Object classification method and device based on artificial intelligence

Abstract

The present application provides an object classification method, device, equipment and computer-readable storage medium based on artificial intelligence; the method includes: extracting a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to multiple historical time nodes; based on the first feature sequence, respectively calling a time series model and a neural network model to perform time series prediction processing to obtain a second feature sequence, a third feature sequence and a first time series error; fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold; classifying the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified. Through the present application, the object to be identified can be accurately classified.

Description

Technical Field

[0001] The present application relates to artificial intelligence technology, and in particular to an object classification method, device, equipment and computer-readable storage medium based on artificial intelligence. Background Art

[0002] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0003] In the object classification methods of the prior art, there is usually a large classification error during classification and the degree of error deviation cannot be guaranteed. Regarding how to accurately classify the identified objects, there is no effective solution in the related art. Summary of the invention

[0004] The embodiments of the present application provide an artificial intelligence-based object classification method, device, and computer-readable storage medium, which can accurately classify objects to be identified.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application embodiment provides an object classification method based on artificial intelligence, including:

[0007] Extracting a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to a plurality of historical time nodes respectively;

[0008] Based on the first feature sequence, a time series model and a neural network model are respectively called to perform time series prediction processing to obtain a second feature sequence, a third feature sequence and a first time series error;

[0009] fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold;

[0010] The behavior data of the object to be identified is classified based on the classification threshold to obtain the category of the object to be identified.

[0011] In the above scheme, the target time series model is subjected to order determination and parameter estimation processing to obtain the time series model used for time series prediction processing, including: performing order determination processing on the target time series model to obtain the starting prediction time node of the target time series model, wherein the starting prediction time node is the starting time node of the fourth characteristic sequence; performing parameter estimation operation on the target time series model to obtain the prediction parameters of the target time series model; and determining the time series model used for the time series prediction processing according to the starting prediction time node of the target time series model and the prediction parameters of the target time series model.

[0012] In the above scheme, after the behavioral data of the object to be identified is classified based on the classification threshold and the category of the object to be identified is obtained, the method also includes: when the category of the object to be identified is an abnormal type, intercepting the business request of the object to be identified; when the category of the object to be identified is a normal type, responding to the business request of the object to be identified.

[0013] The embodiment of the present application provides an object classification device based on artificial intelligence, comprising:

[0014] An extraction module, configured to extract a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to a plurality of historical time nodes respectively;

[0015] A prediction module, used for respectively calling a time series model and a neural network model to perform time series prediction processing based on the first feature sequence to obtain a second feature sequence, a third feature sequence and a first time series error;

[0016] A fusion module, used for fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold;

[0017] The classification module is used to classify the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified.

[0018] In the above scheme, the prediction module is also used to call the time series model to perform time series prediction processing based on the first feature sequence to obtain the second feature sequence and the fourth feature sequence, wherein the second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence; determine the second time series error between the first feature sequence and the fourth feature sequence; call the neural network model to perform time series prediction processing based on the second feature sequence to obtain the third feature sequence, wherein the third feature sequence and the second feature sequence include the same multiple future time nodes; call the neural network model to perform time series prediction processing based on the second time series error to obtain the first time series error.

[0019] In the above scheme, the fusion module is also used to perform weighted averaging processing on the second feature sequence and the third feature sequence to obtain a fifth feature sequence; sum the fifth feature sequence and the first time series error to obtain a sixth feature sequence; and normalize the sixth feature sequence to obtain the classification threshold.

[0020] In the above scheme, the extraction module is also used to extract feature data of multiple historical time nodes from the behavioral data of the at least one sample object; select data above the fluctuation degree threshold from the feature data of the multiple historical time nodes, and sort the selected data above the fluctuation degree threshold in chronological order to obtain the first feature sequence.

[0021] In the above scheme, the extraction module is also used to extract atomic dimension feature data of multiple historical time nodes from the behavior data based on the atomic dimension indicators of the behavior data, wherein the atomic dimension indicators are indicators in the behavior data that cannot be further divided; and to extract aggregated dimension feature data of multiple historical time nodes from the behavior data based on the aggregated dimension indicators of the behavior data, wherein the aggregated dimension indicators are aggregated by multiple of the atomic dimension indicators.

[0022] In the above scheme, the artificial intelligence-based object classification device also includes: a first classification module, which is used to cluster the behavior data of the at least one sample object to obtain the sample object set to which each sample object belongs; determine the sample object set to which the object to be identified belongs based on the difference value between the behavior data of the object to be identified and the behavior data of each of the sample objects; and determine the category of the sample object in the sample object set to which the object to be identified belongs as a similar category of the object to be identified.

[0023] In the above scheme, the classification module is also used to perform the following processing on any sample object: determine a first sample object set to which the any sample object belongs based on the behavior data of the any sample object, wherein the distance between the sample objects in the first sample object set and the any sample object is less than a radius parameter; determine a second sample object set within the radius parameter range of each sample object in the first sample object set based on each sample object in the first sample object set and the radius parameter, wherein the number of sample objects in the second sample object set is the same as the number of sample objects in the first sample object set; when the number of sample objects in the second sample object set is less than a domain density threshold, select the sample objects in the first sample object set and the sample objects in the second sample object set to obtain the sample object set to which the any sample object belongs.

[0024] In the above scheme, the classification module is also used to determine that the category of the object to be identified is an abnormal type when the behavior data of the object to be identified is greater than the classification threshold; when the behavior data of the object to be identified is less than or equal to the classification threshold, determine that the category of the object to be identified is a normal type.

[0025] In the above scheme, the artificial intelligence-based object classification device also includes: a training module, which is used to train the time series model in the following manner: performing data smoothing processing on the first feature sequence to obtain a smoothed first feature sequence; determining a target time series model to be trained from multiple candidate time series models based on the statistical characteristics of the smoothed first feature sequence, wherein the multiple candidate time series models include an autoregressive model, a moving average model and an autoregressive moving average model; performing order determination processing and parameter estimation processing on the target time series model to obtain the time series model used for time series prediction processing.

[0026] In the above scheme, the training module is also used to perform order determination processing on the target time series model to obtain the starting prediction time node of the target time series model, wherein the starting prediction time node is the starting time node of the fourth feature sequence; perform parameter estimation operation on the target time series model to obtain the prediction parameters of the target time series model; and determine the time series model used for the time series prediction processing based on the starting prediction time node of the target time series model and the prediction parameters of the time series model.

[0027] In the above scheme, the artificial intelligence-based object classification device also includes: a judgment module, which is used to intercept the business request of the object to be identified when the category of the object to be identified is an abnormal type; when the category of the object to be identified is a normal type, respond to the business request of the object to be identified.

[0028] The embodiment of the present application provides an object classification device based on artificial intelligence, comprising:

[0029] A memory for storing executable instructions;

[0030] The processor is used to implement the artificial intelligence-based object classification method provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0031] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for causing a processor to execute and implement the artificial intelligence-based object classification method provided in the embodiment of the present application.

[0032] The embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned artificial intelligence-based object classification method of the embodiment of the present application.

[0033] The embodiments of the present application have the following beneficial effects:

[0034] The first feature sequence based on multi-dimensional features calls the time series model and the neural network model respectively for time series prediction processing, and combines the time series model and the neural network model for time prediction processing to obtain the first time series error. The first time series error is fused with the predicted second feature sequence and the third feature sequence, and the obtained classification threshold is used to classify the behavior data of the object to be identified, so that the classification result is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is an optional structural diagram of an artificial intelligence-based object classification system architecture provided in an embodiment of the present application;

[0036] Figure 2 This is an optional structural diagram of an artificial intelligence-based object classification device provided in an embodiment of the present application;

[0037] Figures 3 to 7 This is an optional flowchart of the artificial intelligence-based object classification method provided in the embodiment of the present application;

[0038] Figure 8 It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided in an embodiment of the present application;

[0039] Fig. 9 It is a schematic diagram of the system background structure and logic flow of the object classification method based on artificial intelligence provided by the embodiment of the present application;

[0040] Fig.10 It is a schematic diagram of the architecture of the abnormally active early warning system provided in an embodiment of the present application;

[0041] Fig.11 is a flow chart of an optimized particle swarm algorithm provided in an embodiment of the present application;

[0042] Fig.12 It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided in an embodiment of the present application;

[0043] Fig.13 It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided in an embodiment of the present application;

[0044] Fig.14 It is a schematic diagram of the principle of the artificial intelligence-based object classification method provided in the embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0046] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0048] The relevant data collection and processing in the embodiments of this application should be strictly in accordance with the requirements of relevant laws and regulations when applied in examples, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of authorization of laws and regulations and the personal information subject.

