User behavior anomaly detection method, device, electronic device, and readable storage medium

Abstract

Embodiments of the present disclosure provide a method, apparatus, electronic device, and readable storage medium for detecting abnormal user behavior. The method comprises: detecting a preset business behavior initiated by a user when visiting a merchant, initiating a capture request to the user for the business behavior; obtaining a first image captured by the user in response to the capture request; obtaining a preset template image corresponding to the first image; obtaining a similarity value between the preset template image and the first image based on the image features of the preset template image and the first image; and determining that the user's access behavior is abnormal when the similarity value is lower than a preset similarity threshold. The method can determine whether the user's access behavior is abnormal based on the similarity between the captured data when the user visits the merchant and the preset template image, thereby improving the efficiency of abnormality detection.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of detection technology, and in particular, to a method, device, electronic device, and readable storage medium for detecting abnormal user behavior. Background Art

[0002] In the field of testing technology, the authenticity of merchant reviews is often verified through the visit records kept by account managers. For example, managers can use account manager visit records to assess the authenticity of merchant reviews and identify any problems or areas for improvement.

[0003] However, there are the following problems in assessing the authenticity of merchant reviews using the above method: during manual investigation, the data base is large, and it is difficult to verify whether the records entered into the system by the account manager are true and valid. It is also difficult to obtain real feedback on whether the store has been visited, resulting in low investigation efficiency. Summary of the Invention

[0004] Embodiments of the present disclosure provide a method, apparatus, electronic device, and readable storage medium for detecting abnormal user behavior, to improve the efficiency of abnormality troubleshooting.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for detecting abnormal user behavior is provided, the method comprising:

[0006] Detecting a preset business behavior initiated by a user when visiting a merchant, and initiating a photo shooting request for the business behavior to the user;

[0007] Acquire a first image captured by the user in response to the capture request;

[0008] Acquire a preset template image corresponding to the first image;

[0009] acquiring a similarity value between the first image and the preset template image according to the image features of the preset template image and the first image;

[0010] When the similarity value is lower than a preset similarity threshold, it is determined that the access behavior of the user is abnormal.

[0011] According to a second aspect of an embodiment of the present disclosure, a device for detecting abnormal user behavior is provided, the device comprising:

[0012] The shooting request initiation module is used to detect the preset business behavior initiated by the user when visiting the merchant, and initiate a shooting request for the business behavior to the user

[0013] A first image acquisition module, configured to acquire a first image captured by a user in response to the capture request;

[0014] A preset template image acquisition module, configured to acquire a preset template image corresponding to the first image;

[0015] a similarity value acquisition module, configured to acquire a similarity value between the first image and the preset template image based on the image features of the preset template image and the first image;

[0016] The first anomaly determination module is configured to determine that an anomaly exists in the user's access behavior when the similarity value is lower than a preset similarity threshold.

[0017] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0018] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method for detecting abnormal user behavior when executing the program.

[0019] According to a fourth aspect of an embodiment of the present disclosure, a readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the aforementioned user behavior abnormality detection method.

[0020] Embodiments of the present disclosure provide a method, apparatus, electronic device, and readable storage medium for detecting abnormal user behavior. The method comprises: detecting a preset business behavior initiated by a user when visiting a merchant, initiating a capture request to the user for the business behavior; obtaining a first image captured by the user in response to the capture request; obtaining a preset template image corresponding to the first image; obtaining a similarity value between the preset template image and the first image based on the image features of the preset template image and the first image; and determining that the user's access behavior is abnormal when the similarity value is lower than a preset similarity threshold. The method can monitor whether the user's access behavior is abnormal based on the captured data of the user's visit to the merchant, thereby improving the efficiency of abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the description of the embodiments of the present disclosure. Obviously, the drawings described below are only some embodiments of the embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0022] Figure 1 A flowchart showing the steps of a method for detecting abnormal user behavior in one embodiment of the present disclosure is shown;

[0023] Figure 2A flowchart showing the steps of a method for detecting abnormal user behavior in another embodiment of the present disclosure is shown;

[0024] Figure 3 A structural diagram of a user behavior anomaly detection device in one embodiment of the present disclosure is shown;

[0025] Figure 4 A structural diagram of a user behavior anomaly detection device in another embodiment of the present disclosure is shown;

[0026] Figure 5 A structural diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, but not all of them. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the embodiments of the present disclosure.

