A message anomaly detection method and device

Abstract

The embodiment of the present application provides a kind of message exception detection method and device, the method comprises: business system determines the event type of message to be detected;The message to be detected is generated according to the user event reported by client and the associated user event of the user event by the business system;The message to be detected is tokenized, and each message token of the message to be detected is obtained;From the preset keyword set corresponding to the event type of the message to be detected, each preset keyword corresponding to each message token is determined;According to matching degree calculation formula, the matching degree of each message token and each preset keyword is determined;According to the matching degree, the detection result of the message to be detected is determined.The above method can automatically generate messages and detect messages compared with prior art without detecting messages;Reduce the cost of message generation, and improve the accuracy of message and user experience.

Description

Technical Field

[0001] This application relates to the field of computer technology in financial technology (Fintech), and more particularly to a method and apparatus for detecting message anomalies. Background Technology

[0002] In recent years, with the development of computer technology, more and more technologies are being applied in the financial sector. The traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, higher demands are being placed on technology. For example, banks need to communicate with users in a timely manner, and reminder messages can be used to remind users of relevant business information. The content of these reminder messages must be accurate to prevent misleading users. For instance, the repayment date in the reminder message is particularly important for bank loan business. If the repayment date or other information is incorrect, it could mislead users, potentially leading to late payments and affecting their credit scores, negatively impacting both the customer's reputation and the bank's reputation.

[0003] In existing technologies, reminder message templates are typically configured manually, allowing the business system to generate reminder messages based on the templates and corresponding reminder information. However, this method requires manual configuration of reminder message templates, which wastes manpower and resources and cannot guarantee the accuracy of the reminder messages.

[0004] Therefore, there is an urgent need for a message anomaly detection method and device to automatically generate messages and improve their accuracy. Summary of the Invention

[0005] This invention provides a message anomaly detection method and apparatus for automatically generating messages and improving message accuracy.

[0006] In a first aspect, embodiments of the present invention provide a message anomaly detection method, the method comprising:

[0007] The business system determines the event type of the message to be detected; the message to be detected is generated by the business system based on user events reported by the client and related user events.

[0008] The message to be detected is segmented into words to obtain the message segments of the message to be detected;

[0009] Determine each preset keyword corresponding to each message segment from the preset keyword set corresponding to the event type of the message to be detected;

[0010] The matching degree between each message segment and each preset keyword is determined according to the matching degree calculation formula;

[0011] The detection result of the message to be detected is determined based on the matching degree.

[0012] In the above method, the business system determines the event type of the message to be detected, and segments the message according to the event type and natural language processing (NLP) technology to obtain each message segment. It then determines the corresponding preset keywords for each message segment from a preset keyword set corresponding to the event type of the message. Based on preset message segmentation weight rules, the weight of each message segment is determined. The matching degree between each message segment and the preset keywords is determined according to a matching degree calculation formula. The matching degree is used to determine whether the message to be detected is abnormal. If abnormal, the message is destroyed, and a new message can be generated. Messages that pass the detection are then sent to the user. Thus, compared to existing technologies that do not detect messages, this application detects messages, improving message accuracy and user experience.

[0013] Optionally, the message to be detected is generated by the business system based on user events reported by the client and related user events, including: the business system receiving user events; the business system determining the event type of the message to be generated corresponding to the user event; the business system obtaining related user events from historical user event records; the business system performing word segmentation on the user event and the related user events to obtain each event word segment; the business system determining each event keyword based on the preset script set corresponding to each event word segment and the event type of the message to be generated; and generating a message template based on the syntax rules corresponding to each event keyword and the event type of the message to be generated; and generating the message to be detected based on the information filling rules and the message template.

[0014] In the above method, the business system receives user events and determines the event type of the message to be generated corresponding to each user event; it segments the user events and related user events using natural language processing (NLP) technology to obtain event segments; it then determines the keywords for each event based on the event segments and the preset script set corresponding to the event type; it generates a message template based on the event keywords and the grammar rules corresponding to the event type; and finally, it generates the message to be tested based on the information filling rules and the message template. The grammar rules are pre-obtained by analyzing the keyword sorting and part-of-speech information of a large number of messages of this event type. This automated message template generation significantly reduces costs compared to the manual configuration of message templates in existing technologies.

[0015] Optionally, the business system performs word segmentation on the user event and the associated user event, including: the business system determines the trigger condition type based on the event type of the message to be generated; if the trigger condition type is instantaneous triggering, the business system performs word segmentation on the user event and the associated user event using natural language processing technology; if the trigger condition type is non-instantaneous triggering, the business system determines the trigger time point according to a preset trigger time rule, and when the trigger time point is reached, the business system performs word segmentation on the user event and the associated user event using natural language processing technology.

[0016] In the above method, the business system records user events in historical user event records according to the event time sequence. Based on the event type of the user event, the business system determines the trigger condition type for generating the message to be detected. If the trigger condition type is immediate, the user event and related user events are segmented using natural language processing (NLP). If the trigger condition type is non-immediate, the trigger time point is determined according to preset trigger time rules. When the trigger time point is reached, the user event and related user events are segmented using NLP. In this way, the business system can analyze and obtain the business trajectory corresponding to the event type to determine the trigger condition type for generating the message to be detected. This allows for accurate determination of the timing of message generation, improving message timeliness.

