Target event detection method based on natural language processing and related equipment

Abstract

The invention provides a target event detection method based on natural language processing and related equipment. The method comprises the following steps: acquiring event data of a to-be-detected event; detecting the event data based on a trained target event model, and determining that the to-be-detected event is a target event; wherein the trained target event model is obtained by training based on training text data about a target event, and the method comprises the steps that the training text data are acquired, and event types and target features of the target event are marked on the training text data; performing data preprocessing and data enhancement on the training text data to obtain enhanced text data; and training a natural language processing model based on historical text data and the enhanced text data to obtain the trained target event model.

Description

Technical Field

[0001] The present disclosure relates to the field of language processing, and in particular to a target event detection method based on natural language processing and related equipment. Background Art

[0002] With the rapid development and popularization of information technology, the Internet has become an indispensable part of people's daily lives. However, with the development of the Internet, various target events (such as new types of fraud) have emerged in an endless stream, and these means have been continuously upgraded in complexity and concealment, making it difficult for traditional target event detection technology to cope with them. Existing target event detection systems usually rely on historical data and known target event patterns for detection, but due to the frequent appearance of new target event means, the detection ability of the system has gradually become insufficient, resulting in reduced accuracy of target event detection and insufficient timeliness. Summary of the invention

[0003] The present disclosure proposes a target event detection method based on natural language processing and related equipment to solve technical problems such as reduced accuracy and lack of timeliness of target event detection to a certain extent.

[0004] In a first aspect, the present disclosure provides a target event detection method based on natural language processing, comprising:

[0005] Obtaining event data of the event to be detected;

[0006] Detecting the event data based on the trained target event model to determine that the event to be detected is a target event;

[0007] The trained target event model is obtained based on training text data about the target event, and includes:

[0008] Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event;

[0009] Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data;

[0010] The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

[0011] In a second aspect of the present disclosure, a target event detection device based on natural language processing is provided, comprising:

[0012] An acquisition module, used for acquiring event data of an event to be detected;

[0013] A model module, used to detect the event data based on a trained target event model, and determine that the event to be detected is a target event;

[0014] The trained target event model is obtained based on training text data about the target event, and includes:

[0015] Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event;

[0016] Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data;

[0017] The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

[0018] In a third aspect of the present disclosure, an electronic device is provided, comprising one or more processors, a memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, and the programs include instructions for executing the method described in the first aspect.

[0019] According to a fourth aspect of the present disclosure, a non-volatile computer-readable storage medium containing a computer program is provided. When the computer program is executed by one or more processors, the processors execute the method described in the first aspect.

[0020] In a fifth aspect of the present disclosure, a computer program product is provided, comprising computer program instructions, which, when executed on a computer, enable the computer to execute the method described in the first aspect.

[0021] From the above, it can be seen that the target event detection method and related equipment based on natural language processing provided by the present disclosure realize that application data can carry any existing communication protocol by defining the network layer protocol, thereby improving the application scope and flexibility of the CAN bus communication protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 Schematic diagram of a target event detection architecture based on natural language processing according to an embodiment of the present disclosure.

[0024] Figure 2 The figure is a schematic diagram of the hardware structure of an exemplary electronic device according to an embodiment of the present disclosure.

[0025] Figure 3 Schematic diagram of the process of the target event detection method based on natural language processing according to an embodiment of the present disclosure.

[0026] Figure 4 Schematic diagram of a target event detection device based on natural language processing according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0028] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0029] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, scope of use, and usage scenarios of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. For example, in response to receiving an active request from the user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require the acquisition and use of the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0030] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0031] Figure 1FIG. 1 is a schematic diagram showing a target event detection architecture based on natural language processing according to an embodiment of the present disclosure. Figure 1 , the target event detection architecture 100 based on natural language processing may include a server 110, a terminal 120, and a network 130 providing a communication link. The server 110 and the terminal 120 may be connected via a wired or wireless network 130. The server 110 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, security services, and CDN.

[0032] The terminal 120 may be implemented in hardware or software. For example, when the terminal 120 is implemented in hardware, it may be various electronic devices having a display screen and supporting page display, including but not limited to smart phones, tablet computers, e-book readers, laptop portable computers, and desktop computers, etc. When the terminal 120 device is implemented in software, it may be installed in the electronic devices listed above; it may be implemented as multiple software or software modules (such as software or software modules used to provide distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.

