User behavior data detection method, device, equipment and computer program product

Abstract

The present application discloses a user behavior data detection method, device, equipment and computer program product, which obtains user behavior data, calculates the distance threshold between each data object in the user behavior data; divides the user behavior data into cells according to the distance threshold, and respectively assigns each data object to the corresponding cell to form a data table; determines the number threshold of the data objects in the data table based on the number of data objects in each cell, and respectively calculates the dynamic number threshold of each cell according to the number threshold; respectively detects the data objects that are isolated points in each cell according to the number of data objects in each cell and the dynamic number threshold of each cell, and outputs the data objects that are isolated points in each cell as abnormal user behavior data. The present application can accurately determine the data objects that are isolated points in the user behavior data, and improve the accuracy of isolated point detection.

Description

Technical Field

[0001] The present application relates to the field of Internet information technology, and in particular to a user behavior data detection method, device, equipment and computer program product. Background Art

[0002] There are often a certain number of outliers in the data source, which are different or inconsistent with other parts of the data source. Such data is often called outliers. By detecting outliers in the data source, on the one hand, we can identify the abnormal data in the data source, improve the system risk control ability, and ensure system security. On the other hand, we can achieve the purpose of data cleaning and improve the data quality of the data source.

[0003] In user behavior data detection, the isolated point detection algorithm can be used to identify abnormal user behavior data, thereby identifying abnormal user behaviors such as abnormal logins, abnormal orders, abnormal payments, etc., and performing risk control on these users, thereby improving the system's risk control capabilities and ensuring system security.

[0004] However, when using the existing outlier detection algorithm to detect abnormal user behavior data, it is easy to misjudge some data located at edge nodes as outliers, resulting in low accuracy of current outlier detection. Summary of the invention

[0005] The main purpose of this application is to provide a user behavior data detection method, device, equipment and computer program product, aiming to solve the current technical problem of low accuracy of isolated point detection.

[0006] To achieve the above purpose, the present application provides a method for detecting user behavior data, which includes:

[0007] Acquire user behavior data, and calculate distance thresholds between data objects in the user behavior data;

[0008] Dividing the user behavior data into cells according to the distance threshold, and assigning each of the data objects to a corresponding cell to form a data table;

[0009] Based on the number of data objects in each of the cells, determine a number threshold of data objects in the data table, and calculate a dynamic number threshold of each of the cells according to the number threshold;

[0010] According to the number of data objects in each cell and the dynamic number threshold of each cell, the data objects that are isolated points in each cell are detected respectively, and the data objects that are isolated points in each cell are output as abnormal user behavior data.

[0011] Preferably, the step of determining a threshold value of the number of data objects in the data table based on the number of data objects in each of the cells comprises:

[0012] Sequentially acquiring the number of data objects in a first preset neighborhood of each of the cells to obtain a plurality of data object number values, wherein the first preset neighborhood is a set of all cells adjacent to the current cell;

[0013] The data object quantity value with the largest value among the plurality of data object quantity values ​​is calculated with a preset coefficient to obtain a threshold value of the number of data objects in the first preset neighborhood of each cell.

[0014] Preferably, the step of respectively calculating the dynamic number threshold of each of the cells according to the number threshold comprises:

[0015] Sequentially obtaining the number of data objects in a second preset neighborhood of each of the cells, where the second preset neighborhood is a set of all cells that are separated from the current cell by a preset number of cells;

[0016] The dynamic number threshold of each cell is calculated respectively according to the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood and the number threshold.

[0017] Preferably, the step of detecting the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells comprises:

[0018] For each of the cells, perform the following steps respectively:

[0019] Obtaining the number of data objects in the current cell, and comparing the number of data objects in the current cell with a target number threshold value based on a dynamic number threshold value of the current cell;

[0020] If the number of data objects in the current cell is greater than or equal to the target number threshold, then all data objects in the current cell are determined to be non-isolated points;

[0021] If the number of data objects in the current cell is less than the target number threshold, comparing a first sum of the number of data objects in the current cell and the number of cells in a first preset neighborhood of the current cell with the target number threshold;

[0022] If the sum of the first number is greater than or equal to the target number threshold, determining that all data objects of the current cell are non-isolated points;

[0023] If the first number sum is less than the target number threshold, comparing the second number sum of the number of data objects in the current cell and the number of cells in the first preset neighborhood and the second preset neighborhood of the current cell with the target number threshold;

[0024] If the sum of the second number is less than the target number threshold, determining that all data objects of the current cell are isolated points;

[0025] If the first number sum of the current cell is less than the target number threshold and the second number sum is greater than or equal to the target number threshold, data objects that are isolated points in each data object of the current cell are detected respectively.

[0026] Preferably, the step of respectively detecting data objects that are isolated points in each data object of the current cell comprises:

[0027] For each target data object of the current cell, perform the following steps respectively:

[0028] Taking the current target data object as the origin and the preset length as the radius, determining a third preset neighborhood where the current target data object is located, and counting the number of data objects other than the current target data object in the third preset neighborhood;

[0029] Comparing the number of data objects other than the current target data object in the third preset neighborhood with the dynamic number threshold of the current cell;

[0030] If the number of data objects other than the current target data object in the third preset neighborhood is less than the dynamic number threshold of the current cell, the current target data object is determined to be an isolated point.

[0031] Preferably, the step of acquiring user behavior data and calculating the distance threshold between each data object in the user behavior data comprises:

[0032] Acquire user behavior data, perform data abstraction and normalization processing on the user behavior data, and obtain the user behavior data after data abstraction and normalization processing;

[0033] Determining spatial dimension information of the data object of the user behavior data according to dimension information and data vector information of the data object of the user behavior data;

[0034] The number information of the data objects of the user behavior data is obtained, and the distance threshold between the data objects in the user behavior data is calculated according to the number information, dimension information and spatial size information of the data objects of the user behavior data.

[0035] Preferably, after the step of determining the threshold value of the number of data objects in the data table based on the number of data objects in each of the cells, the method further comprises:

[0036] Determine whether each of the cells is a non-boundary cell according to the number of data objects in the first preset neighborhood and the second preset neighborhood of each of the cells;

[0037] If there is a target cell that is a non-boundary cell among the cells, obtaining a first number of data objects in the target cell and a second number of data objects in a first preset neighborhood of the target cell, and comparing a third number of the first number and the second number with a non-boundary number threshold based on the number threshold;

[0038] If the sum of the third number is greater than or equal to the non-boundary number threshold, determining that all data objects of the target cell are non-isolated points;

[0039] If the third number sum is less than the non-boundary number threshold, obtaining a third number of data objects in a second preset neighborhood of the target cell, comparing the third number sum and a fourth number sum of the third number with the non-boundary number threshold, and if the fourth number sum is less than the non-boundary number threshold, determining that all data objects of the target cell are isolated points;

[0040] If the sum of the fourth number is greater than or equal to the non-boundary number threshold, data objects that are isolated points in each data object of the target cell are detected respectively.

[0041] To achieve the above-mentioned purpose, the present application further provides a user behavior data detection device, the user behavior data detection device comprising:

[0042] A calculation module, used to obtain user behavior data and calculate the distance threshold between each data object in the user behavior data;

[0043] A division module, used to divide the user behavior data into cells according to the distance threshold, and respectively assign each of the data objects to a corresponding cell to form a data table;

[0044] A determination module, configured to determine a number threshold of data objects in the data table based on the number of data objects in each of the cells, and calculate a dynamic number threshold of each of the cells according to the number threshold;

[0045] The detection module is used to detect the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells, and output the data objects that are isolated points in each of the cells as abnormal user behavior data.