[0028] Example 1

[0029] Reference Figure 1 , which shows a flowchart of the steps of a method for detecting abnormal user behavior in one embodiment of the present disclosure, including:

[0030] Step 101: Detecting a preset business behavior initiated by a user when visiting a merchant, and initiating a photo shooting request for the business behavior to the user.

[0031] In an embodiment of the present disclosure, in a scenario of authenticity detection of user visits to a store, when a user visits the store to perform business operations, a store visit behavior verification task can be issued to the user through the application platform. The verification task requests the user to capture image data of a specified scene in the merchant's store. For example, when a user visits the store to place an order, pay, and evaluate, a request is sent to the user to capture real image data of the corresponding ordering, payment, and evaluation objects. The user can take pictures according to the prompts. For example, the shooting scene corresponding to the ordering operation is the image data of the dish, the shooting scene corresponding to the payment operation is the image data of the bill and receipt, and the shooting scene corresponding to the evaluation operation is the image data of the evaluation object, such as the merchant's store environment, dish quality, merchant door image data, image data of celebrity posters in the store, table sticker verification image data, etc.

[0032] Of course, in actual applications, the preset business behaviors and the corresponding shooting scenes are not limited to the above description, and the embodiments of the present disclosure are not limited to this.

[0033] Step 102: Acquire a first image captured by the user in response to the capture request;

[0034] In the embodiment of the present disclosure, according to the above description, after the user receives a shooting request, the image data of the corresponding scene is captured according to the shooting request and uploaded as the first image. Of course, the first image is a designated name for the needle image data, and the order is irrelevant.

[0035] Among them, the user can select the above-mentioned preset scene label to mark the first image when taking an image, so as to facilitate subsequent identification.

[0036] The first image that the user is required to upload may be a static first image or a dynamic first image, and this embodiment of the present disclosure does not impose any limitation on this.

[0037] In the embodiment of the present disclosure, after obtaining the first image uploaded by the user, image meta information can be obtained from the first image as detection information to determine whether the user's access behavior is abnormal.

[0038] Specifically, image metadata generally includes image shooting time, positioning information, shooting device information, fingerprint information, etc.

[0039] Of course, the image meta-information is not limited to the above description, and the embodiments of the present disclosure are not limited to this.

[0040] Step 103: Acquire a preset template image corresponding to the first image.

[0041] In the embodiment of the present disclosure, when a user takes a first image according to a corresponding scene, a template first image pre-set in the system is searched according to a label. For example, the store environment of a merchant, the quality of dishes, the first image of the merchant's storefront, the first image of the celebrity poster in the store, the first image of the table sticker, etc. can all be used as the template image.

[0042] Of course, the template image is not limited to the above description, and the embodiments of the present disclosure are not limited to this.

[0043] Step 104 : Acquire a similarity value between the first image and the preset template image based on the image features of the preset template image and the first image.

[0044] In the disclosed embodiment, the first image uploaded by the user in real time is compared with the template image of the corresponding scene to obtain similarity data, and it is determined based on the similarity data whether the first image taken by the user is a real first image of the same scene.

[0045] Of course, the template data can be provided by the merchant or set by the system, for example, a poster of an endorsed celebrity, and the template data provided by the merchant is also screened by the system through unified rules. After setting, it cannot be modified at will by the merchant. The setting method and source of the template data are not limited in the embodiment of this disclosure.

[0046] Preferably, step 104 specifically includes:

[0047] Sub-step A1, splitting the preset template image into a plurality of first image partitions of preset sizes;

[0048] Sub-step A2, marking a weight value of each first image partition in the preset template image according to the image feature;

[0049] Specifically, taking the preset template image as a celebrity poster as an example, the template photo is split into 3*3 blocks, and the weight W[1…9] of each area is set manually. The size of the i-th area is recorded as R[w / 3,h / 3]. Among them, the weight set for areas with higher recognition is higher, such as the celebrity face area and the endorsed product area or brand area on the poster. The weight value is set one level lower for the relatively low recognition area, and so on to set the weight value for each area.

[0050] It can be understood that the size of the divided areas of the template image can be adjusted according to the recognition accuracy. If you want to obtain high-precision recognition results, then divide the template image into small and numerous areas. Otherwise, divide it into large and fewer areas. Therefore, the method of dividing the areas is not limited to the 3*3 blocks described above, and the embodiments of the present disclosure are not limited to this.

