Abnormal investment advisor user detection method and system based on behavior trajectory

Abstract

The present invention provides a method and system for detecting abnormal investment consultant users based on behavior trajectories, including: reading user behavior data and an existing abnormal user list; constructing a first user behavior trajectory, removing user behavior trajectories with less than 5 behavior points; coarse-graining the behavior time points of each user into time periods by day, and for each investment consultant, counting the number of associated users in each time period; dividing the time period into multiple time sets according to the user time distribution; converting the first user behavior trajectory into a second user behavior trajectory; mapping the user behavior trajectory to a high-dimensional space to obtain a behavior trajectory vector; calculating the similarity between users, and counting the similarities above a set threshold ε s The number of users; if the similarity of the candidate users is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then it is an abnormal user. The present invention can quickly detect abnormal investment advisory users, help quickly locate illegal users, and reduce company losses.

Description

Technical Field

[0001] The present invention relates to the technical field of behavior trajectory sequence modeling, and in particular to a method and system for detecting abnormal investment advisor users based on behavior trajectories. Background Art

[0002] With the rapid growth of the national economy, people's living standards have also been greatly improved, which has also attracted more people's attention to the topic of investment and financial management. Investment and financial management require certain technical requirements and information channels. A large number of customer demands and industry barriers have led to the rise of investment consultants. The vigorous development of mobile Internet technology has made the Internet a carrier for people to obtain communication information. Along with it is the release of various advertising information and the interference of some peer customers. Therefore, we need to efficiently detect these abnormal users. Abnormal peer customers in the network often bring problems to network security and information security, such as publishing advertisements, user privacy risks, and occupying network resources. Therefore, it is necessary to discover potential related users based on the behavioral trajectories between users and dig out the accomplices of existing abnormal users to maintain network security.

[0003] The invention patent with the publication number CN110113368B discloses a network behavior anomaly detection method based on the sub-trajectory pattern. First, the network traffic data is collected and converted into a user behavior trajectory sequence according to the definition of user behavior. Then, considering that network abnormal behavior generally occurs in a short period of time, the invention divides each behavior trajectory sequence into multiple sub-behavior sequences with a unified behavior pattern according to the minimum description length criterion. Then, the similarity of each sub-behavior sequence with other behavior sequences is calculated according to the word vector method and its density is obtained. Finally, the local abnormality degree of the sequence to be detected is comprehensively obtained according to the density-based anomaly detection method, and the abnormal behavior is determined according to its size.

[0004] The traditional method of similar user mining based on behavioral trajectories mainly compares the similarity between user trajectories through the longest common subsequence method, which cannot compare related behaviors. With the development and breakthroughs of deep learning technology, more and more deep models have achieved great results in the fields of images, texts and voices. Deep learning technology mainly captures sequence features by modeling sequences, and compares the similarity between trajectories through vector similarity. The segment vector model is developed on the basis of word vectors. It can model a paragraph of sequence and extract sequence features. However, it is a deep neural network based on bag of words, and its sequence modeling ability has certain limitations. The model results (LSTM and GRU) based on recurrent neural network (RNN) are insufficient in feature capture ability on longer sequences. In addition, due to the characteristics of RNN, it is impossible to train the model in parallel, which further reduces the training time of the model. The modeling method based on convolutional neural network (CNN) can also achieve good results. However, CNN needs to stack convolutional layers for long sequences to achieve the ability to capture long sequence features. Deep models mean more parameters, and model parameter adjustment becomes more difficult. Summary of the invention

[0005] In view of the defects in the prior art, the present invention provides a method and system for detecting abnormal investment advisor users based on behavior trajectories.

[0006] According to a method and system for detecting abnormal investment advisor users based on behavior trajectories provided by the present invention, the scheme is as follows:

[0007] In a first aspect, a method for detecting abnormal investment advisor users based on behavior trajectories is provided, the method comprising:

[0008] Step S1: Read user behavior data and the list of existing abnormal users;

[0009] Step S2: constructing a first user behavior trajectory according to the user activity time sorting in the user behavior data, and removing user behavior trajectories with less than 5 behavior points;

[0010] Step S3: The behavior time points of each user are coarsely granularized into time periods on a daily basis, and for each investment advisor, the number of associated users in each time period is counted;

[0011] Step S4: fitting the time distribution of the number of users associated with each investment advisor, and dividing the time period into multiple time sets according to the user time distribution;

[0012] Step S5: converting the first user behavior trajectory into the second user behavior trajectory according to the mapping between the user behavior time period and the partition set;

[0013] Step S6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector;

[0014] Step S7: Calculate the similarity between users based on the behavior trajectory vector of each candidate user, and count the similarities that are higher than the set threshold ε s The number of users;

[0015] Step S8: If the similarity of each candidate user is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then the user is marked as an abnormal user, otherwise it is not marked.

