parameters of the abnormal behavior analysis model according to the second loss value.

[0350] In an optional embodiment, the model loss value can be calculated using the following binary classification objective function L:

[0351]

[0352] Among them, L' in formula 2 is the second loss value, S' is the number of all second training samples selected in this round, and p' jFor the jth second training sample, the target behavior detection result output by the second fully connected layer is another predicted probability value, for example, its value range can be [0, 1], representing the suspicious degree of the sample object behavior sequence. The larger the value, the higher the suspicious degree. j is the sample label of the j-th second training sample, which is the true probability value and takes the value of 0 or 1.

[0353] In S1063, the parameters that need to be adjusted are those of the abnormal behavior detection model, such as the number of attention heads, the width of the feedforward layer, the dropout ratio of the multi-head attention mechanism, and the learning rate, so as to improve the model's ability to understand the input sequence and the prediction accuracy.

[0354] Of course, when the label is a multi-classification label, other possible loss functions may also be used, which will not be described one by one in the embodiments of the present application.

[0355] During the iterative training process of the second training stage, after each execution of S1062 and determination of the second loss value, it is necessary to determine whether the training termination condition is met. If so, the training of the abnormal behavior detection model is terminated. If not, the parameters of the abnormal behavior detection model are adjusted based on the second loss value, and the next iterative training process is entered, that is, jumping to S104. The specific implementation method is the same as the first training stage and will not be repeated here.

[0356] In the above implementation, the training of the model is divided into two stages. First, by extracting basic features and then performing deep modeling, the model can gradually learn and optimize different behavioral features to improve detection accuracy; second, phased training makes the parameter adjustment of each stage more refined, thereby improving the robustness and generalization ability of the model; finally, this method also facilitates fine-tuning for specific tasks at different training stages and gradually optimizes model performance.

[0357] In yet another optional embodiment, in addition to training the behavior feature extraction model and the abnormal behavior analysis model in stages, the behavior feature extraction model and the abnormal behavior analysis model may also be trained and optimized together.

[0358] Specifically, in this process, there is no need to use the first fully connected layer because the behavior feature extraction model and the abnormal behavior analysis model are jointly trained, and the sequence fusion features will be directly transferred from the behavior feature extraction model to the abnormal behavior analysis model for processing.

[0359] In this way, it is only necessary to determine the second loss value based on the difference between the target behavior detection results finally output by the abnormal behavior detection model and the sample labels; based on the second loss value, the parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted synchronously.

[0360] The calculation method of the second loss value is shown in the above formula 2, which will not be repeated here. Compared with the second training stage during staged training, the only difference is the parameters that need to be adjusted. In addition to the parameters of the abnormal behavior detection model, the parameters of the behavior feature extraction model are also included. The specific parameters are as above and will not be repeated here. In addition, if the embedded features are obtained by random mapping, the embedded features need to be adjusted synchronously.

[0361] In the above implementation, the behavior feature extraction model and the abnormal behavior analysis model are trained together, and the model can learn feature extraction and anomaly detection tasks at the same time, reducing the time and complexity of staged training, while also improving the overall coordination and convergence speed of the model; in addition, joint training can better capture the relationship between behavior features and anomaly detection tasks, which helps to improve the prediction accuracy and generalization ability of the model.

[0362] The above is an explanation of the model training part. In order to ensure that the model can play the expected role in actual applications, the performance of the model needs to be evaluated after the training. Through model evaluation, it can be determined whether the model has sufficient accuracy, stability and reliability, and whether it is suitable for behavior prediction or anomaly detection in specific scenarios. The following are several common indicators for evaluating the effect of model training and their explanations:

[0363] In an optional embodiment, after the model training is completed, multiple evaluation indicators are needed to evaluate whether the model effect has reached the expected result. For example, the evaluation indicators can be precision, recall, information value (IV), confusion matrix, area under the curve (AUC), KS (Kolmogorov-Smirnov, Kolmogorov-Smirnov statistic), etc. Some of the evaluation indicators can identify the source of model errors, especially when processing the prediction results after the fusion of time series features, which helps to analyze whether the model misjudges certain abnormal behaviors or misses potential high-risk behaviors.

[0364] After completing the analysis of the above evaluation indicators, if the evaluation results of the model meet expectations, the model can be considered to have good predictive capabilities and can be actually deployed and applied to perform abnormal behavior prediction and detection tasks. Of course, after the model is actually deployed and applied, it can also be adjusted again based on the feedback from the object to be detected, which is not specifically limited in this article. However, if the effect of the model does not meet expectations, it is necessary to return to the model training part and readjust the model, which may involve feature selection of the behavior feature extraction model and the abnormal behavior analysis model, adjustment of the model architecture, hyperparameter tuning, or increasing the amount of training data, until the model effect reaches the standard of practical application.

[0365] It should be noted that the several evaluation indicators listed above are just simple examples. In addition, other evaluation indicators are also applicable to the embodiments of the present application, and this document does not make specific limitations on this.

[0366] In the above implementation, through comprehensive evaluation of the above multiple evaluation indicators, the accuracy and stability of the behavior feature extraction model and the abnormal behavior analysis model in practical applications can be guaranteed, thereby effectively detecting abnormal behaviors and reducing potential risks in multiple scenarios such as finance, supply chain management, and Internet of Things security.

[0367] After the above-mentioned behavior feature extraction model and abnormal behavior analysis model are trained, the trained model can be used to predict the risk of the actual object resource transfer sequence. The predicted results can also be uploaded to an online server for use, which is the specific model application part.

[0368] The following is a detailed description of the behavior detection method for the model application part:

[0369] See also Fig.11 As shown, it is an implementation flow chart of a behavior detection method provided in an embodiment of the present application. Taking the server as the execution subject as an example, the specific implementation process of the method is as follows S111-S112:

[0370] S111: Divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors occurring within a time window for the same object to be detected.

[0371] Among them, resource transfer source data refers to the original data related to resource transfer behavior. In different application scenarios, the form and content of resource transfer source data may be different. In actual application, in financial transaction scenarios, resource transfer source data may include user account information, transaction amount, transaction type, transaction time, transaction channel, etc.; in supply chain management scenarios, resource transfer source data may include cargo transportation information, inventory status, operation records of logistics nodes, etc.; and in the Internet of Things scenario, resource transfer source data may include data transmission records between devices, instruction execution status, and device status, etc.

[0372] The object to be detected refers to the entity or user whose behavior needs to be detected. In practical applications, such as in financial transaction scenarios, the object to be detected may be a specific bank account, user or transaction subject; in supply chain management, the object to be detected may be a certain product, warehouse, supply chain node, etc.; and in the Internet of Things scenario, the object to be detected may be a certain device or network node, etc.

[0373] For example, in a financial transaction scenario, the object to be detected may be a bank account, and the resource transfer source data may include all transaction behavior related data of the account within a period of time. For another example, in supply chain management, the object to be detected may be a logistics center, and the resource transfer source data may be all logistics scheduling records of the center within a year, and so on.

