Behavior recognition method and device, electronic device, and storage medium

Abstract

The present disclosure is about a behavior recognition method and device, electronic device, and storage medium, and relates to the field of Internet technology. The method includes: constructing a graph model based on order data corresponding to the user's historical behavior, and determining the initial confidence of each node contained in the graph model; obtaining community characteristics and comprehensive characteristics for the user through the order data; determining the message value of the graph model through the community characteristics, the comprehensive characteristics, the initial confidence, and the message update rule, determining the graph model according to the message value, and calculating the confidence of the order data corresponding to the current behavior through the graph model, so as to determine the recognition result of the current behavior according to the confidence. The present disclosure can establish a graph model for the user from multiple dimensions, making the graph model more accurate, thereby accurately identifying the user behavior and improving the accuracy.

Description

Background Art

[0002] Due to the large transaction volume and imperfect monitoring methods of Internet finance, it is easy for fraudsters to make fake orders and cash out. The single amount of mobile phone recharge payment is small and the daily transaction volume is large, so the fraudulent behavior is more likely to be missed by the monitoring system.

[0003] In common anti-fraud solutions for mobile phone recharge, it is generally determined whether the user's current recharge request is a fraudulent behavior based on real-time information such as the user's account information and behavioral characteristics. The input data is all single feature data, and the graph model built based on single data cannot accurately and comprehensively identify whether the user's behavior is fraudulent. In addition, the model is built based only on historical data to identify recharge behavior. Since the historical data is not accurate, it cannot accurately identify user behavior and cannot avoid fraud risks in a timely manner.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a behavior recognition method and device, an electronic device, and a storage medium, thereby overcoming, at least to a certain extent, the problem of being unable to accurately identify fraudulent behavior due to the limitations and defects of related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a behavior recognition method is provided, including: constructing a graph model based on order data corresponding to a user's historical behavior, and determining an initial confidence of each node contained in the graph model; obtaining community features and comprehensive features for the user through the order data; determining a message value of the graph model through the community features, the comprehensive features, the initial confidence, and a message update rule, determining the graph model according to the message value, and calculating the confidence of the order data corresponding to the current behavior through the graph model, so as to determine an identification result of the current behavior according to the confidence.

[0008] In an exemplary embodiment of the present disclosure, constructing a graph model based on order data corresponding to a user's historical behavior includes: obtaining the order data corresponding to the historical behavior, the order data including a user number and a recharge number associated with the user; and constructing the graph model based on the association relationship between the user number and the recharge number.

[0009] In an exemplary embodiment of the present disclosure, based on the association relationship between the user number and the recharge number, constructing the graph model includes: grouping according to the user number, constructing a co-occurrence matrix of the user number and the recharge number, and constructing the graph model based on the co-occurrence matrix; or jointly constructing a co-occurrence array using the user number and the recharge number as an index, and constructing the graph model based on the co-occurrence array.

[0010] In an exemplary embodiment of the present disclosure, determining the initial confidence of each node included in the graph model includes: constructing a confidence data set for the multiple users based on their confidence score data and historical reference numbers; training a confidence prediction function based on the confidence data set to obtain a trained confidence prediction function; and predicting each user based on the trained confidence prediction function to determine the initial confidence of each node corresponding to each user.

[0011] In an exemplary embodiment of the present disclosure, obtaining community features and comprehensive features for the user through the order data includes: constructing the graph model based on the order data; processing the graph model using a percolation algorithm to obtain a cluster set; and labeling the user's confidence data set according to the cluster set and the historical reference number to obtain the community features.

[0012] In an exemplary embodiment of the present disclosure, obtaining community features and comprehensive features for the user through the order data includes: acquiring data of at least one dimensional feature for the user, and clustering the data of the at least one dimensional feature to obtain the comprehensive features.

[0013] In an exemplary embodiment of the present disclosure, the at least one dimensional feature includes one or more of age habit features, real-time consumption features, geographic features, and consumption business features, and the comprehensive features include risk level features.

[0014] In an exemplary embodiment of the present disclosure, determining the message value of the graph model through the community characteristics, the comprehensive characteristics, the initial confidence and the message update rule includes: generating weight training data according to the community characteristics and the comprehensive characteristics; training the weight training data and the confidence data set respectively to obtain multiple weight coefficients; inputting the multiple weight coefficients and the comprehensive characteristics into the message update rule to obtain the initial message value of the graph model.

[0015] In an exemplary embodiment of the present disclosure, the method further includes: updating the co-occurrence matrix, and updating the initial message value according to the co-occurrence frequency of each node in the co-occurrence matrix to obtain a target message value of the graph model.

[0016] In an exemplary embodiment of the present disclosure, the initial message value is updated according to the co-occurrence frequency of each node in the co-occurrence matrix to obtain the target message value of the graph model, including: calculating the confidence that the recharge number meets the preset conditions through the initial message value; calculating the confidence loss of all recharge numbers that meet the preset conditions; and optimizing the initial message value by minimizing the confidence loss to obtain the target message value.