[0046] Furthermore, to achieve the above-mentioned purpose, the present application also provides a user behavior data detection device, which includes a memory, a processor, and a user behavior data detection program stored in the memory and executable on the processor, and the user behavior data detection program implements the steps of the above-mentioned user behavior data detection method when executed by the processor.

[0047] Furthermore, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a user behavior data detection program is stored, and when the user behavior data detection program is executed by a processor, the steps of the above-mentioned user behavior data detection method are implemented.

[0048] Furthermore, to achieve the above-mentioned purpose, the present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned user behavior data detection method when executed by a processor.

[0049] The embodiment of the present application provides a user behavior data detection method, device, equipment and computer program product, which obtains user behavior data, calculates the distance threshold between each data object in the user behavior data; divides the user behavior data into cells according to the distance threshold, and assigns each data object to the corresponding cell to form a data table; determines the number threshold of the data objects in the data table based on the number of data objects in each cell, and calculates the dynamic number threshold of each cell according to the number threshold; detects the data objects that are isolated points in each cell according to the number of data objects in each cell and the dynamic number threshold of each cell, and outputs the data objects that are isolated points in each cell as abnormal user behavior data. The present application calculates the dynamic number threshold of each cell through the number threshold of the data objects in the first preset neighborhood of each cell, and then detects whether the data object in each cell is an isolated point according to the dynamic number threshold of each cell combined with the number of data objects in each cell, which can accurately determine the data objects that are isolated points in the user behavior data, avoid the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improves the accuracy of isolated point detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a schematic diagram of the structure of the hardware operating environment involved in the embodiment of the user behavior data detection method of this application;

[0051] Figure 2 This is a flow chart of the first embodiment of the user behavior data detection method of the present application;

[0052] Figure 3 This is a schematic diagram of a scene of the first boundary situation in the first embodiment of the user behavior data detection method of the present application;

[0053] Figure 4 This is a schematic diagram of a scenario of the second boundary situation in the first embodiment of the user behavior data detection method of the present application;

[0054] Figure 5 This is a schematic diagram of a scenario in which data objects are evenly distributed in the first embodiment of the user behavior data detection method of the present application;

[0055] Figure 6 This is a schematic diagram of a scenario in which data objects are unevenly distributed in the first embodiment of the user behavior data detection method of the present application;

[0056] Figure 7 This is a flowchart of part of the second embodiment of the user behavior data detection method of this application;

[0057] Figure 8 This is a schematic diagram of the functional modules of a preferred embodiment of the user behavior data detection device of the present application.

[0058] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0059] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The embodiment of the present application provides a user behavior data detection method, device, equipment and computer program product, which obtains user behavior data, calculates the distance threshold between each data object in the user behavior data; divides the user behavior data into cells according to the distance threshold, and assigns each data object to the corresponding cell to form a data table; determines the number threshold of the data objects in the data table based on the number of data objects in each cell, and calculates the dynamic number threshold of each cell according to the number threshold; detects the data objects that are isolated points in each cell according to the number of data objects in each cell and the dynamic number threshold of each cell, and outputs the data objects that are isolated points in each cell as abnormal user behavior data. The present application calculates the dynamic number threshold of each cell through the number threshold of the data objects in the first preset neighborhood of each cell, and then detects whether the data object in each cell is an isolated point according to the dynamic number threshold of each cell combined with the number of data objects in each cell, which can accurately determine the data objects that are isolated points in the user behavior data, avoid the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improves the accuracy of isolated point detection.

[0061] like Figure 1 As shown, Figure 1 It is a schematic diagram of the structure of a user behavior data detection device in the hardware operating environment involved in the embodiment of the present application.

[0062] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0063] The user behavior data detection device in the embodiment of the present application can be a PC, or a portable terminal device such as a tablet computer or a portable computer.

[0064] like Figure 1 As shown, the user behavior data detection device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

[0065] Those skilled in the art will understand that Figure 1 The structure of the user behavior data detection device shown in the figure does not constitute a limitation on the user behavior data detection device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0066] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a user behavior data detection program.

[0067] exist Figure 1 In the device shown, the network interface 1004 is mainly used to connect to the backend server and communicate data with the backend server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the user behavior data detection program stored in the memory 1005 and perform the following operations:

[0068] Acquire user behavior data, and calculate distance thresholds between data objects in the user behavior data;

[0069] Dividing the user behavior data into cells according to the distance threshold, and assigning each of the data objects to a corresponding cell to form a data table;

[0070] Based on the number of data objects in each of the cells, determine a number threshold of data objects in the data table, and calculate a dynamic number threshold of each of the cells according to the number threshold;

[0071] According to the number of data objects in each cell and the dynamic number threshold of each cell, the data objects that are isolated points in each cell are detected respectively, and the data objects that are isolated points in each cell are output as abnormal user behavior data.

[0072] Furthermore, the step of determining a threshold value of the number of data objects in the data table based on the number of data objects in each of the cells includes:

[0073] Sequentially acquiring the number of data objects in a first preset neighborhood of each of the cells to obtain a plurality of data object number values, wherein the first preset neighborhood is a set of all cells adjacent to the current cell;

[0074] The data object quantity value with the largest value among the plurality of data object quantity values ​​is calculated with a preset coefficient to obtain a threshold value of the number of data objects in the first preset neighborhood of each cell.

[0075] Furthermore, the step of respectively calculating the dynamic number threshold of each of the cells according to the number threshold comprises:

[0076] Sequentially obtaining the number of data objects in a second preset neighborhood of each of the cells, where the second preset neighborhood is a set of all cells that are separated from the current cell by a preset number of cells;

[0077] The dynamic number threshold of each cell is calculated respectively according to the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood and the number threshold.

[0078] Furthermore, the step of detecting the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells includes:

[0079] For each of the cells, perform the following steps respectively:

[0080] Obtaining the number of data objects in the current cell, and comparing the number of data objects in the current cell with a target number threshold value based on a dynamic number threshold value of the current cell;

[0081] If the number of data objects in the current cell is greater than or equal to the target number threshold, then all data objects in the current cell are determined to be non-isolated points;

[0082] If the number of data objects in the current cell is less than the target number threshold, comparing a first sum of the number of data objects in the current cell and the number of cells in a first preset neighborhood of the current cell with the target number threshold;

[0083] If the sum of the first number is greater than or equal to the target number threshold, determining that all data objects of the current cell are non-isolated points;

[0084] If the first number sum is less than the target number threshold, comparing the second number sum of the number of data objects in the current cell and the number of cells in the first preset neighborhood and the second preset neighborhood of the current cell with the target number threshold;

[0085] If the sum of the second number is less than the target number threshold, determining that all data objects of the current cell are isolated points;

[0086] If the first number sum of the current cell is less than the target number threshold and the second number sum is greater than or equal to the target number threshold, data objects that are isolated points in each data object of the current cell are detected respectively.

[0087] Furthermore, the step of respectively detecting the data objects that are isolated points in the data objects of the current cell includes:

[0088] For each target data object of the current cell, perform the following steps respectively:

[0089] Taking the current target data object as the origin and the preset length as the radius, determining a third preset neighborhood where the current target data object is located, and counting the number of data objects other than the current target data object in the third preset neighborhood;

[0090] Comparing the number of data objects other than the current target data object in the third preset neighborhood with the dynamic number threshold of the current cell;

[0091] If the number of data objects other than the current target data object in the third preset neighborhood is less than the dynamic number threshold of the current cell, the current target data object is determined to be an isolated point.