[0049] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0050] 1) Behavior data: It is an observation report about the behavior of the organism and the environment in which the behavior occurs. For example, the behavior data can be the recharge behavior data, game behavior data, etc. of the sample object.

[0051] 2) Feature sequence: includes multi-dimensional features of multiple time nodes. The feature sequence can be the observation values ​​of multi-dimensional features of multiple time nodes arranged in chronological order.

[0052] 3) Multi-dimensional features: features of at least two dimensions. For example, multi-dimensional features may include atomic dimensional features and aggregated dimensional features formed by aggregating multiple atomic dimensions.

[0053] 4) Future time node: With the current time node as the base time node, the future time node refers to the time node after the base time node. For example, the future time node may be a time node tomorrow (eg, 3:00 p.m. tomorrow).

[0054] 5) Historical time node: The current time node is used as the base time node. The historical time node refers to the time node before the base time node. For example, the historical time node may be a time node yesterday (for example, 3:00 p.m. yesterday).

[0055] In the object classification method of the prior art, the classification of the objects to be classified is usually carried out by analyzing the data of multiple classified objects, summarizing the behavior patterns of the objects, marking the behaviors of abnormal objects, and summarizing the behavior patterns of abnormal objects. The classification of the objects to be classified and the formulation of the early warning and interception strategies for the objects to be classified are completed in combination with the behavior patterns of the classified objects. However, the shortcomings of the object classification method of the prior art are also undoubted:

[0056] In the object classification methods of the prior art, the formulation and use of classification strategies are highly subjective. Some hidden rules in the data of the classified objects may not be discovered. Moreover, due to the large number of classification strategies themselves and the large overall number of classification strategies, the cost of manually configuring classification strategies is high, and the labor cost is high. In addition, fixed classification strategies cannot cover all abnormal behaviors, and external factors will affect the accuracy of object classification. It is necessary to re-analyze the behavior logs of newly added objects, which is more time-lagged and unable to respond to external changes quickly. At the same time, the object classification methods of the prior art often cannot intervene in advance in objects with abnormal behavior tendencies to correct bad habits.

[0057] Based on the above analysis, the applicant found that the object classification method of the prior art cannot accurately classify the object to be identified. To address the above problem, the embodiment of the present application provides an object classification method based on artificial intelligence, which can accurately classify the object to be identified.

[0058] The artificial intelligence-based object classification method, apparatus, device and computer-readable storage medium provided in the embodiments of the present application can accurately classify the objects to be identified. The following describes an exemplary application of an electronic device for artificial intelligence-based object classification provided in the embodiments of the present application. The electronic device provided in the embodiments of the present application can be implemented as various types of user terminals such as laptops, tablet computers, desktop computers, set-top boxes, mobile devices (for example, mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), and can also be implemented as a server.

[0059] See also Figure 1 , Figure 1 It is an optional architectural diagram of an artificial intelligence-based object classification system 100 provided in an embodiment of the present application. To realize an artificial intelligence-based object classification application scenario, a terminal (terminal 400 is shown as an example) is connected to a server 200 via a network 300. The network 300 may be a wide area network or a local area network, or a combination of the two.

[0060] The terminal 400 is used for the user to use the client 410, which is displayed on a graphical interface 410-1 (graphic interface 410-1 is shown as an example). The terminal 400 and the server 200 are connected to each other via a wired or wireless network.

[0061] In some embodiments, the server 200 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present application.

[0062] In some embodiments, taking a server as an example, it can be a server cluster deployed in the cloud, opening artificial intelligence cloud services (AI as a Service, AIaaS) to users. The AIaaS platform will split several common AI services and provide independent or packaged services in the cloud. This service model is similar to an AI theme mall. All users can access one or more artificial intelligence services provided by the AIaaS platform through an application programming interface.

[0063] For example, one of the artificial intelligence cloud services can be a time series model and a neural network model prediction service, that is, the server 200 in the cloud is encapsulated with a time series model and a neural network model prediction program provided by an embodiment of the present application. The time series model and neural network model prediction service in the cloud service is called through the terminal 400 (running with a client 410, such as a game client, a chat client, etc.), so that the server 200 deployed in the cloud calls the encapsulated time series model and the neural network model prediction program. For example, for a game application, the category of the object to be identified (such as a user of a game application) is determined by calling the time series model and the neural network model based on the first feature sequence for time prediction processing (for game object classification), such as an abnormal object, a normal object, etc. If the object to be identified is an abnormal object, the game behavior of the object to be identified can be intercepted, and if the category of the object to be identified is a normal object, the game behavior of the object to be identified can be allowed.

[0064] In some embodiments, the terminal 400 sends a service request (e.g., a recharge request, a reward request, etc.) triggered by the object to be identified to the server 200, and the server 200 calls the time series model and the neural network model prediction interface. The server 200 predicts the first feature sequence through the time series model and the neural network model, determines the category of the object to be identified, and then processes the service request (e.g., a recharge request, a reward request, a game prop acquisition request) of the object to be identified based on the category of the object to be identified, and feeds back the processing result to the terminal 400. After receiving the processing result sent by the server 200, the terminal 400 displays the processing result in the graphical interface 410-1. For example, when the category of the object to be identified is an abnormal object, the server 200 intercepts the business request of the object to be identified, and feeds back the business request failure information (such as recharge failure, reward collection failure) to the terminal 400. The terminal 400 receives the business request failure information sent by the server 200, and displays the business request failure information in the graphical interface 410-1; when the category of the object to be identified is a normal object, the server 200 responds to the business request of the object to be identified (such as allowing recharge, allowing reward collection), and feeds back the business request success information (such as recharge success, reward collection success) to the terminal 400. The terminal 400 receives the business request success information sent by the server 200, and displays the business request success information in the graphical interface 410-1.

[0065] In other embodiments, after the terminal 400 responds to the service request triggered by the object to be identified, the time series model and neural network model prediction interface in the terminal 400 are called, and the terminal 400 predicts the first feature sequence through the time series model and the neural network model to determine the category of the object to be identified, and then processes the service request of the object to be identified (such as a recharge request, a reward collection request, a game prop acquisition request) based on the category of the object to be identified, and displays the processing result in the graphical interface 410-1. For example, when the category of the object to be identified is an abnormal object, the terminal 400 intercepts the service request of the object to be identified, and displays the service request failure information (such as recharge failure, reward collection failure) in the graphical interface 410-1; when the category of the object to be identified is a normal object, the terminal 400 responds to the service request of the object to be identified (such as recharge success, reward collection success) and displays the service request success information in the graphical interface 410-1.

[0066] See also Figure 2 , Figure 2 is a schematic diagram of the structure of the server 200 for object classification based on artificial intelligence provided in an embodiment of the present application, Figure 2The server 200 shown includes: at least one processor 410, a memory 450, and at least one network interface 420. The various components in the server 200 are coupled together via a bus system 440. It is understood that the bus system 440 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 440 is not described in detail. Figure 2 Various buses are labeled as bus system 440 .

[0067] Processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0068] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices that are physically remote from the processor 410.

[0069] The memory 450 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 450 described in the embodiments of the present application is intended to include any suitable type of memory.

[0070] In some embodiments, memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0071] Operating system 451, including system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0072] A network communication module 452, for reaching other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 include: Bluetooth, Wireless Compatibility Authentication (WiFi), and Universal Serial Bus (USB);

[0073] In some embodiments, the artificial intelligence-based object classification device provided in the embodiments of the present application can be implemented in software. Figure 2 The object classification device 455 based on artificial intelligence stored in the memory 450 is shown, which can be software in the form of programs and plug-ins, etc., including the following software modules: extraction module 4551, prediction module 4552, fusion module 4553, classification module 4554, these modules are logical, so according to the functions implemented, they can be arbitrarily combined or further split. The functions of each module will be explained below.