[0017] Optionally, before the business system performs word segmentation on the message to be detected, it further includes:

[0018] It was determined that the message to be detected did not contain garbled characters;

[0019] After obtaining the message segments of the message to be detected, the process also includes:

[0020] Match event type keywords and node keywords under each event type from the segmented messages.

[0021] In the above method, if it is determined that the message to be detected does not contain garbled characters, and event type keywords and node keywords under the event type can be matched from each message segmentation, then the text content of the message to be detected can be considered to be in the correct format. Then, the segmentation process can be performed. Otherwise, the message to be detected is determined to be an abnormal message and is destroyed. This improves the detection efficiency of the message to be detected.

[0022] Optionally, determining the matching degree between each message segment and each preset keyword according to the matching degree calculation formula includes: determining the positive matching degree between each message segment and the preset keyword corresponding to the positive keyword set corresponding to the event type according to the matching degree calculation formula, and determining the negative matching degree between each message segment and the preset keyword corresponding to the negative keyword set corresponding to the event type according to the matching degree calculation formula; determining the detection result of the message to be detected according to the matching degree includes: determining the detection result of the message to be detected according to the positive matching degree and the negative matching degree.

[0023] In the above method, the positive matching degree between each message segment and the preset keywords in the positive keyword set corresponding to the event type is determined according to the matching degree calculation formula, and the negative matching degree between each message segment and the preset keywords in the negative keyword set corresponding to the event type is determined according to the matching degree calculation formula; the detection result of the message to be detected is determined based on the positive and negative matching degrees. Thus, by considering the matching degree of keywords in the message to be detected in both the positive and negative dimensions, the detection accuracy is improved.

[0024] Optionally, the matching degree calculation formula is: Matching degree = (Preset keyword weight / Number of characters) (Matching word count) + preset keyword weight; where the matching word count is the number of words in the message segment that are the same as the preset keyword.

[0025] In the above method, after obtaining the weight of the message segment, the matching degree of the message to be detected is determined based on the number of words in the message segment and the corresponding preset keywords and the weight of the preset keywords. This method can take into account the semantics represented by the weight of the preset keywords and the matching degree of the message segment and the preset keywords represented by the number of words, so that the final result can represent the degree of matching semantics and can accurately obtain the detection result.

[0026] Optionally, determining the detection result of the message to be detected based on the positive matching degree and the negative matching degree includes: the business system obtaining the relationship between the positive matching degree and a preset positive matching degree range, and the relationship between the negative matching degree and a preset negative matching degree range; if it is determined that the positive matching degree is within the preset positive matching degree range and the negative matching degree is outside the preset negative matching degree range, then the detection result of the message to be detected is "passed". If the positive matching degree is outside the preset positive matching degree range, or the negative matching degree is within the preset negative matching degree range, then the detection result of the message to be detected is "abnormal".

[0027] In the above method, the matching degree between the message segmentation in the message to be detected and the preset keywords in the positive keyword set and the negative keyword set is considered separately. This allows us to consider both the semantic matching degree between the message segmentation and the preset keywords in the positive keyword set, and the semantic matching degree between the message segmentation and the preset keywords in the negative keyword set. In this case, even if the matching degree between the message segmentation of the message to be detected and the preset keywords in the positive keyword set is high (the positive matching degree is within the preset positive matching degree range), but at the same time, the matching degree with the preset keywords in the negative keyword set is also high (the negative matching degree is within the preset negative matching degree range), it is highly likely that the message segmentation of the message to be detected contains message segmentation with negative semantics, and the weight corresponding to this segmentation has exceeded the normal range, which is very likely to mislead users. In this case, the message to be detected is probably an abnormal message. Therefore, when the positive matching degree is determined to be within the preset positive matching degree range, and the negative matching degree is outside the preset negative matching degree range, it can be determined that the positive semantics of the message to be detected are consistent, while the negative semantics are inconsistent, and the detection result is "passed". If the positive matching degree is outside the preset positive matching degree range, or the negative matching degree is within the preset negative matching degree range, then the positive semantics of the message to be detected are inconsistent, or the negative semantics are consistent. In either case, the positive semantics of the message to be detected are considered unsatisfactory, or the negative semantics are considered misleading to the user, and the detection result is "abnormal". Thus, by considering the keyword matching degree in the message to be detected in both the positive and negative dimensions, the detection accuracy is improved.

[0028] Secondly, embodiments of the present invention provide a message anomaly detection device, the device comprising:

[0029] The determination module is used to determine the event type of the message to be detected; the message to be detected is generated by the business system based on the user events reported by the client and the associated user events of the user events;

[0030] The processing module is used to segment the message to be detected into words, thereby obtaining the message segments of the message to be detected.

[0031] The processing module is further configured to determine each preset keyword corresponding to each message segment from the preset keyword set corresponding to the event type of the message to be detected;

[0032] The determining module is further configured to determine the matching degree between each message segment and each preset keyword according to the matching degree calculation formula;

[0033] The determining module is further configured to determine the detection result of the message to be detected based on the matching degree.

[0034] Thirdly, embodiments of this application also provide a computing device, including: a memory for storing a program; and a processor for calling the program stored in the memory and executing the method described in various possible designs of the first aspect according to the obtained program.