[0092] Furthermore, the step of obtaining user behavior data and calculating the distance threshold between each data object in the user behavior data includes:

[0093] Acquire user behavior data, perform data abstraction and normalization processing on the user behavior data, and obtain the user behavior data after data abstraction and normalization processing;

[0094] Determining spatial dimension information of the data object of the user behavior data according to dimension information and data vector information of the data object of the user behavior data;

[0095] The number information of the data objects of the user behavior data is obtained, and the distance threshold between the data objects in the user behavior data is calculated according to the number information, dimension information and spatial size information of the data objects of the user behavior data.

[0096] Further, after the step of determining the threshold value of the number of data objects in the data table based on the number of data objects in each of the cells, the processor 1001 may be used to call the user behavior data detection program stored in the memory 1005 and perform the following operations:

[0097] Determine whether each of the cells is a non-boundary cell according to the number of data objects in the first preset neighborhood and the second preset neighborhood of each of the cells;

[0098] If there is a target cell that is a non-boundary cell among the cells, obtaining a first number of data objects in the target cell and a second number of data objects in a first preset neighborhood of the target cell, and comparing a third number of the first number and the second number with a non-boundary number threshold based on the number threshold;

[0099] If the sum of the third number is greater than or equal to the non-boundary number threshold, determining that all data objects of the target cell are non-isolated points;

[0100] If the third number sum is less than the non-boundary number threshold, obtaining a third number of data objects in a second preset neighborhood of the target cell, comparing the third number sum and a fourth number sum of the third number with the non-boundary number threshold, and if the fourth number sum is less than the non-boundary number threshold, determining that all data objects of the target cell are isolated points;

[0101] If the sum of the fourth number is greater than or equal to the non-boundary number threshold, data objects that are isolated points in each data object of the target cell are detected respectively.

[0102] In order to better understand the above technical solution, exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0103] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0104] Reference Figure 2 , the first embodiment of the present application provides a flow chart of a method for detecting user behavior data. In this embodiment, the method for detecting user behavior data includes the following steps:

[0105] Step S10, obtaining user behavior data, and calculating a distance threshold between each data object in the user behavior data;

[0106] It is understandable that the data source of user behavior data often contains a certain number of outliers, which are different or inconsistent with other parts of the data source. Such data is often called isolated points. By detecting isolated points in the data source of user behavior data, on the one hand, it is possible to identify abnormal data in the data source, improve the system's risk control capabilities, and ensure system security. On the other hand, it can achieve the purpose of data cleaning and improve the data quality of the data source. In user behavior data detection, abnormal user behavior data can be identified through isolated point detection algorithms, thereby identifying abnormal user behaviors such as abnormal logins, abnormal orders, and abnormal payments, and performing risk control on these users, thereby improving the system's risk control capabilities and ensuring system security. However, the existing isolated point detection of user abnormal behavior data uses a fixed threshold, which will cause some data located at edge nodes to be misjudged as isolated points. For example, user behavior data located at edge nodes is misjudged as abnormal user behavior, which will cause normal users to be treated as abnormalities, affecting the user's experience. Reference Figure 3 and Figure 4 , Figure 3 and Figure 4 They are respectively a schematic diagram of a first boundary situation and a schematic diagram of a second boundary situation in the first embodiment of the user behavior data detection method of the present application, Figure 3 It is composed of 4*4 cells, including a currently detected boundary cell C, a plurality of cells 1 within a first preset neighborhood of the boundary cell C, a plurality of cells 2 within a second preset neighborhood of the boundary cell C, and a plurality of blank cells to which no data objects are allocated; Figure 4It is composed of 5*7 cells, including the currently detected boundary cell C, multiple cells 1 of the boundary cell C in the first preset neighborhood, multiple cells 2 of the boundary cell C in the second preset neighborhood, and multiple blank cells to which no data objects are assigned, wherein the first preset neighborhood is the area formed by the set of all cells directly adjacent to the currently detected cell, and the second preset neighborhood is the set of all cells separated from the current cell by a preset number of cells, and in this embodiment is the area formed by the set of all cells that are one to two cells away from the currently detected cell in any direction. If the existing fixed threshold isolated point detection method is used to perform isolated point detection on the above-mentioned first boundary case and the second boundary case, the data in the cell C in the first boundary case and the second boundary case are easily misjudged as isolated points, so that the corresponding user behavior is misjudged as abnormal behavior, affecting the user's experience.

[0107] Based on the above problems, the present application proposes a user behavior data detection method. In this embodiment, the user behavior data detection method can be applied to a cell-based isolated point detection system with an improved threshold. The cell-based isolated point detection system with an improved threshold can be deployed in smart terminals. Smart terminals can be but are not limited to smart phones, tablet computers, laptops, desktop computers and other terminals. It can be understood that for the convenience of description, the cell-based isolated point detection system with an improved threshold will be referred to as a system in the following. The present application calculates the dynamic number threshold of each cell through the number threshold of data objects in the first preset neighborhood of each cell, and then detects whether the data object in each cell is an isolated point based on the dynamic number threshold of each cell combined with the number of data objects in each cell. It can accurately determine the data objects that are isolated points in the user behavior data, avoid the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improve the accuracy of isolated point detection.

[0108] Specifically, when performing isolated point detection on user behavior data, the system first obtains the user behavior data generated when the user logs in, places an order, pays and / or performs other operations. To facilitate the isolated point detection on the user behavior data, the system converts the data objects in the obtained user behavior data into the form of data vectors. Further, after completing the data conversion of the user behavior data, the system obtains the number information and data vector information of the data objects in the user behavior data, calculates the spatial size information of the data objects of the user behavior data through the number information and data vector information of the data objects in the user behavior data, and further calculates the distance threshold between each data object in the user behavior data based on the number information, dimension information and spatial size information of the data objects of the user behavior data, wherein the data vector information is the specific information of the data vector, the dimension information includes the number of dimensions included in the data object, and the spatial size information is the "area" of the data space of the user behavior data, for example, the length in one-dimensional space, the area in two-dimensional space, and the volume in three-dimensional space. By calculating the distance threshold between each data object in the user behavior data, it is convenient to subsequently divide the user behavior data into cells according to the distance threshold and detect the data objects that are isolated points in each cell according to the number of data objects in each cell after division and the dynamic number threshold of each cell. The data objects that are isolated points in the user behavior data can be accurately determined, avoiding the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improving the accuracy of isolated point detection.

[0109] Furthermore, the step of obtaining user behavior data and calculating the distance threshold between each data object in the user behavior data includes:

[0110] Step S11, acquiring user behavior data, performing data abstraction and normalization processing on the user behavior data, and obtaining user behavior data after data abstraction and normalization processing;

[0111] Step S12, determining the spatial size information of the data object of the user behavior data according to the dimension information and data vector information of the data object of the user behavior data;

[0112] Step S113, obtaining the number information of the data objects of the user behavior data, and calculating the distance threshold between the data objects in the user behavior data according to the number information, dimension information and spatial size information of the data objects of the user behavior data.