[0374] For the description of the time window, please refer to the above model training process, which will not be repeated here. It should be emphasized that in the model training part, if the time window is set to 1 week, then in the model application part, the time window must also be 1 week; similarly, in the model training part, if the time window is set to 1 month, then in the model application part, the time window must also be 1 month, and the two can be kept consistent.

[0375] Similar to the model training part, in the model application part, the resource transfer behavior sequence is a collection of a preset number of resource transfer behaviors that occur for the same object within a certain time range. According to the object and time window, the resource transfer source data can be divided into one or more resource transfer behavior sequences. For example, in actual application, the resource transfer behavior sequence can be multiple transfer, payment, and withdrawal records of a bank account within a week in a financial security scenario.

[0376] Among them, the actual resource transfer behavior of an object to be detected within a time window may be exactly the preset number of times, or may exceed the preset number of times, or be less than the preset number of times. In the latter two cases, certain adjustments are required to generate a resource transfer behavior sequence that includes the preset number of resource transfer behaviors.

[0377] like Fig.12 As shown, it is a schematic diagram of a resource transfer behavior sequence obtained by dividing resource transfer source data in an embodiment of the present application. Fig.12 It means that the resource transfer source data is divided into five resource transfer behavior sequences according to the object and time window. The number of transactions in each resource transfer behavior sequence is processed according to the preset number of time windows, which is 10.

[0378] In sequence 1, it indicates that the number of transactions is less than the preset number of 10. The number of transactions in these sequences is less than 10, so the fixed number of 10 transactions is achieved by padding with zeros to ensure data integrity. Fig.12 In the example, dot filling is used to indicate such situations. Examples include transaction 1, transaction 11, etc. The number of transactions in these transaction sequences does not meet the requirements of the time window, so they are padded to ten transactions through zero padding.

[0379] In sequence 2, it is shown that the number of transactions just meets the requirement of the preset number of 10. The number of transactions in these sequences is exactly 10, so no additional processing is required. Fig.12 In the example, white text on a black background indicates such a situation. Examples include transaction 2, transaction 4, etc. The number of these transaction sequences meets the preset limit and has reached the prescribed number of ten transactions, so there is no need to add zeros or delete them.

[0380] In sequence 3, it shows the situation when the number of transactions exceeds the upper limit of 10. The number of transactions in these sequences is more than 10, so several transactions (such as the earliest ones) need to be removed to meet the requirements of the time window. Fig.12 In the example, black text on a white background indicates such a situation. Examples include transaction 5, transaction 12, etc. The number of these transaction sequences exceeds the limit of the time window, so they are deleted to ten transactions through the removal operation.

[0381] It should be emphasized that the resource transfer source data used above has obtained the permission or consent of the subject, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0382] After obtaining a resource transfer behavior sequence of a preset number of resource transfer behaviors of the object to be detected within a time window, the following specific processing will be performed:

[0383] S112: For each resource transfer behavior sequence, perform the following operations S1121 to S1122 respectively:

[0384] S1121: For each resource transfer behavior included in the resource transfer behavior sequence, encode according to the corresponding behavior attribute to obtain a coded sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element included in the coded sequence, wherein each behavior feature is obtained by combining the embedded features after the conversion of the corresponding sequence element and the behavior features of the previous sequence element.

[0385] In the above process, two main models are involved: a trained behavior feature extraction model and an abnormal behavior analysis model. For each resource transfer behavior sequence, the input of the trained behavior feature extraction model is each sequence element contained in the encoding sequence (i.e., the encoded resource transfer behavior sequence), which is used to extract the features of each resource transfer behavior from the encoded sample resource transfer behavior sequence, recorded as behavior features.

[0386] In this way, each behavior feature is merged into a sequence fusion feature corresponding to the resource transfer behavior sequence, and then input into the trained abnormal behavior analysis model. The abnormal behavior analysis model is used to analyze whether there is an abnormality in the resource transfer behavior of the object to be detected within the time window based on this sequence fusion feature, and output the behavior detection result.

[0387] The following first introduces the encoding process of the resource transfer behavior sequence:

[0388] In the embodiment of the present application, the unit of the resource transfer behavior sequence refers to the resource transfer behavior of the object to be detected, each resource transfer behavior can be regarded as an action node, and each action node can be encoded to obtain a code value. An optional encoding method is as follows:

[0389] For each resource transfer behavior contained in a resource transfer behavior sequence, the resource transfer behavior is mapped to a behavior parameter in the behavior parameter set constructed by the model training part according to the behavior attribute of the resource transfer behavior. Then, the sequence composed of the obtained behavior parameters can be used as the encoding sequence corresponding to the resource transfer behavior sequence, wherein each behavior parameter is a sequence element in the encoding sequence.

[0390] It should be noted that the encoding process in the model application part is the same as that in the model training part. Taking the transaction behavior sequence as an example, for example, the transaction behavior sequence contains 10 transaction behaviors, then each transaction behavior can be represented as the description string listed above according to the behavior attributes. Each description string can fully describe the various behavior attributes of a transaction behavior. Each description string represents a transaction behavior with one attribute. According to the mapping relationship between the description string and the behavior parameter set listed above, these 10 transaction behaviors can be encoded into 10 behavior parameters to form the final encoding sequence. For example, by referring to Figure 4 From the mapping relationships listed above, we can see that the behavior parameters corresponding to these 10 transaction behaviors are 12, 13, 1, 11, 14, 7, 2, 13, 2, 3, respectively. The encoding sequence can be expressed as [12, 13, 1, 11, 14, 7, 2, 13, 2, 3]. The specific encoding process is the same as the relevant description of the model training part above, and will not be repeated here.

[0391] In the above implementation, based on the predefined behavior parameter set and the behavior attributes of each resource transfer behavior, each resource transfer behavior can be represented as a unique coding value, which can not only closely associate the various attributes of the resource transfer behavior, but also effectively distinguish different behavior patterns. Through the standardized coding of resource transfer behavior, the behavior feature extraction model and abnormal behavior detection model in the embodiment of the present application can efficiently process a large amount of data, further improve the analysis ability and processing efficiency of the model, and realize more simple and efficient feature processing.

[0392] For each resource transfer behavior sequence, after obtaining the corresponding coding sequence, the coding sequence can be input into the trained behavior feature extraction model. The result of the behavior feature extraction model can refer to the relevant description of the behavior feature extraction model in the above model training process.

[0393] An optional implementation is that the trained behavior feature extraction model includes an embedding layer and a recurrent neural network, wherein the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence.

[0394] Then in S1121, for each sequence element, the behavior feature of the sequence element can be extracted in the following manner:

[0395] Firstly, the embedding layer in the trained behavior feature extraction model is used to embed the sequence element to obtain the embedding feature of the sequence element; then, the corresponding recurrent neural network layer is used to fuse the embedding feature of the sequence element with the behavior feature of the previous sequence element to extract the behavior feature of the sequence element.