[0074] In other embodiments, the artificial intelligence-based object classification device provided in the embodiments of the present application can be implemented in hardware. As an example, the artificial intelligence-based object classification device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the artificial intelligence-based object classification method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs) or other electronic components.

[0075] The object classification method based on artificial intelligence provided in the embodiment of the present application can be implemented by various types of electronic devices. Figure 3 , Figure 3 is an optional flow chart of an object classification method based on artificial intelligence provided in an embodiment of the present application, which will be combined with Figure 3 The steps shown are explained.

[0076] In step 101, a first feature sequence is extracted from behavioral data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to a plurality of historical time nodes.

[0077] For example, in an online game application, the sample object may be a game player, and the behavior data of the sample object may be various game operation data triggered by the game player during the game process.

[0078] For example, the first feature sequence of sample object A, the first feature sequence of sample object B, and the first feature sequence of sample object C are respectively extracted from the behavior data of sample object A, sample object B, and sample object C. The first feature sequence of sample object A includes multi-dimensional features corresponding to multiple historical time nodes of sample object A, the first feature sequence of sample object B includes multi-dimensional features corresponding to multiple historical time nodes of sample object B, and the first feature sequence of sample object C includes multi-dimensional features corresponding to multiple historical time nodes of sample object C.

[0079] See also Figure 4 , Figure 4 is an optional flow chart of an object classification method based on artificial intelligence provided in an embodiment of the present application. Figure 4 Step 101 shown can be implemented through steps 1011 to 1012 .

[0080] In step 1011, feature data of multiple historical time nodes are extracted from the behavior data of at least one sample object.

[0081] For example, feature data of multiple historical time nodes of sample object A is extracted from the behavior data of sample object A. Similarly, feature data of multiple historical time nodes of sample object B can be extracted from the behavior data of sample object B, and feature data of multiple historical time nodes of sample object C can be extracted from the behavior data of sample object C.

[0082] In some embodiments, the above step 1011 can be implemented in the following ways: based on the atomic dimension indicators of the behavior data, the atomic dimension feature data of multiple historical time nodes are extracted from the behavior data, wherein the atomic dimension indicators are indicators in the behavior data that cannot be further divided; based on the aggregated dimension indicators of the behavior data, the aggregated dimension feature data of multiple historical time nodes are extracted from the behavior data, wherein the aggregated dimension indicators are aggregated from multiple atomic dimension indicators.

[0083] For example, an atomic dimension indicator can be a single data field in an object behavior log, a single data field in a device behavior log, a recharge record, a player consumption record, etc. Atomic dimension feature data can be the specific value of an atomic dimension indicator, such as an object identification value, a game ID value, a user device number information value, a login IP value, a login duration value, an object game duration value on the device, an object level growth value on the device, an object login address value, a device memory value, etc. Aggregate dimension indicators can be divided into object-angle aggregate dimension indicators and device-angle aggregate dimension indicators. Aggregate dimension indicators can be aggregated from multiple atomic dimension indicators.

[0084] In this way, based on the atomic dimension indicators and aggregate dimension indicators of the behavioral data, feature data of multiple historical time nodes are extracted from the behavioral data, so that the extracted feature data can better reflect the characteristics of different dimensions of the object, providing a reliable data source for the subsequent prediction processing of time series models and neural network models.

[0085] In step 1012, data above a fluctuation degree threshold is selected from the feature data of multiple historical time nodes, and the selected data above the fluctuation degree threshold is sorted in chronological order to obtain a first feature sequence.

[0086] The fluctuation degree threshold may be pre-set or predicted by calling a neural network model based on a large amount of sample data.

[0087] For example, data above the fluctuation degree threshold are selected from the feature data of multiple historical time nodes of sample object A, the feature data of multiple historical time nodes of sample object B, and the feature data of multiple historical time nodes of sample object C, and the selected data above the fluctuation degree threshold of sample object A, sample object B, and sample object C are sorted in chronological order to obtain the first feature sequences of sample object A, sample object B, and sample object C accordingly.

[0088] The statistics for measuring the degree of fluctuation may include mean deviation, range, variance, etc. The degree of fluctuation of the characteristic data of multiple historical nodes may be characterized based on the mean deviation, range, and variance of the characteristic data of multiple historical nodes.

[0089] In step 102, a time series model and a neural network model are respectively called to perform time series prediction processing based on the first feature sequence to obtain a second feature sequence, a third feature sequence and a first time series error.

[0090] For example, a time series can be a sequence of data that is ordered in chronological order, changes over time, and is interrelated. According to the statistical characteristics of time series, time series can be divided into stationary time series and non-stationary time series. A stationary time series refers to a time series in which the mean and variance of all sequence values ​​of the time series do not change systematically, and a non-stationary time series refers to a time series in which the mean or variance of all sequence values ​​of the time series changes over time.

[0091] See also Figure 4 , Figure 4 is an optional flow chart of an object classification method based on artificial intelligence provided in an embodiment of the present application. Figure 4 Step 102 shown can be implemented through steps 1021 to 1024 .

[0092] In step 1021, a time series model is called based on the first feature sequence to perform time series prediction processing to obtain a second feature sequence and a fourth feature sequence.

[0093] The second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence. The granularity of the time node division can be "minutes", "hours", "days", etc.

[0094] For example, taking the division granularity of the time node as "day", the starting time node of the first feature sequence is August 31, 2020, and the ending time node is July 30, 2021. The starting time node of the second feature sequence can be August 1, 2021, and the ending time node can be September 30, 2021; the starting time node of the fourth feature sequence can be September 3, 2020, and the ending time node can be July 30, 2021.

[0095] In step 1022, a second time series error between the first feature sequence and the fourth feature sequence is determined.

[0096] The second time series error may be a characteristic difference value within a common time period of the first characteristic sequence and the fourth characteristic sequence.

[0097] For example, the starting time node of the first feature sequence is August 31, 2020, and the ending time node is July 30, 2021. The starting time node of the fourth feature sequence may be September 3, 2020, and the ending time node may be July 30, 2021. Then, the feature difference between the first feature sequence and the fourth feature sequence in the time period from September 3, 2020 to July 30, 2021 may be determined, and the feature difference may be determined as the second time series error.

[0098] In step 1023, a neural network model is called to perform time series prediction processing based on the second feature sequence to obtain a third feature sequence.

[0099] The third feature sequence includes the same multiple future time nodes as the second feature sequence.

[0100] For example, the start time node of the second feature sequence may be August 1, 2021, and the end time node may be September 30, 2021. Then the start time node of the third feature sequence may be August 1, 2021, and the end time node may be September 30, 2021. That is, the third feature sequence and the second feature sequence include multiple future time nodes in the same future time period from August 1, 2021 to September 30, 2021.

[0101] In step 1024, a neural network model is called to perform time series prediction processing based on the second time series error to obtain a first time series error.

[0102] As an example, see Figure 8 , Figure 8 1 is a schematic diagram of the principle of the object classification method based on artificial intelligence provided in an embodiment of the present application. Based on the first feature sequence 120, the time series model 121 is called to perform time series prediction processing to obtain a second feature sequence 124 and a fourth feature sequence 122. The second time series error 123 between the first feature sequence 120 and the fourth feature sequence 122 is determined. Based on the second feature sequence 124, the neural network model 125 is called to perform time series prediction processing to obtain a third feature sequence 128. Based on the second time series error 123, the neural network model 126 is called to perform time series prediction processing to obtain a first time series error 127, which is also called a residual or a residual sequence.

[0103] In this way, by calling the time series model, the first feature sequence is subjected to preliminary time series prediction processing, and the second feature sequence and the fourth feature sequence are obtained, wherein the second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence. By calling the neural network model twice, the second feature sequence and the second time series error are subjected to time series prediction processing, and the third feature sequence and the first time series error are obtained respectively. In this way, by calling the time series model and the neural network model, the time series prediction processing is performed three times, which effectively improves the accuracy of time series prediction.