[0016] Preferably, step S4 comprises:

[0017] Step S4.1: Assume that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model that satisfies the following form:

[0018]

[0019] Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0, is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows:

[0020]

[0021] α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k and They are respectively represented as the mean and variance of the k-th model, which are estimated by maximizing the expected EM algorithm;

[0022] y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of each sub-model point in the mixed Gaussian model, which is the parameter to be solved;

[0023] Step S4.2: Estimating the final Gaussian mixture model parameters through the EM algorithm;

[0024] Step S4.3: Calculate the probability of each time period based on the obtained mixed Gaussian model Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1), the calculation formula is as follows:

[0025]

[0026] Step S4.4: If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets;

[0027] If the ratio θ (t,t+1) Greater than or equal to the set threshold ε t , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

[0028] Preferably, the EM algorithm solution step in step S4.1 includes:

[0029] Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model:

[0030]

[0031] Among them, y t is the observed value at time t, and T is the time period for all user activity distribution;

[0032] Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula:

[0033]

[0034] Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

[0035] Preferably, step S6 comprises:

[0036] Step S6.1: For a user behavior trajectory of length n, formalized as Tr = {x1, x2, ... x n}, x i represents user behavior, i = 1, 2, ..., n;

[0037] Step S6.2: The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sub-layers, namely a multi-head self-attention layer and a fully connected feed-forward neural network layer. Each sub-layer is followed by a residual connection and layer normalization operation;

[0038] Step S6.3: Each user behavior activity x is randomly initialized as a high-dimensional vector E, and the activity position in the sequence is encoded, and the calculation formula is as follows:

[0039]

[0040]

[0041] pos is the position of the behavior in the activity sequence, 2i is the vector position, d model is the preset vector dimension size. The position code P obtained according to this formula is added to the initialization vector E to generate the vector code X of activity x;

[0042] Step S6.4: The multi-head self-attention layer projects the inputs Q, K, and V through h different linear transformation layers, and finally concatenates the results of different attention layers, where Q, K, and V represent the query, key, and value in the attention mechanism, respectively;

[0043] Step S6.5: Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows:

[0044] FFN(X)=max(0,XW1+b1)W2+b2

[0045] Among them, W1, b1, W2 and b2 are network parameters;

[0046] Step S6.6: Finally, a fully connected layer and a Softmax layer are connected to predict the behavior of the masked position. The calculation method is as follows:

[0047] Output = Softmax(XW1+b1);

[0048] Step S6.7: Encode the behavior trajectory of each user according to the trained user trajectory embedding model to obtain the encoding vector of each behavior, and use the average of all behavior vectors to obtain the user's behavior trajectory vector T.

[0049] Preferably, the calculation formula of the multi-head self-attention layer in step S6.4 is as follows:

[0050] MultiHead(Q,K,V)=Concat(head1,head2,…,head h )W O

[0051] head i =Attention(Qwi Q ,KW i K ,VW i V )

[0052] W O is the weight matrix of the multi-head splicing result;

[0053] W i Q ,W i K ,W i V They are the weight matrices of Q, K, and V respectively;

[0054] MultiHead() represents a multi-head attention mechanism, which merges each attention model;

[0055] Concat() represents a merge operation, that is, the obtained vectors are concatenated;

[0056] Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula;

[0057] Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavior factor with an influence greater than the set value in the next layer;

[0058] The user behavior attention calculation formula uses the dot multiplication method:

[0059]

[0060] d k is the vector dimension size corresponding to each attention head, given by Calculation available;

[0061] X Q ,X K ,X V It refers to the vector representation of the original input X obtained by different weight matrices;

[0062] Represents X K The transposed matrix of

[0063] h represents the number of heads in the multi-head attention mechanism and is a set hyperparameter.

