Behavior data classification processing method, apparatus, device, and storage medium

Abstract

The application provides a behavior data classification processing method and device, equipment and a storage medium, relates to the technical field of data processing, and the method comprises the following steps: receiving user behavior data sent by a first client, and determining target data according to the user behavior data; inputting the target data into a trained random forest model to obtain the results of each classification tree in the trained random forest model; determining a classification result corresponding to the user behavior data according to the proportion of abnormal results in all results in the results of each classification tree; and sending the classification result to a second client for display. The method provided by the application increases the accuracy of user behavior data classification.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus, device and storage medium for classifying and processing behavioral data. Background Technology

[0002] As more and more clickable and submitable content appears on web pages and in software, user behavior on these platforms becomes increasingly unpredictable, which can easily lead to security issues.

[0003] Currently, the classification and pre-classification of user behaviors that are likely to cause security problems are usually done manually.

[0004] However, due to the vast variety of user behaviors, manual classification of user behaviors is prone to omissions or errors, resulting in low classification accuracy. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for classifying and processing behavioral data to solve the problem of low accuracy in manual classification.

[0006] Firstly, this application provides a method for classifying and processing behavioral data, including:

[0007] The system receives user behavior data sent by the first client and determines the target data based on the user behavior data; it inputs the target data into a trained random forest model to obtain the results of each classification tree in the trained random forest model; it determines the classification result corresponding to the user behavior data based on the proportion of abnormal results in all results of each classification tree; and it sends the classification result to the second client for display.

[0008] In one possible implementation, before receiving user behavior data sent by the first client, the method further includes: acquiring historical user behavior data; receiving assignment information sent by the third client and assigning values ​​to the historical user behavior data according to the assignment information to obtain assigned historical user behavior data, wherein the assigned historical user behavior data includes normal data and abnormal data; determining standard historical user behavior data based on the assigned historical user behavior data; and training a random forest model using the standard historical user behavior data to obtain a trained random forest model.

[0009] In one possible implementation, standard historical user behavior data is determined based on the assigned historical user behavior data, including: using all abnormal data as the base data, calculating new abnormal data, and adding the new abnormal data to the abnormal data until the amount of abnormal data reaches a first preset proportion of the assigned historical user behavior data; and determining the assigned historical user behavior data containing abnormal data that reaches the first preset proportion as standard historical user behavior data.

[0010] In one possible implementation, new abnormal data is calculated based on all abnormal data as the base data, including: using any one of the abnormal data as the base data and another abnormal data as the auxiliary data, and then subtracting the base data from the auxiliary data to obtain the new abnormal data.

[0011] In one possible implementation, a random forest model is trained using standard historical user behavior data to obtain a trained random forest model. This includes: extracting a predetermined number of data points with replacement from the standard historical user behavior data as a training set, and using the remaining unextracted data as a test set; training the initial random forest model using the training set to obtain a random forest model to be determined; if the classification accuracy obtained by inputting the test set into the random forest model to be determined is less than a second predetermined proportion, then the steps of determining the standard historical user behavior data based on the assigned historical user behavior data are repeated, and the steps of establishing the training set and test set and training the model are continued until the classification accuracy exceeds the second predetermined proportion, thus obtaining a trained random forest model.

[0012] Secondly, this application provides a behavioral data classification and processing apparatus, comprising:

[0013] The target data determination module is used to receive user behavior data sent by the first client and determine the target data based on the user behavior data; the result acquisition module is used to input the target data into the trained random forest model and obtain the results of each classification tree in the trained random forest model; the classification result acquisition module is used to determine the classification result corresponding to the user behavior data based on the proportion of abnormal results in all results in each classification tree; and the classification result sending module is used to send the classification result to the second client for display.

[0014] In one possible implementation, the behavioral data classification and processing apparatus further includes:

[0015] The system comprises the following modules: a behavior data acquisition module for acquiring historical user behavior data; an assignment data acquisition module for receiving assignment information from a third client and assigning values ​​to the historical user behavior data based on this information, resulting in assigned historical user behavior data, which includes both normal and abnormal data; a standard data determination module for determining standard historical user behavior data based on the assigned historical user behavior data; and a model acquisition module for training a random forest model using the standard historical user behavior data, resulting in a trained random forest model.

[0016] Thirdly, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the behavioral data classification processing method as described in the first aspect above.

[0017] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the behavioral data classification processing method as described in the first aspect above.

[0018] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the behavioral data classification processing method as described in the first aspect above.

