A method, system, device and storage medium for identifying risky users

Abstract

The present application discloses a method for identifying risky users, including: a sequence splicing step: based on the acquired request behavior sequence of the user to be identified, a corresponding request time interval sequence is generated, and the request behavior sequence and the request time interval sequence are spliced ​​to generate a new request behavior sequence; a vector conversion step: converting the new request behavior sequence into a computable vector; an identification step: inputting the computable vector into a risky user identification model to complete the risk identification of the user to be identified. The method of the present invention is a method for identifying risky users by constructing a user's request sequence behavior analysis model through a deep learning method.

Description

Technical Field

[0001] The present application relates to the field of information query, and in particular to a risk user identification method, system, computer device and computer-readable storage medium. Background Art

[0002] With the development of e-commerce platforms in high-speed rail and passenger transport, people's travel has become much more convenient. People buy tickets through various channels such as the 12306 website, mobile client, telephone, and self-service machines, gradually changing the situation in the past where it was difficult to get a ticket. However, the current train and bus operation systems still have the following problems: during holidays, when passenger flow peaks, tickets are still a scarce social resource, and various ticket grabbing systems have emerged, resulting in irrational allocation of resources. At the same time, there are also undesirable phenomena such as ticket scalping and ticket selling.

[0003] During holidays, tickets for popular trains and routes are in short supply, so some passengers will use malicious ticket grabbing. The frequent ticket grabbing systems put tremendous pressure on the regular railway ticketing system, affecting the stable operation of the system. Therefore, in order to maintain a fair, just and stable ticket purchasing environment, it is necessary to identify the ticket purchases of risky users and control them. Risky users will have a series of request behaviors when purchasing tickets, such as logging in, checking remaining tickets, etc., forming an access sequence. The user's request behavior sequence represents the user's operating habits. Analysis of the user's request behavior sequence is also an effective way to mine risky users.

[0004] When traditional methods are used to identify abnormal users, most of them are to establish a certain pattern library. When there is a new user request, its request sequence is matched with the request behavior in the pattern library, so as to realize the discovery of abnormal users. In this user request analysis method, each user request must be matched with the entire pattern library, which is inefficient, and the matching effect is related to the number of abnormal access patterns included in the pattern library. The establishment of the pattern library also requires a certain amount of time to accumulate and the judgment of experts, and the cycle is long. For this reason, the present invention proposes to use deep learning technology to build a risk user identification model.

[0005] The present invention provides a solution for identifying risky users based on the combination of deep learning and behavior sequence. The present invention is a method for identifying risky users by constructing a user request sequence behavior analysis model using a deep learning method. Summary of the invention

[0006] The embodiment of the present application provides a solution to the risk user identification based on the combination of deep learning and behavior sequence. The present invention is a method for identifying risky users by constructing a user request sequence behavior analysis model using a deep learning method.

[0007] In a first aspect, an embodiment of the present application provides a method for identifying risky users, including:

[0008] Sequence splicing step: based on the acquired request behavior sequence of the user to be identified, generate a corresponding request time interval sequence, splice the request behavior sequence and the request time interval sequence to generate a new request behavior sequence;

[0009] Vector conversion step: Based on vector conversion, the new request behavior sequence is converted into a computable vector;

[0010] Identification step: Input the computable vector into the risk user identification model to complete the risk identification of the user to be identified.

[0011] In some embodiments, the risky user identification model includes: a one-dimensional convolution layer, an LSTM layer, and an attention layer.

[0012] In some embodiments, the above-mentioned vector conversion step includes:

[0013] Text conversion step: the new request behavior sequence is indexed and filled as text to generate the request sequence text;

[0014] Embedding conversion step: The request sequence text is converted into a computable vector through the embedding layer.

[0015] In some embodiments, the identifying step includes:

[0016] Feature extraction step: Based on the one-dimensional convolution layer, LSTM layer and attention layer, complete the feature extraction of computable vectors;

[0017] Feature classification step: The computable vector after feature extraction passes through the fully connected layer, and the softmax layer is used to output the classification probability of the user to be identified, generating the final risk score of the user to be identified.

[0018] In some embodiments, the feature extraction step includes:

[0019] One-dimensional convolution step: Use a one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector;

[0020] LSTM step: Use the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector;

[0021] Attention layer step: Use the attention layer to complete the feature extraction of the LSTM vector based on the semantic contribution weighting and output the attention weight vector.