[0104] In step 103, the first time series error, the second feature sequence and the third feature sequence are fused to obtain a classification threshold.

[0105] See also Figure 4 , Figure 4 is an optional flow chart of an object classification method based on artificial intelligence provided in an embodiment of the present application. Figure 4 The illustrated step 103 can be implemented through steps 1031 to 1033 .

[0106] In step 1031, weighted averaging is performed on the second feature sequence and the third feature sequence to obtain a fifth feature sequence.

[0107] The weighted average processing of the second feature sequence and the third feature sequence may be to perform weighted average processing on the multidimensional features corresponding to the multiple time nodes included in the second feature sequence and the multidimensional features corresponding to the multiple time nodes included in the third feature sequence according to the corresponding relationship of the time nodes, obtain the weighted average processing numerical result corresponding to each time node, and arrange the weighted average processing numerical results corresponding to each time node in chronological order to obtain the fifth feature sequence. For example, the second feature sequence is {1,2,3,4}, and the third feature sequence is {5,6,7,8}. After the weighted average processing of the second feature sequence and the third feature sequence is performed, the fifth feature sequence obtained is {3,4,5,6}.

[0108] For another example, the start time node of the second feature sequence may be August 1, 2021, and the end time node may be September 30, 2021. The start time node of the third feature sequence is August 1, 2021, and the end time node is September 30, 2021. Then the start time node of the fifth feature sequence may be August 1, 2021, and the end time node may be September 30, 2021.

[0109] In step 1032, the fifth characteristic sequence and the first time series error are summed to obtain a sixth characteristic sequence.

[0110] The fifth feature sequence and the first time series error are summed, and the multi-dimensional features corresponding to the multiple time nodes included in the fifth feature sequence are summed with the first time series errors corresponding to the multiple time nodes to obtain the summed numerical results corresponding to each time node, and the summed numerical results corresponding to each time node are arranged in chronological order to obtain the sixth feature sequence. For example, the fifth feature sequence is {1,2,3,4}, the first time error is {1,1,1,1}, and the sixth feature sequence is {2,3,4,5}.

[0111] In step 1033, the sixth feature sequence is normalized to obtain a classification threshold.

[0112] For example, the multidimensional features corresponding to multiple time nodes in the sixth feature sequence are normalized to obtain a classification threshold, wherein the classification threshold is used to characterize the normalization rule of the multidimensional features corresponding to multiple time nodes in the sixth feature sequence.

[0113] As an example, see Figure 8, perform weighted averaging on the second feature sequence 124 and the third feature sequence 128 to obtain a fifth feature sequence, perform summation on the fifth feature sequence and the first time series error 127 to obtain a sixth feature sequence, perform normalization on the sixth feature sequence to obtain a classification threshold 129.

[0114] For example, the multi-dimensional features corresponding to the multiple time nodes included in the fifth feature sequence and the first time series errors corresponding to the multiple time nodes are summed up to obtain the summed processing numerical results corresponding to each time node, and the summed processing numerical results corresponding to each time node are arranged in chronological order to obtain the sixth feature sequence.

[0115] In this way, by performing weighted averaging processing on the second feature sequence and the third feature sequence, summing the fifth feature sequence and the first time series error, and normalizing the sixth feature sequence, the classification threshold is obtained, thereby effectively improving the accuracy of the classification threshold.

[0116] In step 104, the behavior data of the object to be identified is classified based on the classification threshold to obtain the category of the object to be identified.

[0117] See also Figure 4 , Figure 4 Step 104 shown can be implemented through steps 1041 to 1042 .

[0118] In step 1041, when the behavior data of the object to be identified is greater than the classification threshold, the category of the object to be identified is determined to be an abnormal type.

[0119] For example, the classification threshold can be used as a critical behavior data value for determining whether the behavior of a sample object is abnormal. When the behavior data of the object to be identified is greater than the critical behavior data value for determining whether the behavior of the sample object is abnormal, the category of the object to be identified is determined to be an abnormal type.

[0120] In step 1042, when the behavior data of the object to be identified is less than or equal to the classification threshold, it is determined that the category of the object to be identified is a normal type.

[0121] For example, when the behavior data of the object to be identified is less than or equal to the critical behavior data value of whether the behavior of the sample object is abnormal, the category of the object to be identified is determined to be a normal type.

[0122] In some embodiments, in step 104, the behavioral data of the object to be identified is classified based on the classification threshold, and after the category of the object to be identified is obtained, the following processing is performed: when the category of the object to be identified is an abnormal type, the business request of the object to be identified is intercepted; when the category of the object to be identified is a normal type, the business request of the object to be identified is responded to.

[0123] In this way, according to whether the object to be identified is of abnormal type / normal type, the business request of the object to be identified is further intercepted or responded to, thereby ensuring that the business request of the abnormal type of object to be identified is intercepted to prevent the abnormal type of object to be identified from affecting normal business operations.

[0124] See also Figure 5 , Figure 5 This is an optional flow chart of the artificial intelligence-based object classification method provided in an embodiment of the present application. In step 104, the behavior data of the object to be identified is classified based on the classification threshold. After the category of the object to be identified is obtained, steps 105 to 107 are executed.

[0125] In step 105, clustering is performed on the behavior data of at least one sample object to obtain a sample object set to which each sample object belongs.

[0126] For example, clustering is performed on the behavior data of sample object A, the behavior data of sample object B, and the behavior data of sample object C to obtain sample object set 1 to which sample object A belongs, sample object set 2 to which sample object B belongs, and sample object set 3 to which sample object C belongs.

[0127] See also Figure 6 , Figure 6 is an optional flow chart of an object classification method based on artificial intelligence provided in an embodiment of the present application. Figure 6 The illustrated step 105 can be implemented through steps 1051 to 1053. The following steps 1051 to 1053 can be performed for any sample object.

[0128] In step 1051, the first sample object set to which any sample object belongs is determined according to the behavior data of any sample object.

[0129] The distance between a sample object in the first sample object set and any sample object is less than the radius parameter. For example, the value range of the first sample object set is a circle with a sample object in the first sample object set as the center and the radius parameter as the radius. Therefore, the distance between any two sample objects in the first sample object set is less than the radius parameter.

[0130] In step 1052, according to each sample object in the first sample object set and the radius parameter, a second sample object set within the radius parameter range of each sample object in the first sample object set is determined.

[0131] The number of the second sample object set is the same as the number of sample objects in the first sample object set.

[0132] For example, each sample object in the first sample object set is taken as the center of the circle and the radius parameter is taken as the radius, and a second sample object set within the radius parameter range of each sample object in the first sample object set is determined.

[0133] For another example, assuming that the sample objects in the first sample object set are sample object D, sample object E, and sample object F, then with sample object D, sample object E, and sample object F as the center of the circle, and with the radius parameter as the radius, determine the second sample object set within the radius parameter range of sample object D, the second sample object set within the radius parameter range of sample object E, and the second sample object set within the radius parameter range of sample object F. It can be understood that the number of the second sample object set is 3, and the number of sample objects in the first sample object set is 3, that is, the number of the second sample object set is the same as the number of sample objects in the first sample object set.

[0134] In step 1053, when the number of sample objects in the second sample object set is less than the domain density threshold, sample objects in the first sample object set and sample objects in the second sample object set are selected to obtain the sample object set to which any sample object belongs.

[0135] For example, if the domain density threshold is 5 and the number of sample objects in the second sample object set is 4, that is, the number of sample objects in the second sample object set is less than the domain density threshold, then the sample objects in the first sample object set and the sample objects in the second sample object set are selected to obtain the sample object set to which any sample object belongs.

[0136] For another example, the selection processing method may be to record the overlapping sample objects in the first sample object set and the second sample object set as one sample object, select the sample objects in the second sample object set, and filter out the boundary sample objects in the second sample object set.

[0137] In step 106, the set of sample objects to which the object to be identified belongs is determined based on the difference between the behavior data of the object to be identified and the behavior data of each sample object.