[0019] The behavioral data classification processing method, apparatus, device, and storage medium provided in this application obtain the results of all classification trees in the trained random forest model by inputting user behavior data into the model. The classification result is determined according to the proportion of abnormal results in each classification tree. This allows the trained random forest model to output more than just yes or no results. Furthermore, by considering the results of all classification trees, it can perform more refined classification of user behavior data, thereby improving classification accuracy. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] Figure 1 This is a schematic diagram illustrating an application scenario of the behavioral data classification and processing method provided in the embodiments of this application;

[0022] Figure 2 A flowchart illustrating the behavioral data classification and processing method provided in this application embodiment;

[0023] Figure 3 A schematic diagram of a behavioral data classification and processing device provided in this application embodiment. Figure 1 ;

[0024] Figure 4 A schematic diagram of a behavioral data classification and processing device provided in this application embodiment. Figure 2 ;

[0025] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0026] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0028] With the increasing number of software programs and websites on the internet, netizens enjoy greater freedom online. For internet service providers, the increased content that users can submit means more unpredictable user behavior, posing a greater risk of harm to their services. Currently, classifying user behavior into normal and abnormal operations can be done manually. However, due to the sheer volume and diverse paths of user actions, manual classification is prone to omissions or misclassifying normal operations as abnormal, resulting in low accuracy.

[0029] To address the issue of low accuracy in manual classification, this application provides the following technical concept: by inputting the obtained user behavior data into a random forest model, the results of each classification tree of the random forest model are obtained, and the user behavior data is classified using the proportion of abnormal results to all results in each classification tree of the random forest model, thereby improving the accuracy of classification and solving the problem of low classification accuracy.

[0030] This application is applied to scenarios involving the classification of user behavior data. The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein all comply with relevant laws and regulations and do not violate public order and good morals.

[0031] Figure 1 This is a schematic diagram illustrating an application scenario of the behavioral data classification and processing method provided in the embodiments of this application. For example... Figure 1 In this scenario, there are: a first client 101, a server 102, and a second client 103.

[0032] In the specific implementation process, the first client 101 is used to collect user behavior data and send the collected user behavior data to the server 102.

[0033] Server 102 is used to input user behavior data into a trained random forest model to obtain the results of each classification tree in the random forest model, determine the classification result corresponding to the user behavior data based on the results of each classification tree in the random forest model, and send the classification result to the second client 103.

[0034] The second client 103 is used to receive and display the classification results.

[0035] The first client 101 can be any device with data collection and transmission capabilities, including but not limited to computers, servers, tablets, mobile phones, PDAs (Personal Digital Assistants), and laptops. The server 102 can be implemented using one or more servers in a cluster, offering greater processing power and higher security. Where possible, computers or laptops with strong computing capabilities can also be used as alternatives. The second client 103 can include tablets, mobile phones, PDAs, computers connected to a monitor, and laptops.

[0036] The connection between the first client 101, the server 102, and the second client 103 can be via a wired connection or a wireless network connection. The network used for the wireless network connection can include various types of wired and wireless networks, such as, but not limited to: the Internet, local area network, Wireless Fidelity (WIFI), Wireless Local Area Networks (WLAN), cellular communication networks (General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), 2G / 3G / 4G / 5G cellular networks), satellite communication networks, etc.

[0037] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the behavioral data classification and processing method. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0038] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0039] Figure 2 This is a flowchart illustrating the behavioral data classification and processing method provided in this application embodiment. The execution entity of this application embodiment may be... Figure 1 The server 102 in this embodiment can also be a computer and / or other electronic devices such as a mobile phone; this embodiment does not impose any particular limitations on this. Figure 2 As shown, the method includes:

[0040] S201: Receive user behavior data sent by the first client and determine the target data based on the user behavior data.

[0041] In this step, user behavior data can be user behavior data generated after a user performs browsing, input, and / or clicking operations on the first client. Determining target data based on user behavior data can be achieved by extracting a portion of the user behavior data, obtaining the extracted user behavior data, and then encoding the extracted user behavior data to obtain the target data.

[0042] For example, user behavior data can include entry into the interface, entry time, clicks on links, the time of those clicks, request actions, request times, time intervals between actions, exiting the interface, and exit time. Extracting a portion of user behavior data can mean capturing all actions between two request actions, or capturing all actions between entering and exiting the interface. Encoding the extracted user behavior data can involve using WOE (Weight of Evidence) encoding.

[0043] S202: Input the target data into the trained random forest model to obtain the results of each classification tree in the trained random forest model.