[0033] It should be noted that the target event detection method based on natural language processing provided in the embodiment of the present application can be executed by the terminal 120 or by the server 110. It should be understood that Figure 1 The number of terminals, networks and servers in the embodiment is only for illustration and is not intended to limit the number of terminals, networks and servers. Any number of terminals, networks and servers may be provided as required.

[0034] Figure 2 FIG. 2 shows a schematic diagram of the hardware structure of an exemplary electronic device 200 provided in an embodiment of the present disclosure. Figure 2 As shown, the electronic device 200 may include: a processor 202, a memory 204, a network module 206, a peripheral interface 208 and a bus 210. The processor 202, the memory 204, the network module 206 and the peripheral interface 208 are connected to each other in communication within the electronic device 200 through the bus 210.

[0035] Processor 202 may be a central processing unit (CPU), a neural network processor (NPU), a microcontroller (MCU), a programmable logic device, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or one or more integrated circuits. Processor 202 may be used to perform functions related to the technology described in this disclosure. In some embodiments, processor 202 may also include multiple processors integrated into a single logical component. For example, Figure 2 As shown, processor 202 may include a plurality of processors 202a, 202b, and 202c.

[0036] The memory 204 may be configured to store data (eg, instructions, computer code, etc.). Figure 2 As shown, the data stored in the memory 204 may include program instructions (for example, program instructions for implementing the target event detection method based on natural language processing of the embodiment of the present disclosure) and data to be processed (for example, the memory may store configuration files of other modules, etc.). The processor 202 may also access the program instructions and data stored in the memory 204, and execute the program instructions to operate on the data to be processed. The memory 204 may include a volatile storage device or a non-volatile storage device. In some embodiments, the memory 204 may include a random access memory (RAM), a read-only memory (ROM), an optical disk, a magnetic disk, a hard disk, a solid-state drive (SSD), a flash memory, a memory stick, etc.

[0037] The network module 206 can be configured to provide communication with other external devices to the electronic device 200 via a network. The network can be any wired or wireless network capable of transmitting and receiving data. For example, the network can be a wired network, a local wireless network (e.g., Bluetooth, WiFi, near field communication (NFC) etc.), a cellular network, the Internet or a combination thereof. It is understood that the type of network is not limited to the above specific examples. In some embodiments, the network module 206 can include any number of network interface controllers (NICs), radio frequency modules, transceivers, modems, routers, gateways, adapters, cellular network chips, etc., in any combination.

[0038] The peripheral interface 208 can be configured to connect the electronic device 200 to one or more peripheral devices to achieve information input and output. For example, the peripheral devices can include input devices such as a keyboard, a mouse, a touch pad, a touch screen, a microphone, and various sensors, and output devices such as a display, a speaker, a vibrator, and an indicator light.

[0039] The bus 210 can be configured to transmit information between various components of the electronic device 200 (e.g., the processor 202, the memory 204, the network module 206, and the peripheral interface 208), such as an internal bus (e.g., a processor-memory bus), an external bus (USB port, PCI-E bus), etc.

[0040] It should be noted that, although the architecture of the electronic device 200 only shows the processor 202, the memory 204, the network module 206, the peripheral interface 208 and the bus 210, in the specific implementation process, the architecture of the electronic device 200 may also include other components necessary for normal execution. In addition, it can be understood by those skilled in the art that the architecture of the electronic device 200 may also only include the components necessary for implementing the embodiments of the present disclosure, and does not necessarily include all the components shown in the figure.

[0041] Existing target event detection systems usually rely on historical data and known target event patterns for detection, such as the detection of fraudulent behavior by anti-fraud systems. Traditional anti-fraud technology mainly relies on predefined rules and fixed pattern recognition methods. Although this method has a certain detection effect on known fraud methods, it often shows great limitations when facing rapidly evolving new fraud patterns. New fraud methods may bypass the existing rules of the system or exploit system loopholes, resulting in the inability to identify and prevent them in a timely and accurate manner. In addition, the model may face the problem of "catastrophic forgetting" during the updating process, that is, the phenomenon of forgetting old patterns when learning new patterns, which further weakens the comprehensive detection capabilities of the system. Therefore, how to improve the accuracy and timeliness of target event detection has become a technical problem that needs to be solved urgently.