[0017] In an exemplary embodiment of the present disclosure, determining the graph model according to the message value includes: generating the graph model for the co-occurrence matrix and the target message value.

[0018] In an exemplary embodiment of the present disclosure, the method further includes: issuing an early warning for the order data whose confidence level is greater than a preset value.

[0019] According to one aspect of the present disclosure, there is provided a behavior recognition device, comprising: a confidence calculation module, for constructing a graph model based on order data corresponding to a user's historical behavior, and determining an initial confidence of each node contained in the graph model; a feature extraction module, for obtaining community features and comprehensive features for the user through the order data; an identification control module, for determining a message value of the graph model through the community features, the comprehensive features, the initial confidence, and a message update rule, determining the graph model according to the message value, and calculating the confidence of the order data corresponding to the current behavior through the graph model, so as to determine an identification result of the current behavior according to the confidence.

[0020] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned behavior recognition methods by executing the executable instructions.

[0021] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the behavior recognition method described in any one of the above items is implemented.

[0022] In a behavior recognition method, a behavior recognition device, an electronic device, and a computer-readable storage medium provided in an exemplary embodiment of the present disclosure, on the one hand, community characteristics and comprehensive characteristics for users are obtained through order data corresponding to historical behaviors, which increases the dimension of feature description, avoids errors caused by single characteristics, and improves accuracy; on the other hand, the message value of the graph model is determined through community characteristics, comprehensive characteristics, initial confidence, and message update rules, and then the graph model is constructed according to the message value, so that accurate message values ​​can be obtained and accurate graph models can be constructed; on the other hand, the confidence of the order data corresponding to the current behavior is calculated through the obtained graph model, so that user behavior can be identified quickly and accurately according to the confidence, and fraud risks can be avoided in time.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0025] Figure 1 A schematic diagram of a behavior recognition method in an exemplary embodiment of the present disclosure is schematically shown;

[0026] Figure 2 A schematic diagram schematically illustrates a method of constructing a graph model in an exemplary embodiment of the present disclosure;

[0027] Figure 3 A schematic diagram schematically illustrates a method for determining an initial confidence level of a node in an exemplary embodiment of the present disclosure;

[0028] Figure 4 A schematic diagram schematically illustrates calculation of an initial message value in an exemplary embodiment of the present disclosure;

[0029] Figure 5 A schematic diagram schematically illustrates an optimization of an initial message value in an exemplary embodiment of the present disclosure;

[0030] Figure 6 A block diagram schematically shows a behavior recognition device in an exemplary embodiment of the present disclosure;

[0031] Figure 7 A block diagram schematically illustrates an electronic device in an exemplary embodiment of the present disclosure;

[0032] Figure 8A program product in an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0034] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0035] This example implementation first provides a behavior recognition method that can be applied to various anti-fraud scenarios, such as recharge anti-fraud, cash-out fraud, or telecommunications fraud, etc. Figure 1 The behavior recognition method is described in detail.

[0036] In step S110, a graph model is constructed based on the order data corresponding to the user's historical behavior, and an initial confidence level of each node included in the graph model is determined.

[0037] In this exemplary embodiment, the user may be a user registered on at least one platform. The historical behavior may be the historical recharge behavior of the user on all platforms. The order data refers to all historical order data corresponding to the user, and may specifically be the recharge order data corresponding to the recharge request. The order data may specifically include the user number corresponding to the user, and the user number refers to the mobile phone number bound to the user account, i.e., the user ID. The order data may also include the recharge number included in the order request, i.e., the mobile phone number used to recharge the user account. The user number and the recharge number may be the same or different, and are not specifically limited here.

[0038] The specific process of building a graph model based on the order data corresponding to the user's historical behavior is as follows: Figure 2 As shown, it mainly includes step S210 and step S220:

[0039] In step S210, order data corresponding to the historical behavior is obtained, wherein the order data includes a user number and a recharge number associated with the user.

[0040] In this step, each order data may correspond to a recharge behavior of the user. The acquired order data may include the user ID, the user binding number, the user recharge number, and the recharge amount for the recharge number, etc. In addition, it may also include the order number and the order generation time, etc.

[0041] In step S220, the graph model is constructed based on the association relationship between the user number and the recharge number.