[0051] Sub-step A3, matching the first image with the preset template image through affine transformation to obtain a matched first image;

[0052] Specifically, because the angle of the captured photo may be tilted or stretched, which is significantly different from the preset template photo, an affine transformation is required for better processing. If the material photo (preset template image) has a prominent yellow tint, edge detection is first performed to determine the largest yellow rectangular area. Then, the top left, top right, and bottom left corners are used to locate the area, aligning it with the yellow area in the template, and using an affine transformation to calculate the transformation matrix.

[0053]

[0054] The upper left corner, upper right corner and left corner are matched with the template in turn, and the matrices A and B are calculated. Then, an affine transformation is performed on the entire image, and the photo is stretched to a size close to that of the template photo.

[0055] Sub-step A4: splitting the matching first image into a plurality of second image partitions of preset sizes according to the mapping relationship between the first image partition and the matching first image.

[0056] Specifically, the divided areas of the corresponding template image are used to perform a moving comparison on the image areas photographed by the user after matching. That is, the preset template image and the photo taken by the user are moved and compared by the sliding window method, so that the area corresponding to the first partition forms a segmented area on the matching first image, and the matching first image is divided into multiple second image partitions of preset sizes. For example, if the template image is divided into 3*3 blocks, then the corresponding first image is also divided into 3*3 blocks for one-by-one comparison.

[0057] Sub-step A5: obtaining first similarities between each of the first image partitions and each of the second image partitions;

[0058] Specifically, for the divided template image and the first image taken by the user, the first image taken by the user is grayscaled according to the adaptive Otsu method, and the template matching algorithm is used to calculate the maximum similarity S[i] between the template image and the taken image.

[0059] The template matching algorithm is as follows:

[0060] For the photos taken by users when visiting the store, find the template photos S[1]…S[9] of the category to which the photos belong, and calculate the similarity S[i,j] of the two images when the window moves to position [i,j].

[0061]

[0062] Where SD represents the grayscale value of the template grayscale photo minus the average value, OD represents the grayscale value of the user grayscale photo minus the average value, x∈[0,3 / w], y∈[0,h / 3], and finally find max(S[i,j]) as the similarity between the template and the user's photo.

[0063] Among them, the adaptive Otsu method, also known as the Otsu method, is a method for image threshold segmentation. It adaptively finds a binarization threshold and divides the image into two parts: background and target according to the grayscale characteristics of the image. The larger the inter-class variance between the background and the target, the greater the difference between the two parts of the image. When part of the target is mistakenly classified as the background or part of the background is mistakenly classified as the target, the difference between the two parts will decrease. After obtaining the grayscale value of each region of the template image and the first captured image through this method, the template image is used as the background image and the captured image as the foreground image. The inter-class variance S[i] of each region is obtained as the maximum similarity between the template image and the captured image.

[0064] Of course, in actual applications, the method for calculating the similarity between two first images is not limited to the above description, and the embodiment of the present disclosure does not calculate this.

[0065] It is understandable that different similarity calculation methods have different requirements for the template image and the captured first image, such as image features such as resolution and format, which are not limited in the embodiments of the present disclosure.

[0066] Sub-step A6: obtaining a similarity value between the first image and the preset template image according to a weighted sum of the first similarities and the weight values of the first image partitions.

[0067] Specifically, after obtaining the maximum similarity S[i] between the template image and the captured image, the final similarity between the template image and the captured image is calculated based on the specific weight value of each template area corresponding to S[i]. That is, the similarities and weight values of all template images are finally weighted and summed to obtain W=W[i]*S[i], where W is the final similarity.

[0068] Preferably, there are multiple first images; each first image corresponds to a preset template image; step 104 includes:

[0069] Sub-step C1: for each first image, obtaining a first similarity between the first image and the preset template image corresponding to the first image based on the image features of the first image;

[0070] Specifically, according to the description of the above steps, when a user visits a store, multiple in-store first images according to multiple requests may be requested from the user, and each first image, or each required first image, corresponds to a preset template image.

[0071] The first similarity is obtained by obtaining image features of the first image and comparing them with a preset template image. Of course, the image features are determined by image processing methods based on the type of template image. For example, if the preset template image is a portrait, the image features are facial features. Therefore, the embodiment of the present invention does not limit the type of image features.

[0072] Sub-step C2, performing calculations on the first similarity values corresponding to the respective first images according to a preset ratio to obtain a comprehensive similarity value;

[0073] Specifically, the calculation method of the comprehensive similarity can be a simple accumulation of multiple similarities, or it can be to set a similarity ratio for the first image according to the importance of different first images, and accumulate the products of the first similarities of multiple first images and the similarity ratios to obtain a comprehensive similarity value. The setting of the similarity ratio in the present invention is not specifically limited.