[0138] For example, by determining the difference value between the behavior data of the object to be identified and the behavior data of each sample object, the sample object with the smallest difference value with the sample object to be identified is taken as the sample object with the most similar behavior to the sample object to be identified, and the sample object set to which the sample object with the smallest difference value with the sample object to be identified belongs is determined as the sample object set to which the object to be identified belongs.

[0139] In step 107, the category of the sample objects in the sample object set to which the object to be identified belongs is determined as a similar category of the object to be identified.

[0140] For example, if the category of the object to be identified is an abnormal category, the categories of the sample objects in the sample object set to which the object to be identified belongs are determined to be similar abnormal categories.

[0141] In this way, after obtaining the category of the object to be identified, by determining the sample object set to which the object to be identified belongs, the sample objects in the sample object set to which the object to be identified belongs are determined as objects of similar category to the object to be identified. If the object to be identified is an abnormal object, the sample objects in the sample object set to which the object to be identified belongs are determined as objects of similar category to the object to be identified, i.e., potential abnormal objects. Thus, while ensuring the accuracy of identifying abnormal objects, the breadth of identifying abnormal objects is achieved. Thus, all abnormal objects can be identified without omission.

[0142] See also Figure 7 , Figure 7 This is an optional flow chart of the artificial intelligence-based object classification method provided in an embodiment of the present application. Before step 101, a time series model is trained by executing steps 108 to 110.

[0143] In step 108, data stabilization is performed on the first feature sequence to obtain a stabilized first feature sequence.

[0144] Since the law of large numbers and the central theorem require samples to be identically distributed, that is, the stationarity of the sequence is required, and the training of the time series model is based on the premise of the law of large numbers and the central theorem, it is first necessary to perform data stationarization on the first feature sequence to obtain a stationary first feature sequence for the subsequent training of the time series model.

[0145] Among them, data stabilization processing can convert non-stationary data into stable data.

[0146] In step 109, a target time series model to be trained is determined from a plurality of candidate time series models according to the statistical characteristics of the stabilized first feature sequence, wherein the plurality of candidate time series models include an autoregressive model, a moving average model and an autoregressive moving average model.

[0147] For example, the statistical characteristics of the stabilized first feature sequence may be an autocorrelation function and a partial autocorrelation function of the stabilized first feature sequence. According to the autocorrelation function and the partial autocorrelation function of the stabilized first feature sequence, a target time series model to be trained may be determined from a plurality of candidate time series models.

[0148] For example, the relationship between the autocorrelation function / partial autocorrelation function and the candidate time series model is shown in Table 1 below.

[0149] Table 1 Relationship between autocorrelation function / partial autocorrelation function and candidate time series models

[0150]

[0151] In step 110, the target time series model is subjected to order determination and parameter estimation processing to obtain a time series model for time series prediction processing.

[0152] In some embodiments, the above step 110 can be implemented in the following ways: performing order determination processing on the target time series model to obtain the starting prediction time node of the target time series model, wherein the starting prediction time node is the starting time node of the fourth feature sequence; performing parameter estimation operation on the target time series model to obtain the prediction parameters of the target time series model; and determining the time series model used for time series prediction processing based on the starting prediction time node of the target time series model and the prediction parameters of the target time series model.

[0153] In this way, by screening the feature data of multiple historical time nodes of the sample object according to the fluctuation degree threshold, the feature data with higher value is retained and the feature data with lower value is screened out. The feature data of each time node in the obtained first feature sequence is typical and representative. Since the amount of data in the first feature sequence after screening is greatly reduced but the amount of information is not affected, the algorithm running time is effectively shortened and the algorithm running efficiency is significantly improved.

[0154] The following is an explanation of an exemplary application of the embodiment of the present application in an application scenario of an online game.

[0155] In the application scenario of online games, game players initiate business requests in the game APP, such as game recharge, game coin purchase, etc. The online game background determines whether the game player's behavior is abnormal. If the game player's behavior is abnormal, the online game background can prohibit the business request initiated by the game player.

[0156] In an online game application scenario, see Fig. 9 , Fig. 9 It is a schematic diagram of the system background structure and logical flow of the artificial intelligence-based object classification method provided in the embodiment of the present application.

[0157] Taking the system background of implementing the object classification method based on artificial intelligence in the server as an example, the system background of the object classification method based on artificial intelligence can be composed of a background logic module and a data processing / cache support module, wherein the data processing / cache support module can include a data collection part and an artificial intelligence model part. The data collection part can report data such as the daily behavior of game players in the game to the data channel, and call the artificial intelligence model part for verification of the data in the data channel. After classifying the game players, only the normal game players in the classification results can initiate business requests, which can be used for payment, receiving rewards, etc.

[0158] The backend logic module is used for daily management and maintenance of the system backend based on the artificial intelligence object classification method. The backend administrator can log in to the backend management interface through the unified authentication login module. The backend management interface displays the data interface module, risk control strategy module, operation log module, blacklist and whitelist module, and interception details module.

[0159] The data interface module is used to switch the display content in the background management interface to display the initialization query conditions and the policy preview data download in response to a click operation on the data interface module. The initialization query conditions are used to display the abnormal activity warning data details and the abnormal warning policy effect details in the background management interface in response to a click operation on displaying the initialization query conditions. Among them, the abnormal activity warning data details are used to display the abnormal activity warning data, and the abnormal warning policy effect details are used to display the abnormal warning policy effect. The policy preview data download is used to download the policy preview data to the background local in response to a click operation on the policy preview data download.

[0160] The risk control strategy module is used to switch the display content in the background management interface to display the existing configuration of the game strategy in response to a click operation on the risk control strategy module. The existing configuration of the game strategy is used to display the preview of the warning strategy effect downloaded by the strategy preview data download in the background management interface or to change the warning configuration strategy configuration in the background management interface in response to a selection operation on the existing configuration of the game strategy.

[0161] The operation log module is used to respond to a click operation on the operation log module and display the full record and query of the relevant operation log in the background management interface. The full record and query of the relevant operation log are used to query and display the records of the relevant operation log.

[0162] The black and white list module is used to respond to a click operation on the black and white list module and display the initialization query conditions in the background management interface. The initialization query conditions are used to respond to the query operation on the initialization query conditions and display the viewing of relevant list data and the modification of black and white list data in the background management interface. Viewing relevant list data is used to display the relevant black and white list data that meets the query conditions in the background management interface. The black and white list data modification is used to respond to the modification operation, modify the black and white list data in the background management interface and display the modified black and white list data in the background management module.

[0163] The interception detail module is used to respond to a click operation on the interception detail module and display the initialization query conditions in the background management interface. The initialization query conditions are used to display the relevant account / device details and the relevant account / device alarms in the background management interface. The relevant account / device details are used to respond to a click operation on the relevant account / device details and display the detailed information of the intercepted relevant account / device details in the background management interface. The relevant account / device alarm is used to respond to a click operation on the relevant account / device alarm and display the relevant information of the intercepted relevant account / device alarm in the background management interface.

[0164] The data processing / cache support module is used to respond to a click operation on the data processing / cache support module, detect the payment behavior of the game player to be detected through the payment behavior detection module, and after the payment behavior is detected, verify the payment order initiated by the game player to be detected through the order information verification module. After verifying the payment order behavior, query whether the game player to be detected is in the black and white list library through the black and white list query module, and send the query result to the necessary condition determination module. The necessary condition determination module is used to obtain the judgment result. If the game player to be detected is in the white list library, the necessary conditions are met. The background model selection configuration module is used to configure and train the parameters of the time series model and the neural network model, and send the configured time series model and neural network model to the model screening module. A model screening module is used to extract a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to multiple historical time nodes; based on the first feature sequence, the time series model and the neural network model are respectively called to perform time series prediction processing to obtain a second feature sequence, a third feature sequence and a first time series error; the first time series error, the second feature sequence and the third feature sequence are fused to obtain a classification threshold; based on the classification threshold, the behavior data of the object to be identified is classified to obtain the category of the object to be identified. If the category of the object to be identified is an abnormal category, an abnormal warning module is used to issue an abnormal warning to the object to be identified, and the relevant account / device details and relevant account / device alarm information of the object to be identified are fed back to the initialization query condition for storage. If the category of the object to be identified is a normal category, the success determination module determines that the object to be identified has passed the payment behavior verification.