[0042] In this step, the association between the user number and the recharge number can be described by the number of recharges a user number makes for a certain recharge number. The graph model can be, for example, an MRF (MRF-Markov Random Field) model, or a conditional random field model, etc. The MRF model is an MRF graph, and specifically a directed graph. In order to facilitate the analysis of causal relationships, the MRF model simulates the image into a grid composed of random variables, each of which has a clear dependence on its neighbors composed of random variables other than itself (Markov property). Specifically, the process in step S220 includes two methods, step S221 and step S222:

[0043] Recharge Number 1 Recharge Number 2 Recharge Number 3 …… User Number 1 2 1 0 …… User Number 2 0 0 3 …… User Number 3 0 0 2 …… …… …… …… …… ……

[0044] Table 1

[0045] In step S221, the user numbers are grouped, a co-occurrence matrix of the user numbers and the recharge numbers is constructed, and the graph model is constructed according to the co-occurrence matrix. Grouping by user number means grouping all historical order data according to the user numbers bound to the users. Since a user can bind at least one user number, one user number can be divided into one group. The co-occurrence matrix refers to a matrix composed of the number of times multiple user numbers and multiple recharge numbers appear together. An example of the co-occurrence matrix of user numbers and recharge numbers is shown in Table 1.

[0046] Among them, the element E in the co-occurrence matrix E ij It represents the number of orders between user number i and recharge number j. ij =0 means that there is no historical recharge order between numbers i and j.

[0047] After obtaining the co-occurrence matrix, you can use networkx to build an empty graph model. For example, you can use the following code to build a graph model:

[0048] import networkx as nx

[0049] def createGraph(A,V):

[0050] G = nx.Graph() #Create an empty graph

[0051] G.add_nodes_from(V)#Add nodes from v

[0052] for edge in zip(A.index,A['cnt']):

[0053] nodes = edge[0][:].split('_')

[0054] node1 = nodes[0]

[0055] node2 = nodes[1]

[0056] G.add_edges_from(node1,node2,weight=edge[1])

[0057] return G

[0058] When there are a large number of user numbers and recharge numbers, the storage requirements of the co-occurrence matrix are too large, which may lead to memory overflow. At this time, a co-occurrence array can be used to construct a graph model. Specifically, in step S222, the user number and the recharge number are combined as indexes to construct a co-occurrence array, and the graph model is constructed based on the co-occurrence array. In this step, similar to step S221, the order data corresponding to the historical behavior can be obtained first, and the order data includes the user number and the recharge number associated with the user. Next, a co-occurrence array A is established to describe the number of times multiple user numbers and multiple recharge numbers appear together. Specifically, as shown in Reference Table 2, the user number and the recharge number can be combined as an index to construct a co-occurrence array. It should be noted that in order to save storage space, only combinations of user numbers and recharge numbers for which recharge behavior actually occurs are stored in the co-occurrence array.

[0059] quantity User number 1_Recharge number 1 2 User number 1_Recharge number 2 1 User number 2_Recharge number 3 2 User number 3_Recharge number 3 2 …… ……

[0060] Table 2

[0061] After obtaining the co-occurrence array A, you can use networkx to build an empty graph model. For example, you can use the following code to build a graph model:

[0062] def createGraph(A,V):

[0063] G = nx.Graph() #Create an empty graph

[0064] G.add_nodes_from(V)#Add nodes from v

[0065] for edge in zip(A.index,A['cnt']):

[0066] nodes = edge[0][:].split('_')

[0067] node1 = nodes[0]

[0068] node2 = nodes[1]

[0069] G.add_edges_from(node1,node2,weight=edge[1])

[0070] return G

[0071] exist Figure 2 On the basis of, the edge weights in the graph model can be temporarily set to the number of co-occurrences of the user number and the recharge number. After the graph model is established by the method in step S221 and step S222, the network structure diagram can be visualized, for example, calling the networkx interface to visualize the graph model. When the number of nodes in the graph model is too large, the time required for drawing and rendering will be too long. At this time, other visualization tools are needed, such as the PM large-scale visualization tool to visualize the graph model. Of course, the network structure diagram can also be not visualized, which is set according to actual needs.

[0072] It should be added that the relationship between the bank card reserved mobile phone number and the recharge mobile phone number can also be used to compose the picture; or the relationship network composition of the user's mobile phone number, bank card reserved mobile phone number, and recharge mobile phone number can be used, which can be set according to the user's actual needs and application scenarios.

[0073] After constructing the graph model, the initial confidence of each node included in the graph model can be determined. The nodes included in the graph model include but are not limited to multiple user numbers and multiple recharge numbers. For each node, its initial confidence can be determined. Confidence refers to the degree to which a specific individual believes in the authenticity of a specific proposition, that is, the probability. The initial confidence of each node refers to the initial probability that each node is involved in organized crime.

[0074] In this example, the process of determining the initial confidence of each node is as follows: Figure 3 As shown in , it specifically includes steps S310 to S330:

[0075] In step S310, a confidence data set of the plurality of users is constructed according to the confidence score data of the plurality of users and the historical reference numbers.