[0064] In a second aspect, a system for detecting abnormal investment advisor users based on behavior trajectories is provided, the system comprising:

[0065] Module M1: Read user behavior data and the list of existing abnormal users;

[0066] Module M2: constructing a first user behavior trajectory according to the user activity time order in the user behavior data, and removing user behavior trajectories with less than 5 behavior points;

[0067] Module M3: The behavior time points of each user are coarsely granularized into time periods by day, and for each investment advisor, the number of associated users in each time period is counted;

[0068] Module M4: Fit the time distribution of the number of users associated with each investment advisor, and divide the time period into multiple time sets according to the user time distribution;

[0069] Module M5: converting the first user behavior trajectory into the second user behavior trajectory according to the mapping between the user behavior time period and the partition set;

[0070] Module M6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector;

[0071] Module M7: Calculate the similarity between users based on the behavior trajectory vector of each candidate user, and count the similarities that are higher than the set threshold ε s The number of users;

[0072] Module M8: If the similarity of each candidate user is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then the user is marked as an abnormal user, otherwise it is not marked.

[0073] Preferably, the module M4 includes:

[0074] Step S4.1: Assume that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model that satisfies the following form:

[0075]

[0076] Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0,

[0077] is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows:

[0078]

[0079] α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k and They are respectively represented as the mean and variance of the k-th model, which are estimated by maximizing the expected EM algorithm;

[0080] y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of each sub-model point in the mixed Gaussian model, which is the parameter to be solved;

[0081] Step S4.2: Estimating the final Gaussian mixture model parameters through the EM algorithm;

[0082] Step S4.3: Calculate the probability of each time period based on the obtained mixed Gaussian model Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1) , the calculation formula is as follows:

[0083]

[0084] Step S4.4: If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets;

[0085] If the ratio θ (t,t+1) Greater than or equal to the set threshold ε t , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

[0086] Preferably, the EM algorithm solving step in the module M4.1 includes:

[0087] Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model:

[0088]

[0089] Among them, y t is the observed value at time t, and T is the time period for all user activity distribution;

[0090] Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula:

[0091]

[0092] Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

[0093] Preferably, the module M6 comprises:

[0094] Module M6.1: For a user behavior trajectory of length n, it is formalized as Tr = {x1, x2, ... x n}, x i represents user behavior, i = 1, 2, ..., n;

[0095] Module M6.2: The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sub-layers, namely a multi-head self-attention layer and a fully connected feedforward neural network layer. Each sub-layer is followed by a residual connection and layer normalization operation;

[0096] Module M6.3: Each user behavior activity x is randomly initialized as a high-dimensional vector E and encodes the activity position in the sequence. The calculation formula is as follows:

[0097]

[0098]

[0099] pos is the position of the behavior in the activity sequence, 2i is the vector position, d model is the preset vector dimension size. The position code P obtained according to this formula is added to the initialization vector E to generate the vector code X of activity x;

[0100] Module M6.4: The multi-head self-attention layer projects the inputs Q, K, and V through h different linear transformation layers, and finally concatenates the results of different attention layers, where Q, K, and V represent the query, key, and value in the attention mechanism, respectively;

[0101] Module M6.5: Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows:

[0102] FFN(X)=max(0,XW1+b1)W2+b2

[0103] Among them, W1, b1, W2 and b2 are network parameters;

[0104] Module M6.6: Finally, a fully connected layer and a Softmax layer are connected to predict the behavior of the masked position. The calculation method is as follows:

[0105] Output = Softmax(XW1+b1);

[0106] Module M6.7: According to the trained user trajectory embedding model, encode the behavior trajectory of each user to obtain the encoding vector of each behavior, and use the average of all behavior vectors to obtain the user's behavior trajectory vector T.

[0107] Preferably, the calculation formula of the multi-head self-attention layer in the module M6.4 is as follows:

[0108] MultiHead(Q,K,V)=Concat(head1,head2,…,head h )W O

[0109] head i =Attention(Qw i Q ,KW i K ,VW i V )

[0110] W O is the weight matrix of the multi-head splicing result;

[0111] W i Q ,W i K ,W i V They are the weight matrices of Q, K, and V respectively;

[0112] MultiHead() represents a multi-head attention mechanism, which merges each attention model;

[0113] Concat() represents a merge operation, that is, the obtained vectors are concatenated;

[0114] Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula;

[0115] Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavior factor with an influence greater than the set value in the next layer;

[0116] The user behavior attention calculation formula uses the dot multiplication method:

[0117]

[0118] d k is the vector dimension size corresponding to each attention head, given by Calculation available;

[0119] X Q ,X K ,X V It refers to the vector representation of the original input X obtained by different weight matrices;

[0120] Represents X K The transposed matrix of

[0121] h represents the number of heads in the multi-head attention mechanism and is a set hyperparameter.