[0113] Specifically, when obtaining user behavior data and calculating the distance threshold between each data object in the user behavior data, the system obtains the user behavior data generated when the user logs in, places an order, pays and / or performs other operations, and performs data abstraction and normalization on the obtained user behavior data. Specifically, the user behavior data is converted through preset mapping rules, the data objects in the user behavior data are converted into multi-dimensional data vector form, and the data objects in the data vector form are normalized so that the data objects are all mapped within the range of [0, 1) to facilitate identification and processing of the data objects. For example, data such as the user's mobile phone model, the user's mobile phone operating system, the user's average single login time, the user's 24-hour login times, the user's gender, age, and login city are obtained to form a seven-dimensional vector data object of the user behavior data, and the user behavior data is abstracted (for example, mapping gender, mobile phone platform, etc. to different numbers) and normalized (for example, dividing age by 100). For example, the data objects in the user behavior data (iphone 6s, ios, 20 minutes, 5 times, male, 28 years old, Nanjing) are converted into data objects in the form of data vectors (0.3, 1.0, 0.33, 0.2, 1.0, 0.28, 0.63) after pre-processing operations such as data abstraction and normalization.

[0114] After completing the preprocessing of the user behavior data such as data abstraction and normalization, the system identifies the dimension information of the data object of the user behavior data, and determines the spatial dimension information of the data object of the user behavior data based on the dimension information and data vector information of the data object of the user behavior data. Specifically, the maximum and minimum values ​​of each dimension of multiple data objects are obtained, and the difference between the maximum and minimum values ​​of the data objects of each dimension is calculated, and the calculated differences corresponding to each dimension are multiplied to obtain the spatial dimension information of the data object of the user behavior data. For example, assuming that the dimension information of the data object of the user behavior data is w-dimensional, and the data object in the user behavior data contains n points, namely C1(X 11 , X 12 , …, X 1w ), C2(X 21 , X 22 , …, X 2w ), …, C n (X n1 , X n2 , …, X nw ). For the "side length" of the i-th dimension, we need to find the maximum value X of the i-th dimension among n points. i_max and the minimum value X i_min , calculate the difference D i =X i_max -X i_min, which is the side length of the i-th dimension. Thus, the "area" of the data space can be obtained as shown in the following formula:

[0115]

[0116] Where S is the spatial size information of the data object of the user behavior data, that is, the "area" of the spatial data, w is the dimension information, i = 0, 1, 2, ...; X i_max is the maximum value of the i-th dimension, X i_min is the minimum value of the i-th dimension, D i is the difference in the i-th dimension.

[0117] Furthermore, the system identifies the data objects in the user behavior data and obtains the number information of the data objects in the user behavior data. And further, based on the number information, dimension information and spatial size information of the data objects in the user behavior data, the distance threshold between the data objects in the user behavior data is calculated. It can be understood that for the determination of the distance threshold r, the existing distance-based isolated point detection method usually calculates the distance between all the data objects in the data set, and then sums up all the distances and takes the average value as the distance threshold r. It can be seen that the amount of calculation of this method is very large. Therefore, the determination of the r value in this embodiment does not adopt this traditional approach, but adopts a new calculation method. Taking a two-dimensional plane as an example, an ideal two-dimensional plane map with no isolated points at all should be a map where all data objects are evenly distributed. If this two-dimensional plane map is divided into many small squares of the same size, then each data object should occupy a small square, such as Figure 5 As shown, Figure 5 This is a schematic diagram of a scene in which data objects are evenly distributed in the first embodiment of the user behavior data detection method of this application. If some data objects are close to each other, there will inevitably be two or more data objects in a square, and there will inevitably be no data objects in some squares. At this time, the data objects in the two-dimensional plane will form clusters and isolated points, such as Figure 6 As shown, Figure 6 This is a schematic diagram of a scenario in which data objects are unevenly distributed in the first embodiment of the user behavior data detection method of this application. Figure 5 and Figure 6 The side length of the small and medium squares is r0. Figure 5 and Figure 6It can be found that if a data object has no adjacent data objects within the radius neighborhood of r0, then the data object cannot be in a certain cluster. Based on this, this embodiment uses r0 as the distance threshold r between each data object. Specifically, the system inputs the number information, dimension information, and spatial size information of the data objects of the user behavior data into the preset distance threshold calculation formula, and calculates the number information, dimension information, and spatial size information of the data objects of the user behavior data through the distance threshold calculation formula. After the calculation is completed, the distance threshold between each data object in the user behavior data is obtained, wherein the preset distance threshold calculation formula is shown as follows:

[0118]

[0119] Among them, r and r0 are distance thresholds, w is dimension information, S is the spatial size information of the data object of the user behavior data, and n is the number information of the data objects of the user behavior data.

[0120] Step S20, dividing the user behavior data into cells according to the distance threshold, and assigning each of the data objects to a corresponding cell to form a data table;

[0121] After calculating the distance threshold between each data object in the user behavior data, the system first calculates the cell division parameter based on the dimension information of the data object in the user behavior data and the distance threshold; then divides the user behavior data into cells based on the cell division parameter and the data vector information of the data object in the user behavior data, and determines the number of cells that the user behavior data needs to be divided into. After determining the number of cells that the user behavior data needs to be divided into, the system calculates the number of data objects in each cell, and assigns each data object in the user behavior data to the corresponding cell, forming a data table from each cell and its data object. For example, the system assigns C1, C2, ..., C n A total of n points are assigned to the divided cells. Now consider the jth point C j (X j1 , X j2 , …, X jw ), the cell to which the point is assigned in the i-th dimension is divided into:

[0122] NUM i =min{(X ji -X i_min ) / t+1,SUM i};

[0123] Among them, NUM i The result is rounded down, NUM i Indicates that the point falls on the NUMth dimension in the i-th dimensioni divisions (counting from the first division), t is the cell division parameter, i = 0, 1, 2, ...; X ji is the value of the jth data in the i-th dimension, X i_min is the minimum value of the i-th dimension, SUM i is the number of cells divided in the i-th dimension, and min{x, y} is the minimum value of x and y.

[0124] Furthermore, when NUM is calculated for each dimension of a w-dimensional data object i Then, point C j Assigned to the divided cell space. The system cyclically executes the above steps of assigning data objects to corresponding cells until all data objects in the user behavior data are assigned to corresponding cells, and a data table is formed by each cell and its data objects. By assigning all data objects in the user behavior data to corresponding cells and forming a data table, the amount of calculation in the subsequent process can be reduced.

[0125] Furthermore, the step of dividing the user behavior data into cells according to the distance threshold comprises:

[0126] Step S21, calculating a cell division parameter based on the dimension information of the data object in the user behavior data and the distance threshold;

[0127] Step S22: dividing the user behavior data into cells according to the cell division parameters and the data vector information of the data objects in the user behavior data.

[0128] When dividing user behavior data into cells according to the distance threshold, the system inputs the dimension information and distance threshold of the data object in the obtained user behavior data into the preset cell division parameter calculation formula, and performs calculations according to the dimension information and the distance threshold through the cell division parameter calculation formula. After the calculation is completed, the cell division parameter is obtained, where the preset cell division parameter calculation formula is shown in the following formula:

[0129]

[0130] Among them, t is the cell division parameter, w is the dimension information, and r0 is the distance threshold.

[0131] After calculating the cell division parameters, the system will obtain the maximum and minimum values ​​of the data vectors of each dimension in the data object, input the maximum and minimum values ​​of the data vectors of each dimension into the preset cell division formula, and calculate the number of cell divisions of the data vectors of each dimension by combining the maximum and minimum values ​​of the data vectors of each dimension through the cell division formula, and divide the user behavior data into cells according to the number of cell divisions of each dimension, so as to allocate each data object in the user behavior data to the corresponding cell, wherein the preset cell division formula is shown as follows:

[0132] SUM i =(X i_max -X i_min ) / t;

[0133] Among them, SUM i is the number of cells divided in the i-th dimension, t is the cell division parameter, X i_max is the maximum value of the i-th dimension, X i_min is the minimum value of the i-th dimension.