[0022] In a second aspect, an embodiment of the present application provides a risk user identification system, which adopts the risk user identification method as described above, including:

[0023] Sequence splicing module: based on the acquired request behavior sequence of the user to be identified, generates a corresponding request time interval sequence, splices the request behavior sequence and the request time interval sequence to generate a new request behavior sequence;

[0024] Vector conversion module: Based on vector conversion, it converts the new request behavior sequence into a computable vector;

[0025] Identification module: Input the computable vector into the risk user identification model to complete the risk identification of the user to be identified.

[0026] In some embodiments, the risky user identification model includes: a one-dimensional convolution layer, an LSTM layer, and an attention layer.

[0027] In some embodiments, the vector conversion module includes:

[0028] Text conversion module: performs index conversion and filling processing on the new request behavior sequence as text to generate the request sequence text;

[0029] Embedding conversion module: converts the request sequence text into a computable vector through the embedding layer.

[0030] In some embodiments, the identification module includes:

[0031] Feature extraction module: Based on the one-dimensional convolution layer, LSTM layer and attention layer, it completes the feature extraction of computable vectors;

[0032] Feature classification module: The computable vector after feature extraction passes through the fully connected layer, and the softmax layer is used to output the classification probability of the user to be identified, generating the final risk score of the user to be identified.

[0033] In some embodiments, the feature extraction module includes:

[0034] One-dimensional convolution module: uses a one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector;

[0035] LSTM module: uses the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector;

[0036] Attention layer module: The attention layer is used to complete the feature extraction of LSTM vector based on semantic contribution weighting and output the attention weight vector.

[0037] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the risk user identification method of the first aspect described above is implemented.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the risk user identification method as described in the first aspect above.

[0039] Compared with the related prior art, it has the following outstanding beneficial effects:

[0040] 1) The present invention mainly realizes the identification of risky users based on the user request behavior sequence, provides favorable data support for the railway to accurately crack down on the purchase of tickets by risky users, and better protects the ticket purchase rights of passengers;

[0041] 2) The present invention provides a risk user identification method based on deep learning combined with behavior sequence, which mainly solves the problem of risk user identification based on user request sequence using deep learning method;

[0042] 3) The present invention organically combines the user's request behavior sequence and time interval sequence, transforms them into computable vectors using text analysis methods, and constructs a risk user identification model using one-dimensional convolution and LSTM deep learning technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 is a flow chart of the risk user identification method of the present invention;

[0045] Figure 2 This is a structural diagram of the risk user identification model based on one-dimensional convolution and LSTM;

[0046] Figure 3 This is a data change flow chart of an embodiment of the present invention;

[0047] Figure 4 It is a schematic diagram of the risk user identification system of the present invention;

[0048] Figure 5 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0049] In the above picture:

[0050] 100 Risk User Identification System

[0051] 10 sequence splicing module 20 vector conversion module

[0052] 30 Identification Module

[0053] 81. Processor; 82. Memory; 83. Communication interface; 80. Bus. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0055] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0056] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent.

[0057] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0058] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0059] The present invention aims to provide a risk user identification method based on deep learning and behavior sequence, which mainly solves the problem of risk user identification based on user request sequence using deep learning method. The user's request behavior sequence and time interval sequence are organically combined, converted into a computable vector using text analysis method, and a risk user identification model is constructed using one-dimensional convolution and LSTM deep learning technology.

[0060] The method of the present invention first obtains the user's request behavior sequence, generates the corresponding request time interval sequence, combines the two sequences of the user, and then uses the text analysis method and the Embedding method to convert the combined sequence into a computable vector as the input of the model. Finally, a risk user identification model for the request behavior sequence is constructed by using one-dimensional convolution, LSTM and attention layers.

[0061] Figure 1 The risk user identification method of the present invention is as follows: Figure 1 As shown, the method of the present invention provides a method for identifying risky users, comprising:

[0062] Sequence splicing step S10: based on the acquired request behavior sequence of the user to be identified, generate a corresponding request time interval sequence, splice the request behavior sequence and the request time interval sequence to generate a new request behavior sequence;

[0063] Vector conversion step S20: based on vector conversion, convert the new request behavior sequence into a computable vector;

[0064] Identification step S30: inputting the computable vector into the risk user identification model to complete the risk identification of the user to be identified.

[0065] Among them, the risky user identification model includes: one-dimensional convolution layer, LSTM layer and attention layer.

[0066] The vector conversion step S20 includes:

[0067] Text conversion step: the new request behavior sequence is indexed and filled as text to generate the request sequence text;

[0068] Embedding conversion step: The request sequence text is converted into a computable vector through the embedding layer.