[0122] Compared with the prior art, the present invention has the following beneficial effects:

[0123] 1. The present invention can aggregate user behaviors in the time dimension through the time attribute aggregation module, enhance the correlation in the time dimension, and reduce the discreteness of the behavior space;

[0124] 2. The user behavior sequence model in the present invention constructs a sequence model through contextual behavior states, maps user behavior states into a high-dimensional space, and quantifies the user's behavior preference characteristics. At the same time, the contextual sequence model can link behavior states with high correlation to improve user behavior similarity comparison;

[0125] 3. The user similarity calculation module in the present invention can efficiently mine potential abnormal users, including peers, risky users, etc., to reduce company losses;

[0126] 4. The present invention can discover potential related users based on the behavioral trajectories between users, dig out the accomplices of existing abnormal users, and maintain network security and information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0127] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0128] Figure 1 is a flow chart of the method of the present invention;

[0129] Figure 2 It is a method framework diagram of the present invention;

[0130] Figure 3 User behavior trajectory diagram. DETAILED DESCRIPTION

[0131] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0132] The embodiment of the present invention provides a method for detecting abnormal investment advisor users based on behavioral trajectories, which is used to detect abnormal investment advisor users, help quickly locate illegal users, and reduce company losses. By comparing the behavioral similarity between candidate users and known abnormal users, if the similarity of the candidate user exceeds a set threshold ε s The number of users exceeds the threshold ε n , then the user is considered to be an abnormal user, refer to Figure 1 As shown, the specific steps of this method are as follows:

[0133] Step S1: Read user behavior data and the list of existing abnormal users;

[0134] Step S2: constructing a first user behavior trajectory according to the user activity time sorting in the user behavior data, and removing user behavior trajectories with less than 5 behavior points;

[0135] Step S3: The behavior time points of each user are coarsely granularized into time periods on a daily basis, and for each investment advisor, the number of associated users in each time period is counted;

[0136] Step S4: Use the Gaussian mixture model to fit the time distribution of the number of users associated with each investment advisor, and divide the time period into multiple time sets according to the user time distribution.

[0137] Specifically, step S4 includes: assuming that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model that satisfies the following form:

[0138]

[0139] Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0, is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows:

[0140]

[0141] The Gaussian mixture model is a mixture model, the basic distribution is the Gaussian distribution, and k is a hyperparameter;

[0142] α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k and They are respectively represented as the mean and variance of the k-th model, which are estimated by the EM (Expectation-Maximization) algorithm; y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of each sub-model point in the mixed Gaussian model, which is the parameter to be solved.

[0143] Among them, the EM algorithm solution steps include:

[0144] Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model:

[0145]

[0146] Among them, y t is the observed value at time t, and T is the time period for all user activity distribution;

[0147] Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula:

[0148]

[0149] Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

[0150] The final Gaussian mixture model parameters are estimated by the EM algorithm;

[0151] According to the obtained mixed Gaussian model, calculate the probability of each time period Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1) , the calculation formula is as follows:

[0152]

[0153] If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets;

[0154] If the ratio θ (t,t+1) Greater than or equal to the set threshold εt , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

[0155] Step S5: According to the mapping between the user behavior time period and the partition set, the first user behavior trajectory is converted into the second user behavior trajectory; formally represented as Tr = {x1, x2, ... x n}, where x i =(u i ,t c ),u i is the investment advisor number, t c is a collection of associated times.

[0156] Step S6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector.

[0157] Specifically, step S6 includes: for a user behavior trajectory of length n, formalized as Tr = {x1, x2, ... x n}, x i Represents user behavior, i = 1, 2, ..., n; randomly select 15% of the behavior points in the user trajectory and mask them, of which 80% of the behaviors are replaced by masks, 10% of the behaviors are replaced by other random behaviors, and the remaining 10% remain unchanged. We predict the behavior through the context of the activity behavior.

[0158] The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sublayers, namely a multi-head self-attention layer and a fully connected feedforward neural network layer. Each sublayer is followed by a residual connection and a layer normalization operation; therefore, each sublayer output can be formally represented as sublayer_output = LayerNorm(X+SubLayer(X)), where LayerNorm() represents the layer normalization operation; SubLayer() represents the sublayer function mapping operation.

[0159] Each user behavior activity x is randomly initialized as a high-dimensional vector E and encodes the activity position in the sequence. The calculation formula is as follows:

[0160]

[0161]

[0162] pos is the position of the behavior in the activity sequence, 2i is the vector position, d modelIt is the preset vector dimension size. The position code P obtained according to this formula and the initialization vector E are added to generate the vector code X of the activity x.