[0042] In view of this, the embodiments of the present disclosure provide a target event detection method and related equipment based on natural language processing. By building a user feedback system to timely collect and update the corpus of the target event, and combining the cleaning and mixing of new and old corpora for incremental training, it is ensured that the model does not forget the old mode while adapting to the new mode. This method not only maintains the comprehensive detection capability of the model, but also improves the overall performance of the target event detection system by continuously optimizing the model, and enhances the system's ability to cope with complex and changing target event environments.

[0043] See also Figure 3 , Figure 3 A schematic flow chart of a target event detection method based on natural language processing according to an embodiment of the present disclosure is shown. The target event detection method based on natural language processing according to an embodiment of the present disclosure can be deployed on a server or a terminal. Figure 3 In the present invention, the target event detection method 300 based on natural language processing may further include the following steps.

[0044] In step S310, event data of the event to be detected is obtained.

[0045] The event to be detected may refer to a specific event whose nature or category needs to be determined by detection means. For example, the event to be detected may be a text message notifying the user that he has won a prize and needs to provide personal information to receive the prize. Event data may refer to relevant information describing the event, including but not limited to text content, sender information, receiving time, etc. For example, the specific text content of the text message, the sender's phone number, the receiving time, etc.

[0046] In step S320, the event data is detected based on the trained target event model to determine that the event to be detected is a target event;

[0047] The trained target event model is obtained based on training text data about the target event, and includes:

[0048] Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event;

[0049] Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data;

[0050] The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

[0051] Among them, the target event model may refer to a model used to identify a specific type of event (i.e., "target event"), for example, to distinguish between fraudulent information and normal information. The target event may refer to a specific type of event with specific characteristics and patterns that is expected to be detected and identified, such as telecommunications fraud. Training text data may refer to a set of labeled data used to train the model, which should contain typical features of the target event. For example, a text message or email containing known fraudulent information can be labeled as "fraud." Event type may refer to a way of classifying events, and classifying them into a certain category based on their main characteristics. For example, the types of target events may include phishing, fake customer service, false winning notifications, financial fraud, etc. Target features may refer to key attributes or features used to distinguish target events. For example, in telecommunications fraud, the feature of "requesting bank account information" may be one of the target features.

[0052] Specifically, in order to effectively detect new fraud patterns, it is first necessary to establish an efficient user feedback system. The main function of this system is to collect and record various new fraud corpora reported by users. For example, the design of the user feedback system includes the front-end user interface, the back-end database, the data transmission module, etc. The user interface allows users to easily submit the suspicious fraud information they encounter, while the back-end database is responsible for storing and managing this information. The data transmission module ensures that the information submitted by users can be transmitted to the back-end quickly and securely. During the data collection process, the system will automatically perform preliminary annotations on the data reported by users, including the type of fraud, the characteristics of the method, etc. These annotation information will help with subsequent data analysis and model training.

[0053] Obtain labeled training text data from user feedback and other reliable channels. These data contain typical features and event types of target events (such as fraud information). Preprocess the collected training text data, including data cleaning (removing irrelevant information, handling missing values, outliers), data integration (merging data from different sources), data conversion (standardization / normalization, format conversion) and feature selection (selecting the most valuable features). In order to enhance the generalization ability of the model and prevent overfitting, the preprocessed training text data is enhanced to expand the scale and diversity of the training data set by synthesizing new data samples. Use historical text data and enhanced text data to train the natural language processing model. In this step, the model will learn the characteristics of new and old fraud patterns, and continuously adjust parameters through incremental training to adapt to new fraud methods without forgetting old patterns. Finally, the data of the event to be detected is input into the trained model for detection. If the model recognizes that the event meets the characteristics of the target event, it is determined to be the target event (such as fraud). At the same time, new cases in the real world are collected through the user feedback system to further improve the training data set.

[0054] Because the model is trained on diverse and high-quality data, its ability to identify new fraud patterns is significantly enhanced. Through incremental training, the model can remember old fraud patterns, rather than just being limited to new patterns, thereby maintaining the ability to detect a variety of fraud methods. Continuous data updates and model optimization enable the system to quickly adapt to evolving fraud methods, improving the flexibility and response speed of the system. According to the method of the embodiment of the present disclosure, not only the detection performance of the anti-fraud system is improved, but also the robustness and practicality of the system are enhanced through continuous iterative optimization.