[0069] The identification step S30 includes:

[0070] Feature extraction step: Based on the one-dimensional convolution layer, LSTM layer and attention layer, complete the feature extraction of computable vectors;

[0071] Feature classification step: The computable vector after feature extraction passes through the fully connected layer, and the softmax layer is used to output the classification probability of the user to be identified, generating the final risk score of the user to be identified.

[0072] Furthermore, the feature extraction step includes:

[0073] One-dimensional convolution step: Use a one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector;

[0074] LSTM step: Use the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector;

[0075] Attention layer step: Use the attention layer to complete the feature extraction of the LSTM vector based on the semantic contribution weighting and output the attention weight vector.

[0076] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings:

[0077] Figure 2 This is a structural diagram of the risk user identification model based on one-dimensional convolution and LSTM, as shown in Figure 2 As shown:

[0078] The risk user identification model structure based on one-dimensional convolution and LSTM is as follows: Figure 2 As shown in the figure, the request sequence and the time interval sequence are first concatenated to form a new sequence as input. The model structure mainly includes an Embedding layer, a one-dimensional convolutional layer, an LSTM layer, an Attention layer, and a Dense layer. For the sake of the following description, the model is abbreviated as Conv1D_LSTM_At.

[0079] (1) Request sequence and time interval sequence combination method

[0080] Since the request sequence and time interval are different types of data, they cannot be directly concatenated. Therefore, the time interval is considered as a "no operation" request and inserted into the request sequence. The number of "no operation" requests is determined according to the size of the time interval. Since the value of the time interval is relatively large and the distribution range is relatively wide, it is necessary to discretize the value to reduce the noise caused by sample deviation, which can effectively reduce the influence of extreme values ​​and outliers. Unsupervised discretization is used for the time interval variable. Discretization is to divide the sample data into multiple spaces, each space is identified by a discrete value. Unsupervised discretization algorithms include equal distance discretization method (ED), equal frequency discretization method (EF), approximate equal frequency discretization method (AEFD), local density-based discretization algorithm, clustering-based discretization algorithm, etc. This paper adopts the local density-based discretization method to divide the user's request time interval into 6 levels, as shown in Table 1.

[0081] Table 1 Classification of user request time intervals

[0082]

[0083] Each level represents the number of "no operation" requests. Different levels are used to reflect the difference in time intervals. For example, if the level is 3, three "no operations" are inserted between the corresponding request sequences. For example, if the request sequence is [login, add a common contact, submit an order], and the corresponding interval level is [1,3], the new sequence is [login, no operation, add a common contact, no operation, no operation, no operation, submit an order]. The final request sequence string is regarded as text and used as the input of the model.

[0084] (2) Word vector representation

[0085] The request sequence is considered as a string of text, and each operation request is considered as a word. This article mainly analyzes 17 requests for users to purchase tickets and one request for "no operation", a total of 18 requests, which is equivalent to each sentence consisting of some of the 18 words. The dictionary corresponding to the request sequence is generated through the Dictionary in gensim.corpora, and the corresponding words are converted into corresponding indexes through the doc2idx function to generate the index list corresponding to each sample, and the insufficient length is filled with 0. Taking [login, no operation, add common contacts, no operation, no operation, no operation, submit order] as an example, the generated dictionary is [login, no operation, add common contacts, submit order], and the index corresponding to each word is [1,3,2,4], so the index list corresponding to the above sequence is [1,3,2,3,3,3,4]. Assuming the maximum length is 10, the index list needs to be filled. Since the end point is the time point of the user's last visit, the request sequence before that moment is counted. If the length is insufficient, it needs to be supplemented at the front of the sequence. The result is [0,0,0,1,3,2,3,3,3,4], which is used as the input of Embedding.

[0086] In the Embedding layer, the user's index sequence is converted into a corresponding vector. If the length of the user's request sequence is 10, and the word vector dimension set in the Embedding layer is 5, after passing through the Embedding layer, each sample will generate a 10*5 two-dimensional vector as the input of the feature extraction layer. The main purpose of the Embedding layer is to compress high-dimensional sparse data. The number of words in this article is relatively small, so the main role of the Embedding layer here is to extract contextual relationships.

[0087] (3) Feature extraction and classification

[0088] Figure 3 This is a data change flow chart of an embodiment of the present invention, such as Figure 3 As shown in the figure, the feature extraction layer consists of three parts: one-dimensional convolution, LSTM, and Attention layer. Since one-dimensional CNN is good at extracting local pattern features, a one-dimensional convolution layer is used for feature extraction. Considering that the text string formed by the request sequence not only has the nature of text, but also is time series data with a clear time sequence, and LSTM is good at extracting the features of time series data, and has achieved good results in speech and text analysis, so an LSTM layer is added after the one-dimensional convolution for feature extraction.