[0163] The multi-head self-attention layer refers to projecting the inputs Q, K, and V through h different linear transformation layers, and finally concatenating the results of different attention layers, where Q, K, and V represent the query Query, key value Key, and value item Value in the attention mechanism respectively; the calculation formula is as follows:

[0164] MultiHead(Q,K,V)=Concat(head1,head2,…,head h )W O

[0165] head i =Attention(QW i Q ,KW i K ,VW i V )

[0166] W O is the weight matrix of the multi-head splicing result;

[0167] W i Q ,W i K ,W i V They are the weight matrices of Q, K, and V respectively;

[0168] MultiHead() represents a multi-head attention mechanism, which merges each attention model;

[0169] Concat() represents a merge operation, that is, the obtained vectors are concatenated;

[0170] Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula;

[0171] Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavioral factors with greater influence in the next layer;

[0172] The user behavior attention calculation formula uses the dot multiplication method:

[0173]

[0174] d k is the vector dimension size corresponding to each attention head, given by Calculation available;

[0175] X Q ,X K ,X V It refers to the vector representation of the original input X obtained by different weight matrices;

[0176] Represents X K The transposed matrix of

[0177] h represents the number of heads in the multi-head attention mechanism, which is usually a set hyperparameter.

[0178] Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows:

[0179] FFN(X)=max(0,XW1+b1)W2+b2

[0180] Among them, W1, b1, W2 and b2 are network parameters;

[0181] Finally, a fully connected layer and a Softmax layer are used to predict the behavior of the masked position. The calculation method is as follows:

[0182] Output = Softmax(XW1+b1).

[0183] According to the trained user trajectory embedding model, the behavior trajectory of each user is encoded to obtain the encoding vector of each behavior, and the user's behavior trajectory vector T is obtained by averaging all behavior vectors.

[0184] Step S7: Based on the behavior trajectory vector T of each candidate user, the similarity between users is calculated by cosine similarity, and the similarities above the set threshold ε are counted. s The number of users.

[0185] Step S8: If the similarity of each candidate user is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then the user is marked as an abnormal user, otherwise it is not marked.

[0186] The embodiment of the present invention provides a method and system for detecting abnormal investment advisor users based on behavioral trajectories. The time attribute aggregation module can aggregate the user's behavior in the time dimension, enhance the correlation in the time dimension, and reduce the discreteness of the behavioral space; the user behavior sequence model constructs a sequence model through the contextual behavior state, maps the user behavior state to a high-dimensional space, and quantifies the user's behavioral preference characteristics. At the same time, the context sequence model can link behavioral states with high correlation to improve the comparison of user behavior similarity; the user similarity calculation module can efficiently mine potential abnormal users, including peers, risky users, etc., to reduce company losses.

[0187] The present invention also provides a system for detecting abnormal investment advisor users based on behavior trajectories, the system comprising:

[0188] Module M1: Read user behavior data and the list of existing abnormal users;

[0189] Module M2: constructing a first user behavior trajectory according to the user activity time order in the user behavior data, and removing user behavior trajectories with less than 5 behavior points;

[0190] Module M3: The behavior time points of each user are coarsely granularized into time periods by day, and for each investment advisor, the number of associated users in each time period is counted;

[0191] Module M4: Fit the time distribution of the number of users associated with each investment advisor, and divide the time period into multiple time sets according to the user time distribution;

[0192] Module M5: converting the first user behavior trajectory into the second user behavior trajectory according to the mapping between the user behavior time period and the partition set;

[0193] Module M6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector;

[0194] Module M7: Calculate the similarity between users based on the behavior trajectory vector of each candidate user, and count the similarities that are higher than the set threshold ε s The number of users;

[0195] Module M8: If the similarity of each candidate user is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then the user is marked as an abnormal user, otherwise it is not marked.