[0035] Fourthly, embodiments of this application also provide a computer-readable non-volatile storage medium including a computer-readable program that, when read and executed by a computer, causes the computer to perform the method described in various possible designs of the first aspect.

[0036] These or other implementations of this application will become clearer and easier to understand in the following description of the embodiments. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a schematic diagram of an architecture for message anomaly detection provided in an embodiment of the present invention;

[0039] Figure 2 This is a flowchart illustrating a message anomaly detection method provided in an embodiment of the present invention;

[0040] Figure 3 This is a flowchart illustrating a message anomaly detection method provided in an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of a message anomaly detection device provided in an embodiment of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0043] Figure 1This invention provides a system architecture for message anomaly detection. A message generation module 101 receives user events reported by clients. Each user event contains a unique identifier generated by the client, along with user behavior information, basic user information, event type keywords, and node keywords under that event type. Upon receiving the user event, the message generation module 101 records it in a historical user event record and determines its event type. Based on the trigger condition type corresponding to the event type, the module performs word segmentation on the user event and its associated user events using natural language processing (NLP) techniques to obtain event segments. Further, based on the event segments and a preset set of dialogue rules corresponding to the event type, it determines event keywords and generates a message template according to the syntax rules corresponding to the event keywords and event type. Finally, it generates a message to be detected based on information filling rules and the message template. The message generation module 101 then sends the message to be detected to the message detection module 102. After receiving the message to be detected, the message detection module 102 checks whether the message contains garbled characters according to a preset garbled character set. If the message contains garbled characters, it is directly determined to be an abnormal message, destroyed, and can be regenerated and detected again. If the message does not contain garbled characters, the event type of the message is determined. Further, natural language processing (NLP) is used to segment the message to obtain message segments. Preset keywords corresponding to each message segment are determined from a preset keyword set corresponding to the event type of the message. Event type keywords and node keywords under the event type are matched from these preset keywords. If no event type keyword is matched... If a message to be detected is identified as an abnormal message based on keywords and / or node keywords under an event type, the message is destroyed and can be regenerated and detected. If an event type keyword and node keywords under the event type are matched, the weight of each message segment is determined according to a preset keyword weighting rule. Furthermore, the positive matching degree between each message segment and the preset keywords in the positive keyword set corresponding to the event type is determined according to the matching degree calculation formula, and the negative matching degree between each message segment and the preset keywords in the negative keyword set corresponding to the event type is also determined according to the matching degree calculation formula. Finally, the detection result of the message to be detected is determined based on the positive and negative matching degrees. Thus, by automatically generating messages to be detected through the message generation module 101, message generation efficiency can be improved, and the manual and time costs of manually configuring messages can be reduced. The message detection module 102 then detects the messages to be detected to improve the accuracy of message generation.

[0044] Based on this, embodiments of this application provide a flowchart of a message anomaly detection method, such as... Figure 2 As shown, it includes:

[0045] Step 201: The business system determines the event type of the message to be detected; the message to be detected is generated by the business system based on the user events reported by the client and the associated user events of the user events;

[0046] Here, the message to be detected can be a reminder message, a notification message, etc., such as a repayment reminder message or an account login notification message. The client can be a mini-program or an app, or other programs or products that can generate and report user events.

[0047] Step 202: Segment the message to be detected into words to obtain the message segments of the message to be detected;

[0048] Step 203: Determine the preset keywords corresponding to each message segment from the preset keyword set corresponding to the event type of the message to be detected;

[0049] Here, the event type of the message to be detected can be determined based on the user event. For example, if the event type corresponding to the user login event is login, then the corresponding preset keyword set is the keywords that the user login event may generate, such as keywords like confirmation, you are currently, login, operation, my operation, etc.

[0050] Step 204: Determine the matching degree between each message segment and each preset keyword according to the matching degree calculation formula;

[0051] Step 205: Determine the detection result of the message to be detected based on the matching degree.

[0052] In the above method, the business system determines the event type of the message to be detected, and segments the message according to the event type and natural language processing (NLP) technology to obtain each message segment. It then determines the corresponding preset keywords for each message segment from a preset keyword set corresponding to the event type of the message. Based on preset message segmentation weight rules, the weight of each message segment is determined. The matching degree between each message segment and the preset keywords is determined according to a matching degree calculation formula. The matching degree is used to determine whether the message to be detected is abnormal. If abnormal, the message is destroyed, and a new message can be generated. Messages that pass the detection are then sent to the user. Thus, compared to existing technologies that do not detect messages, this application detects messages, improving message accuracy and user experience.