[0076] In this step, the confidence score data of each user among the multiple users, that is, the confidence score data, includes but is not limited to those shown in Table 3. The historical reference number refers to all the gang-related numbers stored in the gang-related case database, that is, the mobile phone numbers involved in historical fraud cases. According to the confidence score data corresponding to the multiple users and all the gang-related numbers stored in the gang-related case database, the confidence data set for each user shown in Table 3 can be constructed.

[0077]

[0078] Table 3

[0079] In step S320, a confidence prediction function is trained based on the confidence data set to obtain a trained confidence prediction function.

[0080] Based on the confidence data set established in step S310, a confidence prediction function can be trained using the data in the confidence data set. Specifically, the confidence prediction function can be a classifier function, which can be trained using softmax to optimize the performance of the confidence prediction function, thereby obtaining a trained confidence prediction function. In the trained confidence prediction function, the obtained parameter is W b .

[0081] In step S330, prediction is performed for each user according to the trained confidence prediction function to determine the initial confidence of each node corresponding to each user.

[0082] Based on step S320, each historical order data of each user can be input into the trained confidence prediction function, and then according to the parameter W b The confidence prediction function determines the initial confidence corresponding to the user number and the recharge number in the historical order data. Through the method in this exemplary embodiment, a relatively accurate confidence preset function can be trained according to the confidence data set, thereby obtaining an accurate initial confidence.

[0083] In step S120, community characteristics and comprehensive characteristics for the user are obtained through the order data.

[0084] In this exemplary embodiment, community features are used to describe the social relationships of users. When generating community features, the following steps can be mainly adopted: First, construct an MRF graph model. The specific composition steps are as follows: Figure 2 The second step is to use the percolation algorithm to process the graph model to obtain clusters, where clusters are used to describe the communities to which multiple nodes belong, and nodes in a cluster belong to the same community.

[0085] The basic idea of ​​the clique algorithm is that for an MRF graph, if there is a complete subgraph (there is an edge between any two nodes) with k nodes, then this complete subgraph can be called a k-clique. Furthermore, if there are k-1 common nodes between two k-cliques, then the two cliques are called "adjacent". Such a string of adjacent cliques constitutes the largest set, which can be called a community.

[0086] In this exemplary embodiment, the cluster set obtained by using the cluster permeation algorithm can be, for example: [('Mobile Number 1', 'Mobile Number 2', 'Mobile Number 3'), ('Mobile Number 3', 'Mobile Number 4', 'Mobile Number 5'), ...]. It should be noted that the number of nodes k included in each cluster set can be manually adjusted, and k determines how many nodes generate adjacent complete subgraphs that can be considered a community. For example, a cluster set can include 3 or 5 nodes, etc.

[0087] The third step is to label the user's confidence data set according to the group set and the historical reference number to obtain community features. The historical reference number refers to all the black-related numbers in the black-related case database, and the user's confidence data set refers to all the confidence score data of the user shown in Table 3. Labeling the user's confidence data set means adding labels to the data in each confidence data set. When labeling, the shortest distance minDistToClosetsClique from the center of the group closest to the user's number to the user's number can be specifically labeled, that is, the number of edges on the graph. You can also label the ratio of black-related numbers in the group where the user's number is located, fraudMobileCntInCliqueRatio. If the user is not in the group, the ratio of black-related numbers in the group where the user's number is located is set to -1. In addition, you can also label the number of recharge numbers in the group where the user is located / the number of recharge numbers chargeMobileCntInCliqueRatio. If the user is not in the group, set it to -1. After labeling these data, you can get the community features for the user, and further add the community features to the confidence data set shown in Table 3 to update the confidence data set. In addition, community characteristics may also include community size, community density and other characteristics. The specific community characteristics to be used can be determined based on the actual scenario.

[0088] In addition, comprehensive features for users can also be obtained. The comprehensive features here are used to comprehensively describe at least one dimensional feature, and the at least one dimensional feature includes but is not limited to one or more of age features, real-time consumption features, geographic features, and consumer service features. In the application scenario of mobile phone recharge involving gangs in this exemplary embodiment, in order to more comprehensively consider the influence of factors such as the user's personal habits and age, at least one dimensional feature is an age habit feature and a real-time consumption feature.

[0089] In order to make the prediction results more accurate, both the age habit characteristics and the real-time consumption characteristics can be converted into a specific comprehensive characteristic for description, which can be, for example, a risk level characteristic. Specifically, the risk level characteristic can be obtained by clustering the data of at least one dimensional characteristic. When clustering, the kmeans clustering algorithm can be used, or any suitable clustering algorithm such as the K-MEDOIDS algorithm, the CLARANS algorithm, the DBSCAN algorithm, the OPTICS algorithm, the DENCLUE algorithm, etc. can be used. Since older people use mobile payment less frequently, and the active periods of young and middle-aged people are different, the risk level characteristics can be obtained based on this kind of cognition to rate the payment risk.