[0396] like Fig.13 As shown, it is a processing logic diagram of a behavior feature extraction model in an embodiment of the present application. The input of the behavior feature extraction model is a coding sequence [12, 13, 1, 11, 14, 7, 2, 13, 2, 3], which contains a total of 10 sequence elements, namely sequence elements 1 to 10. Correspondingly, there are a total of 10 recurrent neural network layers in the behavior feature extraction model, namely recurrent neural network layers 1 to 10.

[0397] First, each sequence element in a coded sequence is input into the embedding layer respectively to extract the embedded features. Then, for each sequence element, its embedded features and the behavioral features of its previous sequence element are input into the recurrent neural network layer corresponding to the current sequence element respectively to extract the corresponding behavioral features.

[0398] In addition, it should be noted that for the first sequence element in the encoding sequence, since there is no previous sequence element, it is impossible to provide the behavioral characteristics of a sequence element. Therefore, when extracting the behavioral characteristics of the first sequence element, certain processing is required. The specific processing method is the same as the training process. For example, the behavioral characteristics of the corresponding previous sequence element can be represented as a zero vector, or other fixed non-zero vectors, or other methods. Please refer to the relevant instructions in the model training part for details, which will not be repeated here.

[0399] like Fig.13 In , a four-pointed star represents an embedded feature, a five-pointed star represents a behavioral feature, the number on the four-pointed star represents an embedded feature x, and the number on the five-pointed star represents a behavioral feature x, and the value of x ranges from 1 to 10. For sequence element 1, assuming that the behavioral feature of the previous sequence element corresponding to it is represented as a zero vector, then its behavioral feature 1 can be based on the embedded feature 1 and this zero vector ( Fig.13 For sequence element 2, its behavior feature 2 can be obtained based on embedded feature 2 and behavior feature 1; ...; and so on, for sequence element 10, its behavior feature 10 can be obtained based on embedded feature 10 and behavior feature 9, and the last 10 behavior features can be combined to obtain the sequence fusion feature. Note that the model application part no longer involves the first fully connected layer.

[0400] There are many ways to embed each sequence element. One optional implementation is:

[0401] For each sequence element, this sequence element is represented as an embedding feature according to the embedding feature table obtained by pre-training the embedding layer.

[0402] That is, the sequence elements are embedded by table lookup. The embedding feature table contains the embedding features corresponding to each possible sequence element, which is obtained in the model training part. For the specific process, please refer to the relevant description of the above model training part.

[0403] It should be noted that when embedding the sequence elements by looking up the table and obtaining the embedding features of the sequence elements, this process is not exactly the same as the embedding method in the above model training part. During the training process, the embedding layer learns the best embedding representation of the sequence elements by continuously updating the parameters, and finally the behavior is the embedding feature table. In the model application part (i.e., the inference stage), for each sequence element, the parameters are no longer updated, but the sequence elements are directly mapped to the corresponding embedding features by looking up the embedding feature table pre-generated in the model training part.

[0404] Taking the embedding feature as a vector as an example, in an optional implementation, the embedding feature table is generated by pre-training the embedding layer, and the table contains each possible sequence element and its corresponding embedding vector.

[0405] Assume that in the model training part, a certain sequence element may be a behavior parameter encoded as 5. During the training process, the embedding layer learns and eventually maps the sequence element encoded as 5 to a 300-dimensional embedding vector. For example, the embedding vector corresponding to 5 may be: [0.12, -0.34, 0.56, ..., 0.89]. At this time, the embedding feature table will record this mapping relationship: 5-> [0.12, -0.34, 0.56, ..., 0.89]. And so on, you can eventually get an embedding feature table containing every possible sequence element and its corresponding embedding vector.

[0406] As shown in Table 1 below, it is a schematic diagram of an embedded feature table in an embodiment of the present application.

[0407] Table 1

[0408] Sequence Elements Embedding vector Sequence element 1 [0.15,-0.32,0.58,...,0.87] Sequence element 2 [0.10,-0.36,0.54,...,0.91] Sequence element 3 [0.14,-0.35,0.57,...,0.90] Sequence element 4 [0.11,-0.33,0.59,...,0.88] Sequence element 5 [0.12,-0.34,0.56,...,0.89] … … Sequence element N [0.13,-0.31,0.55,...,0.86]

[0409] The embedding feature table contains the embedding vectors corresponding to all possible sequence elements. Taking the sequence element as the behavior parameter as an example, assuming that there are N behavior parameters in the behavior parameter set, the embedding feature table records these N behavior parameters and their corresponding embedding vectors, such as sequence element 1->embedding vector 1[0.15,-0.32,0.58,...,0.87], sequence element 2->embedding vector 2[0.10,-0.36,0.54,...,0.91], sequence element 3->embedding vector 3[0.14,-0.35,0.57,...,0.90], ..., sequence element N->embedding vector N[0.13,-0.31,0.55,...,0.86].

[0410] Then in the model application part, when the system encounters a sequence element with code 5 again, it can directly find the embedding vector [0.12, -0.34, 0.56, ..., 0.89] corresponding to code 5 from the embedding feature table and map the sequence element to the pre-trained embedding feature. This method greatly improves the computational efficiency of the model inference stage.

[0411] In the above implementation, in the model training part, the embedding layer embeds the sequence elements and continuously updates its weight parameters through the back propagation of the model, and finally generates the optimal embedding vector of each sequence element. In the model application part, by searching the pre-trained embedding feature table, the embedding feature of each sequence element is quickly determined, avoiding the complexity of online calculation and ensuring the efficiency and consistency of model application.

[0412] Of course, in addition to the above-mentioned table lookup method, other algorithms are used to embed sequence elements, such as word2vec, BERT, RoBERTa, etc. listed in the above-mentioned embedding method 2. For details, please refer to the above-mentioned embodiment, which will not be repeated here.

[0413] After obtaining the embedding features of each sequence element through the above operation, the embedding features of the sequence element and the behavioral features of the previous sequence element are respectively input into the recurrent neural network layer corresponding to the sequence element to extract the behavioral features. In this processing process, an optional implementation is as follows:

[0414] For each sequence element, first, the embedding feature of this sequence element and the behavioral feature of its previous sequence element are input into the recurrent neural network layer corresponding to this sequence element respectively; then, the corresponding positions of this embedding feature and this behavioral feature are added to obtain the element fusion feature. This addition operation can effectively integrate the information of the current transaction with the information of the previous transaction, reflecting the correlation between the previous and subsequent behaviors in the time series; finally, the recurrent neural network layer corresponding to this sequence element is used to extract the feature of this element fusion feature to obtain the behavioral feature of this sequence element.

[0415] Specifically, the processing process is the same as the processing logic of the model training part. Please refer to the relevant instructions of the above model training part for details, and will not be repeated here.