[0165] See also Fig.14 , Fig.14 It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided by the embodiment of the present application. The neural network model is a multi-layer feedforward neural network trained according to the error back propagation algorithm, and is the most widely used neural network. The neural network model has the ability to classify arbitrarily complex patterns and excellent multi-dimensional function mapping capabilities, solving the XOR problem that simple perceptrons cannot solve. Structurally, the neural network model has an input layer, a hidden layer, and an output layer; in essence, the neural network model uses the square of the network error as the objective function and uses the gradient descent method to calculate the minimum value of the objective function.

[0166] The embodiment of the present application extracts a first feature sequence from the behavioral data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to multiple historical time nodes. Among them, the multi-dimensional features may include atomic dimensional feature indicators and atomic aggregate dimensional feature indicators. Below, taking the application scenario of online games as an example, the atomic dimensional feature indicators and atomic aggregate dimensional feature indicators are explained in combination with the following Tables 2 and 3.

[0167] Table 2 Atomic dimension characteristic indicators

[0168]

[0169] Table 3 Atomic aggregation dimension characteristic indicators

[0170]

[0171]

[0172] See also Fig.10 , Fig.10 It is a schematic diagram of the architecture of the abnormal activity warning system provided in an embodiment of the present application.

[0173] In step 310, in-game behaviors such as active behaviors of players on the game side are reported to the data cluster.

[0174] In step 311, each data in the data cluster is detected, and special feature engineering / data cleaning is performed periodically.

[0175] The clustering model 31 is called based on the cleaned data to obtain the user active behavior trend.

[0176] In step 312, preventive intervention is performed on users with abnormal user activity behavior trends, such as publishing announcements, emails, etc.

[0177] Based on the cleaned data, the time series + neural network binary classification composite model 32 (ie, the time series model and neural network model mentioned above) is called to obtain the prediction result.

[0178] In step 313, the time series + neural network binary classification composite model threshold is determined and cached.

[0179] The prediction result is compared with the cached binary classification model threshold to obtain the judgment result. The management backend is used for data display, policy activation / deactivation, user unblocking, administrator selection of model version, etc. The management backend is also used to store configuration information in the DB database, and can extract and display stored information from the DB database.

[0180] If the classification result obtained by the time series + neural network binary classification composite model 32 is abnormal, the abnormal activity can be judged through the reward and recharge interface 33 to complete the status judgment of the user's order, and players with abnormal behavior are prohibited from completing related rewards and obtaining in-game props.

[0181] The overall abnormal activity warning system is as follows Fig. 9 As shown, combined with the data detected in the data cluster, periodic feature detection and data cleaning are performed for data analysis. First, feature analysis and feature selection are performed on the data. Secondly, the filtered data is predicted by the time series + neural network binary classification composite model. The predicted results are cached and the corresponding strategies are enabled. On the other hand, cluster analysis is performed on this batch of data to obtain users who are not on the blacklist (but have very similar behaviors) and preventive intervention is carried out on these users. The results of each step of the entire process are stored in the database.

[0182] The role of feature selection is to retain features that are helpful to the artificial intelligence-based object classification method, and filter out features that are of no help to the artificial intelligence-based object classification method and will not bring any improvement to the artificial intelligence-based object classification method.

[0183] Feature selection in the prior art mainly selects a single feature through a single chi-square test, information gain method, etc., but in this application, since a large number of feature logics are required for combination, the selection of a single feature cannot meet the demand (too many combined logical features). Therefore, the embodiment of the present application recursively combines features on the basis of single feature selection (i.e., all features are arranged, combined and paired), and the selection of subsets is regarded as a search and optimization problem, generating different combinations, evaluating the combinations, and then comparing them with other combinations. In this way, the selection of subsets is regarded as an optimization problem. On this basis, a heuristic optimization particle swarm algorithm is used to select the optimal feature subset for a specific classifier, and the algorithm is subsequently applied to the features / combined features with the best calculated information gain.

[0184] See also Fig.11 , Fig.11 is a flowchart of the particle swarm optimization algorithm provided in the embodiment of the present application. Fig.11 The optimized particle swarm algorithm shown can optimize the feature selection described above. First, initialize the particle swarm and parameter settings. Then set T = 1, further calculate the objective function value, and update the individual optimal value Pbest and the group optimal value Gbest. Then determine whether the convergence criterion is met. If the convergence criterion is met, output the optimal result and the number of iterations; if the convergence criterion is not met, update the position vector and velocity vector of each particle, set T = T + 1, and return to calculate the objective function value.

[0185] The original data (multi-dimensional feature data) is used as input for feature selection. First, the information gain method is used to screen each single feature. On this basis, all prominent features are recursively arranged and combined. All the results of the arrangement and combination are paired and the library function of the function library is called. The arranged and combined features are used as x input, and the learning factors c1, c2 and other parameters are initialized. The objective function values ​​of all the arranged and combined features are calculated and the optimal results are obtained. Then, useful features are screened and useless features are eliminated, which improves the subsequent operation efficiency of the algorithm and avoids useless features occupying the algorithm running time.

[0186] The selected features are cached and recorded, and feature selection operations are performed before each algorithm operation to obtain corresponding feature resets to prevent the business strategy from being figured out. The advantage of calling the optimized particle swarm algorithm lies in the computational advantages and feature complexity advantages for massive features.

[0187] See also Fig.12 , Fig.12 It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided by the embodiment of the present application. The main purpose of the design of the time series + neural network binary classification composite model is to combine the data after feature selection with the logical judgment index to perform binary classification to determine which users are abnormal users. The implementation method is to apply the time series model to predict the data after feature selection, and compare the obtained predicted value (i.e., the fourth feature sequence described above) with the actual value (i.e., the first feature sequence described above). The obtained sequence is subjected to data stabilization processing, and then the residual sequence (i.e., the second time series error described above) is standardized as input, and the parameters are adjusted according to the method in the previous step. After learning and neural network modeling, the obtained error data set is predicted to obtain the predicted value of the residual sequence (i.e., the first time series error described above), so as to further combine and calculate to obtain the predicted value (i.e., the classification threshold described above).

[0188] First, the time series model is used to perform linear analysis and prediction on the data after feature selection, which actually reflects the linear change law of the feature sequence (with seasons, time, etc.), and then the neural network model is used to predict the actual value error of the time series model (reflecting the nonlinear change law of the data) to obtain the composite model error, and a prediction value is made for the error (compound model error, i.e. the first time series error mentioned above), so that the subsequent test data can be combined with the error on the basis of the time series model to obtain a more objective prediction value, and obtain the composite model prediction result (i.e. the classification threshold mentioned above). Then, the neural network nonlinear prediction analysis is used on the basis of the linear data change law to improve the prediction accuracy.

[0189] See also Fig.13 , Fig.13It is a schematic diagram of the principle of the object classification method based on artificial intelligence provided in the embodiment of the present application. The time series model can be trained in the following ways: stationary non-white noise sequence, calculation of sample correlation coefficient, model identification, parameter estimation, model testing, and if the model test is qualified, the model is optimized to obtain the time series model, and then the sequence is predicted.

[0190] Among them, the stationary non-white noise sequence is obtained after the non-stationary sequence is stabilized; the calculated sample correlation coefficient is obtained by correlation calculation of the stationary non-white noise sequence; model identification can identify the type of time series model, such as autoregressive model, moving average model and autoregressive moving average model; parameter estimation is to estimate the parameters of the time series model; model testing can test whether the determined model type is qualified.

[0191] In order to objectively reflect the prediction effect of the time series + neural network binary classification composite model, the root mean square error (RMSE) and mean absolute percent error (MAPE) of the time series + neural network binary classification composite model can be used to compare the effect. Taking the game marketing activity as an example, the historical data of the game marketing activity is generally divided into 500 time nodes, the data of the first 400 time nodes are used as training data, and the data of the last 100 time nodes are used as test data for training. First, the time series model is serialized and predicted for the data of the first 400 data nodes to obtain the model arima (2,2,4), and then the actual values ​​of the data of the first 400 data nodes are compared to obtain the residual corresponding to the data of the first 400 data nodes. The data of the first 400 data nodes are used as the input neural network model and the parameters are saved. Finally, the prediction effect of the test data is compared. The comparison of the two indicators of the single model and the time series model and neural network composite model is shown in Table 4 below.