[0055] In some embodiments, performing data preprocessing and data enhancement on the training text data to obtain enhanced text data includes:

[0056] Performing data preprocessing on the training text data to obtain preprocessed samples, wherein the data preprocessing includes at least one of data cleaning, noise filtering, deduplication, data formatting or unified encoding;

[0057] Data merging, text replacement and / or text deletion are performed based on the preprocessed samples and the synthesized samples to obtain the enhanced text data.

[0058] Among them, data cleaning can refer to removing irrelevant or erroneous data, for example, deleting records that do not contain any useful information. Noise filtering can refer to identifying and filtering out noise in the text, such as advertising links, meaningless characters or words. Deduplication can refer to identifying and deleting duplicate data records to ensure the uniqueness of the data set. Data formatting can refer to converting data into a consistent format, such as date format, numeric representation, etc. Unified encoding can refer to ensuring that all text data uses the same character encoding (such as UTF-8) to avoid problems caused by different encodings. In this way, data preprocessing can improve the quality of the data and make subsequent model training more efficient.

[0059] Specifically, the collected corpus can be preprocessed, including removing duplicate data, formatting text, and unifying encoding. This step can improve data consistency and reduce interference during data processing. In addition, the system automatically identifies and removes noise data, such as irrelevant advertisements and user input errors, through text analysis technology. Noise filtering can be achieved by setting keyword filtering, sentiment analysis, and other methods. During the cleaning process, text content that is not related to fraud, such as user personal comments and invalid interactive information, needs to be eliminated. Through natural language processing technology, these irrelevant information can be effectively identified and excluded. For example, several annotated SMS data can be used as training text data, including many known fraud SMS examples. Data cleaning can be performed on known fraud SMS examples to remove SMS containing garbled or meaningless characters. Noise filtering can also be performed to filter out advertising links or special symbols in SMS. Duplicates can also be removed to ensure that there are no duplicate SMS records. Data formatting can also be performed to unify the format of all data of the same type. Unified encoding can also be performed, such as converting all SMS to UTF-8 encoding. The enhanced text data obtained in this way can be used to train the model so that it can more accurately identify new fraud patterns.

[0060] Data merging can be used to merge preprocessed samples with synthetic samples that may have existed before to expand the size of the data set. Text replacement can refer to replacing certain words with synonyms or near-synonyms based on preprocessed samples to generate new but semantically similar text samples. Text deletion can refer to deleting some non-critical words or phrases from the original text to create new samples that still retain the original intent. In this way, enhanced text data can be obtained for subsequent model training to help the model better learn and recognize various patterns.

[0061] In some embodiments, method 300 further includes:

[0062] The synthetic sample about the target event is generated based on a generative adversarial network, wherein the loss function of the generative adversarial network includes:

[0063]

[0064] Among them, D is the discriminator, G is the generator, x is the real sample about the target event, z is the noise, p data (x) is the distribution of the real samples, p z (z) is the noise distribution.

[0065] Specifically, after data preprocessing, data enhancement can be performed. Data enhancement can include three steps: the first step is to generate synthetic samples and use a generative adversarial network to generate fraud samples with different expressions to enhance data diversity. The loss function formula of the generative adversarial network is as follows:

[0066] Among them, D is the discriminator, G is the generator, x is the real sample, z is the noise, p data (x) is the data distribution, p z (z) is the noise distribution.

[0067] In some embodiments, the data merging includes:

[0068] Merging the preprocessed sample and the synthesized sample in a feature space to obtain a merged sample;

[0069] The text replacement includes replacing at least part of the preprocessed samples, the synthesized samples and the merged samples with similar words;

[0070] And / or, the text deletion includes deleting preset text in at least part of the preprocessed samples, the synthesized samples and the merged samples.

[0071] Specifically, in the second step, SMOTE technology is applied to the original data and the generated samples. SMOTE (Synthetic Minority Over-sampling Technique) can be used to deal with the problem of class imbalance in the data set. Class imbalance means that the number of samples in a certain class is much less than the number of samples in other classes. This situation may cause the model to favor the majority class, thereby ignoring the minority class and affecting the performance of the model. A sample x can be randomly selected from the minority class. minority , find the K nearest neighbors (e.g. using Euclidean distance or other distance metric) of the sample in the minority class. Randomly select a sample x from the K nearest neighbors neighbor , then in the selected two samples x minority and x neighbor Generate a new synthetic sample x new The generated new sample is located on the line connecting the two samples, and its eigenvalue is calculated by linear interpolation. Repeat the above steps until the number of minority class samples reaches the desired balanced ratio. For example, after merging the generated samples with the original data, use SMOTE to generate new synthetic samples in the feature space to balance the dataset. The formula used is as follows:

[0072] x new =x minority +λ(x neighbor -x minority ), where x new is a synthetic sample, x minority is a minority class sample, x neighbor are neighboring samples, and λ is a random value.