[0134] Step S30, determining a number threshold of data objects in the data table based on the number of data objects in each of the cells, and calculating a dynamic number threshold of each of the cells according to the number threshold;

[0135] Further, the system first obtains the number of data objects in each cell respectively, and then for each cell, sequentially obtains the number of data objects in all cells within the first preset neighborhood of each cell, and obtains multiple data object number values; then obtains the preset coefficient, and calculates the data object number value with the largest value among the multiple data object number values ​​with the preset coefficient to obtain the number threshold of data objects in the data table, wherein the preset coefficient is set according to actual needs. Further, the system obtains the number of data objects in the second preset neighborhood of each cell respectively; according to the obtained number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood, and the determined number threshold of data objects in the first preset neighborhood of each cell, the dynamic number threshold of each cell is calculated respectively, wherein the second neighborhood is a second layer of cells composed of cells that are one or two cells away from each cell in any direction. For example, the dynamic number threshold of the first cell is calculated based on the number of data objects in the first preset neighborhood of the first cell, the number of data objects in the second preset neighborhood, and the number threshold of data objects in the first preset neighborhood of each cell; the dynamic number threshold of the second cell is calculated based on the number of data objects in the first preset neighborhood of the second cell, the number of data objects in the second preset neighborhood, and the number threshold of data objects in the first preset neighborhood of each cell, and so on, until the calculation of the dynamic number threshold of each cell is completed. By calculating the dynamic number threshold of each cell, it is possible to accurately detect whether the data object of each cell is an isolated point based on the dynamic number threshold of each cell, thereby effectively improving the accuracy of isolated point detection.

[0136] Step S40, according to the number of data objects in each cell and the dynamic number threshold of each cell, respectively detect the data objects that are isolated points in each cell, and output the data objects that are isolated points in each cell as abnormal user behavior data.

[0137] The system obtains the number of data objects in each cell respectively, and detects the data objects that are isolated points in each cell respectively based on the obtained number of data objects in each cell and the determined dynamic number threshold of each cell. Specifically, the system first directly determines whether all data objects in each cell are isolated points or non-isolated points based on the number of data objects in each cell and the dynamic number threshold of each cell. When a data object is detected to be an isolated point, an isolated point identifier is set for the data object that is an isolated point. If the data object is a non-isolated point, the data object is not processed, wherein the isolated point identifier is used to identify the isolated point, for example, the isolated point can be marked as red, etc. If there are data objects in the cell but not all data objects are isolated points or non-isolated points, isolated point detection is performed on all data objects in the cell respectively, and an isolated point identifier is set for the data objects detected to be isolated points. Furthermore, the data objects with isolated point identifiers in each cell are extracted, and the data objects are output as abnormal user behavior data to determine the abnormal user behavior data corresponding to the isolated point according to the preset mapping rules, and then determine the abnormal behavior user, wherein the preset mapping rules are used to determine whether the data objects corresponding to the isolated point are abnormal data, which can be set manually or obtained through learning, and are not limited here. According to the number of data objects in each cell and the dynamic number threshold of each cell, the data objects that are isolated points in each cell can be accurately detected, avoiding the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improving the accuracy of isolated point detection.

[0138] It can be understood that this embodiment can calculate the dynamic number threshold of each cell through the number threshold of data objects in the first preset neighborhood of each cell, and then detect whether the data object in each cell is an isolated point based on the dynamic number threshold of each cell combined with the number of data objects in each cell. Therefore, regardless of whether the cell is a boundary cell or a non-boundary cell, it can be accurately determined whether each data object in the cell is an isolated point without the need to determine whether each cell is a boundary cell.

[0139] In another specific embodiment of the present application, it can be determined whether the cell is a boundary cell. If it is a boundary cell, the above-mentioned dynamic number threshold method is used to perform isolated point detection; if it is a non-border cell, the fixed number threshold method is used to perform isolated point detection on the data object of the cell. Specifically, after the step of determining the number threshold of the data objects in the data table based on the number of data objects in each of the cells, it also includes:

[0140] Step A1, determining whether each cell is a non-border cell according to the number of data objects in the first preset neighborhood and the second preset neighborhood of each cell;

[0141] Step A2, if there is a target cell that is a non-boundary cell among the cells, obtaining a first number of data objects in the target cell and a second number of data objects in a first preset neighborhood of the target cell, and comparing a third number of the first number, the second number and a non-boundary number threshold value based on the number threshold value;

[0142] Step A3: if the sum of the third number is greater than or equal to the non-boundary number threshold, then determining that all data objects of the target cell are non-isolated points;

[0143] Step A4, if the third number sum is less than the non-boundary number threshold, obtaining a third number of data objects in a second preset neighborhood of the target cell, comparing the third number sum and a fourth number sum of the third number with the non-boundary number threshold, and if the fourth number sum is less than the non-boundary number threshold, determining that all data objects of the target cell are isolated points;

[0144] Step A5: if the sum of the fourth number is greater than or equal to the non-boundary number threshold, then respectively detect the data objects that are isolated points in the data objects of the target cell.

[0145] Further, the system determines whether each cell is a non-boundary cell according to the number of data objects in the first preset neighborhood and the second preset neighborhood of each cell. Specifically, for each cell, it determines whether the sum of the number of data objects in the first preset neighborhood and the second preset neighborhood of the cell is equal to a preset value. If it is equal, the cell is determined to be a non-boundary cell; if it is not equal, the cell is determined to be a boundary cell until the judgment of all cells is completed. Here, the preset value is a value set according to the actual situation for determining whether a cell is a boundary cell. Further, if it is determined that there are target cells that are non-boundary cells among all cells, the system then obtains the first number of data objects in the target cell and the second number of data objects in the first preset neighborhood of the target cell, calculates the third sum of the first number and the second number, and compares the third sum with the non-boundary number threshold based on the number threshold. The non-boundary number threshold is a value obtained by adding one to the number threshold. If it is determined through comparison that the third sum is greater than or equal to the non-boundary number threshold, for example: a + b1 >= M + 1, it is determined that all data objects in the target cell are non-isolated points, where a is the first number of data objects in the target cell, b1 is the second number of data objects in the first preset neighborhood of the target cell, and M is the number threshold. Further, if it is determined through comparison that the third sum is less than the non-boundary number threshold, the system then obtains the third number of data objects in the second preset neighborhood of the target cell, calculates the fourth sum of the third sum and the third number, and compares the fourth sum with the non-boundary number threshold. If it is determined through comparison that the fourth sum is less than the non-boundary number threshold, for example: a + b1 + b2 < M + 1, it is determined that all data objects in the target cell are isolated points, where b2 is the third number of data objects in the second preset neighborhood of the target cell. Further, if it is determined through comparison that the fourth sum is greater than or equal to the non-boundary number threshold, it is detected whether each data object in the target cell is an isolated point respectively. Specifically, when detecting whether each data object in the target cell is an isolated point respectively, for each undetected target data object among the multiple data objects in the target cell, the system can sort the detection order of each target data object according to a preset sorting method, such as sorting each target data object by row-by-row detection or column-by-column detection and other sorting methods, and perform user behavior data detection on each target data object according to the sorted sequence. Further, for the target data object P that needs to be detected currently, the system obtains the number count of the data objects in the third preset neighborhood of the current target data object P p , and initializes the number count of the data objects in the third preset neighborhood of the current target data object P p to the first sum minus one of the number count of the data objects in the target cell and the number count1 of the cells in the first preset neighborhood of the target cell, that is, countp = count + count1 - 1, wherein the third preset neighborhood is an area formed by taking the data object as the center and having a radius of the distance threshold r0. Further, the distance between the target data object P and the target cell C is calculated according to the preset distance calculation formula. x，y The distance between each data object in the second preset neighborhood is used to obtain multiple distance information, wherein the preset distance calculation formula is as shown in the following formula:

[0146]

[0147] Among them, d ij is the distance between two objects, w is the dimension information, k = 0, 1, 2, 3, ...; X ik is the value of the i-th object in the k-th dimension, X jk is the value of the jth object in the kth dimension.