[0044] In this step, the trained random forest model contains multiple classification trees, and the results of each classification tree include "normal behavior" and "abnormal behavior".

[0045] S203: Determine the classification result corresponding to the user behavior data based on the proportion of abnormal results to all results in each classification tree.

[0046] In this step, the abnormal result can be the "behavioral abnormality" result in step S202 above.

[0047] For example, risk levels can be categorized based on the proportion of abnormal results to the total results. For instance, 0% to 25% is considered no risk, 25% to 50% is low risk, 50% to 75% is medium risk, and 75% to 100% is high risk. Specifically, if a trained random forest model contains 100 classification trees, and 30 of them are abnormal results, then the proportion of abnormal results to the total results is 30%, and the classification result of the user behavior data can be determined as low risk. If a trained random forest model contains 100 classification trees, and 60 of them are abnormal results, then the proportion of abnormal results to the total results is 60%, and the classification result of the user behavior data can be determined as medium risk. The above risk level classification criteria are merely illustrative and are not intended to limit the embodiments of this application. Those skilled in the art will readily conceive of other implementation methods after reading the embodiments of this application.

[0048] S204: Send the classification results to the second client for display.

[0049] In this step, the classification result obtained in step S203 can be sent to the second client, and the second client will display the classification result on the screen.

[0050] As can be seen from the description of the above embodiments, the embodiments of this application obtain the results of all classification trees in the trained random forest model by inputting user behavior data into the trained random forest model, and determine the classification result according to the proportion of abnormal results in each classification tree to all results. This makes the trained random forest model not only used to output two results, yes or no, but also, since the results of all classification trees are considered, it can perform more refined classification of user behavior data, thereby improving classification accuracy.

[0051] In one possible implementation, before receiving the user behavior data sent by the first client in step S201 above, the method further includes:

[0052] S301: Obtain historical user behavior data.

[0053] In this step, historical user behavior data can be obtained from a data acquisition device, which may include a server, computer, etc. Alternatively, historical user behavior data can be obtained by recording user behavior data within a preset time period. The recording of user behavior data can be done by using data tracking points and then storing the obtained user behavior data.

[0054] S302: Receive the assignment information sent by the third client, and assign values ​​to the historical user behavior data according to the assignment information to obtain the assigned historical user behavior data, which includes normal data and abnormal data.

[0055] In this step, assigning values ​​to historical user behavior data may include converting the data in the historical user behavior data into corresponding numerical values, and may also include adding the judgment of whether the historical user behavior data is abnormal data to the historical user behavior data.

[0056] For example, request time data with a duration of less than 30 seconds can be converted to 1, request time data with a duration of 30 to 40 seconds can be converted to 2, and request time data with a duration of 40 to 60 seconds can be converted to 3. This application does not impose specific restrictions on the numerical values ​​obtained from the data conversion in historical user behavior data. Adding the judgment of whether the corresponding historical user behavior data is abnormal to the historical user behavior data can include adding "user behavior data normal" or "user behavior data abnormal" to the historical user behavior data. "User behavior data normal" can also be replaced by "0", and "user behavior data abnormal" can also be replaced by "1". It can also include adding risk level data to the historical user behavior data, such as "no risk", "low risk", "medium risk" or "high risk". Risk level data can also be replaced by numbers, such as the numerical risk level data "0", "1", "2" and "3".

[0057] S303: Determine standard historical user behavior data based on the assigned historical user behavior data.

[0058] In this step, the standard historical user behavior data can include abnormal data in the historical user behavior data that has been added using the smote method. The historical user behavior data with added abnormal data is then used as the standard historical user behavior data.

[0059] For example, if the total amount of current standard historical user behavior data is 100, of which 90 is normal data and 10 is abnormal data, then using the `smote` method to add abnormal data will also increase the amount of abnormal data to 90, bringing the total amount of data to 180. The amount of abnormal data to add can be preset, and the addition of abnormal data will stop once a certain percentage of the total data or a preset number is reached.

[0060] S304: Train a random forest model using standard historical user behavior data to obtain a trained random forest model.

[0061] In this step, training a random forest model may involve constructing classification trees in the random forest model using different data types. The data types are data types from standard historical user behavior data, such as request time and request object.

[0062] As can be seen from the description of the above embodiments, since there is relatively little abnormal data in the historical user behavior data, the embodiments of this application obtain standard historical user behavior data by assigning values ​​to the historical user behavior data and adding abnormal data to the assigned historical user behavior data, thereby ensuring the accuracy of the trained model and further improving the classification accuracy.