[0074] Step 105: When the similarity value is lower than a preset similarity threshold, it is determined that the user's access behavior is abnormal.

[0075] In the embodiment of the present disclosure, when the similarity value between the first image and the preset template image is lower than a preset threshold, it is considered that the first image is suspected to be false, and further that the user's access behavior is abnormal.

[0076] Preferably, according to sub-steps C1-C2, step 105 specifically includes:

[0077] Sub-step D1: When the comprehensive similarity value is lower than a preset similarity threshold, it is determined that the user's access behavior is abnormal.

[0078] Specifically, according to the description of sub-step C1, when there are multiple first images, the first similarity value obtained by comparing each first image with the corresponding preset template image is used to calculate a comprehensive similarity value including multiple first similarities. When the comprehensive similarity value is lower than the preset similarity threshold, it is determined that there is an abnormality in the user's access behavior.

[0079] In summary, embodiments of the present disclosure provide a method for detecting abnormal user behavior, the method comprising: detecting a preset business behavior initiated by a user when visiting a merchant, and initiating a capture request to the user for the business behavior; obtaining a first image captured by the user in response to the capture request; obtaining a preset template image corresponding to the first image; obtaining a similarity value between the preset template image and the first image based on the image features of the preset template image and the first image; and determining that the user's access behavior is abnormal when the similarity value is lower than a preset similarity threshold. The method can determine whether the user's access behavior is abnormal based on the similarity between the captured data when the user visits the merchant and the preset template image, thereby improving the efficiency of abnormality detection.

[0080] Example 2

[0081] Reference Figure 2 , which shows a step flow chart of a method for detecting abnormal user behavior in another embodiment of the present disclosure, as follows.

[0082] Step 201: detecting a preset business activity initiated by a user when visiting a merchant, and initiating a photo-taking request for the business activity to the user;

[0083] This step is the same as step 101 and will not be described in detail here.

[0084] Step 202: Acquire a first image captured by the user in response to the capture request;

[0085] This step is the same as step 102 and will not be described in detail here.

[0086] Step 203: Acquire the shooting time and positioning information of the first image.

[0087] In the embodiment of the present disclosure, the geographical location where the first image is taken is determined by the positioning information in the image meta-information, and then the shooting time information in the image meta-information is obtained.

[0088] Understandably, the time point of entry of records is taken, and if multiple records are included within a short period of time, it is considered suspected to be false.

[0089] It is understandable that in the case of chain stores, using the same first storefront image or poster data cannot determine whether the user actually visits the specified store, so it is necessary to determine based on geographic location.

[0090] Step 204: determining a shooting frequency and / or a shooting position of the first image according to the shooting time and the positioning information;

[0091] Specifically, the shooting frequency of the first image may be calculated according to the shooting time. If a plurality of first image upload records of the user are included in a short period of time, it is suspected that the access behavior of the user is abnormal.

[0092] Step 205: When the shooting frequency or shooting location exceeds a preset threshold, it is determined that the user's access behavior is abnormal.

[0093] Specifically, the specific location of the first image and the frequency of shooting are used to determine whether the first image was actually taken by the user at the merchant's store. If any of the above information is within the set threshold, it is determined that the user's access behavior is abnormal, that is, it is not authentic.

[0094] It is understandable that, based on the distance between the user's shooting location and the registered address of the merchant's store, if the distance exceeds the preset distance, it can be determined that the first image was not actually taken by the user in the store, and the user's visit behavior is abnormal.

[0095] Of course, in practical applications, abnormality detection of the first image can be combined with multiple information for joint judgment, which is not limited to the above description and is not limited in the embodiments of the present disclosure.

[0096] Among them, it is determined whether the distance between the geographical location and the marked location of the store on the platform is less than the set distance threshold. If it is less than the set distance threshold, it is considered that the user's access behavior is abnormal.

[0097] Preferably, it also includes:

[0098] Step B1: Obtain image attribute information of the first image.

[0099] Specifically, after the first image taken by the user is acquired, the authenticity of the image is determined based on the attribute information of the first image.

[0100] It can be understood that the attribute information can be information specific to the shooting requirements, such as the fingerprint information of the first image and the camera device information of the first image. The attribute information can be different for different shooting requirements, and the embodiments of the present disclosure do not limit this.

[0101] Step B2: determining the Hamming distance and shooting device information of the first image based on the image attribute information;

[0102] Specifically, after obtaining the shooting device information in the first image, the historical shooting device information in the historical first images uploaded by the user is obtained.