[0148] Furthermore, the plurality of distance information are respectively compared with the distance threshold r0. When a distance information is obtained by each comparison and is less than or equal to the distance threshold, the number of data objects of the current target data object P in the third preset neighborhood is counted. p Add one until the comparison of multiple distance information with the distance threshold is completed. Further, after the comparison of multiple distance information with the distance threshold is completed, the system counts the number of data objects within the third preset neighborhood of the current target data object p The number of data objects count of the current target data object P within the third preset neighborhood is compared with the number threshold M. p If the number is less than the threshold value M, the current target data object P is determined to be an isolated point, and an isolated point flag is set for the current target data object.

[0149] The present embodiment provides a method, apparatus, device and computer program product for detecting user behavior data, which obtains user behavior data, calculates the distance threshold between each data object in the user behavior data; divides the user behavior data into cells according to the distance threshold, and assigns each data object to a corresponding cell to form a data table; determines the number threshold of data objects in the data table based on the number of data objects in each cell, and calculates the dynamic number threshold of each cell according to the number threshold; detects the data objects that are isolated points in each cell according to the number of data objects in each cell and the dynamic number threshold of each cell, and outputs the data objects that are isolated points in each cell as abnormal user behavior data. The present application calculates the dynamic number threshold of each cell through the number threshold of data objects in the first preset neighborhood of each cell, and then detects whether the data object in each cell is an isolated point according to the dynamic number threshold of each cell combined with the number of data objects in each cell, which can accurately determine the data objects that are isolated points in the user behavior data, avoids the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improves the accuracy of isolated point detection.

[0150] Furthermore, based on the first embodiment of the user behavior data detection method of the present application, a second embodiment of the user behavior data detection method of the present application is proposed. In the second embodiment, the step of determining the number threshold of the data objects in the data table based on the number of data objects in each of the cells includes:

[0151] Step S31, sequentially acquiring the number of data objects in a first preset neighborhood of each of the cells to obtain a plurality of data object number values, wherein the first preset neighborhood is a set of all cells adjacent to the current cell;

[0152] Step S32, calculating the data object quantity value with the largest value among the plurality of data object quantity values ​​and a preset coefficient to obtain a threshold value of the number of data objects in the first preset neighborhood of each cell.

[0153] When determining the number threshold of data objects in a data table, the system first obtains the number of data objects in each cell. On this basis, the system then detects the data objects in the first preset neighborhood of each cell in turn, and counts the total number of data objects in all cells in the first preset neighborhood (first-layer cells) of each cell, thereby obtaining multiple data object quantity values ​​(i.e., the total number of data objects in all cells in the first-layer cells of each cell is the data object quantity value of one cell); and further compares the multiple data object quantity values, and determines the data object quantity value with the largest value from the multiple data object quantity values, wherein the first preset neighborhood is the set of all cells adjacent to the current cell. After determining the data object quantity value with the largest value among the multiple data object quantity values, the system obtains the preset coefficient, and calculates the preset coefficient with the data value of the data object. After the calculation is completed, the threshold of the number of data objects in the first preset neighborhood of each cell is obtained. The specific calculation process is shown in the following formula:

[0154] M0=C*M max ;

[0155] Among them, M0 is the number threshold, C is the preset coefficient, M max The value of the number of data objects having the largest value among the values ​​of the number of data objects in the first preset neighborhood of the multiple cells.

[0156] Further, refer to Figure 7 After determining the number threshold of data objects in the first preset neighborhood of each cell, the system calculates the dynamic number threshold of each cell according to the number threshold, wherein the step of calculating the dynamic number threshold of each cell according to the number threshold includes:

[0157] Step S33, sequentially obtaining the number of data objects in a second preset neighborhood of each of the cells, where the second preset neighborhood is a set of all cells that are separated from the current cell by a preset number of cells;

[0158] Step S34, respectively calculating the dynamic number threshold of each cell according to the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood and the number threshold.

[0159] After determining the number threshold of data objects in the data table, the system detects the data objects in the second preset neighborhood of each cell (the area formed by the set of all cells in the second layer of cells) respectively, and obtains the number of data objects in the second preset neighborhood of each cell (that is, the number of data objects in all cells in the second layer of cells). The second preset neighborhood is the set of all cells separated from the current cell by preset cells. Further, the system obtains a preset dynamic number threshold calculation formula, and inputs the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood, the number threshold of data objects in the first preset neighborhood of each cell, and the dimension information of data objects in the user behavior data into the preset dynamic number threshold calculation formula, and calculates the dynamic number threshold of each cell by combining the input data with the preset dynamic number threshold calculation formula, and obtains the dynamic number threshold of each cell after completing the calculation. Among them, the preset dynamic number threshold calculation formula is shown as follows:

[0160]

[0161] Among them, M c is the dynamic number threshold of the cell, w is the dimension information, M0 is the number threshold, c1 is the number of data objects in the first preset neighborhood of the cell, and c2 is the number of data objects in the second preset neighborhood of the cell.

[0162] According to the above formula, it can be determined whether a cell is at a boundary or a non-boundary, and corresponding dynamic number thresholds are set for cells at different boundary conditions, so that the detection result of isolated point detection using the dynamic number threshold is more accurate.

[0163] After dividing the user behavior data into cells, this embodiment calculates the dynamic number threshold of each cell according to the number threshold of data objects in the first preset neighborhood of each cell, the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood, and the dimensional information of the data objects, so that the data objects that are isolated points in each cell can be accurately detected according to the dynamic number threshold, thereby avoiding the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improving the accuracy of isolated point detection.

[0164] Further, based on the first embodiment of the user behavior data detection method of the present application, a third embodiment of the user behavior data detection method of the present application is proposed. In the third embodiment, the step of detecting the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells includes:

[0165] Step S41, for each cell, execute steps S42-S48 respectively;

[0166] Step S42, obtaining the number of data objects in the current cell, and comparing the number of data objects in the current cell with a target number threshold value based on a dynamic number threshold value of the current cell;

[0167] Step S43, if the number of data objects in the current cell is greater than or equal to the target number threshold, then all data objects in the current cell are determined to be non-isolated points;

[0168] Step S44, if the number of data objects in the current cell is less than the target number threshold, comparing a first sum of the number of data objects in the current cell and the number of cells in a first preset neighborhood of the current cell with the target number threshold;

[0169] Step S45, if the sum of the first numbers is greater than or equal to the target number threshold, determining that all data objects of the current cell are non-isolated points;

[0170] Step S46, if the first sum is less than the target number threshold, comparing the second sum of the number of data objects in the current cell and the number of cells in the first preset neighborhood and the second preset neighborhood of the current cell with the target number threshold;

[0171] Step S47, if the sum of the second number is less than the target number threshold, determining that all data objects of the current cell are isolated points;

[0172] Step S48: if the sum of the first number of the current cell is less than the target number threshold and the sum of the second number is greater than or equal to the target number threshold, then respectively detect the data objects that are isolated points in the data objects of the current cell.