[0089] When classifying the features extracted from the request sequence, the contributions of the features extracted from different requests to the final classification calculation are different, especially the difference between "no operation" and normal business requests. Therefore, the Attention mechanism is used to weight the contribution of the features of important requests to the semantics to the features at the sentence level, which can express the true semantics of the request sequence at a deeper level. Assume that the output vector of the LSTM network structure is represented as [h1, h2, ..., h n ], use formula (4-7) to encode each feature hi output by LSTM, use tanh activation function to perform a nonlinear transformation to get ui, and use softmax function according to formula (4-8) to get the attention weight vector W = (β1, β2, ... β n ), and finally the vector [h1, h2, …, h n ] weighted sum to obtain the sentence feature vector representation S extracted by LSTM.

[0090] u i =tanh(W h h i +b h ) (4-7)

[0091] β i =softmax(W β u i ) (4-8)

[0092]

[0093] By adding a fully connected layer at the end of the feature extraction layer and using the softmax layer to output the probability of belonging to each category, the final user classification is achieved. The probability of category 1 in the result is taken as the user's final risk score. Taking the 10*5 vector output by the word vector as an example, according to 3 convolution kernels and hidden_size=8, the data change process is as follows Figure 3 shown.

[0094] Figure 4 Schematic diagram of the risk user identification system of the present invention, as shown in Figure 4 As shown, the present invention provides a risk user identification system 100, which adopts the risk user identification method as described above, including:

[0095] Sequence splicing module 10: based on the acquired request behavior sequence of the to-be-identified user, generates a corresponding request time interval sequence, splices the request behavior sequence and the request time interval sequence, and generates a new request behavior sequence;

[0096] Vector conversion module 20: based on vector conversion, converts the new request behavior sequence into a computable vector;

[0097] Identification module 30: inputs the computable vector into the risk user identification model to complete the risk identification of the user to be identified.

[0098] Among them, the risky user identification model includes: one-dimensional convolution layer, LSTM layer and attention layer.

[0099] Among them, the vector conversion module includes:

[0100] Text conversion module: performs index conversion and filling processing on the new request behavior sequence as text to generate the request sequence text;

[0101] Embedding conversion module: converts the request sequence text into a computable vector through the embedding layer.

[0102] The identification module includes:

[0103] Feature extraction module: Based on the one-dimensional convolution layer, LSTM layer and attention layer, it completes the feature extraction of computable vectors;

[0104] Feature classification module: The computable vector after feature extraction passes through the fully connected layer, and the softmax layer is used to output the classification probability of the user to be identified, generating the final risk score of the user to be identified.

[0105] Among them, the feature extraction module includes:

[0106] One-dimensional convolution module: uses a one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector;

[0107] LSTM module: uses the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector;

[0108] Attention layer module: The attention layer is used to complete the feature extraction of LSTM vector based on semantic contribution weighting and output the attention weight vector.

[0109] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the risk user identification method of the first aspect described above is implemented.

[0110] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the risk user identification method as described in the first aspect above.

[0111] In addition, combined Figure 1 The risky user identification method described in the embodiment of the present application can be implemented by a computer device. Figure 5 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0112] The computer device may include a processor 81 and a memory 82 storing computer program instructions.

[0113] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0114] Among them, the memory 82 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 82 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 82 may be inside or outside the data processing device. In a specific embodiment, the memory 82 is a non-volatile memory. In a specific embodiment, the memory 82 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (Programmable Read-Only Memory, PROM for short), an erasable PROM (Erasable ProgrammableRead-Only Memory, EPROM for short), an electrically erasable PROM (Electrically Erasable ProgrammableRead-Only Memory, EEPROM for short), an electrically alterable ROM (Electrically Alterable Read-Only Memory, EAROM for short) or a flash memory (FLASH) or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0115] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .

[0116] The processor 81 implements any one of the risky user identification methods in the above embodiments by reading and executing computer program instructions stored in the memory 82 .

[0117] In some of these embodiments, the computer device may further include a communication interface 83 and a bus 80. Figure 5 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0118] The communication interface 83 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication port 83 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0119] The bus 80 includes hardware, software or both, and couples the components of the computer device to each other. The bus 80 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 80 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0120] The computer device can be combined based on the usage relationship Figure 1 Describe the risky user identification method.