[0103] The first image includes Exif (Exchangeable image file format), which is specially set for photos of digital cameras and can record the shooting device information of the digital photo.

[0104] Preferably, step B2 includes:

[0105] Step B21: The detection information includes fingerprint data, and the data fingerprint is used to obtain a current fingerprint vector of the first image;

[0106] Specifically, in the captured first image, each first image has a uniquely identifiable code when the device is produced, and the value calculated using pHash for the code is the pHash fingerprint data of the first image, which serves as the current fingerprint vector of the first image.

[0107] Among them, pHash is a perceptual hash algorithm, which is a type of hash algorithm. It is mainly used to search for similar images by calculating the pHash value of the first image code.

[0108] Step B22, obtaining a preset historical fingerprint vector of the first historical image;

[0109] Specifically, the first historical image uploaded by the user for the current merchant is obtained, the uniquely identifiable code of the first historical image is also obtained, and its pHash fingerprint data is calculated as the historical fingerprint vector of the first historical image.

[0110] Step B23, calculating the Hamming distance between the first image and a preset historical first image according to the current fingerprint vector and the historical fingerprint vector;

[0111] Specifically, the Hamming distance between the current fingerprint vector and the previous fingerprint vector is calculated. The Hamming distance represents the number of bits that differ between two words (of the same length). We use d(x, y) to represent the Hamming distance between two words x and y. Perform an XOR operation on the two strings and count the number of 1s in the result. This number is the Hamming distance.

[0112] Step B3: When the Hamming distance is less than a preset distance threshold, and / or the shooting device information is inconsistent with historical shooting device information, it is determined that the user's access behavior is abnormal.

[0113] Specifically, when the calculated Hamming distance is less than a preset distance threshold, the user's access behavior is suspected to be abnormal.

[0114] Specifically, the EXIF information of the current first image is obtained. If there is a change with the historical device information, that is, the historical EXIF information, it is considered that the user's merchant access behavior is abnormal.

[0115] For example, based on changes in EXIF information, it can be determined that the user may have commissioned someone else to take photos in the store.

[0116] Of course, in actual applications, if the user changes devices, the EXIF information may also change. Therefore, a time threshold can be set for this detection. That is, after the user takes photos with the new device more than a certain number of times, the new device is considered the user's default device, and the first image taken by the user with this device is recognized as authentic.

[0117] It can be understood that obtaining the metadata, attribute information and image features of the first image and calculating the similarity are all judgment bases used in the embodiments of the present disclosure. The above factors can be used as a layer-by-layer judgment method, or only one of them can be used as a judgment basis. In actual applications, the judgment method is not limited to the above description, and the embodiments of the present disclosure do not impose any restrictions on this.

[0118] It is understandable that when multiple of the above-described methods are combined for anomaly detection, the detection accuracy will be higher.

[0119] In summary, the embodiments of the present disclosure provide a method for detecting abnormal user behavior, the method comprising: detecting a preset business behavior initiated by a user when visiting a merchant, initiating a shooting request for the business behavior to the user; obtaining a first image shot by the user in response to the shooting request. Obtaining the shooting time and positioning information of the first image; determining the shooting frequency and / or shooting location of the first image based on the shooting time and positioning information; determining that the user's access behavior is abnormal when the shooting frequency or shooting location exceeds a preset threshold. It is possible to determine whether the user's access behavior is abnormal based on the information obtained from the shooting data when the user visits the merchant, thereby improving the efficiency of abnormality investigation. In addition, it is possible to combine multiple first image information methods for abnormality detection to improve detection accuracy.

[0120] Example 3

[0121] Reference Figure 3 , which shows a structural diagram of a user behavior anomaly detection device in one embodiment of the present disclosure, as follows.

[0122] The shooting request initiating module 301 is used to detect a preset business behavior initiated by a user when visiting a merchant, and initiate a shooting request for the business behavior to the user;

[0123] A first image acquisition module 302 is configured to acquire a first image captured by a user in response to the capture request;

[0124] A preset template image acquisition module 303 is configured to acquire a preset template image corresponding to the first image;

[0125] A similarity value acquisition module 304 is configured to acquire a similarity value between the first image and the preset template image based on the image features of the preset template image and the first image;

[0126] Preferably, the similarity value acquisition module 304 includes:

[0127] A first splitting submodule, configured to split the preset template image into a plurality of first image partitions of preset sizes;

[0128] a weight marking submodule, configured to mark a weight value of each first image partition in the preset template image according to the image feature;

[0129] a matched first image obtaining submodule, configured to match the first image with the preset template image through affine transformation to obtain a matched first image;

[0130] a second splitting submodule, configured to split the matching first image into a plurality of second image partitions of preset sizes according to a mapping relationship between the first image partitions and the matching first image;

[0131] A first similarity acquisition submodule, configured to acquire first similarities between each of the first image partitions and each of the second image partitions;

[0132] The similarity value acquisition submodule is configured to acquire a similarity value between the first image and the preset template image according to a weighted sum of the first similarities and the weight values of the first image partitions.