[0090] For example, if the user's age, the number of orders placed by the user in a day, and the total recharge amount of the user in a day are clustered, the cluster center is [age group center, recharge order number segment center, recharge amount segment center], and the risk level feature obtained is the risk level of people of different age groups in a day, the ratio of the number of recharge orders m, and the total recharge transaction amount n. It should be noted that the larger or smaller the value of the user's age group center is, the more orders and recharge amounts are in the cluster center, and the higher the risk level is.

[0091] If the user age and the number of orders per hour within 24 hours are clustered, the cluster center is [age group center, active time period center], and the risk level feature is the risk level of transactions that occur when people of different age groups are active in a day. The larger or smaller the age group center of the user's cluster center is, and the more the recharge time period center is in the rest time, the higher the risk level.

[0092] For real-time consumption characteristics, it describes the frequency and frequency of users' recharge consumption. Small-amount, high-frequency behaviors can be used as a basis for risk inference and a risk assessment level can be given. If the number of recharge requests and the total amount of recharge by users in the past hour are clustered, the cluster center is [recharge request number segment center, recharge amount segment center], and the risk level feature obtained is the risk level of the recharge orders issued by users in the past hour from the time of the current order. The larger the number of recharge requests in the class center where the user is located, the larger the recharge amount, and the higher the risk level.

[0093] It should be noted that after obtaining the comprehensive features of the user, the comprehensive features can be added to the confidence data set shown in Table 3 to update the confidence data set.

[0094] In addition, in other anti-fraud scenarios such as business cashing, the user's behavior can also be described by features such as geographic features and consumer business type preferences. In this exemplary embodiment, the dimensions of describing the user's order data can be increased through community features and comprehensive features, thereby comprehensively describing the user's recharge behavior from multiple dimensions. In this way, the deviation caused by describing the user's recharge behavior with a single feature can be avoided, thereby improving the accuracy. In addition, by using the relationship network of the user's recharge number, personalized anti-fraud identification can be completed based on the social characteristics and consumption characteristics of different users.

[0095] In step S130, the message value of the graph model is determined by the community characteristics, the comprehensive characteristics, the initial confidence and the message update rules, the graph model is determined according to the message value, and the confidence of the order data corresponding to the current behavior is calculated by the graph model to determine the recognition result of the current behavior according to the confidence.

[0096] In this exemplary embodiment, the message is mainly used to describe the mutual influence between local nodes in the MRF graph model. Setting the message, that is, setting the rules for mutual influence between local nodes, that is, the message update rule, is mainly to determine the transfer update formula of the confidence between local nodes in the graph model. The message value used when determining the graph model in this step is the target message value obtained after optimizing the initial message value, wherein the initial message value refers to the initial edge weight of the graph model, and the target message value refers to the target edge weight of the graph model, for example, it can be an optimized or trained edge weight. The message update rule can be shown in formula (1):

[0097]

[0098] Among them, X is the comprehensive feature extracted from the order data associated with the user's historical behavior, and the feature weight W k Determined by logistic algorithm training. P = 3. k = 1 means that the recharged mobile number is the account mobile number; k = 2 means that the recharged mobile number is not the account mobile number, but it is unclear whether the recharged mobile number is involved in organized crime; k = 3 means that the recharged mobile number is not the account mobile number, but it is involved in organized crime. V iu Indicates the user's mobile phone number, V jc Indicates the recharge mobile phone number. kViuVjc It refers to the state k, which is composed of node V iu To Node V jc The weight value of X kViuVjc It refers to the state k, which is composed of node V iu To Node V jc The characteristic value of .

[0099] When the message value of the graph model is determined by the community feature, the comprehensive feature, the initial confidence and the message update rule, the process of determining the initial message value is as follows: Figure 4 As shown in , it specifically includes steps S410 to S430.

[0100] In step S410, weight training data is generated according to the community features and the comprehensive features.

[0101] In this step, the community characteristics and comprehensive characteristics can be sorted to generate weight training data, which is represented by X. Specifically, the sorted weight training data may include the following features: X1, the shortest distance from the center of the group closest to the user number to the user number. X2, the ratio of numbers involved in organized crime in the group where the user number is located. If the user is not in the group, set to -1. X3, the number of user recharge numbers in the group where the user is located / the number of mobile phones recharged by the user. If the user is not in the group, set to -1. X4, the ratio of the number of recharge orders m for people of different age groups in one day to the total recharge transaction amount n, the risk level. X5, the risk level of transactions that occur when people of different age groups are active in one day. X6, the risk level of recharge orders issued by users within one hour from the time of the current order. X7, the risk level of recharge orders issued by users within 5 minutes from the time of the current order.

[0102] In step S420, the weight training data and the confidence data set are trained respectively to obtain a plurality of weight coefficients.