[0416] This application takes into account that normal objects and malicious objects usually have different behavior patterns. Taking transactions as an example, especially fraudulent objects usually have payment sequence combinations of specific actions, such as multiple consecutive similar collection actions or the continuous appearance of (collection-withdrawal) actions, etc., which will form different multi-level temporal features. Therefore, after constructing the resource transfer behavior sequence of the object, this application uses the RNN model to pre-train the resource transfer behavior sequence, so that each resource transfer behavior incorporates the information of its previous resource transfer behavior, which can reflect the key attributes and time changes of the resource transfer behavior. The behavior feature extraction model trained in this way can effectively capture the temporal dependencies and contextual information of the resource transfer behavior.

[0417] For a coding sequence, after obtaining the behavioral features of each sequence element in the coding sequence, these behavioral features can be merged and then input into the trained abnormal behavior analysis model. The specific process is as follows:

[0418] S1122: The obtained behavior features are combined into a sequence fusion feature, and input into the trained abnormal behavior analysis model to obtain a behavior detection result, which represents: the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

[0419] Among them, the behavior features can be merged by combining multiple behavior vectors into a matrix, or by concatenating multiple behavior vectors, or by performing average pooling, maximum pooling, etc. For details, please refer to the relevant instructions in the model training part, which will not be repeated here.

[0420] For a resource transfer behavior sequence, after obtaining its corresponding sequence fusion features, it can be input into the trained abnormal behavior analysis model for classification to output the behavior detection result for the resource transfer behavior sequence.

[0421] In an optional implementation, the trained abnormal behavior analysis model includes a transformer and a fully connected layer; therefore, S1122 can be implemented according to the following process, including S11221 to S11223 ( Fig.11 not shown):

[0422] S11221: Merge the obtained behavior features into sequence fusion features.

[0423] S11222: Use a transformer to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features.

[0424] S11223: Use the fully connected layer to perform feature mapping on the attention weighted features to obtain the behavior detection results.

[0425] Specifically, the abnormal behavior analysis model uses a transformer to perform attention transformation fusion processing on the sequence fusion features obtained by merging various behavioral features to obtain attention weighted features. In this process, the transformer can use the multi-head attention mechanism to assign different weights to different parts of the sequence fusion features. These weights reflect the correlation and importance between different behavioral features, thereby highlighting important behavioral features. Among them, the multi-head attention mechanism allows the abnormal behavior analysis model to pay attention to different positions of the input at the same time, improving the model's ability to capture complex patterns.

[0426] Then, the fully connected layer is used to perform feature mapping on the attention-weighted features to obtain the behavior detection results. Among them, the fully connected layer is responsible for mapping the attention-weighted features to specific prediction results. This step converts the captured key information into a form that can be directly used for decision-making. The final behavior detection result reflects the predicted probability of whether the object to be detected has abnormal behavior within the corresponding time window.

[0427] Among them, the specific structure and processing logic of the abnormal behavior analysis model (such as Figure 8 ) Please refer to the above training process and will not repeat it here.

[0428] In the above implementation, each resource transfer behavior integrates the information of its previous resource transfer behavior, which is equivalent to integrating the location information of the resource transfer behavior into the feature vector of the resource transfer behavior, eliminating the process of combining the position encoding vector, making up for the limitation of the weak use of location information in the transformer model, and strengthening the ability to mine the temporal features of the object resource transfer behavior sequence. Finally, for the fraudulent malicious objects identified by the model.

[0429] Through the above process, anomaly detection can be performed on the resource transfer behaviors of different objects to be detected in different time windows. In this way, each object to be detected can obtain one or more behavior detection results, which specifically correspond to the time window to which the resource transfer behavior occurs.

[0430] Furthermore, after obtaining the behavior detection result of the predicted probability of abnormal behavior of the corresponding object to be detected within the corresponding time window, after completing the prediction of the object to be detected, the behavior detection structure corresponding to each object to be detected can also be uploaded to the real-time online system.

[0431] Subsequently, in the real-time online system, the objects to be detected with abnormal risks (such as fraud risks) can be detected and handled based on the results of model prediction to reduce the risk of fraud and loss of the platform and the object. For example, if the results of model prediction indicate that the current object to be detected has a high risk of fraud, risk control measures such as reminders and interception can be taken on the object to be detected to reduce the risk of fraud and loss of the platform and the object to be detected. Of course, other risk prevention and control strategies can also be used for risk prevention and control.

[0432] In practical applications, the behavior detection results can be divided based on parameter thresholds to obtain behavior detection results of different risks, so as to formulate different risk prevention and control strategies according to different risks. In addition, only the corresponding results of the objects to be detected with higher behavior detection results can be uploaded to the real-time online system. This can improve the speed and efficiency of data upload on the one hand, and reduce the consumption of system storage resources on the other hand. The following is a detailed introduction:

[0433] In an optional implementation, after obtaining the behavior detection results, the behavior detection results obtained that are higher than a preset parameter threshold or within a preset sorting range can also be used as target behavior detection results; based on the determined target behavior detection results, the risk prevention and control strategy for the corresponding object is determined, and risk prevention and control processing is performed on the corresponding object according to the risk prevention and control strategy.

[0434] Among them, being in the preset sorting range can generally refer to some behavior detection results that are ranked higher when the behavior detection results are arranged in descending order, such as the first 20, or it can also refer to some behavior detection results that are ranked lower when the behavior detection results are arranged in descending order, such as the last 20.

[0435] Of course, if a detected object has resource transfer behaviors in multiple time windows, multiple behavior detection results can be detected. Then, in order to ensure timeliness, these multiple behavior detection results can also be screened and only the latest behavior detection results are retained.

[0436] Among them, the risk prevention and control strategy is a strategy used to prevent and control risks in the resource transfer process, to ensure resource security and prevent fraud, data leakage or other forms of risks. In the embodiment of the present application, the risk prevention and control strategy includes but is not limited to some or all of the following:

[0437] Real-time detection, anomaly detection, triggering of multiple verification measures, automated alarms, and limiting the occurrence of suspicious behavior.

[0438] In practical applications, the risk of the detected object can be divided according to the obtained behavior detection results to determine the subsequent risk prevention and control strategy. Different risk levels can correspond to different risk prevention and control strategies. Specifically, the purpose of risk division is to evaluate the potential risk level of the object through comprehensive analysis of its behavior, so as to adopt a risk prevention and control strategy corresponding to its risk level.

[0439] For example, based on the behavior detection results of the object to be detected, two parameter thresholds can be set: 0.3 and 0.7, based on which the object to be detected is divided into different risk levels of low risk, medium risk and high risk, as shown in Table 2 (which can be stored on the terminal device side and / or the server side), which is specifically introduced below:

[0440] (I) Low risk: The behavior of the subject to be tested is usually consistent with its historical behavior pattern, without obvious abnormal characteristics, or the model detection results show that the risk is very low. For example, when the behavior detection result is a probability, if the probability is between 0 and 0.3, it is considered low risk.