[0053] This application provides a message generation method, wherein the message to be detected is generated by the business system based on user events reported by the client and related user events, including: the business system receiving user events; the business system determining the event type of the message to be generated corresponding to the user event; the business system obtaining related user events from historical user event records; the business system performing word segmentation on the user event and the related user events to obtain event segments; the business system determining event keywords based on the event segments and a preset set of phrases corresponding to the event type of the message to be generated; and generating a message template based on the syntax rules corresponding to the event keywords and the event type of the message to be generated; and generating the message to be detected based on information filling rules and the message template. In one example, when a user performs a repayment action on the client, the client generates a user event for the user's repayment action, including a unique identifier of the user event, user behavior information, user basic information, event type keywords, and node keywords under the event type. For example, when a user clicks the 'Repay' button on the client, the client can obtain basic user information such as name (abai), gender (male), ID number (wxxxxm9qac), and phone number (1382564XXXX); as well as user behavior information such as repayment amount (1000 yuan) and bank (XX bank). The client generates event time information for this user event: June 27, 2021, 17:28:03, and generates a unique identifier for this user event, assigning the event type keyword CA_A200 and the node keyword CA_A200100 based on the event type. After the client reports this user event to the business system, the business system determines the event type of the user event—repayment—and thus determines the event type of the message to be generated—a repayment notification message.The business system retrieves related user events from historical user event records. For example, related user events include: a login event (containing basic user information such as user name: abai, gender: male, ID number: wxxxxm9qac, phone number: 1382564XXXX; and user behavior information such as login and XX bank). The client generates event time information for this user event: May 24, 2021, 15:26:07, and generates a unique identifier for this user event. Based on the event type, the client assigns the user the event type keyword CA_A300 and the node keyword CA_A300100 under the event type. The event includes: application events (including user's name: abai, gender: male, ID number: wxxxxm9qac, phone number: 1382564XXXX, etc., basic user information; and user behavior information such as application, loan application, and XX bank; the client generates event time information for this user event: May 24, 2021, 16:26:07, and the client generates a unique identifier for this user event, and assigns the event type keyword CA_A400 and the node keyword CA_A400100 under the event type to this user based on the event type), and loan events (including user's name: abai, gender: male, ID number: wxxxxm9q). The system collects basic user information such as account number and phone number (e.g., 1382564XXXX); user behavior information such as loan details (e.g., loan amount of 10,000 yuan, XX bank); the client generates event time information for this user event (June 24, 2021, 15:26:07); and generates a unique identifier for this user event, assigning the event type keyword CA_A400 and the node keyword CA_A400100 based on the event type. The business system performs word segmentation on the user event and related user events, obtaining the word segments for each event. The business system determines the event keywords based on the word segments and the preset script set corresponding to the event type of the message to be generated: C Given the following information: A_A200, CA_A200100, June 27, 2021, 17:28:03, XX Bank, repayment amount 1000 yuan, loan amount 10000 yuan, etc., a message template will be generated based on the event keywords and the syntax rules corresponding to the event type of the message to be generated: CA_A200, CA_A200100, [XX Bank], verification code ____; Dear customer: You made a repayment operation at 17:28:03 on June 27, 2021, with a repayment amount of 1000 yuan; Your loan amount is 10000 yuan, the current outstanding repayment amount is ____, and the repayment deadline is ____; This message is valid for ____ hours; If this was not your operation, please do not disclose it.The business system generates the message to be checked based on the verification code generation program, validity period generation rules, repayment algorithm program, and other information filling rules and the message template: CA_A200, CA_A200100, [XX Bank], Verification Code: 159753; Dear customer: You made a repayment operation at 17:28:03 on June 27, 2021, with a repayment amount of 1,000 yuan; Your loan amount is 10,000 yuan, the current outstanding repayment amount is 9,000 yuan, and the repayment deadline is 15:26:07 on July 24, 2021; This message is valid for 5 days. If this was not your operation, please do not disclose it.

[0054] This application provides a message generation method. The business system performs word segmentation on the user event and the associated user event, including: the business system determines the trigger condition type based on the event type of the message to be generated; if the trigger condition type is instantaneous triggering, the business system performs word segmentation on the user event and the associated user event using natural language processing (NLP); if the trigger condition type is non-instantaneous triggering, the business system determines the trigger time point according to a preset trigger time rule, and when the trigger time point is reached, the business system performs word segmentation on the user event and the associated user event using NLP. Based on the above example, if the event type of the message to be generated is a loan message notification, it can be determined that the trigger condition type of this event type is instantaneous triggering. The business system performs word segmentation on the user event and the associated user event using NLP to obtain the message to be detected - loan message notification. If the event type of the message to be generated is a repayment reminder message, then the trigger condition type of this event type can be determined as non-instantaneous trigger. The business system determines the trigger time point based on preset trigger time rules such as the repayment period and the user's loan term. For example, if the repayment period is one month, the business system determines the repayment date-trigger time point as July 22, 2021, at 15:26:07 based on the loan date of June 24, 2021, 15:26:07. When this trigger time point is reached: July 22, 2021, 15:26:07, the business system uses natural language processing technology to segment the user event and related user events, obtains the repayment reminder message, and sends it to the user to remind them to repay the loan.