[0103] The confidence data set is shown in Table 3. The confidence of the distribution of user recharge transactions shown in Table 3 of the training confidence data set may specifically include label1, which indicates the proportion of orders in which the recharge number is equal to the bound number in the user's historical order data. Label2 indicates the proportion of orders in which the recharge number is not equal to the bound number but the recharge number is not related to black (not related to black is not necessarily a safe mobile phone number) in the user's historical order data. Label3 indicates the proportion of orders in which the recharge number is not equal to the bound number but the recharge number is a number related to black.

[0104] The multiple weight coefficients refer to the weight coefficients for label1, label2 and label3 respectively. By substituting each weight coefficient into the above formula (1), the initial message values ​​for label1, label2 and label3 can be obtained. Specifically, different machine learning algorithms can be used to train the weight training data and the confidence of different user recharge transaction distributions to obtain multiple weight coefficients. For example, the regression model can be trained using (X, label1) and the Lasso regression algorithm to obtain the weight coefficient W1 corresponding to the trained regression model. The support vector machine model is trained using (X, label2) and a support vector machine algorithm including a tanh kernel to obtain the weight coefficient W2 corresponding to the trained support vector machine model. The support vector machine model is trained using (X, label3) and a support vector machine algorithm including a linear kernel to obtain the weight coefficient W3 corresponding to the trained support vector machine model. In addition, suitable machine learning models such as ridge logistic regression models, logistic regression models, and support vector machine models under different kernel functions can also be trained to obtain weight coefficients, which are not specifically limited in this example.

[0105] In step S430, the multiple weight coefficients and the comprehensive features are input into the message update rule to obtain the initial message value of the graph model.

[0106] On the basis of step S420, the weight coefficients for label1, label2 and label3 and the corresponding comprehensive feature X are respectively substituted into the above formula (1), so as to obtain the initial message value of the graph model, that is, the initial edge weight.

[0107] According to a set of parameters (β c ,W b ,W) After obtaining the initial message value, the initial message value can be updated to obtain the target message value. In this group of parameters, β c Refers to the confidence of the recharge number node, for example, it can be [0.5,0.5]. b ,W is the value obtained by multiple random sampling and cross validation, W b Refers to the coefficient of the trained confidence prediction function for calculating the initial confidence, and W refers to the weight parameter. The target message value refers to the edge weight of a relatively stable and high-performance graph model.

[0108] After obtaining the initial message value, in order to make the calculation result more accurate, the initial message value can be optimized and updated to obtain the target message value according to the initial message value. When updating the initial message value, the co-occurrence matrix used to describe the number of times multiple user numbers and multiple recharge numbers co-occur in step S221 can be updated. Specifically, the co-occurrence frequency of each node in the co-occurrence matrix can be updated to the message value, that is, the message value is updated from the number of co-occurrences to the co-occurrence frequency. After updating the co-occurrence matrix E, the pgmpy code in the python package can be used to construct a graph model, and the edge weight in the graph model is the co-occurrence frequency.

[0109] The specific process of optimizing the initial message value to obtain the target message value of the graph model is as follows: Figure 5 As shown, it includes steps S510 to S530:

[0110] In step S510, the confidence that the recharge number meets the preset conditions is calculated by the initial message value. The preset conditions refer to the conditions to be judged in the end, such as the conditions involving gangs. The recharge number meeting the preset conditions means that the recharge number is involved in gangs. The confidence propagation algorithm can be used to determine the confidence that the recharge number is involved in gangs. The confidence propagation algorithm uses the information transmitted between nodes to update the marking state of the entire MRF. After multiple iterations, the confidence of all nodes no longer changes. At this time, the mark of each node is called the optimal mark, and the MRF has reached a convergence state.

[0111] After the confidence propagation, the edge weight of each edge in the graph model can be determined. For each recharge number or user number represented by a node, the confidence I of the node can be determined by the edge weight of all edges connected to the node. C For example, for recharge number 1, if there are 4 nodes connected to it, and it is known that the edge weight between node 1 and recharge number 1 is a, the edge weight between node 2 and recharge number 1 is b, the edge weight between node 3 and recharge number 1 is c, and the edge weight between node 4 and recharge number 1 is d, and a+b+c+d is equal to 1. Then for recharge number 1, its confidence is the product of the edge weights of these four edges, that is, a*b*c*d. The confidence propagation algorithm can reduce the amount of data calculation, thereby improving the calculation efficiency.

[0112] In step S520, the confidence loss of all recharge numbers that meet the preset conditions is calculated. The confidence loss function is shown in formula (2):

[0113]

[0114] Among them, t is the index of a number involved in the black market in the black market database, T is the total number of numbers involved in the black market in the black market database, Rct is the real black market label (if involved in the black market, it is set to 1, otherwise it is set to 0), and Ict is the confidence of the predicted recharge number involved in the black market. The confidence loss of all recharge numbers contained in the historical order data can be calculated by the above formula (2).

[0115] In step S530, the initial message value is optimized by minimizing the confidence loss to obtain the target message value.