[0441] (II) Medium risk: The behavior of medium risk objects may show certain abnormal characteristics, such as transaction frequency, amount or time period inconsistent with their historical behavior, but the risk is not significant. For example, when the behavior detection result is a probability, if the probability is between 0.3 and 0.7 (excluding 0.3), it is medium risk.

[0442] (III) High risk: High-risk objects show characteristics that seriously deviate from their normal behavior patterns, such as large-scale fund transfers in online payment scenarios, frequent failed login attempts in financial security scenarios, or other behaviors marked as highly abnormal by the model. For example, when the behavior detection result is a probability, if the probability is between 0.7 and 1 (excluding 0.7), it is considered high risk.

[0443] Table 2

[0444]

[0445] After the model objects are divided into different levels, corresponding prevention and control measures can be taken according to the division results, such as the risk prevention and control strategies corresponding to various risks in Table 2. The following is a detailed introduction:

[0446] In an optional implementation, for low-risk objects, the system may adopt risk prevention and control strategies as shown in Table 2, including but not limited to: continuous background detection, behavior recording, and risk warnings. These measures ensure that the system can detect potential abnormal activities without interfering with the operation of the object to be detected, and ensure that its behavior records are available for future reference.

[0447] For example, in an online transaction scenario, the subject to be detected made a small payment during its regular operation period. This behavior is roughly consistent with its historical behavior pattern. The system detects low abnormality and judges it as low risk. In this case, it will only record the transaction in the background and take no intervention measures, or send a reminder notification to the subject to be detected, suggesting that it regularly check the account security. For another example, in a financial security scenario, a subject to be detected performs a small transfer operation after logging into a bank account. The abnormality of the operation is detected to be low and judged to be low risk. Therefore, only background detection will be performed, and the transaction will not be blocked, or a prompt message will be sent to the subject to be detected to remind it to pay attention to account security and avoid misoperation.

[0448] In an optional implementation, for medium-risk objects, the system may adopt risk prevention and control strategies as shown in Table 2, including but not limited to: delayed transaction processing, manual review, risk warnings, and additional identity verification.

[0449] For example, in an online transaction scenario, a subject to be detected suddenly performs a medium-amount transfer operation, and the time point deviates from its regular operation. The system detects that this behavior has certain risks and judges it as medium risk. The system may require the subject to be detected to perform additional identity verification, such as verifying identity through SMS verification code or dynamic password, to ensure that the operation is performed by the subject to be detected. For another example, in a financial security scenario, a subject to be detected suddenly performs a large withdrawal operation in a different city. The system detects that this behavior is inconsistent with its historical pattern and judges it as medium risk. The system will send a notification to the subject to be detected, requiring it to confirm the transaction through additional identity verification steps (such as face recognition or other biometric technology) to prevent account theft. For another example, in a smart contract execution detection scenario, the system detects that an unauthorized fund transfer operation has occurred in a smart contract, and the operation is inconsistent with the terms of the contract. The system immediately delays the execution of the contract and issues a risk warning requiring both parties to the contract to perform further identity verification to ensure the security of funds and the integrity of the contract.

[0450] In an optional implementation, for high-risk objects, the system may adopt risk prevention and control strategies as shown in Table 2, including but not limited to: account freezing, transaction interception, and mandatory identity verification.

[0451] For example, in an online transaction scenario, a subject to be detected suddenly makes multiple large transfers, and the transfer destination is a high-risk country or region. The system detects that the operation of the subject to be detected is abnormally serious, and immediately takes account freezing measures to prevent the transfer of funds, and notifies the subject to be detected to perform strict identity verification, such as submitting identity documents or performing video verification, to lift the freeze. For another example, in a financial security scenario, the account of a subject to be detected has attempted multiple failed logins in a short period of time, and the login IP address is different for each attempt. The system believes that the account is at a high risk of being stolen, so it immediately freezes the account and issues an alarm, requiring the subject to be detected to restore account access rights through two-factor authentication or directly contact bank customer service.

[0452] In another optional implementation, the system can choose to intercept ongoing transactions or operations to prevent potential risks. For example, a subject to be detected suddenly initiates an abnormally high transaction, and the transaction is significantly inconsistent with the historical behavior pattern. After detecting the anomaly, the system immediately intercepts the transaction, prevents the transfer of funds, and notifies the subject to be detected to perform identity verification to confirm that the operation is safe.

[0453] It should be noted that the several risk level divisions and risk prevention and control strategies listed above are just simple examples. In addition, other risk level divisions and other risk prevention and control strategies are also applicable to the embodiments of the present application and will not be described one by one here.

[0454] In the above implementation, by screening the behavior detection results, the results that are higher than the preset parameter threshold or within the preset sorting range are used as the target behavior detection results. This mechanism effectively improves the system's recognition accuracy of high-risk behaviors and avoids misjudgment. In addition, by combining the target behavior detection results, the system can automatically formulate targeted risk prevention and control strategies and promptly carry out prevention and control treatment on the corresponding objects, enhancing the timeliness and accuracy of risk response, thereby greatly improving the overall security and prevention and control efficiency of the system.

[0455] See also Fig.14 As shown, it is a logical diagram of interaction between a terminal device and a server in an embodiment of the present application. Among them, a client related to behavior detection and recognition can be installed on the terminal device, and the object can perform some transaction behaviors based on the client. The corresponding source data will be sent to the server through the terminal device for storage, and the server side has pre-deployed a trained behavior feature extraction model and an abnormal behavior analysis model. Furthermore, the server adopts the behavior detection method in the embodiment of the present application to identify the abnormal probability (such as ) corresponding to the transaction behavior sequence extracted based on the source data based on the trained behavior feature extraction model and abnormal behavior analysis model. Fig.14 0.7 in the figure, which is also the behavior detection result in this article). The specific process will not be repeated here. Finally, it is determined whether there is any abnormality in the transaction behavior of the object to be detected within a certain time window, and the detection result is fed back to the terminal device. Based on this result, the terminal device can present risk warning information to the object to be detected according to the corresponding risk prevention and control strategy, such as prompting the user that there is a payment risk in the transaction and requiring the user to perform additional identity verification (such as face verification or verification code verification). After the user completes the verification, if the verification is successful, the transaction will continue; otherwise, the transaction will be terminated or further processed.

[0456] in, Fig.14 The example is taken in the online transaction scenario. In addition, resource transfer behavior can also be other resource transfer behaviors, such as goods transfer in the logistics system, funds transfer in the banking system, etc. In this way, abnormal behavior and even illegal behavior detection can be carried out in a variety of application scenarios to ensure the security and compliance of transactions, logistics and other processes.

[0457] In summary, the implementation method of this application is simple and is applicable to various resource transfer scenarios such as online transaction scenarios. It can detect anomalies in various types of resource behaviors, while improving the accuracy of detection and enhancing the overall security and user experience of the system.