[0133] Preferably, there are multiple first images; each first image corresponds to a preset template image, and the similarity value acquisition module 304 includes:

[0134] a first similarity value acquisition submodule, configured to acquire, for each first image, a first similarity value between the first image and the preset template image corresponding to the first image and the image features of the first image;

[0135] The first anomaly determination module 305 is configured to determine that an anomaly exists in the user's access behavior when the similarity value is lower than a preset similarity threshold.

[0136] Preferably, the first abnormality determination module 305 includes:

[0137] The first abnormality determination submodule is configured to determine that an abnormality exists in the user's access behavior when the comprehensive similarity value is lower than a preset similarity threshold.

[0138] In summary, an embodiment of the present disclosure provides a user behavior anomaly detection device, the device comprising: a shooting request initiation module, for detecting a preset business behavior initiated by a user when visiting a merchant, and initiating a shooting request for the business behavior to the user; a first image acquisition module, for acquiring a first image shot by the user in response to the shooting request; a preset template image acquisition module, for acquiring a preset template image corresponding to the first image; a similarity value acquisition module, for acquiring a similarity value between the preset template image and the first image based on the image features of the preset template image and the first image; a first anomaly determination module, for determining that the user's access behavior is abnormal when the similarity value is lower than a preset similarity threshold. The device can determine whether the user's access behavior is abnormal based on the similarity between the shooting data when the user visits the merchant and the preset template image, thereby improving the efficiency of anomaly detection.

[0139] The third embodiment of the device corresponds to the first embodiment of the method. The detailed description can refer to the first embodiment and will not be repeated here.

[0140] Example 4

[0141] Reference Figure 4 , which shows a structural diagram of a user behavior anomaly detection device in another embodiment of the present disclosure, as follows.

[0142] The shooting request initiating module 401 is used to detect a preset business behavior initiated by a user when visiting a merchant, and initiate a shooting request for the business behavior to the user;

[0143] A first image acquisition module 402 is configured to acquire a first image captured by a user in response to the capture request;

[0144] The shooting time and positioning information acquisition module 403 is used to acquire the shooting time and positioning information of the first image.

[0145] a shooting frequency calculation module 404, configured to determine a shooting frequency and / or a shooting position of the first image according to the shooting time and the positioning information;

[0146] The second abnormality determination module 405 is configured to determine that the user's access behavior is abnormal when the shooting frequency or shooting location exceeds a preset threshold.

[0147] Preferably, it also includes:

[0148] An image attribute information acquisition module, configured to acquire the image attribute information of the first image;

[0149] a Hamming distance determination module, configured to determine the Hamming distance and shooting device information of the first image based on the image attribute information;

[0150] Preferably, the image attribute information includes fingerprint data, and the Hamming distance determination module includes:

[0151] a fingerprint vector acquisition submodule, configured to acquire a current fingerprint vector of the first image using the data fingerprint;

[0152] A historical fingerprint vector acquisition submodule is used to acquire a preset historical fingerprint vector of the first historical image;

[0153] The Hamming distance calculation submodule is configured to calculate the Hamming distance between the first image and a preset historical first image according to the current fingerprint vector and the historical fingerprint vector.

[0154] The third abnormality determination module is configured to determine that an abnormality exists in the user's access behavior when the Hamming distance is less than a preset distance threshold and / or the shooting device information is inconsistent with historical shooting device information.

[0155] In summary, an embodiment of the present disclosure provides a user behavior anomaly detection device, the device comprising: a shooting request initiation module, for detecting a preset business behavior initiated by a user when visiting a merchant, and initiating a shooting request for the business behavior to the user; a first image acquisition module, for acquiring a first image shot by the user in response to the shooting request; a shooting time and positioning information acquisition module, for acquiring the shooting time and positioning information of the first image. A shooting frequency calculation module, for determining the shooting frequency and / or shooting location of the first image based on the shooting time and positioning information; a second anomaly determination module, for determining that the user's access behavior is abnormal when the shooting frequency or shooting location exceeds a preset threshold. It can determine whether the user's access behavior is abnormal based on the information obtained from the shooting data when the user visits the merchant, thereby improving the efficiency of anomaly detection. In addition, it can also combine multiple first image information methods to perform anomaly detection to improve detection accuracy.