[0055] This application embodiment provides a method for detecting a message to be detected. Before the business system performs word segmentation on the message to be detected, it further includes: determining that the message to be detected does not contain garbled characters; after obtaining each message segment of the message to be detected, it further includes: matching event type keywords and node keywords under the event type from each message segment. Based on the above example, the business system first determines -- message to be detected: CA_A200, CA_A200100, [XX Bank], verification code: 159753; Dear customer: You made a repayment operation at 17:28:03 on June 27, 2021, with a repayment amount of 1000 yuan; Your loan amount is 10000 yuan, the current outstanding repayment amount is 9000 yuan, and the repayment deadline is 15:26:07 on July 24, 2021; This message is valid for 5 days. If this is not your operation, please do not disclose it. There are no garbled characters in this message, which can be achieved by matching it with a pre-set set of garbled characters. Next, the message to be detected is segmented into words to obtain the following message segments: CA_A200, CA_A200100, XX Bank, verification code, esteemed customer, you made a repayment, operation, repayment amount, your, loan amount, current, amount due, repayment deadline, this message, valid time, if not operated by you, please do not disclose. The event type keyword CA_A200 and the node keyword CA_A200100 under the event type are matched from each message segment. The matching degree of the event type keyword CA_A200 is determined only if it matches a pre-stored event type keyword, and the node keyword CA_A200100 under the event type is a corresponding node keyword under the event type keyword CA_A200. Otherwise, the message to be detected is determined to be an abnormal message and destroyed. An alarm may also be generated, or the message to be detected may be retrieved again (a threshold can be set for the number of times the message to be detected is retrieved again to prevent the message from being continuously abnormal and getting stuck in a loop of re-retrieval).

[0056] This application provides a method for detecting a message to be detected. The method determines the matching degree between each message segment and a preset keyword set according to a matching degree calculation formula. This includes: determining the positive matching degree between each message segment and a preset keyword in the positive keyword set corresponding to the event type according to the matching degree calculation formula; and determining the negative matching degree between each message segment and a preset keyword in the negative keyword set corresponding to the event type according to the matching degree calculation formula. The method then determines the detection result of the message to be detected based on the matching degree, including: determining the detection result of the message to be detected based on the positive matching degree and the negative matching degree. Based on the above example, the positive keyword set corresponding to a repayment reminder message of a repayment event type includes: making repayment, repayment amount, loan amount, amount due for repayment, repayment deadline, etc., while the negative keyword set corresponding to a repayment reminder message of a repayment event type includes: taking out a loan, loan amount, loan operation, loan guarantee, guarantor, etc. The detection result is then determined based on the positive matching degree between each message segment and the preset keyword in the positive keyword set corresponding to the event type, and the negative matching degree between each message segment and the preset keyword in the negative keyword set corresponding to the event type.

[0057] This application provides a matching degree calculation method, wherein the matching degree calculation formula is: Matching degree = (Preset keyword weight / Number of characters) (Matching word count) + preset keyword weight, where the matching word count is the number of words in the message segment that are identical to the preset keyword. Based on the above example: --Message to be detected: CA_A200, CA_A200100, [XX Bank], Verification code: 159753; Dear customer: You made a repayment operation at 17:28:03 on June 27, 2021, with a repayment amount of 1000 yuan; Your loan amount is 10000 yuan, the current outstanding repayment amount is 9000 yuan, and the repayment deadline is 15:26:07 on July 24, 2021; This message is valid for 5 hours. If this was not your operation, please do not disclose it. -- Determine the preset keywords of the corresponding positive keyword set as repayment, repayment amount, and loan amount. The message to be detected is assigned the following weights: 1. The amount due for repayment; 2. The repayment deadline. Based on the weighting rules, the weights for each word are: 0.7 for "making repayment," 0.5 for "repayment amount," 0.5 for "loan amount," 0.5 for "amount due for repayment," and 0.5 for "repayment deadline." Therefore, the total weight is 0.7 + 0.5 + 0.5 + 0.5 + 0.5 = 2.7. Further, the word segmentation weights for the message to be detected are: 0.7 / 2.7 for "making repayment," 0.5 / 2.7 for "repayment amount," 0.5 / 2.7 for "loan amount," and 0.5 / 2.7 for "amount due for repayment." The positive matching degree is 0.5 / 2.7 / 4. 4 + 0.5 / 2.7 + 0.5 / 2.7 / 4 4 + 0.5 / 2.7 + 0.5 / 2.7 / 5 5 + 0.5 / 2.7. Reverse matching degree = 0.5 / 2.7 / 4 4+0.5 / 2.7.

[0058] This application provides a method for detecting a message to be detected, which determines the detection result of the message to be detected based on the forward matching degree and the reverse matching degree. The method includes: the business system acquiring the relationship between the forward matching degree and a preset forward matching degree range, and the relationship between the reverse matching degree and a preset reverse matching degree range; if it is determined that the forward matching degree is within the preset forward matching degree range and the reverse matching degree is outside the preset reverse matching degree range, then the detection result of the message to be detected is "passed". If the forward matching degree is outside the preset forward matching degree range, or the reverse matching degree is within the preset reverse matching degree range, then the detection result of the message to be detected is "abnormal". In other words, the higher the matching degree between the message segmentation of the message to be detected and the corresponding preset keywords in the preset forward keyword set, the lower the probability of the message to be detected being abnormal; the lower the matching degree between the message segmentation of the message to be detected and the corresponding preset keywords in the preset forward keyword set, the higher the probability of the message to be detected being abnormal. The higher the match between the message segmentation of the message to be detected and the corresponding preset keywords in the reverse preset keyword set, the higher the probability that the message to be detected is abnormal; the lower the match between the message segmentation of the message to be detected and the corresponding preset keywords in the reverse preset keyword set, the lower the probability that the message to be detected is abnormal. Big data analytics can be used to analyze the weights and matching characters of the positive preset keywords in each message segmentation of messages corresponding to each event type, as well as the weights and matching characters of the negative preset keywords, to determine the preset positive and negative match ranges.