[0458] Based on the same inventive concept, the present application also provides a behavior detection device. Fig.15 As shown, it is a schematic diagram of the structure of the behavior detection device 1500, which may include:

[0459] The sequence generating unit 1501 is used to divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors of the same object to be detected occurring within a time window;

[0460] The detection unit 1502 is configured to perform the following operations for each resource transfer behavior sequence:

[0461] For each resource transfer behavior contained in the resource transfer behavior sequence, encode it according to the corresponding behavior attribute to obtain the encoding sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element contained in the encoding sequence, wherein each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element;

[0462] The obtained behavior features are merged into sequence fusion features and input into the trained abnormal behavior analysis model to obtain the behavior detection result. The behavior detection result indicates: the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

[0463] Optionally, the detection unit 1502 is specifically configured to:

[0464] For each resource transfer behavior included in the resource transfer behavior sequence, the resource transfer behavior is mapped to a behavior parameter in a preset behavior parameter set according to the behavior attribute of the resource transfer behavior, wherein resource transfer behaviors with different attributes correspond to different behavior parameters;

[0465] The sequence composed of the obtained behavior parameters is used as a coding sequence, wherein each behavior parameter is a sequence element in the coding sequence.

[0466] Optionally, the behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence;

[0467] The detection unit 1502 is specifically used for:

[0468] For each sequence element in the encoded sequence, perform the following operations:

[0469] The embedding layer is used to embed the sequence elements and obtain the embedding features of the sequence elements.

[0470] The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

[0471] Optionally, the detection unit 1502 is specifically configured to:

[0472] The embedded features of the sequence element and the behavioral features of its previous sequence element are input into the recurrent neural network layer corresponding to the sequence element respectively;

[0473] Add the corresponding positions in the embedded features and behavioral features to obtain the element fusion features;

[0474] The recurrent neural network layer is used to extract the element fusion features and obtain the behavioral characteristics of the sequence elements.

[0475] Optionally, the detection unit 1502 is specifically configured to:

[0476] For each sequence element, the sequence element is represented as an embedding feature according to the embedding feature table obtained by pre-training the embedding layer, and the embedding feature table contains the embedding features corresponding to each possible sequence element.

[0477] Optionally, the abnormal behavior analysis model includes a transformer and a fully connected layer; the detection unit 1502 is specifically used for:

[0478] Merge the obtained behavioral features into sequence fusion features;

[0479] The transformer is used to perform attention transformation fusion processing on the sequence fusion features to obtain the attention weighted features;

[0480] The fully connected layer is used to perform feature mapping on the attention weighted features to obtain the behavior detection results.

[0481] Optionally, the device 1500 further includes:

[0482] The risk prevention and control unit 1503 is used to use the obtained behavior detection results that are higher than a preset parameter threshold or within a preset sorting range as target behavior detection results;

[0483] Based on the determined detection results of each target behavior, the risk prevention and control strategy for the corresponding object is determined, and the risk prevention and control treatment is performed on the corresponding object according to the risk prevention and control strategy.

[0484] Based on the same inventive concept, the present application also provides a model training device. Fig.16 As shown, it is a schematic diagram of the structure of the model training device 1600, which may include:

[0485] The sample acquisition unit 1601 is used to acquire multiple training samples, each training sample is: a sequence consisting of a preset number of resource transfer behaviors of the same sample object occurring within a sample time window;

[0486] The detection unit 1602 is used to encode, for each training sample, each resource transfer behavior contained in the training sample according to the corresponding behavior attribute to obtain a coding sequence; use the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; merge the obtained behavior features into a sequence fusion feature, input the trained abnormal behavior analysis model, and obtain a target behavior detection result, which represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window;

[0487] The parameter adjustment unit 1603 is used to adjust the parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and the corresponding sample labels; the trained behavior feature extraction model and abnormal behavior analysis model are used to predict the abnormal behavior risk of the detected object.

[0488] Optionally, the behavior feature extraction model includes a first fully connected layer; the detection unit is further used for:

[0489] For each training sample, the first fully connected layer is used to perform feature mapping on the behavior features of the last sequence element in the corresponding coding sequence to obtain the pre-behavior detection result, which represents the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window;

[0490] The parameter adjustment unit 1603 is specifically used for:

[0491] According to the obtained target behavior detection results and pre-behavior detection results and corresponding sample labels, the parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted.

[0492] Optionally, the parameter adjustment unit 1603 is specifically configured to:

[0493] In the first training stage, a first loss value is determined according to the difference between each pre-behavior detection result and the corresponding sample label; and parameters of the behavior feature extraction model are adjusted according to the first loss value;

[0494] In the second training stage, a second loss value is determined based on the difference between the obtained target behavior detection results and the corresponding sample labels; and parameters of the abnormal behavior analysis model are adjusted based on the second loss value.

[0495] Optionally, the parameter adjustment unit 1603 is specifically configured to:

[0496] Determine a second loss value according to the difference between each target behavior detection result obtained and the corresponding sample label;

[0497] According to the second loss value, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted synchronously.

[0498] Optionally, the detection unit 1602 is specifically configured to:

[0499] For each resource transfer behavior included in the training sample, the resource transfer behavior is mapped to a behavior parameter in a preset behavior parameter set according to the behavior attribute of the resource transfer behavior, wherein resource transfer behaviors with different attributes correspond to different behavior parameters;

[0500] The sequence composed of the obtained behavior parameters is used as a coding sequence, wherein each behavior parameter is a sequence element in the coding sequence.

[0501] Optionally, the behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence;

[0502] The detection unit 1602 is specifically used for:

[0503] For each sequence element in the encoded sequence, perform the following operations:

[0504] The embedding layer is used to embed the sequence elements and obtain the embedding features of the sequence elements.

[0505] The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

[0506] Optionally, the detection unit 1602 is specifically configured to:

[0507] Using the embedding layer, the sequence elements are randomly mapped to obtain the embedding features corresponding to the sequence elements;

[0508] When adjusting the parameters of the behavior feature extraction model, the parameter adjustment unit 1603 is further used to:

[0509] The embedded features obtained by randomly mapping each sequence element are adjusted synchronously, and after the training is completed, the embedded features corresponding to each possible sequence element are formed into an embedded feature table, so that in the model application part, the embedded features of each sequence element are determined according to the embedded feature table.

[0510] Optionally, the abnormal behavior analysis model includes a transformer and a second fully connected layer; the detection unit 1602 is specifically used for:

[0511] Merge the obtained behavioral features into sequence fusion features;

[0512] The transformer is used to perform attention transformation fusion processing on the sequence fusion features to obtain the attention weighted features;

[0513] The second fully connected layer is used to perform feature mapping on the attention weighted features to obtain the target behavior detection results.

[0514] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0515] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0516] After introducing the behavior detection method and device according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0517] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0518] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a server, such as Figure 1 In this embodiment, the structure of the electronic device can be as follows: Fig.17 As shown, it includes a memory 1701 , a communication module 1703 and one or more processors 1702 .