[0156] The fourth embodiment of the device corresponds to the second embodiment of the method. The detailed description can refer to the second embodiment and will not be repeated here.

[0157] The embodiment of the present disclosure also provides an electronic device, see Figure 5 , including: a processor 501, a memory 502, and a computer program 5021 stored in the memory and capable of running on the processor, and when the processor executes the program, the user behavior abnormality detection method of the aforementioned embodiment is implemented.

[0158] An embodiment of the present disclosure further provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the user behavior abnormality detection method of the aforementioned embodiment.

[0159] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0160] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used together with the teachings herein. Based on the above description, it is apparent that the structure required for constructing such systems is suitable. In addition, the embodiments of the present disclosure are not directed to any specific programming language. It should be understood that various programming languages may be utilized to implement the contents of the embodiments of the present disclosure described herein, and the above description of specific languages is intended to disclose the best mode of implementation of the embodiments of the present disclosure.

[0161] In the description provided herein, numerous specific details are described. However, it is understood that the embodiments of the present disclosure can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0162] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present disclosure, various features of the embodiments of the present disclosure are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed approach should not be interpreted as reflecting an intention that the claimed embodiments of the present disclosure require more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all of the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present disclosure.

[0163] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0164] The various component embodiments of the embodiments of the present disclosure may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the sorting device according to the embodiments of the present disclosure. The embodiments of the present disclosure may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program implementing the embodiments of the present disclosure may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0165] It should be noted that the above embodiments illustrate rather than limit the embodiments of the present disclosure, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbols placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The embodiments of the present disclosure may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0166] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0167] The above description is merely a preferred embodiment of the embodiments of the present disclosure and is not intended to limit the embodiments of the present disclosure. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the embodiments of the present disclosure shall be included in the protection scope of the embodiments of the present disclosure.

[0168] The above description is merely a specific implementation of the embodiments of the present disclosure, but the scope of protection of the embodiments of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the embodiments of the present disclosure should be included in the scope of protection of the embodiments of the present disclosure. Therefore, the scope of protection of the embodiments of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A method for detecting abnormal user behavior, characterized in that: The method comprises: Detecting a preset business behavior initiated by a user when visiting a merchant, initiating a capture request for the business behavior to the user, wherein the preset business behavior is the user visiting the store to place an order, pay, and comment; Obtaining a first image captured by the user in response to the capture request, where the first image is real image data corresponding to an order, payment, or evaluation object; Acquire a preset template image corresponding to the first image; acquiring a similarity value between the first image and the preset template image according to the image features of the preset template image and the first image; When the similarity value is lower than a preset similarity threshold, determining that the user's access behavior is abnormal; After the step of obtaining the first image captured by the user in response to the capture request, the method further includes: Acquire shooting time and location information of the first image; determining a shooting frequency and / or a shooting position of the first image according to the shooting time and the positioning information; When the shooting frequency or the shooting position exceeds a preset threshold, it is determined that the user's access behavior is abnormal.

2. The method according to claim 1, characterized in that The step of obtaining a similarity value between the first image and the preset template image based on the image features of the preset template image and the first image includes: Splitting the preset template image into a plurality of first image partitions of preset sizes; Marking a weight value of each first image partition in the preset template image according to the image feature; Matching the first image with the preset template image through affine transformation to obtain a matched first image; splitting the matching first image into a plurality of second image partitions of preset sizes according to a mapping relationship between the first image partition and the matching first image; Obtaining first similarities between each of the first image partitions and each of the second image partitions; A similarity value between the first image and the preset template image is obtained according to a weighted sum of the first similarities and the weight values of the first image partitions.

3. The method according to claim 1, characterized in that After the step of obtaining the first image captured by the user in response to the capture request, the method further includes: Obtaining picture attribute information of the first image; determining the Hamming distance and shooting device information of the first image according to the image attribute information; When the Hamming distance is smaller than a preset distance threshold, and / or the shooting device information is inconsistent with historical shooting device information, it is determined that the user's access behavior is abnormal.