[0196] Preferably, the module M4 includes:

[0197] Step S4.1: Assume that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model that satisfies the following form:

[0198]

[0199] Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0, is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows:

[0200]

[0201] α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k and They are respectively represented as the mean and variance of the k-th model, which are estimated by maximizing the expected EM algorithm;

[0202] y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of each sub-model point in the mixed Gaussian model, which is the parameter to be solved;

[0203] Step S4.2: Estimating the final Gaussian mixture model parameters through the EM algorithm;

[0204] Step S4.3: Calculate the probability of each time period based on the obtained mixed Gaussian model Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1) , the calculation formula is as follows:

[0205]

[0206] Step S4.4: If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets;

[0207] If the ratio θ (t,t+1) Greater than or equal to the set threshold ε t , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

[0208] Preferably, the EM algorithm solving step in the module M4.1 includes:

[0209] Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model:

[0210]

[0211] Among them, y t is the observed value at time t, and T is the time period for all user activity distribution;

[0212] Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula:

[0213]

[0214] Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

[0215] Preferably, the module M6 comprises:

[0216] Module M6.1: For a user behavior trajectory of length n, it is formalized as Tr = {x1, x2, ... x n}, x i represents user behavior, i = 1, 2, ..., n;

[0217] Module M6.2: The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sub-layers, namely a multi-head self-attention layer and a fully connected feedforward neural network layer. Each sub-layer is followed by a residual connection and layer normalization operation;

[0218] Module M6.3: Each user behavior activity x is randomly initialized as a high-dimensional vector E and encodes the activity position in the sequence. The calculation formula is as follows:

[0219]

[0220]

[0221] pos is the position of the behavior in the activity sequence, 2i is the vector position, d model is the preset vector dimension size. The position code P obtained according to this formula is added to the initialization vector E to generate the vector code X of activity x;

[0222] Module M6.4: The multi-head self-attention layer projects the inputs Q, K, and V through h different linear transformation layers, and finally concatenates the results of different attention layers, where Q, K, and V represent the query, key, and value in the attention mechanism, respectively;

[0223] Module M6.5: Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows:

[0224] FFN(X)=max(0,XW1+b1)W2+b2

[0225] Among them, W1, b1, W2 and b2 are network parameters;

[0226] Module M6.6: Finally, a fully connected layer and a Softmax layer are connected to predict the behavior of the masked position. The calculation method is as follows:

[0227] Output = Softmax(XW1+b1);

[0228] Module M6.7: According to the trained user trajectory embedding model, encode the behavior trajectory of each user to obtain the encoding vector of each behavior, and use the average of all behavior vectors to obtain the user's behavior trajectory vector T.

[0229] Preferably, the calculation formula of the multi-head self-attention layer in the module M6.4 is as follows:

[0230] MultiHead(Q,K,V)=Concat(head1,head2,…,head h )W O

[0231] head i =Atrention(QW i Q ,KW i K ,VW i V )

[0232] W O is the weight matrix of the multi-head splicing result;

[0233] W i Q ,W i K ,W i V They are the weight matrices of Q, K, and V respectively;

[0234] MultiHead() represents a multi-head attention mechanism, which merges each attention model;

[0235] Concat() represents a merge operation, that is, the obtained vectors are concatenated;

[0236] Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula;

[0237] Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavioral factors with greater influence in the next layer;

[0238] The user behavior attention calculation formula uses the dot multiplication method:

[0239]

[0240] d k is the vector dimension size corresponding to each attention head, given by Calculation available;

[0241] X Q ,X K ,X V It refers to the vector representation of the original input X obtained by different weight matrices;

[0242] Represents X K The transposed matrix of

[0243] h represents the number of heads in the multi-head attention mechanism and is a set hyperparameter.