[0192] Table 4 Comparison of the two indicators of the single model, time series model and neural network composite model

[0193]

[0194] From Table 4 above, we can see that the RMSE and MAPE values ​​predicted by the time series + neural network binary classification composite model are significantly smaller than those of the other two single prediction models. Therefore, the prediction accuracy of the time series + neural network binary classification composite model is higher than that of the single time series model and the single neural network model to a certain extent, and the prediction error of the time series + neural network binary classification composite model is much lower. This comparison result shows that the time series + neural network binary classification composite model takes advantage of the linear trend prediction of the time prediction model and the nonlinear trend prediction of the neural network model, complements the advantages of the two models, overcomes the defects of the two models to a certain extent, and reflects the law of data change.

[0195] The embodiment of the present application defines a minimum density reach number (i.e., defines a group of people who are about to become abnormal users similar to a determined abnormal user to be detected) through a business strategy, stops calculating and returns to aggregate into several clusters when the number of points within the reachable density range of the statistical center point reaches the defined minimum density reach number, and uses the data set of each cluster as a new input, and then iterates and aggregates to find the position of the centroid. For example, set the number of users that an abnormal user can reach with the lowest density to 5, and perform 20 rounds of iterative algorithm operations. In each round of iteration, first randomly define a certain number of random points, take each random point as the center of the circle, and continuously add users to the cluster with the minimum number of users reached as the condition. Once the minimum number of users is reached, this value is the density value of the point. If there is a high-density point in the circle of another high-density point, connect the two points, so that many points can be continuously connected in series. Afterwards, if there is a low-density point also in the circle of high-density points, connect it to the nearest high-density point, which is called a boundary point. In this way, all points that can be connected together form a cluster, and low-density points that are not in the circle of any high-density points are abnormal points. According to the above parameters, for each abnormal behavior user calculated, five abnormal behavior users with similar behaviors will be found (reflected in activeness and login, and represented as a class in the clustering algorithm). After later and business testing, it was confirmed that the warning success rate is above 75%, that is, 75% of the clustered users (after being prompted) will not continue to trigger the high-voltage line of abnormal behavior.

[0196] The following is a description of an exemplary structure of an artificial intelligence-based object classification device 455 provided in an embodiment of the present application implemented as a software module. In some embodiments, Figure 2As shown, the software modules in the artificial intelligence-based object classification device 455 stored in the memory 440 may include: an extraction module 4551, which is used to extract a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to multiple historical time nodes; a prediction module 4552, which is used to call the time series model and the neural network model respectively based on the first feature sequence to perform time series prediction processing to obtain a second feature sequence, a third feature sequence and a first time series error; a fusion module 4553, which is used to fuse the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold; a classification module 4554, which is used to classify the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified.

[0197] In some embodiments, the prediction module 4552 is also used to call the time series model to perform time series prediction processing based on the first feature sequence to obtain a second feature sequence and a fourth feature sequence, wherein the second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence; determine the second time series error between the first feature sequence and the fourth feature sequence; call the neural network model to perform time series prediction processing based on the second feature sequence to obtain a third feature sequence, wherein the third feature sequence and the second feature sequence include the same multiple future time nodes; call the neural network model to perform time series prediction processing based on the second time series error to obtain the first time series error.

[0198] In some embodiments, the fusion module 4553 is also used to perform weighted averaging processing on the second feature sequence and the third feature sequence to obtain a fifth feature sequence; sum the fifth feature sequence and the first time series error to obtain a sixth feature sequence; and normalize the sixth feature sequence to obtain a classification threshold.

[0199] In some embodiments, the extraction module 4551 is also used to extract feature data of multiple historical time nodes from the behavioral data of at least one sample object; select data above the fluctuation degree threshold from the feature data of multiple historical time nodes, and sort the selected data above the fluctuation degree threshold in chronological order to obtain a first feature sequence.

[0200] In some embodiments, the extraction module 4551 is also used to extract atomic dimension feature data of multiple historical time nodes from the behavior data based on the atomic dimension indicators of the behavior data, wherein the atomic dimension indicators are indicators in the behavior data that cannot be further divided; and to extract aggregated dimension feature data of multiple historical time nodes from the behavior data based on the aggregated dimension indicators of the behavior data, wherein the aggregated dimension indicators are aggregated from multiple atomic dimension indicators.

[0201] In some embodiments, the artificial intelligence-based object classification device also includes: a first classification module, which is used to cluster the behavior data of at least one sample object to obtain a sample object set to which each sample object belongs; determine the sample object set to which the object to be identified belongs based on the difference value between the behavior data of the object to be identified and the behavior data of each sample object; and determine the category of the sample object in the sample object set to which the object to be identified belongs as a similar category of the object to be identified.

[0202] In some embodiments, the classification module 4554 is also used to perform the following processing on any sample object: determine a first sample object set to which any sample object belongs based on the behavior data of any sample object, wherein the distance between the sample objects in the first sample object set and any sample object is less than a radius parameter; determine a second sample object set within the radius parameter range of each sample object in the first sample object set based on each sample object and the radius parameter in the first sample object set, wherein the number of sample objects in the second sample object set is the same as the number of sample objects in the first sample object set; when the number of sample objects in the second sample object set is less than a domain density threshold, select the sample objects in the first sample object set and the sample objects in the second sample object set to obtain the sample object set to which any sample object belongs.

[0203] In some embodiments, the classification module 4554 is also used to determine that the category of the object to be identified is an abnormal type when the behavior data of the object to be identified is greater than the classification threshold; when the behavior data of the object to be identified is less than or equal to the classification threshold, determine that the category of the object to be identified is a normal type.

[0204] In some embodiments, the artificial intelligence-based object classification device also includes: a training module, which is used to train a time series model in the following manner: performing data smoothing processing on the first feature sequence to obtain a smoothed first feature sequence; determining a target time series model to be trained from multiple candidate time series models based on the statistical characteristics of the smoothed first feature sequence, wherein the multiple candidate time series models include an autoregressive model, a moving average model, and an autoregressive moving average model; performing order determination processing and parameter estimation processing on the target time series model to obtain a time series model for time series prediction processing.

[0205] In some embodiments, the training module is also used to perform order determination processing on the target time series model to obtain the starting prediction time node of the target time series model, wherein the starting prediction time node is the starting time node of the fourth feature sequence; perform parameter estimation operation on the target time series model to obtain the prediction parameters of the target time series model; and determine the time series model used for time series prediction processing based on the starting prediction time node of the target time series model and the prediction parameters of the time series model.

[0206] In some embodiments, the artificial intelligence-based object classification device also includes: a judgment module, which is used to intercept the business request of the object to be identified when the category of the object to be identified is an abnormal type; when the category of the object to be identified is a normal type, respond to the business request of the object to be identified.

[0207] The embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned artificial intelligence-based object classification method of the embodiment of the present application.

[0208] An embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein executable instructions are stored. When the executable instructions are executed by a processor, the processor will execute the artificial intelligence-based object classification method provided by the embodiment of the present application.

[0209] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EP ROM, EEPROM, flash memory, magnetic surface storage, optical disk, or CD-ROM; or it may be various devices including one or any combination of the above memories.

[0210] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0211] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file storing other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (for example, files storing one or more modules, subroutines, or code portions).

[0212] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0213] In summary, the embodiments of the present application have the following beneficial effects:

[0214] (1) Since the first feature sequence includes multi-dimensional features corresponding to multiple historical time nodes, the first feature sequence can more accurately represent the historical behavior of the object.

[0215] (2) Since the first feature sequence simultaneously calls the time series model and the neural network model for prediction processing, the dual prediction processing makes the prediction more accurate.

[0216] (3) Since the first feature sequence uses the time series model and the neural network model to perform time prediction processing, the first time series error is obtained, and the first time series error is further fused with the predicted second feature sequence and the third feature sequence. The classification threshold obtained by the fusion of the triple prediction results is used to classify the behavior data of the object to be identified, making the classification result more accurate.