[0073] The third step is to apply similar word replacement, word deletion and other methods to the synthesized samples and mixed data to obtain more variants and obtain enhanced text data.

[0074] In some embodiments, training a natural language processing model based on the historical text data and the enhanced text data to obtain the trained target event model includes:

[0075] Select target historical data that meets preset conditions from historical text data based on text clustering and frequency analysis;

[0076] The natural language processing model is trained based on the enhanced text data of the first proportion and the target history data of the second proportion to obtain the trained target event model.

[0077] Specifically, in order to prevent the model from forgetting the old fraud patterns when learning new patterns, a strategy of appropriately adding some old fraud corpora to the new corpus can be used. First, a part of the data needs to be selected from the old corpus and mixed into the new corpus. Representative old fraud corpora are selected from historical data. These corpora should include various known fraud methods, such as classic phishing, fake customer service, false winning notifications, financial fraud and other types. When selecting, give priority to common sentences and patterns that appear many times in different fraud cases to ensure that these corpora can cover a wide range of fraud methods. For example, in detail, a large amount of historical fraud corpora can be screened and sorted using automated tools and algorithms. For example, text clustering, frequency analysis and other techniques can be used to quickly screen out the most representative old corpora. In addition, the screening results can be manually reviewed and adjusted in combination with expert knowledge to ensure that the final selected old corpora best meet actual needs.

[0078] In some embodiments, selecting target historical data that meets preset conditions from historical text data based on text clustering and frequency analysis includes:

[0079] Selecting historical text data of different types, different time periods and different regions to obtain multiple historical data sets, each of which has at least one different type, time period and region;

[0080] Performing text clustering and frequency analysis on each historical data set to obtain a clustering result corresponding to each historical data set, each clustering result including the historical text data sorted from high to low in frequency;

[0081] The target historical data in the clustering result is determined based on the preset condition, where the preset condition includes the first n data in descending order of frequency, where n is a positive integer.

[0082] Among them, multiple historical data sets are formed by selecting data of different types, different time periods and different regions from historical text data, and text clustering and frequency analysis are performed on each set. The top n data sorted from high to low in frequency are selected as target historical data, so as to enrich the diversity and representativeness of training samples, thereby improving the comprehensive recognition ability of the anti-fraud system for new and old patterns, and enhancing the detection accuracy and adaptability of the system.

[0083] Specifically, when selecting old corpus, we should also ensure the diversity of data to avoid the model from being overly dependent on a specific old pattern. Specifically, when selecting old corpus, we should select samples from historical data of different categories, different time periods, and different regions, so as to enhance the model's ability to recognize various old patterns.

[0084] In order to ensure that the model always maintains the ability to effectively identify old patterns, the old corpus should also be updated regularly. Over time, some old patterns may gradually lose their realistic threat, or new fraud patterns may appear similar to some old patterns. Specifically, set fixed time intervals to evaluate the currently used corpus. The frequency of the evaluation can be adjusted according to the speed at which the fraud methods change. It is generally recommended to conduct a comprehensive evaluation every 3 to 6 months. The evaluation content includes the detection effect of the model on new and old patterns, the coverage of the corpus, and the representativeness and timeliness of the corpus.

[0085] During the evaluation process, identify old fraud corpora that have lost their real threat. These corpora may have been very typical in the past, but over time, they may no longer be representative or have been effectively prevented. For these corpora, consideration should be given to removing them from the corpus to avoid interfering with the training and updating of the model. Moreover, when updating the corpus, it is still necessary to ensure the diversity of new and old corpora. This includes fraud methods of different types, different regions, and different time periods, ensuring that the model can be exposed to various types of fraud patterns during the training process and improve its comprehensive detection capabilities.

[0086] The updating of the corpus is an ongoing process. With the development of anti-fraud technology and the changes in fraud methods, the corpus also needs to be continuously optimized. Through regular evaluation and updating, we can ensure that the corpus always remains timely and representative, thereby providing stable and effective training data for the model and ensuring the long-term effectiveness of the anti-fraud system.