[0244] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0245] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A method for detecting abnormal investment advisor users based on behavioral trajectories, characterized in that: include: Step S1: Read user behavior data and the list of existing abnormal users; Step S2: constructing a first user behavior trajectory according to the user activity time sequence in the user behavior data; Step S3: The behavior time points of each user are coarse-grained into time periods, and for each investment advisor, the number of associated users in each time period is counted; Step S4: fitting the time distribution of the number of users associated with each investment advisor, and dividing the time period into multiple time sets according to the time distribution of the number of users; Step S5: converting the first user behavior trajectory into a second user behavior trajectory according to the mapping between the user behavior time period and the time set; Step S6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector; Step S7: Calculate the similarity between the candidate user and the abnormal user based on the behavior trajectory vector of each candidate user, and count the similarities that are higher than the set threshold ε s The number of users; Step S8: If the similarity with the candidate user is higher than the set threshold ε s The number of abnormal users exceeds the set threshold ε n , then the candidate user is marked as an abnormal user, otherwise it is not marked; The step S6 comprises: Step S6.1: For a user behavior trajectory of length n, formalized as Tr = {x1, x2, ..., x n }, x i represents user behavior, i = 1, 2, ..., n; Step S6.2: The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sub-layers, namely a multi-head self-attention layer and a fully connected feed-forward neural network layer. Each sub-layer is followed by a residual connection and layer normalization operation; Step S6.3: Each user behavior activity x is randomly initialized as a high-dimensional vector E, and the activity position in the sequence is encoded, and the calculation formula is as follows: pos is the position of the behavior in the activity sequence, 2i is the vector position, d model is the preset vector dimension size. The position code P obtained according to this formula is added to the initialization vector E to generate the vector code X of activity x; Step S6.4: The multi-head self-attention layer projects the inputs Q, K, and V through h different linear transformation layers, and finally concatenates the results of different attention layers, where Q, K, and V represent the query, key, and value in the attention mechanism, respectively; Step S6.5: Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows: FFN(X)=max(0,XW1+b1)W2+b2 Among them, W1, b1, W2 and b2 are network parameters; Step S6.6: Finally, a fully connected layer and a Softmax layer are connected to predict the behavior of the masked position. The calculation method is as follows: Output = Softmax(XW1+b1); Step S6.7: Encode the behavior trajectory of each user according to the trained user trajectory embedding model to obtain the encoding vector of each behavior, and use the average of all behavior vectors to obtain the user's behavior trajectory vector T; The calculation formula of the multi-head self-attention layer in step S6.4 is as follows: MultiHead(Q,K,V)=Concat(head1,head2,...,head h )W O head i =Attention(QW i Q ,KW i K ,VW i V ) W O is the weight matrix of the multi-head splicing result; W i Q , W i K , W i V They are the weight matrices of Q, K, and V respectively; MultiHead() represents a multi-head attention mechanism, which merges each attention model; Concat() represents a merge operation, that is, the obtained vectors are concatenated; Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula; Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavior factor with an influence greater than the set value in the next layer; The user behavior attention calculation formula uses the dot multiplication method: d k is the vector dimension size corresponding to each attention head, given by Calculation available; X Q , X K , X V It refers to the vector representation of the original input X obtained by different weight matrices; Represents X K The transposed matrix of h represents the number of heads in the multi-head attention mechanism and is a set hyperparameter.

2. The abnormal investment advisor user detection method based on behavior trajectory according to claim 1 is characterized in that: In step S2, user behavior trajectories with less than a set number of behavior points are removed; The step S4 comprises: Step S4.1: Assume that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model of the following form: Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0, is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows: α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k , They are respectively represented as the mean and variance of the k-th model, estimated by the EM algorithm for maximizing expectation; y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of the kth model in the mixed Gaussian model, which is the parameter to be solved; Step S4.2: Estimating the final Gaussian mixture model parameters through the EM algorithm; Step S4.3: Calculate the probability of each time period based on the obtained mixed Gaussian model Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1) , the calculation formula is as follows: Where T is the time period of all user activity distribution; Step S4.4: If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets; If the ratio θ (t,t+1) Greater than or equal to the set threshold ε t , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

3. The abnormal investment advisor user detection method based on behavior trajectory according to claim 2 is characterized in that: The EM algorithm solution step in step S4.1 includes: Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model: Among them, y t is the observed value at time t; Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula: Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