[0173] After completing the cell division of user behavior data and calculating the dynamic number threshold of each cell, for each cell in each cell, detect the data objects in the cell that are isolated points according to the number of data objects in the cell and the dynamic number threshold of the cell. First, directly determine whether all data objects in each cell are isolated points or non-isolated points. When a data object is detected as an isolated point, an isolated point flag is set for the data object that is an isolated point. If the data object is a non-isolated point, the data object is not processed. If it is detected that not all data objects in the cell are isolated points or non-isolated points, isolated point detection is performed on all data objects in the cell respectively, and isolated point flags are set for the data objects detected as isolated points until all data objects in all cells are detected. Specifically, the system can sort the detection order of each cell according to a preset sorting method, such as sorting each cell by row-by-row detection or column-by-column detection, and perform isolated point detection on the data objects in each cell according to the sorted sequence. Furthermore, the system performs isolated point detection on the data objects in each cell according to the cell C that currently needs to be detected. x，y , get the number of data objects count in the current cell, compare the number of data objects count in the current cell with the dynamic number threshold M based on the current cell c The target number threshold M c +1 for comparison, if it is determined through comparison that the number of data objects count in the current cell is greater than or equal to the target number threshold M c +1, that is, count ≥ M c +1, then determine the current cell C x，y All data objects are non-isolated points; if the number of data objects count in the current cell is less than the target number threshold M c +1, which is count <M c +1, the sum of the number of data objects in the current cell count and the number of cells in the first preset neighborhood of the current cell count1 and count+count1 is compared with the target number threshold M c +1 for comparison. If it is determined through comparison that the first number and count+count1 are greater than or equal to the target number threshold M c +1, that is, count+count1≥M c +1, then determine the current cell C x，y All data objects in are non-isolated points. If the first number and count+count1 are determined to be less than the target number threshold M by comparison c+1, then the sum of the number of data objects in the current cell count, the number of cells in the first preset neighborhood of the current cell count1, and the number of cells in the second preset neighborhood of the current cell count2 and count+count1+count2 is added to the target number threshold M c +1 for comparison. If the comparison determines that the second number and count+count1+count2 are less than the target number threshold M c +1, all data objects in the current cell are determined to be isolated points, and isolated point identifiers are set for the data objects that are isolated points. If the sum of the first number of the current cell and count+count1 is determined to be less than the target number threshold M by comparison, c +1 and the second number and count+count1+count2 are greater than or equal to the target number threshold M c +1, then check the current cell C respectively x，y A data object that is an isolated point among all data objects.

[0174] Furthermore, the step of respectively detecting the data objects that are isolated points in the data objects of the current cell includes:

[0175] Step S481, for each target data object of the current cell, execute steps S482-S484 respectively;

[0176] Step S482, taking the current target data object as the origin and the preset length as the radius, determining a third preset neighborhood where the current target data object is located, and counting the number of data objects other than the current target data object in the third preset neighborhood;

[0177] Step S483, comparing the number of data objects other than the current target data object in the third preset neighborhood with the dynamic number threshold of the current cell;

[0178] Step S484: If the number of data objects other than the current target data object in the third preset neighborhood is less than the dynamic number threshold of the current cell, the current target data object is determined to be an isolated point.

[0179] When detecting the data objects that are isolated points in each data object of the current cell respectively, for each undetected target data object of multiple data objects in the cell, the system can sort the detection order of each target data object according to a preset sorting method, for example, sorting each target data object by row or column, and performing isolated point detection on each target data object according to the sorted sequence. Furthermore, for the target data object P that needs to be detected currently, the system first takes the current target data object P as the origin and the preset length as the radius to determine the third preset neighborhood where the current target data object P is located, and then counts the number of data objects other than the current target data object P in the third preset neighborhood as the number count of data objects of the current target data object P in the third preset neighborhood. p , count the number of data objects of the current target data object P in the third preset neighborhood p Initialized to the sum of the number of data objects in the current cell count and the number of cells in the first preset neighborhood of the current cell count1 minus one, that is, count p = count + count1 - 1, where the preset length is the length of the cell r, and the third preset neighborhood is the area formed in the data table with the target data object as the origin and the preset length as the radius. Further, the distance between the target data object P and the current cell C is calculated according to the preset distance calculation formula. x，y The distance between each data object in the second preset neighborhood is used to obtain multiple distance information, wherein the preset distance calculation formula is as shown in the following formula:

[0180]

[0181] Among them, d ij is the distance between two objects, w is the dimension information, k = 0, 1, 2, 3, ...; X ik is the value of the i-th object in the k-th dimension, X jk is the value of the jth object in the kth dimension.

[0182] Furthermore, the plurality of distance information are respectively compared with the distance threshold r0. When a distance information is obtained by each comparison and is less than or equal to the distance threshold, the number of data objects of the current target data object P in the third preset neighborhood is counted. p After the comparison between the multiple distance information and the distance threshold is completed, the system compares the number of data objects other than the current target data object in the third preset neighborhood with the dynamic number threshold Mc of the current cell, that is, the number of data objects in the third preset neighborhood of the current target data object count is calculated. pThe dynamic number threshold M of the current cell c If it is determined through comparison that the number of data objects other than the current target data object in the third preset neighborhood is less than the dynamic number threshold of the current cell, that is, the number count of data objects of the current target data object P in the third preset neighborhood is p Less than the dynamic number threshold M of the current cell c , then the current target data object P is determined to be an isolated point, and an isolated point flag is set for the current target data object.

[0183] This embodiment detects the data objects that are isolated points in each cell according to the number of data objects in each cell and the dynamic number threshold of each cell. It can accurately detect the data objects that are isolated points in each cell, avoid the data objects located at the edge nodes in the user behavior data from being misjudged as isolated points, and effectively improve the accuracy of isolated point detection.

[0184] Furthermore, the present application also provides a user behavior data detection device.

[0185] Reference Figure 8 , Figure 8 This is a functional module diagram of the first embodiment of the user behavior data detection device of the present application.

[0186] The user behavior data detection device comprises:

[0187] A calculation module 10 is used to obtain user behavior data and calculate a distance threshold between data objects in the user behavior data;

[0188] A division module 20, for dividing the user behavior data into cells according to the distance threshold, and respectively assigning each of the data objects to a corresponding cell to form a data table;

[0189] A determination module 30, configured to determine a number threshold of data objects in the data table based on the number of data objects in each of the cells, and to calculate a dynamic number threshold of each of the cells according to the number threshold;

[0190] The detection module 40 is used to detect the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells, and output the data objects that are isolated points in each of the cells as abnormal user behavior data.

[0191] In addition, the present application also provides a computer-readable storage medium on which a user behavior data detection program is stored. When the user behavior data detection program is executed by a processor, the steps of each embodiment of the above-mentioned user behavior data detection method are implemented.

[0192] In addition, the present application also provides a computer program product, including a computer program, which implements the steps of each embodiment of the above-mentioned user behavior data detection method when executed by a processor.