4. The method according to claim 3, characterized in that The image attribute information includes fingerprint data, and the step of determining the Hamming distance of the first image based on the image attribute information includes: Using the fingerprint data, obtaining a current fingerprint vector of the first image; Obtain a preset historical fingerprint vector of the first historical image; A Hamming distance between the first image and a preset historical first image is calculated according to the current fingerprint vector and the historical fingerprint vector.

5. The method according to claim 1, wherein There are multiple first images; each first image corresponds to a preset template image; The acquiring, based on the image features of the preset template image and the first image, a similarity value between the first image and the preset template image includes: For each first image, obtaining a first similarity between the first image and the preset template image according to the preset template image corresponding to the first image and the image features of the first image; Calculating the first similarity values corresponding to the respective first images according to a preset ratio to obtain a comprehensive similarity value; When the similarity value is lower than a preset similarity threshold, determining that the user's access behavior is abnormal includes: When the comprehensive similarity value is lower than a preset similarity threshold, it is determined that the access behavior of the user is abnormal.

6. A user behavior abnormality detection device, characterized in that: The device comprises: A shooting request initiating module is used to detect a preset business behavior initiated by a user when visiting a merchant, and initiate a shooting request for the business behavior to the user; A first image acquisition module is configured to acquire a first image captured by a user in response to the capture request, wherein the preset business behavior is when a user visits a store to place an order, make a payment, or perform a review operation; A shooting time and positioning information acquisition module, used to acquire the shooting time and positioning information of the first image; A preset template image acquisition module, configured to acquire a preset template image corresponding to the first image, wherein the first image is real image data corresponding to an order, payment, or evaluation object; a similarity value acquisition module, configured to acquire a similarity value between the first image and the preset template image based on the image features of the preset template image and the first image; a first anomaly determination module, configured to determine that an anomaly exists in the user's access behavior when the similarity value is lower than a preset similarity threshold; a shooting frequency calculation module, configured to determine a shooting frequency and / or a shooting position of the first image according to the shooting time and the positioning information; The second abnormality determination module is configured to determine that an abnormality exists in the user's access behavior when the shooting frequency or the shooting location exceeds a preset threshold.

7. The device according to claim 6, characterized in that The similarity value acquisition module includes: A first splitting submodule, configured to split the preset template image into a plurality of first image partitions of preset sizes; a weight marking submodule, configured to mark a weight value of each first image partition in the preset template image according to the image feature; a matched first image obtaining submodule, configured to match the first image with the preset template image through affine transformation to obtain a matched first image; a second splitting submodule, configured to split the matching first image into a plurality of second image partitions of preset sizes according to a mapping relationship between the first image partitions and the matching first image; A first similarity acquisition submodule, configured to acquire first similarities between each of the first image partitions and each of the second image partitions; The similarity value acquisition submodule is configured to acquire a similarity value between the first image and the preset template image according to a weighted sum of the first similarities and the weight values of the first image partitions.

8. The device according to claim 6, characterized in that Also includes: An image attribute information acquisition module, configured to acquire the image attribute information of the first image; a Hamming distance determination module, configured to determine the Hamming distance and shooting device information of the first image based on the image attribute information; The third abnormality determination module is configured to determine that an abnormality exists in the user's access behavior when the Hamming distance is less than a preset distance threshold and / or the shooting device information is inconsistent with historical shooting device information.

9. The device according to claim 8, characterized in that The image attribute information includes fingerprint data, and the Hamming distance determination module includes: a fingerprint vector acquisition submodule, configured to acquire a current fingerprint vector of the first image using the fingerprint data; A historical fingerprint vector acquisition submodule is used to acquire a preset historical fingerprint vector of the first historical image; The Hamming distance calculation submodule is configured to calculate the Hamming distance between the first image and a preset historical first image according to the current fingerprint vector and the historical fingerprint vector.

10. The device according to claim 6, characterized in that There are multiple first images; each first image corresponds to a preset template image; The similarity value acquisition module includes: a first similarity value acquisition submodule, configured to acquire, for each first image, a first similarity value between the first image and the preset template image corresponding to the first image and the image features of the first image; A comprehensive similarity value acquisition submodule is used to calculate the first similarity values corresponding to each first image according to a preset ratio to obtain a comprehensive similarity value; The first abnormality determination module includes: The first abnormality determination submodule is configured to determine that an abnormality exists in the user's access behavior when the comprehensive similarity value is lower than a preset similarity threshold.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the user behavior anomaly detection method according to any one of claims 1 to 5 when executing the program.

12. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the user behavior abnormality detection method according to any one of claims 1 to 5.

Images