[0121] Compared with the prior art, the present invention mainly realizes the identification of risky users based on user request behavior sequences, provides favorable data support for the railway to accurately crack down on risky users' ticket purchases, and better protects the ticket purchasing rights of passengers; the present invention provides a risky user identification method based on the combination of deep learning and behavior sequences, which mainly solves the problem of identifying risky users based on user request sequences using deep learning methods; the present invention organically combines the user's request behavior sequence and the time interval sequence, converts them into computable vectors using text analysis methods, and constructs a risky user identification model using one-dimensional convolution and LSTM deep learning technology.

[0122] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for identifying risky users, characterized in that: include: Sequence splicing step: based on the acquired request behavior sequence of the user to be identified, generating a corresponding request time interval sequence, splicing the request behavior sequence and the request time interval sequence of the user to be identified to generate a new request behavior sequence; The sequence splicing step comprises: The time interval of the user's request is regarded as a no-operation request, inserted into the request sequence, and the number of no-operation requests is determined according to the size of the time interval; Unsupervised discretization is used for the time interval variable to divide the sample data into multiple spaces, each space is identified by a discrete value; The time interval is divided into levels, each level represents the number of no operation requests, and different levels are used to reflect the difference in the length of the time interval; Insert level number of no operations between corresponding request behavior sequences; Vector conversion step: converting the final request sequence into a computable vector; The vector conversion step includes: the request sequence is a string of text, each operation request is a word in the text, generating a dictionary corresponding to the request sequence, converting the corresponding words into corresponding indexes, and generating an index list corresponding to each text; Convert the index list into the computable vector through an embedding layer; Identification step: inputting the computable vector into a risky user identification model to complete the risk identification of the user to be identified.

2. The risk user identification method according to claim 1, characterized in that: The risk user identification model includes: a one-dimensional convolution layer, an LSTM layer and an attention layer.

3. The risk user identification method according to claim 2, characterized in that: The identification step comprises: Feature extraction step: based on the one-dimensional convolution layer, LSTM layer and attention layer, complete the feature extraction of the computable vector; Feature classification step: The computable vector after feature extraction passes through a fully connected layer, and a softmax layer is used to output the classification probability of the user to be identified, so as to generate the final risk score of the user to be identified.

4. The risk user identification method according to claim 3, characterized in that: The feature extraction step comprises: One-dimensional convolution step: using the one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector; LSTM step: using the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector; Attention layer step: Use the attention layer to complete the feature extraction of the LSTM vector based on semantic contribution weighting and output the attention weight vector.

5. A risk user identification system, using the risk user identification method according to any one of claims 1 to 4, characterized in that: include: Sequence splicing module: based on the acquired request behavior sequence of the user to be identified, generates a corresponding request time interval sequence, splices the request behavior sequence and the request time interval sequence to generate a new request behavior sequence; The sequence splicing module comprises: The time interval of the user's request is regarded as a no-operation request, inserted into the request sequence, and the number of no-operation requests is determined according to the size of the time interval; Unsupervised discretization is used for the time interval variable to divide the sample data into multiple spaces, each space is identified by a discrete value; The time interval is divided into levels, each level represents the number of no operation requests, and different levels are used to reflect the difference in the length of the time interval; Insert level number of no operations between corresponding request behavior sequences; Vector conversion module: based on vector conversion, converts the final request sequence into a computable vector; The vector conversion module includes: the request sequence is a string of text, each operation request is a word in the text, generating a dictionary corresponding to the request sequence, converting the corresponding words into corresponding indexes, and generating an index list corresponding to each text; converting the index list into the computable vector through an embedding layer; Identification module: inputs the computable vector into the risk user identification model to complete the risk identification of the user to be identified.

6. The risk user identification system according to claim 5, characterized in that: The risk user identification model includes: a one-dimensional convolution layer, an LSTM layer and an attention layer.

7. The risk user identification system according to claim 6, characterized in that: The identification module comprises: Feature extraction module: based on the one-dimensional convolution layer, LSTM layer and attention layer, completes the feature extraction of the computable vector; Feature classification module: The computable vector after feature extraction passes through the fully connected layer, and the softmax layer is used to output the classification probability of the user to be identified, so as to generate the final risk score of the user to be identified.

8. The risk user identification system according to claim 7, characterized in that: The feature extraction module comprises: One-dimensional convolution module: using the one-dimensional convolution layer to complete the local pattern feature extraction of the computable vector and output a one-dimensional convolution vector; LSTM module: using the LSTM layer to complete the time series data feature extraction of the one-dimensional convolution vector and output the LSTM vector; Attention layer module: The attention layer is used to complete the feature extraction of the LSTM vector based on semantic contribution weighting and output the attention weight vector.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the risk user identification method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the risk user identification method as described in any one of claims 1 to 4 is implemented.

Images