[0059] Based on the above method flow, embodiments of this application provide a flow chart for an abnormal message detection method, such as... Figure 3 As shown, it includes:

[0060] Step 301: The business system receives user events sent by the client. Each user event contains a unique identifier, event type keywords, node keywords under the event type, user behavior information, and basic user information. For example, if a user clicks on "loan guarantee" on the client, the client can obtain the user's name, gender, ID number, phone number, and other basic user information based on the click action; as well as user behavior information such as "application," "loan guarantee," "XX Bank," and "AA Automobile Company." The client generates event time information for this user event, specifying the year, month, day, hour, minute, and second.

[0061] Step 302: The business system stores the user event in the historical user event record according to the event time sequence. For example, the historical user event record stores all user events of the user within five years: user login events, user application events, user account opening events, user settlement events, etc.

[0062] Step 303: The business system determines the event type of the user event and determines the trigger condition type for generating the reminder message based on the event type of the user event.

[0063] Step 304: If the event type corresponds to an immediate trigger, the business system, upon receiving the user event, performs word segmentation on the user event and related user events using natural language processing (NLP). If the event scenario corresponds to a non-immediate trigger, the business system, upon receiving the user event, determines the trigger time point based on the information of the user event and related user events, as well as preset trigger time rules. When the trigger time point is reached, the business system performs word segmentation on the user event and related user events using NLP. Based on the previous example, if the event type is a guarantee account opening event, the user event is determined to be an immediate trigger. Upon receiving the user event, the business system performs word segmentation on the user event and related user events using NLP. If the event scenario is a loan event scenario, which corresponds to a non-immediate trigger, the business system, upon receiving the user event, analyzes the user event and related user events, determines the trigger time point according to preset trigger time rules, and performs word segmentation on the user event and related user events using NLP when the trigger time point is reached.

[0064] Step 305: Obtain multiple event segments by segmenting the user event and related user events. Compare these event segments with the preset script set corresponding to the event type of the user event to obtain event keywords. Generate a message template based on each event keyword and its corresponding syntax rules. The syntax rules are used to arrange the order of the event keywords and the nature of the characters to be filled between them. For example, if the user event is a user guarantee event, the user guarantee event includes: unique identifier - 74258, user name: abai, user gender: male, ID number: wxxxxm9qac, phone number: 1382564XXXX, beneficiary: XX Bank, applicant: AA Automobile Company, event: Express Car provides guarantee, event time: June 24, 2021, 15:26:07, event generation terminal: PC. By comparing with the preset script set, the event keywords obtained are: Guarantee event keyword: CA_A100 (generated by the client based on the user event), PC event keyword: CA_A100100 (generated by the client based on the user event), XX Bank (generated by the client based on the user event), Verification code (generated by the business system based on the user event scenario), You are providing a guarantee for, applied for, AA Car Company, and Express Car, Valid time (generated by the business system based on the event type), If this was not your operation, please do not disclose it.

[0065] Based on the syntax rules corresponding to the event keywords, the message template is determined as follows: CA_A100, CA_A100100, [XX Bank], Verification Code____; You are providing a guarantee for the express car application of AA Car Company, valid for ___, If this was not your operation, please do not disclose it.

[0066] Step 306: The business system fills the message template according to the information filling rules, such as the verification code randomization program, user name, and the preset validity period of the reminder message for this event type. The message to be detected is: CA_A100, CA_A100100, [XX Bank], Verification Code: 235689; You are providing a guarantee for a direct-access car application for AA Auto Company, valid for 5 minutes. If this was not your operation, please do not disclose it.

[0067] Step 307: Check if the message to be checked is garbled. If garbled characters are found, proceed to step 314; otherwise, proceed to step 308.

[0068] Step 308: Segment the message to be detected into words, and obtain the word segments of each message according to the preset keyword set corresponding to the event type: CA_A100, CA_A100100, XX Bank, verification code, you are providing a guarantee for, AA Automobile Company, applied for, Express Car, valid time, if not operated by yourself, please do not disclose.

[0069] Step 309: Check whether the message to be checked contains the event type keyword - guarantee event keyword: CA_A100. If it does not contain it, proceed to step 314; if it does contain it, proceed to step 310.

[0070] Step 310: Check whether the message to be detected contains the node keyword under the event type - PC node keyword: CA_A100100. If it does not contain it, proceed to step 314; if it does contain it, proceed to step 311.

[0071] Step 311: Obtain the weight values ​​of each message segment in the message to be tested according to the preset message keyword weight rules. For example, the keyword weight values ​​are: XX Bank = 0.1, Verification Code = 0.1, You are working for = 0.3, AA Car Company = 0.5, Applied for = 0.3, Direct Train Car provides guarantee = 0.6, Valid Time = 0.1, If ​​not operated by me, please do not disclose = 0.1; 0.1 + 0.1 + 0.3 + 0.5 + 0.3 + 0.6 + 0.1 = 2, further obtaining the message keyword weights: XX Bank = 0.1 / 2, Verification Code = 0.1 / 2, You are working for = 0.3 / 2, AA Car Company = 0.5 / 2, Applied for = 0.3 / 2, Direct Train Car provides guarantee = 0.5 / 2, Valid Time = 0.1 / 2, If not operated by me, please do not disclose = 0.1 / 2.