[0087] In order to prevent the model from forgetting old fraud patterns when learning new patterns, and to ensure that it can effectively deal with new fraud methods, a strategy for controlling the ratio of new and old corpora is specially proposed. Reasonable ratio control can enable the model to take into account the learning of new and old fraud patterns during incremental training, thereby improving the comprehensive detection ability of the model. Specifically, the initial ratio of new and old corpora is determined, and the ratio of new and old corpora is 80% new corpora and 20% old corpora. This setting helps the model to adapt to newly emerging fraud patterns first, and at the same time, through the supplement of old corpora, it prevents the model from losing the ability to recognize historical fraud methods.

[0088] During the training process, the ratio of new and old corpora can be dynamically adjusted by evaluating the detection effect of the model on the new and old patterns. If the model does not detect well on the new pattern, the proportion of new corpora can be increased; conversely, if the model's recognition ability decreases on the old pattern, the proportion of old corpora can be increased. Specifically, before incremental training begins, all mixed corpora need to undergo rigorous preprocessing. This includes steps such as text cleaning, deduplication, word segmentation, and annotation to ensure that the data input into the model is of high quality, uniform format, and noise-free. For different types of fraud patterns, label unification is also required to ensure that the model can correctly understand and distinguish different fraud patterns during training.

[0089] The mixed corpus is divided into a training set, a validation set, and a test set. The training set is used for actual incremental training, the validation set is used to monitor model performance and tune hyperparameters during training, and the test set is used to perform a final evaluation of the model after training is completed. When performing incremental training, training is performed based on an existing model, that is, a new round of training is continued on the basis of retaining the previously learned weights and structures. This method can avoid training the model from scratch, thereby saving a lot of computing resources and time, while keeping the model's memory of the old pattern.

[0090] When performing incremental training, parameter settings are crucial to improving model performance. Reasonable parameter configuration can effectively prevent the model from overfitting or underfitting when learning new data, and ensure that the model can fully utilize new and old corpora for training. Specifically, during the training process, a learning rate decay strategy is adopted, and the learning rate is gradually reduced in a cosine function manner, so that the model can make small adjustments in the later stages of training to avoid jumping out of the optimal solution. At the same time, an early stopping strategy is adopted to prevent the model from overfitting during training.

[0091] It can be seen that through reasonable parameter setting and dynamic adjustment, the incremental training process of the present invention can make full use of mixed corpus, effectively learning new fraud patterns while retaining the ability to detect old patterns.

[0092] In some embodiments, method 300 further includes:

[0093] Evaluating preset indicators of the target event model on different types of target events;

[0094] Adjust the first ratio and the second ratio based on the preset indicator to obtain updated training data;

[0095] The current target event model is trained based on the updated training data to update the parameters of the target event model.

[0096] Among them, model evaluation and continuous optimization are key steps to ensure that the model can efficiently detect new and old fraud patterns. Through a comprehensive evaluation of the model's detection effect, the model's detection blind spots under different fraud patterns can be discovered in a timely manner, and the overall detection capability of the model can be gradually improved through supplementary training and optimization strategies. Specifically, standard indicators such as accuracy, recall, and F1 score are used to evaluate the model. These indicators can reflect the model's comprehensive detection capabilities on new and old fraud patterns.

[0097] During the model evaluation process, check whether the model has the ability to recognize both new and old patterns. If not, provide additional data for supplementary training. Specifically, if the evaluation results show that the model is not effective in detecting old fraud patterns, it may mean that the model has forgotten some of the features of the old patterns when learning new patterns. In this case, it is necessary to supplement the old data set with representative fraud pattern data where the model performs poorly. These data should contain the features of old patterns that the model has weak detection capabilities, so that the model's memory of these patterns can be strengthened in subsequent training.

[0098] After the supplementary training is completed, the model is evaluated again to check whether the model's detection effect on the old pattern has been improved. If there are still deficiencies, it may be necessary to further adjust the proportion of old data or select more representative data for additional training. If the evaluation results show that the model's detection effect on the new fraud pattern is not good, it means that the model has not fully learned the characteristics of the new pattern, and new data needs to be added. Specifically, the existing new data is enhanced to increase its diversity and complexity. Based on the existing new data, more diverse new data is generated based on the large model. Use the enhanced new data for supplementary training, focusing on strengthening the model's learning of new fraud patterns. At this time, attention should be paid to the setting of the learning rate to avoid the model being biased towards new data due to too fast learning. If the model still cannot effectively cover all types of fraud patterns after supplementary training, it is necessary to repeat the above evaluation and optimization steps until the model can stably detect new and old patterns.