[0193] In the embodiments of the user behavior data detection device, equipment, computer-readable medium and computer program product of the present application, all the technical features of the above-mentioned user behavior data detection method embodiments are included, and the descriptions and explanations are basically the same as those of the above-mentioned user behavior data detection method embodiments, and will not be repeated here.

[0194] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0195] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0196] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes several instructions to enable a terminal device (which can be a fixed terminal, such as an IoT smart device, including smart air conditioners, smart lights, smart power supplies, smart routers and other smart homes; it can also be a mobile terminal, including smart phones, wearable networked AR / VR devices, smart speakers, self-driving cars and many other networked devices) to execute the methods described in the various embodiments of the present application.

[0197] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A user behavior data detection method, characterized in that: The user behavior data detection method comprises: Acquire user behavior data, and calculate distance thresholds between data objects in the user behavior data; Dividing the user behavior data into cells according to the distance threshold, and assigning each of the data objects to a corresponding cell to form a data table; Based on the number of data objects in each of the cells, determine a number threshold of data objects in the data table, and calculate a dynamic number threshold of each of the cells according to the number threshold; According to the number of data objects in each cell and the dynamic number threshold of each cell, the data objects that are isolated points in each cell are detected respectively, and the data objects that are isolated points in each cell are output as abnormal user behavior data; The step of obtaining user behavior data and calculating the distance threshold between each data object in the user behavior data includes: obtaining user behavior data, performing data abstraction and normalization processing on the user behavior data, and obtaining the user behavior data after data abstraction and normalization processing; determining the spatial size information of the data object of the user behavior data according to the dimension information and data vector information of the data object of the user behavior data; obtaining the number information of the data objects of the user behavior data, and calculating the distance threshold between each data object in the user behavior data according to the number information, dimension information and spatial size information of the data objects of the user behavior data; The step of dividing the user behavior data into cells according to the distance threshold includes: calculating cell division parameters based on dimensional information of data objects in the user behavior data and the distance threshold; dividing the user behavior data into cells according to the cell division parameters and data vector information of data objects in the user behavior data.

2. The user behavior data detection method according to claim 1, characterized in that: The step of determining the number threshold of the data objects in the data table based on the number of the data objects in each of the cells comprises: Sequentially acquiring the number of data objects in a first preset neighborhood of each of the cells to obtain a plurality of data object number values, wherein the first preset neighborhood is a set of all cells adjacent to the current cell; The data object quantity value with the largest value among the plurality of data object quantity values ​​is calculated with a preset coefficient to obtain a threshold value of the number of data objects in the first preset neighborhood of each cell.

3. The user behavior data detection method according to claim 2, characterized in that: The step of respectively calculating the dynamic number threshold of each of the cells according to the number threshold comprises: Sequentially obtaining the number of data objects in a second preset neighborhood of each of the cells, where the second preset neighborhood is a set of all cells that are separated from the current cell by a preset number of cells; The dynamic number threshold of each cell is calculated respectively according to the number of data objects in the first preset neighborhood of each cell, the number of data objects in the second preset neighborhood and the number threshold.

4. The user behavior data detection method according to claim 1, characterized in that: The step of detecting the data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and the dynamic number threshold of each of the cells comprises: For each of the cells, perform the following steps respectively: Obtaining the number of data objects in the current cell, and comparing the number of data objects in the current cell with a target number threshold value based on a dynamic number threshold value of the current cell; If the number of data objects in the current cell is greater than or equal to the target number threshold, then all data objects in the current cell are determined to be non-isolated points; If the number of data objects in the current cell is less than the target number threshold, comparing a first sum of the number of data objects in the current cell and the number of cells in a first preset neighborhood of the current cell with the target number threshold; If the sum of the first number is greater than or equal to the target number threshold, determining that all data objects of the current cell are non-isolated points; If the first number sum is less than the target number threshold, comparing the second number sum of the number of data objects in the current cell and the number of cells in the first preset neighborhood and the second preset neighborhood of the current cell with the target number threshold; If the sum of the second number is less than the target number threshold, determining that all data objects of the current cell are isolated points; If the sum of the second numbers is greater than or equal to the target number threshold, data objects that are isolated points in each data object of the current cell are detected respectively.

5. The user behavior data detection method according to claim 4, characterized in that: The step of respectively detecting the data objects that are isolated points in the data objects of the current cell comprises: For each target data object of the current cell, perform the following steps respectively: Taking the current target data object as the origin and the preset length as the radius, determining a third preset neighborhood where the current target data object is located, and counting the number of data objects other than the current target data object in the third preset neighborhood; Comparing the number of data objects other than the current target data object in the third preset neighborhood with the dynamic number threshold of the current cell; If the number of data objects other than the current target data object in the third preset neighborhood is less than the dynamic number threshold of the current cell, the current target data object is determined to be an isolated point.

6. The user behavior data detection method according to claim 3, characterized in that: After the step of determining the threshold value of the number of data objects in the data table based on the number of data objects in each of the cells, the method further includes: Determine whether each of the cells is a non-boundary cell according to the number of data objects in the first preset neighborhood and the second preset neighborhood of each of the cells; If there is a target cell that is a non-boundary cell among the cells, obtaining a first number of data objects in the target cell and a second number of data objects in a first preset neighborhood of the target cell, and comparing a third number of the first number and the second number with a non-boundary number threshold based on the number threshold; If the sum of the third number is greater than or equal to the non-boundary number threshold, determining that all data objects of the target cell are non-isolated points; If the third number sum is less than the non-boundary number threshold, obtaining a third number of data objects in a second preset neighborhood of the target cell, comparing the third number sum and a fourth number sum of the third number with the non-boundary number threshold, and if the fourth number sum is less than the non-boundary number threshold, determining that all data objects of the target cell are isolated points; If the sum of the fourth number is greater than or equal to the non-boundary number threshold, data objects that are isolated points in each data object of the target cell are detected respectively.

7. A user behavior data detection device, characterized in that: The user behavior data detection device comprises: A calculation module, used to obtain user behavior data and calculate the distance threshold between each data object in the user behavior data; A division module, used to divide the user behavior data into cells according to the distance threshold, and respectively assign each of the data objects to a corresponding cell to form a data table; A determination module, configured to determine a number threshold of data objects in the data table based on the number of data objects in each of the cells, and calculate a dynamic number threshold of each of the cells according to the number threshold; A detection module, configured to detect data objects that are isolated points in each of the cells according to the number of data objects in each of the cells and a dynamic number threshold of each of the cells, and output the data objects that are isolated points in each of the cells as abnormal user behavior data; The calculation module is further used to obtain user behavior data, perform data abstraction and normalization processing on the user behavior data, and obtain the user behavior data after data abstraction and normalization processing; determine the spatial size information of the data object of the user behavior data according to the dimension information and data vector information of the data object of the user behavior data; obtain the number information of the data objects of the user behavior data, and calculate the distance threshold between each data object in the user behavior data according to the number information, dimension information and spatial size information of the data objects of the user behavior data; The partitioning module is further used to calculate cell partitioning parameters based on the dimension information of the data objects in the user behavior data and the distance threshold; and to perform cell partitioning on the user behavior data according to the cell partitioning parameters and the data vector information of the data objects in the user behavior data.

8. A user behavior data detection device, characterized in that: The user behavior data detection device includes a memory, a processor, and a user behavior data detection program stored in the memory and executable on the processor. When the user behavior data detection program is executed by the processor, the steps of the user behavior data detection method according to any one of claims 1 to 6 are implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the user behavior data detection method according to any one of claims 1 to 6 are implemented.

Images