[0072] Step 312: Determine the positive matching degree between each message segment and the corresponding keywords in the positive keyword set corresponding to the event type according to the matching degree formula, and determine the negative matching degree between each message segment and the corresponding keywords in the negative keyword set corresponding to the event type according to the matching degree calculation formula.

[0073] In the example above, the keywords corresponding to the positive keyword set for each message keyword and event type are: XX Bank, verification code, you are doing, AA Car, application, provide guarantee, validity period, please do not disclose if not operated by yourself. Therefore, the positive match score = (message keyword weight / number of characters). (Matching word count) + message keyword weight = 0.1 / 2 + 0.1 / 2 + (0.3 / 2 / 4) 3) + 0.3 / 2 + (0.5 / 2 / 6) 4) + 0.5 / 2 + (0.3 / 2 / 3) 2) +0.3 / 2 + (0.5 / 2 / 9) 4) +0.5 / 2 + 0.1 / 2 + 0.1 / 2 = 1.740.

[0074] The keywords corresponding to the reverse keyword set for each message keyword and event type are: XX Bank, verification code, application, validity period, and "Do not disclose if this was not your operation." Therefore, the positive match score is calculated as follows: (Message keyword weight / Number of characters). (Matching character count) + message keyword weight = 0.1 / 2 + 0.1 / 2 + (0.3 / 2 / 3) 2) +0.3 / 2 + 0.1 / 2 + 0.1 / 2 = 0.45.

[0075] Step 313: The business system determines, based on the preset forward matching degree range of 1.5 ± 0.3 (preset blocking threshold) and the preset reverse matching degree range of 1 ± 0.3 (preset blocking threshold), that the forward matching degree is within the preset forward matching degree range and the reverse matching degree is outside the preset reverse matching degree range; then the detection result of the message to be detected is "passed". Alternatively, if the reverse matching degree is determined to be within the preset reverse matching degree range, then the detection result of the message to be detected is "abnormal message", and step 314 is executed.

[0076] Step 314: If the message to be detected is an abnormal message, an alarm is generated.

[0077] It should be noted that the order of the above message anomaly detection process is not unique. For example, step 303 or step 304 can be executed before step 302. This process is just an example and does not restrict the specific execution process.

[0078] Based on the same concept, embodiments of the present invention provide a message anomaly detection device. Figure 4 This is a schematic diagram of a message anomaly detection device provided in an embodiment of this application, as shown below. Figure 4 The following are examples:

[0079] The determination module 401 is used to determine the event type of the message to be detected; the message to be detected is generated by the processing module 402 based on the user event reported by the client and the associated user event of the user event;

[0080] The processing module 402 is used to segment the message to be detected into words to obtain each word segment of the message to be detected;

[0081] The processing module 402 is further configured to determine each preset keyword corresponding to each message segmentation from the preset keyword set corresponding to the event type of the message to be detected;

[0082] The determining module 401 is further configured to determine the matching degree between each message segment and each preset keyword according to the matching degree calculation formula;

[0083] The determining module 401 is further configured to determine the detection result of the message to be detected based on the matching degree.

[0084] Optionally, the processing module 402 is specifically configured to: receive user events; determine the event type of the message to be generated corresponding to the user event through the determining module 401; obtain associated user events of the user event from historical user event records; perform word segmentation on the user event and the associated user events to obtain each event word segmentation; determine each event keyword according to the preset speech set corresponding to each event word segmentation and the event type of the message to be generated; generate a message template according to the syntax rules corresponding to each event keyword and the event type of the message to be generated; and generate a message to be detected according to the information filling rules and the message template.

[0085] Optionally, the processing module 402 is specifically used to determine the trigger condition type based on the event type of the message to be generated; if the trigger condition type is instantaneous triggering, the processing module 402 performs word segmentation on the user event and the associated user event using natural language analysis technology; if the trigger condition type is non-instantaneous triggering, the processing module 402 determines the trigger time point according to a preset trigger time rule, and when the trigger time point is reached, performs word segmentation on the user event and the associated user event using natural language analysis technology.

[0086] Optionally, the determining module 401 is further configured to determine that the message to be detected does not contain garbled characters; the processing module 402 is further configured to match event type keywords and node keywords under the event type from each message segmentation.

[0087] Optionally, the processing module 402 is specifically used to determine the positive matching degree between each message segment and the preset keywords in the positive keyword set corresponding to the event type according to the matching degree calculation formula, and to determine the negative matching degree between each message segment and the preset keywords in the negative keyword set corresponding to the event type according to the matching degree calculation formula.

[0088] The determining module 401 is specifically used to determine the detection result of the message to be detected based on the positive matching degree and the negative matching degree.

[0089] Optionally, the matching degree calculation formula is: Matching degree = (Preset keyword weight / Number of characters) (Matching word count) + Preset keyword weight

[0090] The number of matched characters is the number of characters in the message segment that are identical to the preset keyword.