[0116] In this step, the confidence loss can be minimized, as shown in formula (3):

[0117]

[0118] That is to say, the three steps of updating the message value, calculating the confidence of the recharge number involved in the black market according to the message value, and calculating the confidence loss of the recharge number involved in the black market can be iterated multiple times until the confidence loss is minimized and the iterative process is stopped to obtain the optimal parameter (β c ,W b ,W). In this way, the optimal parameters can be obtained by minimizing the confidence loss, so that the confidence of the calculated recharge number is more accurate. In addition, when there are many parameters to be optimized, a greedy algorithm can be used for iteration to speed up the processing. When the confidence loss is minimized, the initial message value can be optimized to the target message value.

[0119] The initial message value is determined by determining the community characteristics and comprehensive characteristics, initial confidence, and message update rules. The initial message value can be calculated based on the user's historical confidence, providing relatively comprehensive user prior information, which can make the calculated initial message value more accurate and comprehensive. Furthermore, the optimal parameters are determined by minimizing the confidence loss, and the target message value is determined according to the optimal parameters, which can make the obtained graph model target message value, that is, the edge weight of the graph model, more accurate.

[0120] In this exemplary embodiment, the graph model can be determined by the target message value obtained after optimization, so that the performance of the graph model is more stable. Specifically, the optimal parameter (β c ,W b ,W) recalculate the target message value, and update the co-occurrence matrix according to the target message value, and update the co-occurrence frequency of each node in the co-occurrence matrix to the target message value, that is, generate the edge weight in the graph model. Furthermore, for the co-occurrence matrix E with the co-occurrence frequency of each node updated to the target message value, the pgmpy function in the python package is used to build a graph model, and then the confidence I of the order data corresponding to the current behavior is calculated according to the graph model CThe current behavior refers to the current recharge behavior, the order data refers to the recharge order data included in the current recharge behavior, and the order data corresponding to the current recharge request can be at least one. Calculating the confidence is specifically determining the confidence of the recharge number contained in the order data according to the graph model. Calculating the confidence of the recharge number according to the graph model with stable performance can make the calculated confidence more accurate, thereby more accurately identifying the user's recharge behavior and performing recharge anti-fraud in a timely and efficient manner.

[0121] It should be added that, since the user's social relationships and confidence scores may change as transactions occur, the above steps S110 to S130 can be executed at preset intervals to complete the real-time update of user information, thereby re-determining the graph model to ensure the accuracy of the graph model.

[0122] In addition, in this exemplary embodiment, the method further includes: issuing an early warning for the order data whose confidence is greater than a preset value. The preset value can be set according to the actual accuracy requirements, for example, it can be set to 0.7 or 0.8, etc. For example, if the confidence of the recharge number included in the order data 1 calculated in step S130 is 0.9, the order data 1 can be screened out. While the order data 1 is screened out, an early warning can be issued. The way of issuing an early warning includes, for example, generating a prompt message, which may include an order number or other information describing the order data 1. Furthermore, the prompt message can be sent to the regulatory department, and after receiving the prompt message indicating the early warning, the regulatory department can check and review the order data again. By issuing an early warning for order data with a confidence greater than the preset value, recharge fraud can be automatically identified, thereby improving the accuracy and efficiency of anti-fraud monitoring.

[0123] The present disclosure also provides a behavior recognition device. Figure 6 As shown, the behavior recognition device 600 may include:

[0124] A confidence calculation module 601 is used to construct a graph model based on the order data corresponding to the user's historical behavior, and determine the initial confidence of each node included in the graph model;

[0125] A feature extraction module 602, used to obtain community features and comprehensive features for the user through the order data;

[0126] The identification control module 603 is used to determine the message value of the graph model through the community characteristics, the comprehensive characteristics, the initial confidence and the message update rules, determine the graph model according to the message value, and calculate the confidence of the order data corresponding to the current behavior through the graph model to determine the identification result of the current behavior according to the confidence.

[0127] It should be noted that the specific details of each module in the above-mentioned behavior recognition device have been described in detail in the corresponding behavior recognition method, so they will not be repeated here.

[0128] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0129] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0130] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0131] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0132] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present invention will be described. Figure 7 The electronic device 700 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0133] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0134] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps: Figure 1 Follow the steps shown in .

[0135] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0136] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0137] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0138] The display unit 740 may be a display with a display function, so as to display the processing result obtained by the processing unit 710 executing the method in this exemplary embodiment through the display. The display includes but is not limited to a liquid crystal display or other displays.