[0217] (4) Based on the atomic dimension indicators and aggregate dimension indicators of behavioral data, feature data of multiple historical time nodes are extracted from the behavioral data, so that the extracted feature data can better reflect the characteristics of different dimensions of the object, providing strong data guarantee for the subsequent prediction processing of time series models and neural network models.

[0218] (5) Since the law of large numbers and the central theorem require samples to be identically distributed, that is, the stationarity of the sequence is required, and the training of the time series model is based on the premise of the law of large numbers and the central theorem, it is necessary to first perform data stationarization on the first feature sequence to obtain a stationary first feature sequence for the subsequent training of the time series model.

[0219] (6) By screening the feature data of multiple historical time nodes of the sample object according to the fluctuation threshold, the feature data with higher value is retained and the feature data with lower value is screened out. The feature data of each time node in the obtained first feature sequence is typical and representative. Since the amount of data in the first feature sequence after screening is greatly reduced but the amount of information is not affected, the algorithm running time is effectively shortened and the algorithm running efficiency is significantly improved.

[0220] (7) By calling the time series model, a preliminary time series prediction process is performed on the first feature sequence, and a second feature sequence including multi-dimensional features corresponding to multiple future time nodes after the first feature sequence and a fourth feature sequence including multi-dimensional features corresponding to some historical time nodes of the first feature sequence are obtained. Further, the second feature sequence and the second time series error are processed by calling the neural network model twice to obtain the third feature sequence and the first time series error. In this way, the time series prediction process is performed three times by calling the time series model and the neural network model, which effectively improves the accuracy of time series prediction.

[0221] (8) The classification threshold is obtained by performing weighted averaging processing on the second feature sequence and the third feature sequence, summing the errors of the fifth feature sequence and the first time series, and normalizing the sixth feature sequence, thereby effectively improving the accuracy of the classification threshold.

[0222] (9) After obtaining the category of the object to be identified, by determining the sample object set to which the object to be identified belongs, the sample objects in the sample object set to which the object to be identified belongs are determined as objects of similar category to the object to be identified. If the object to be identified is an abnormal object, the sample objects in the sample object set to which the object to be identified belongs are determined as objects of similar category to the object to be identified, i.e., potential abnormal objects. Thus, while ensuring the accuracy of identifying abnormal objects, the breadth of identifying abnormal objects is achieved. Thus, all abnormal objects can be identified without omission.

[0223] (10) Based on whether the object to be identified is of an abnormal type or a normal type, the business request of the object to be identified is further intercepted or responded to, thereby ensuring that the business request of the abnormal type of the object to be identified is intercepted to prevent the abnormal type of the object to be identified from affecting normal business operations.

[0224] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. An object classification method based on artificial intelligence, characterized in that: The method comprises: Extracting a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to a plurality of historical time nodes respectively; Based on the first feature sequence, a time series model is called to perform time series prediction processing to obtain a second feature sequence and a fourth feature sequence, wherein the second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence; Determining a second time series error between the first feature sequence and the fourth feature sequence; Based on the second feature sequence, a neural network model is called to perform time series prediction processing to obtain a third feature sequence, wherein the third feature sequence and the second feature sequence include the same multiple future time nodes; Based on the second time series error, the neural network model is called to perform time series prediction processing to obtain a first time series error; fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold; The behavior data of the object to be identified is classified based on the classification threshold to obtain the category of the object to be identified.

2. The method according to claim 1, characterized in that The fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold comprises: Performing weighted average processing on the second characteristic sequence and the third characteristic sequence to obtain a fifth characteristic sequence; Summing the fifth characteristic sequence and the first time series error to obtain a sixth characteristic sequence; The sixth feature sequence is normalized to obtain the classification threshold.

3. The method according to claim 1, characterized in that The step of extracting a first feature sequence from the behavior data of at least one sample object comprises: Extracting feature data of multiple historical time nodes from the behavior data of the at least one sample object; Data with a higher level of fluctuation than a threshold value is selected from the feature data of the plurality of historical time nodes, and the selected data with a higher level of fluctuation than the threshold value is sorted in chronological order to obtain the first feature sequence.

4. The method according to claim 3, characterized in that The step of extracting feature data of a plurality of historical time nodes from the behavior data of the at least one sample object comprises: Based on the atomic dimension index of the behavior data, extracting atomic dimension feature data of multiple historical time nodes from the behavior data, wherein the atomic dimension index is an index in the behavior data that cannot be further divided; Based on the aggregated dimensional index of the behavior data, aggregated dimensional feature data of multiple historical time nodes are extracted from the behavior data, wherein the aggregated dimensional index is aggregated by multiple of the atomic dimensional indexes.

5. The method according to claim 1, characterized in that After classifying the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified, the method further includes: Performing clustering processing on the behavior data of the at least one sample object to obtain a sample object set to which each sample object belongs; Determining the set of sample objects to which the object to be identified belongs according to a difference value between the behavior data of the object to be identified and the behavior data of each of the sample objects; The category of the sample objects in the sample object set to which the object to be identified belongs is determined as a similar category of the object to be identified.

6. The method according to claim 5, characterized in that The clustering process is performed on the behavior data of the at least one sample object to obtain a set of sample objects to which each sample object belongs, including: The following processing is performed for any sample object: determining a first sample object set to which the any sample object belongs according to the behavior data of the any sample object, wherein the distance between the sample objects in the first sample object set and the any sample object is less than a radius parameter; Determine, according to each sample object in the first sample object set and the radius parameter, a second sample object set within the radius parameter range of each sample object in the first sample object set, wherein the number of the second sample object set is the same as the number of the sample objects in the first sample object set; When the number of sample objects in the second sample object set is less than the domain density threshold, sample objects in the first sample object set and sample objects in the second sample object set are selected to obtain the sample object set to which any one sample object belongs.

7. The method according to claim 1, characterized in that The classifying the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified includes: When the behavior data of the object to be identified is greater than the classification threshold, determining that the category of the object to be identified is an abnormal type; When the behavior data of the object to be identified is less than or equal to the classification threshold, it is determined that the category of the object to be identified is a normal type.

8. The method according to claim 1, characterized in that Before respectively calling the time series model and the neural network model based on the first feature sequence to perform time series prediction processing to obtain the second feature sequence, the third feature sequence and the first time series error, the method further includes: The time series model is trained by the following method: Performing data stabilization processing on the first feature sequence to obtain a stabilized first feature sequence; According to the statistical characteristics of the stabilized first feature sequence, determining a target time series model to be trained from a plurality of candidate time series models, wherein the plurality of candidate time series models include an autoregressive model, a moving average model, and an autoregressive moving average model; The target time series model is subjected to order determination and parameter estimation processing to obtain the time series model used for time series prediction processing.

9. An object classification device based on artificial intelligence, characterized in that: include: An extraction module, configured to extract a first feature sequence from the behavior data of at least one sample object, wherein the first feature sequence includes multi-dimensional features corresponding to a plurality of historical time nodes respectively; A prediction module is used to call a time series model to perform time series prediction processing based on the first feature sequence to obtain a second feature sequence and a fourth feature sequence, wherein the second feature sequence includes multi-dimensional features corresponding to multiple future time nodes after the first feature sequence, and the fourth feature sequence includes multi-dimensional features corresponding to some historical time nodes of the first feature sequence; determine a second time series error between the first feature sequence and the fourth feature sequence; call a neural network model to perform time series prediction processing based on the second feature sequence to obtain a third feature sequence, wherein the third feature sequence and the second feature sequence include the same multiple future time nodes; call the neural network model to perform time series prediction processing based on the second time series error to obtain a first time series error; A fusion module, used for fusing the first time series error, the second feature sequence and the third feature sequence to obtain a classification threshold; The classification module is used to classify the behavior data of the object to be identified based on the classification threshold to obtain the category of the object to be identified.

10. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable instructions; A processor, configured to implement the method according to any one of claims 1 to 8 when executing the executable instructions stored in the memory.

11. A computer-readable storage medium storing executable instructions, characterized in that: When the executable instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images