[0091] Optionally, the determining module 401 is specifically used to obtain the relationship between the positive matching degree and a preset positive matching degree range, and the relationship between the negative matching degree and a preset negative matching degree range; if it is determined that the positive matching degree is within the preset positive matching degree range and the negative matching degree is outside the preset negative matching degree range, then the detection result of the message to be detected is "passed". If the positive matching degree is outside the preset positive matching degree range, or the negative matching degree is within the preset negative matching degree range, then the detection result of the message to be detected is "abnormal".

[0092] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0093] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0094] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0095] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0096] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting message anomalies, characterized in that, The method includes: The business system determines the event type of the message to be detected; the message to be detected is generated by the business system based on user events reported by the client and related user events. The message to be detected is segmented into words to obtain the message segments of the message to be detected; Determine each preset keyword corresponding to each message segment from the preset keyword set corresponding to the event type of the message to be detected; The matching degree between each message segment and each preset keyword is determined according to the matching degree calculation formula; The detection result of the message to be detected is determined based on the matching degree; The message to be detected is generated by the business system based on user events reported by the client and related user events, including: The business system receives user events; The business system determines the event type of the message to be generated corresponding to the user event; The business system retrieves the associated user events of the user event from historical user event records; The business system performs word segmentation on the user events and the associated user events to obtain the word segments for each event. The business system determines keywords for each event based on the word segmentation of each event and the preset set of dialogue corresponding to the event type of the message to be generated; and generates a message template based on the syntax rules corresponding to the event keywords and the event type of the message to be generated. The business system generates a message to be detected based on the information filling rules and the message template. The business system performs word segmentation on the user events and the associated user events, including: The business system determines the trigger condition type based on the event type of the message to be generated; If the trigger condition type is instantaneous trigger, the business system performs word segmentation on the user event and the associated user event using natural language analysis technology; If the trigger condition type is non-instantaneous trigger, the business system determines the trigger time point according to the preset trigger time rules. When the trigger time point is reached, the business system performs word segmentation on the user event and the associated user event according to natural language analysis technology.

2. The method as described in claim 1, characterized in that, Before the business system performs word segmentation on the message to be detected, it also includes: It was determined that the message to be detected did not contain garbled characters; After obtaining the message segments of the message to be detected, the process also includes: Match event type keywords and node keywords under each event type from the segmented messages.

3. The method as described in claim 1, characterized in that, The matching degree between each message segment and the preset keyword set is determined according to the matching degree calculation formula, including: The positive matching degree between each message segment and the preset keyword in the positive keyword set corresponding to the event type is determined according to the matching degree calculation formula, and the negative matching degree between each message segment and the preset keyword in the negative keyword set corresponding to the event type is determined according to the matching degree calculation formula. Determining the detection result of the message to be detected based on the matching degree includes: The detection result of the message to be detected is determined based on the positive matching degree and the negative matching degree.

4. The method as described in claim 1, characterized in that, The matching degree calculation formula is as follows: The matching degree = (preset keyword weight / number of words) (Matching word count) + Preset keyword weight The number of matched characters is the number of characters in the message segment that are identical to the preset keyword.

5. The method as described in claim 3, characterized in that, Determining the detection result of the message to be detected based on the positive matching degree and the negative matching degree includes: The business system obtains the relationship between the positive matching degree and the preset positive matching degree range, and the relationship between the negative matching degree and the preset negative matching degree range; If it is determined that the positive matching degree is within a preset positive matching degree range, and the negative matching degree is outside a preset negative matching degree range, then the detection result of the message to be detected is "passed". If the positive matching degree is outside the preset positive matching degree range, or the negative matching degree is within the preset negative matching degree range, then the detection result of the message to be detected is abnormal.

6. A message anomaly detection device, characterized in that, The device includes: The determination module is used to determine the event type of the message to be detected; the message to be detected is generated by the business system based on the user events reported by the client and the associated user events of the user events; The processing module is used to segment the message to be detected into words, thereby obtaining the message segments of the message to be detected. The processing module is further configured to determine each preset keyword corresponding to each message segment from the preset keyword set corresponding to the event type of the message to be detected; The determining module is further configured to determine the matching degree between each message segment and each preset keyword according to the matching degree calculation formula; The determining module is further configured to determine the detection result of the message to be detected based on the matching degree; The processing module is specifically used to receive user events; determine the event type of the message to be generated corresponding to the user event through the determining module; obtain the associated user events of the user event from historical user event records; perform word segmentation on the user event and the associated user events to obtain each event word segment; determine each event keyword according to the preset speech set corresponding to each event word segment and the event type of the message to be generated; generate a message template according to the syntax rules corresponding to each event keyword and the event type of the message to be generated; and generate a message to be detected according to the information filling rules and the message template. The processing module is specifically used to determine the trigger condition type based on the event type of the message to be generated; if the trigger condition type is instantaneous triggering, then the user event and the associated user event are segmented into words using natural language analysis technology; if the trigger condition type is non-instantaneous triggering, then the trigger time point is determined according to a preset trigger time rule, and when the trigger time point is reached, the user event and the associated user event are segmented into words using natural language analysis technology.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when run on a computer, causes the computer to perform the method of any one of claims 1 to 5.

8. A computer device, characterized in that, include: Memory, used to store computer programs; A processor is configured to invoke a computer program stored in the memory and execute the method as described in any one of claims 1 to 5 according to the obtained program.

Images