[0519] The memory 1701 is used to store computer programs executed by the processor 1702. The memory 1701 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0520] The memory 1701 may be a volatile memory, such as a random-access memory (RAM); the memory 1701 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 1701 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1701 may be a combination of the above memories.

[0521] The processor 1702 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 1702 is used to implement the above behavior detection method when calling the computer program stored in the memory 1701 .

[0522] The communication module 1703 is used to communicate with terminal devices and other servers.

[0523] The specific connection medium between the memory 1701, the communication module 1703 and the processor 1702 is not limited in the embodiment of the present application. Fig.17 In the embodiment, the memory 1701 and the processor 1702 are connected via a bus 1704. The bus 1704 is connected to the processor 1702 via a bus 1704. Fig.17 The connections between the other components are described with bold lines, which are only for illustration and are not intended to be limiting. The bus 1704 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.17 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or one type of bus.

[0524] The memory 1701 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the behavior detection method of the embodiment of the present application. The processor 1702 is used to execute the above-mentioned behavior detection method, such as Fig.18 shown.

[0525] In another embodiment, the electronic device may also be other electronic devices, such as Figure 1 The terminal device 110 shown in FIG. 1 is a terminal device 110 shown in FIG. 1 . In this embodiment, the structure of the electronic device can be as follows: Fig.18As shown, it includes: a communication component 1810, a memory 1820, a display unit 1830, a camera 1840, a sensor 1850, an audio circuit 1860, a Bluetooth module 1870, a processor 1880 and other components.

[0526] The communication component 1810 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the user to send and receive information through the WiFi module.

[0527] The memory 1820 can be used to store software programs and data. The processor 1880 executes various functions and data processing of the terminal device 110 by running the software programs or data stored in the memory 1820. The memory 1820 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 1820 stores an operating system that enables the terminal device 110 to run. In the present application, the memory 1820 can store an operating system and various application programs, and can also store a computer program for executing the behavior detection method of the embodiment of the present application.

[0528] The display unit 1830 can also be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the terminal device 110. Specifically, the display unit 1830 may include a display screen 1832 disposed on the front of the terminal device 110. The display screen 1832 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 1830 may be used to display a user interface related to behavior detection in the embodiment of the present application, etc.

[0529] The display unit 1830 can also be used to receive input digital or character information and generate signal input related to user settings and function control of the terminal device 110. Specifically, the display unit 1830 may include a touch screen 1831 arranged on the front of the terminal device 110, which can collect user touch operations on or near it, such as clicking a button, dragging a scroll box, etc.

[0530] The touch screen 1831 can be covered on the display screen 1832, or the touch screen 1831 and the display screen 1832 can be integrated to realize the input and output functions of the terminal device 110. The integrated touch screen can be referred to as a touch display screen. In this application, the display unit 1830 can display the application and the corresponding operation steps.

[0531] The camera 1840 can be used to capture still images, and the user can publish the images taken by the camera 1840 through the application. The camera 1840 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, and then passes the electrical signal to the processor 1880 to convert it into a digital image signal.

[0532] The terminal device may further include at least one sensor 1850, such as an acceleration sensor 1851, a distance sensor 1852, a fingerprint sensor 1853, and a temperature sensor 1854. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0533] The audio circuit 1860, the speaker 1861, and the microphone 1862 can provide an audio interface between the user and the terminal device 110. The audio circuit 1860 can transmit the electrical signal converted from the received audio data to the speaker 1861, which is converted into a sound signal for output. The terminal device 110 can also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 1862 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1860 and converted into audio data, and then the audio data is output to the communication component 1810 to be sent to, for example, another terminal device 110, or the audio data is output to the memory 1820 for further processing.

[0534] The Bluetooth module 1870 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 1870 to exchange data.

[0535] The processor 1880 is the control center of the terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the memory 1820 and calling data stored in the memory 1820. In some embodiments, the processor 1880 may include one or more processing units; the processor 1880 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 1880. In the present application, the processor 1880 can run the operating system, application programs, user interface display and touch response, as well as the behavior detection method of the embodiment of the present application. In addition, the processor 1880 is coupled to the display unit 1830.

[0536] In some possible implementations, various aspects of the behavior detection method provided in the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to perform the steps of the behavior detection method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may perform the following steps: Figure 2 or Fig.11 Follow the steps shown in .

[0537] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0538] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0539] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0540] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0541] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user electronic device, as a separate software package, partially on the user electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0542] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0543] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0544] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0545] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0546] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0547] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0548] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0549] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A behavior detection method, characterized in that: The method comprises: Divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors of the same object to be detected occurring within a time window; For each resource transfer behavior sequence, perform the following operations: For each resource transfer behavior included in the resource transfer behavior sequence, encode according to the corresponding behavior attribute to obtain a coding sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element included in the coding sequence, wherein each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; The obtained behavior features are combined into sequence fusion features, which are input into the trained abnormal behavior analysis model to obtain behavior detection results, which represent the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

2. The method according to claim 1, characterized in that The step of encoding each resource transfer behavior included in the resource transfer behavior sequence according to a corresponding behavior attribute to obtain a coding sequence includes: For each resource transfer behavior included in the resource transfer behavior sequence, mapping the resource transfer behavior to a behavior parameter in a preset behavior parameter set according to a behavior attribute of the resource transfer behavior, wherein resource transfer behaviors with different attributes correspond to different behavior parameters; The sequence composed of the obtained behavior parameters is used as the encoding sequence, wherein each behavior parameter is a sequence element in the encoding sequence.

3. The method according to claim 1, characterized in that The behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence; The method of using the trained behavior feature extraction model to extract the behavior features of each sequence element contained in the coding sequence includes: For each sequence element in the encoding sequence, perform the following operations respectively: Using the embedding layer, embedding the sequence elements to obtain embedding features of the sequence elements; The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

4. The method according to claim 3, characterized in that The method of using a corresponding recurrent neural network layer to fuse the embedding feature of the sequence element with the behavior feature of its previous sequence element to extract the behavior feature of the sequence element comprises: Inputting the embedding features of the sequence element and the behavioral features of its previous sequence element into the recurrent neural network layer corresponding to the sequence element respectively; Adding the corresponding positions in the embedded feature and the behavior feature to obtain an element fusion feature; The recurrent neural network layer is used to extract the element fusion features to obtain the behavioral features of the sequence elements.

5. The method according to claim 3, characterized in that The embedding layer is used to embed the sequence elements to obtain the embedding features of the sequence elements, including: For each sequence element, the sequence element is represented as an embedding feature according to an embedding feature table obtained by pre-training the embedding layer, and the embedding feature table contains the embedding feature corresponding to each possible sequence element.