4. A system for detecting abnormal investment advisor users based on behavioral trajectories, characterized in that: include: Module M1: Read user behavior data and the list of existing abnormal users; Module M2: constructing a first user behavior trajectory according to the user activity time order in the user behavior data, and removing user behavior trajectories with less than 5 behavior points; Module M3: The behavior time points of each user are coarsely granularized into time periods by day, and for each investment advisor, the number of associated users in each time period is counted; Module M4: Fit the time distribution of the number of users associated with each investment advisor, and divide the time period into multiple time sets according to the user time distribution; Module M5: converting the first user behavior trajectory into the second user behavior trajectory according to the mapping between the user behavior time period and the partition set; Module M6: performing sequence modeling on the second user's behavior trajectory, mapping the second user's behavior trajectory into a high-dimensional space, and obtaining a behavior trajectory vector; Module M7: Calculate the similarity between users based on the behavior trajectory vector of each candidate user, and count the similarities that are higher than the set threshold ε s The number of users; Module M8: If the similarity of each candidate user is higher than the set threshold ε s The number of users exceeds the set threshold ε n , then the user is marked as an abnormal user, otherwise it is not marked; The module M6 comprises: Module M6.1: For a user behavior trajectory of length n, it is formalized as Tr = {x1, x2, ..., x n }, x i represents user behavior, i = 1, 2, ..., n; Module M6.2: The sequence model uses the Transformer Encoder model, which consists of 6 identical layers, each of which consists of two sub-layers, namely a multi-head self-attention layer and a fully connected feedforward neural network layer. Each sub-layer is followed by a residual connection and layer normalization operation; Module M6.3: Each user behavior activity x is randomly initialized as a high-dimensional vector E and encodes the activity position in the sequence. The calculation formula is as follows: pos is the position of the behavior in the activity sequence, 2i is the vector position, d model is the preset vector dimension size. The position code P obtained according to this formula is added to the initialization vector E to generate the vector code X of activity x; Module M6.4: The multi-head self-attention layer projects the inputs Q, K, and V through h different linear transformation layers, and finally concatenates the results of different attention layers, where Q, K, and V represent the query, key, and value in the attention mechanism, respectively; Module M6.5: Calculate the fully connected feedforward neural network layer. The fully connected feedforward neural network layer is a two-layer fully connected layer. The first layer uses the ReLu activation function, and the second layer does not use the activation function. The calculation method is as follows: FFN(X)=max(0,XW1+b1)W2+b2 Among them, W1, b1, W2 and b2 are network parameters; Module M6.6: Finally, a fully connected layer and a Softmax layer are connected to predict the behavior of the masked position. The calculation method is as follows: Output = Softmax(XW1+b1); Module M6.7: Encode the behavior trajectory of each user according to the trained user trajectory embedding model to obtain the encoding vector of each behavior, and use the average of all behavior vectors to obtain the user's behavior trajectory vector T; The calculation formula of the multi-head self-attention layer in the module M6.4 is as follows: MultiHead(Q,K,V)=Concat(head1,head2,...,head h )W O head i =Attention(QW i Q ,KW i K ,VW i V ) W O is the weight matrix of the multi-head splicing result; W i Q , W i K , W i V They are the weight matrices of Q, K, and V respectively; MultiHead() represents a multi-head attention mechanism, which merges each attention model; Concat() represents a merge operation, that is, the obtained vectors are concatenated; Attention() represents the attention mechanism, and the specific calculation formula is shown in the following formula; Self-attention means that each input Q, K, V uses its own input X, that is, it compares itself with itself and selects the behavior factor with an influence greater than the set value in the next layer; The user behavior attention calculation formula uses the dot multiplication method: d k is the vector dimension size corresponding to each attention head, given by Calculation available; X Q , X K , X V It refers to the vector representation of the original input X obtained by different weight matrices; Represents X K The transposed matrix of h represents the number of heads in the multi-head attention mechanism and is a set hyperparameter.

5. The abnormal investment advisor user detection system based on behavior trajectory according to claim 4 is characterized in that: In the module M2, user behavior trajectories with less than a set number of behavior points are removed; The module M4 comprises: Step S4.1: Assume that the number of people associated with investment advisors and users satisfies a mixed Gaussian distribution over time, specifically a probability distribution model that satisfies the following form: Among them, α k is the weight coefficient, indicating α k is the weight of the kth model, satisfying α k ≥0, is the Gaussian distribution density, called the kth sub-model, The calculation formula is as follows: α k ,μ k , is the parameter in the Gaussian mixture model, α k is the weight of the kth model, μ k and They are respectively represented as the mean and variance of the k-th model, which are estimated by maximizing the expected EM algorithm; y represents the number of people associated with the advisor and the user in each time period t; Represents the variance of each sub-model point in the mixed Gaussian model, which is the parameter to be solved; Step S4.2: Estimating the final Gaussian mixture model parameters through the EM algorithm; Step S4.3: Calculate the probability of each time period based on the obtained mixed Gaussian model Calculate the ratio θ of the probabilities of adjacent time periods (t,t+1) , the calculation formula is as follows: Step S4.4: If the ratio θ (t,t+1) Less than the set threshold ε t , then time periods t+1 and t are divided into two time sets; If the ratio θ (t,t+1) Greater than or equal to the set threshold ε t , then time period t+1 and time period t are divided into the same time set, and finally the entire time period is divided into several time sets.

6. The abnormal investment advisor user detection system based on behavior trajectory according to claim 5 is characterized in that: The EM algorithm solution steps in the module M4.1 include: Initialize all parameters randomly and perform the expected E step operation: calculate the prior probability of the observation belonging to the kth sub-model: Among them, y t is the observed value at time t, and T is the time period for all user activity distribution; Perform the maximization M step operation: three parameters α to be solved k ,μ k , According to the prior probability γ obtained in the calculation expectation E step tk To update, calculate by the following formula: Repeat the operations of calculating the expected E step and maximizing the M step, iterating back and forth until the model converges.

Images