[0099] It can be seen that according to the method of the embodiment of the present disclosure, the anti-fraud system can improve its ability to identify new fraud methods by introducing old corpus and mixing them for incremental training, and effectively avoid the problem of the model forgetting the old model when learning the new model. The comprehensiveness and continuous adaptability of the anti-fraud system are greatly enhanced, enabling it to provide more accurate and reliable protection in a complex and changeable fraud environment.

[0100] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0101] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0102] Based on the same technical concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides a target event detection device based on natural language processing, see Figure 4 , the target event detection device based on natural language processing, the device comprising:

[0103] An acquisition module, used for acquiring event data of an event to be detected;

[0104] A model module, used to detect the event data based on a trained target event model, and determine that the event to be detected is a target event;

[0105] The trained target event model is obtained based on training text data about the target event, and includes:

[0106] Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event;

[0107] Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data;

[0108] The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

[0109] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0110] The device of the above embodiment is used to implement the corresponding target event detection method based on natural language processing in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0111] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the target event detection method based on natural language processing as described in any of the above embodiments.

[0112] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0113] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the target event detection method based on natural language processing as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0114] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0115] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present disclosure difficult to understand, the known power / ground connections to the integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present disclosure difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0116] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0117] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A target event detection method based on natural language processing, comprising: Obtaining event data of the event to be detected; Detecting the event data based on the trained target event model to determine that the event to be detected is a target event; The trained target event model is obtained based on training text data about the target event, and includes: Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event; Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data; The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

2. The method according to claim 1, wherein: Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data includes: Performing data preprocessing on the training text data to obtain preprocessed samples, wherein the data preprocessing includes at least one of data cleaning, noise filtering, deduplication, data formatting or unified encoding; Data merging, text replacement and / or text deletion are performed based on the preprocessed samples and the synthesized samples to obtain the enhanced text data.

3. The method according to claim 2, further comprising: The synthetic sample about the target event is generated based on a generative adversarial network, wherein the loss function of the generative adversarial network includes: Among them, D is the discriminator, G is the generator, x is the real sample about the target event, z is the noise, p data (x) is the distribution of the real samples, p z (z) is the noise distribution.

4. The method according to claim 2, wherein: The data merging includes: Merging the preprocessed sample and the synthesized sample in a feature space to obtain a merged sample; The text replacement includes replacing at least part of the preprocessed samples, the synthesized samples and the merged samples with similar words; And / or, the text deletion includes deleting preset text in at least part of the preprocessed samples, the synthesized samples and the merged samples.

5. The method according to claim 1, wherein: The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model, including: Select target historical data that meets preset conditions from historical text data based on text clustering and frequency analysis; The natural language processing model is trained based on the enhanced text data of the first proportion and the target history data of the second proportion to obtain the trained target event model.

6. The method according to claim 5, wherein: Based on text clustering and frequency analysis, target historical data that meets preset conditions is selected from historical text data, including: Selecting historical text data of different types, different time periods and different regions to obtain multiple historical data sets, each of which has at least one different type, time period and region; Performing text clustering and frequency analysis on each historical data set to obtain a clustering result corresponding to each historical data set, each clustering result including the historical text data sorted from high to low in frequency; The target historical data in the clustering result is determined based on the preset condition, where the preset condition includes the first n data in descending order of frequency, where n is a positive integer.

7. The method according to claim 5, further comprising: Evaluating preset indicators of the target event model on different types of target events; Adjust the first ratio and the second ratio based on the preset indicator to obtain updated training data; The current target event model is trained based on the updated training data to update the parameters of the target event model.

8. A target event detection device based on natural language processing, comprising: An acquisition module, used for acquiring event data of an event to be detected; A model module, used to detect the event data based on a trained target event model, and determine that the event to be detected is a target event; The trained target event model is obtained based on training text data about the target event, and includes: Acquire the training text data, wherein the training text data is annotated with an event type and a target feature of a target event; Performing data preprocessing and data enhancement on the training text data to obtain enhanced text data; The natural language processing model is trained based on the historical text data and the enhanced text data to obtain the trained target event model.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program. 10 . A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method according to claim 1 .

Images