[0139] The electronic device 700 may also communicate with one or more external devices 900 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0140] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0141] refer to Figure 8 As shown, a program product 800 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0142] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0143] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0144] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0145] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0146] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0147] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A behavior recognition method, characterized in that: include: Building a graph model based on the order data corresponding to the user's historical behavior, and determining an initial confidence level of each node included in the graph model; Obtaining community characteristics and comprehensive characteristics for the user through the order data; Determine the message value of the graph model through the community features, the comprehensive features, the initial confidence and the message update rule, determine the graph model according to the message value, and calculate the confidence of the order data corresponding to the current behavior through the graph model, so as to determine the recognition result of the current behavior according to the confidence; Constructing a graph model based on order data corresponding to the user's historical behavior includes: acquiring order data corresponding to the historical behavior, the order data including a user number and a recharge number associated with the user; constructing the graph model based on an association relationship between the user number and the recharge number; Obtaining the community features and comprehensive features for the user through the order data includes: constructing the graph model based on the order data; processing the graph model using a percolation algorithm to obtain a cluster set; labeling the user's confidence data set according to the cluster set and the historical reference number to obtain the community features; obtaining data of at least one dimensional feature for the user, and clustering the data of the at least one dimensional feature to obtain the comprehensive features; Determining the message value of the graph model through the community characteristics, the comprehensive characteristics, the initial confidence and the message update rule includes: generating weight training data according to the community characteristics and the comprehensive characteristics; training the weight training data and the confidence data set respectively to obtain multiple weight coefficients; inputting the multiple weight coefficients and the comprehensive characteristics into the message update rule to obtain the initial message value of the graph model; the message update rule is a transfer update formula for determining the confidence between local nodes in the graph model.

2. The behavior recognition method according to claim 1, characterized in that: Based on the association relationship between the user number and the recharge number, constructing the graph model includes: Grouping the user numbers according to the user numbers, constructing a co-occurrence matrix of the user numbers and the recharge numbers, and constructing the graph model according to the co-occurrence matrix; or The user number and the recharge number are combined as indexes to construct a co-occurrence array, and the graph model is constructed according to the co-occurrence array.

3. The behavior recognition method according to claim 1, characterized in that: Determining the initial confidence of each node included in the graph model includes: Constructing a confidence data set of the plurality of users according to the confidence score data and the historical reference numbers of the plurality of users; Training a confidence prediction function based on the confidence data set to obtain a trained confidence prediction function; Predictions are made for each user according to the trained confidence prediction function to determine the initial confidence of each node corresponding to each user.

4. The behavior recognition method according to claim 1, characterized in that: The at least one dimensional feature includes one or more of age habit features, real-time consumption features, geographic features, and consumption business features, and the comprehensive features include risk level features.

5. The behavior recognition method according to claim 1, characterized in that: The method further comprises: The co-occurrence matrix is ​​updated, and the initial message value is updated according to the co-occurrence frequency of each node in the co-occurrence matrix to obtain the target message value of the graph model.

6. The behavior recognition method according to claim 5, characterized in that: The initial message value is updated according to the co-occurrence frequency of each node in the co-occurrence matrix to obtain the target message value of the graph model, including: Calculating the confidence level that the recharge number meets a preset condition by using the initial message value; Calculate the confidence loss of all recharge numbers that meet the preset conditions; The initial message value is optimized by minimizing the confidence loss to obtain the target message value.

7. The behavior recognition method according to claim 5, characterized in that: Determining the graph model according to the message value includes: The graphical model is generated for the co-occurrence matrix and the target message value.

8. The behavior recognition method according to claim 1, characterized in that: The method further comprises: An early warning is issued for order data whose confidence level is greater than a preset value.

9. A behavior recognition device, characterized in that: include: A confidence calculation module, used to construct a graph model based on the order data corresponding to the user's historical behavior, including: obtaining the order data corresponding to the historical behavior, the order data including the user number and the recharge number associated with the user, and constructing the graph model based on the association between the user number and the recharge number; and determining the initial confidence of each node included in the graph model; a feature extraction module, used to obtain community features and comprehensive features for the user through the order data, including: constructing the graph model based on the order data, processing the graph model using a percolation algorithm to obtain a cluster set, annotating the user's confidence data set according to the cluster set and the historical reference number to obtain the community feature, obtaining data on at least one dimensional feature of the user, and clustering the data on the at least one dimensional feature to obtain the comprehensive feature; An identification control module is used to determine the message value of the graph model through the community characteristics, the comprehensive characteristics, the initial confidence and the message update rule, including: generating weight training data according to the community characteristics and the comprehensive characteristics, training the weight training data and the confidence data set respectively to obtain a plurality of weight coefficients, inputting the plurality of weight coefficients and the comprehensive characteristics into the message update rule to obtain the initial message value of the graph model, the message update rule is a transfer update formula for determining the confidence between local nodes in the graph model; determining the graph model according to the message value, and calculating the confidence of the order data corresponding to the current behavior through the graph model, so as to determine the identification result of the current behavior according to the confidence.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the behavior recognition method described in any one of claims 1-8 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the behavior recognition method described in any one of claims 1 to 8 is implemented.

Images