6. The method according to claim 1, characterized in that The abnormal behavior analysis model includes a transformer and a fully connected layer; the behavior features obtained are merged into a sequence fusion feature, input into the trained abnormal behavior analysis model, and the behavior detection result is obtained, including: Merge the obtained behavioral features into sequence fusion features; Using the transformer to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features; The fully connected layer is used to perform feature mapping on the attention weighted features to obtain the behavior detection result.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Among the obtained behavior detection results, the ones that are higher than the preset parameter threshold or within the preset sorting range are taken as the target behavior detection results; Based on the determined detection results of each target behavior, a risk prevention and control strategy for the corresponding object is determined, and risk prevention and control processing is performed on the corresponding object according to the risk prevention and control strategy.

8. A model training method, characterized in that: The method comprises: Acquire multiple training samples, each training sample being: a sequence of resource transfer behaviors of a preset number of times occurring for the same sample object within a sample time window; For each training sample, for each resource transfer behavior contained in the training sample, encode according to the corresponding behavior attribute to obtain a coding sequence; use the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the conversion of the corresponding sequence element and the behavior features of the previous sequence element; merge the obtained behavior features into sequence fusion features, input them into the abnormal behavior analysis model to be trained, and obtain the target behavior detection result, which represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window; According to the obtained target behavior detection results and corresponding sample labels, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted; the trained behavior feature extraction model and abnormal behavior analysis model are used to predict abnormal behavior risks of the detected objects.

9. The method according to claim 8, characterized in that The behavior feature extraction model includes a first fully connected layer; the method also includes: For each training sample, the first fully connected layer is used to perform feature mapping on the behavior feature of the last sequence element in the corresponding coding sequence to obtain a pre-behavior detection result, wherein the pre-behavior detection result indicates: a predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window; The step of adjusting parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and corresponding sample labels includes: According to the obtained target behavior detection results and pre-behavior detection results and corresponding sample labels, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted.

10. The method according to claim 9, characterized in that The step of adjusting parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and pre-behavior detection results and corresponding sample labels includes: In the first training stage, a first loss value is determined according to the difference between each of the pre-behavior detection results and the corresponding sample label; and parameters of the behavior feature extraction model are adjusted according to the first loss value; In the second training stage, a second loss value is determined based on the difference between each of the target behavior detection results and the corresponding sample label; and parameters of the abnormal behavior analysis model are adjusted based on the second loss value.

11. The method according to claim 8, characterized in that The step of adjusting parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and corresponding sample labels includes: Determining a second loss value according to the difference between each of the target behavior detection results obtained and the corresponding sample label; According to the second loss value, parameters of the behavior feature extraction model and the abnormal behavior analysis model are adjusted synchronously.

12. The method according to any one of claims 8 to 11, characterized in that: The resource transfer behaviors included in the training sample are encoded according to corresponding behavior attributes to obtain a coding sequence, including: For each resource transfer behavior included in the training sample, according to the behavior attribute of the resource transfer behavior, mapping the resource transfer behavior to a behavior parameter in a preset behavior parameter set, wherein resource transfer behaviors with different attributes correspond to different behavior parameters; The sequence composed of the obtained behavior parameters is used as the encoding sequence, wherein each behavior parameter is a sequence element in the encoding sequence.

13. The method according to any one of claims 8 to 11, characterized in that: The behavior feature extraction model includes an embedding layer and a recurrent neural network, the number of layers of the recurrent neural network is the same as the length of the encoding sequence, and each recurrent neural network layer corresponds to a sequence element in the encoding sequence; The method of using the behavior feature extraction model to be trained to extract the behavior features of each sequence element contained in the coding sequence includes: For each sequence element in the encoding sequence, perform the following operations respectively: Using the embedding layer, embedding the sequence elements to obtain embedding features of the sequence elements; The corresponding recurrent neural network layer is used to fuse the embedding features of the sequence element with the behavioral features of its previous sequence element to extract the behavioral features of the sequence element.

14. The method according to claim 13, characterized in that The embedding layer is used to embed the sequence elements to obtain the embedding features of the sequence elements, including: Using the embedding layer, randomly mapping the sequence elements to obtain embedding features corresponding to the sequence elements; When adjusting parameters of the behavior feature extraction model, the method further includes: The embedded features obtained by randomly mapping each sequence element are synchronously adjusted, and after the training is completed, the embedded features corresponding to each possible sequence element are formed into an embedded feature table, so that in the model application part, the embedded features of each sequence element are determined according to the embedded feature table.

15. The method according to any one of claims 8 to 11, characterized in that: The abnormal behavior analysis model includes a transformer and a second fully connected layer; the obtained behavior features are merged into a sequence fusion feature, input into the trained abnormal behavior analysis model, and the target behavior detection result is obtained, including: Merge the obtained behavioral features into sequence fusion features; Using the transformer to perform attention transformation fusion processing on the sequence fusion features to obtain attention weighted features; The second fully connected layer is used to perform feature mapping on the attention weighted features to obtain the target behavior detection result.

16. A behavior detection device, characterized in that: include: A sequence generation unit is used to divide the resource transfer source data according to the object to be detected and the time window to obtain at least one resource transfer behavior sequence, each resource transfer behavior sequence includes: a preset number of resource transfer behaviors occurring within a time window for the same object to be detected; The detection unit is used to perform the following operations for each resource transfer behavior sequence: For each resource transfer behavior included in the resource transfer behavior sequence, encode according to the corresponding behavior attribute to obtain a coding sequence; use the trained behavior feature extraction model to extract the behavior features of each sequence element included in the coding sequence, wherein each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; The obtained behavior features are combined into sequence fusion features, which are input into the trained abnormal behavior analysis model to obtain behavior detection results, which represent the predicted probability that the corresponding object to be detected has abnormal behavior within the corresponding time window.

17. A model training device, characterized in that: include: A sample acquisition unit is used to acquire multiple training samples, each training sample is: a sequence of resource transfer behaviors of a preset number of times occurring in a sample time window for the same sample object; A detection unit, configured to encode, for each training sample, each resource transfer behavior included in the training sample according to corresponding behavior attributes to obtain a coding sequence; The behavior feature extraction model to be trained is used to extract the behavior features of each sequence element contained in the coding sequence, each behavior feature is obtained by combining the embedded features after the corresponding sequence element is converted and the behavior features of the previous sequence element; the obtained behavior features are merged into sequence fusion features, and input into the trained abnormal behavior analysis model to obtain the target behavior detection result, and the target behavior detection result represents: the predicted probability that the corresponding sample object has abnormal behavior within the corresponding sample time window; A parameter adjustment unit, used to adjust parameters of the behavior feature extraction model and the abnormal behavior analysis model according to the obtained target behavior detection results and corresponding sample labels; The trained behavior feature extraction model and abnormal behavior analysis model are used to predict abnormal behavior risks of the detected objects.

18. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 15.

19. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any method described in claims 1 to 15.

20. A computer program product, characterized in that The method comprises a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of any one of the methods described in claims 1 to 15.

Images