[0063] In one possible implementation, step S303 above, which determines the standard historical user behavior data based on the assigned historical user behavior data, includes:

[0064] S3031: Based on all abnormal data, calculate new abnormal data and add the new abnormal data to the abnormal data until the amount of abnormal data reaches the first preset proportion of the historical user behavior data assigned.

[0065] In one possible implementation, new abnormal data is calculated based on all abnormal data as the base data. Specifically, this includes: taking any one of the abnormal data as the base data and another abnormal data as the auxiliary data, and then subtracting the base data from the auxiliary data to obtain the new abnormal data.

[0066] In this step, since the abnormal data has been assigned values, new abnormal data can be obtained by subtracting the values ​​of two abnormal data. The difference can be the difference between each data type of the abnormal data, and the difference results of all data types can be obtained. The new abnormal data can be obtained by combining all the difference results.

[0067] For example, there are currently 10 abnormal data entries, where the content of the first abnormal data entry includes:

[0068] First request operation 1, first request time 30 seconds, second request operation 2, second request time 10 seconds, exit operation 0.

[0069] The second abnormal data includes:

[0070] First request operation 1, first request time 20 seconds, second request operation 2, second request time 5 seconds, exit operation 0.

[0071] The difference between the first and second abnormal data can then be calculated. A method for this difference in the first request time can be to use the first abnormal data as the base data and the second abnormal data as auxiliary data, substituting data of the same data type from both the first and second abnormal data into the following formula to obtain the new abnormal data value of the same data type:

[0072] x k =x i +(x i -xj )γ

[0073] Where, x k This indicates that the new abnormal data has a value of the same data type, x. i This indicates the value of the first abnormal data in the same data type, x. i This indicates the value of the first abnormal data in the same data type, and γ represents a random number between 0 and 1.

[0074] The difference yields new outlier data, for example:

[0075] First request operation 1, first request time 14 seconds, second request operation 2, second request time 7 seconds, exit operation 0.

[0076] In one possible implementation, any one of the abnormal data is used as the base data, and another abnormal data is used as the auxiliary data. Specifically, this includes finding the closest abnormal data based on the values ​​of various data types in any one abnormal data as the auxiliary data.

[0077] S3032: Historical user behavior data with an abnormal data volume reaching a first preset proportion is identified as standard historical user behavior data.

[0078] In this step, while creating new abnormal data, the total amount of abnormal data is recorded. When the total amount of abnormal data reaches the first preset proportion of the total amount of historical user behavior data assigned, the creation of new abnormal data stops, and the historical user behavior data assigned at this time is determined as standard historical user behavior data.

[0079] As can be seen from the description of the above embodiments, the present application provides a method for increasing the amount of abnormal data. By increasing the amount of abnormal data, the overfitting problem caused by random sampling can be effectively alleviated, and the trained random forest model can be classified more accurately.

[0080] In one possible implementation, step S304 above uses standard historical user behavior data to train a random forest model, resulting in a trained random forest model, specifically including:

[0081] S3041: Extract a preset number of data points with replacement from standard historical user behavior data as the training set, and use the remaining unextracted data as the test set.

[0082] In this step, a preset number of data points are extracted with replacement as the training set. This can be done by extracting data from the standard historical user behavior data without removing the data from the standard historical user behavior data, so that the data may still be extracted when extracting data in subsequent steps.

[0083] S3042: Train the initial random forest model using the training set to obtain the random forest model to be determined.

[0084] In this step, the number of classification trees can be preset before model training, with the default number of classification trees being the maximum possible value.

[0085] S3043: If the classification accuracy obtained by inputting the test set into the random forest model to be determined is less than the second preset ratio, then the step of determining the standard historical user behavior data based on the assigned historical user behavior data is re-executed, and the steps of establishing the training set and test set and training the model are continued until the classification accuracy obtained exceeds the second preset ratio, and the trained random forest model is obtained.

[0086] In this step, the classification results can include a risk level, i.e., "no risk," "low risk," "medium risk," or "high risk," and can also include "normal user behavior data" or "abnormal user behavior data." Comparing the obtained classification results with the actual data in the test set will determine whether the classification is correct.

[0087] As can be seen from the description of the above embodiments, the embodiments of this application provide a specific method for training a random forest model, which can establish a random forest model even without a random forest model.

[0088] Figure 3 A schematic diagram of a behavioral data classification and processing device provided in this application embodiment. Figure 1 .like Figure 3 As shown, the behavioral data classification and processing device 300 includes a target data determination module 301, a result acquisition module 302, a classification result acquisition module 303, and a classification result sending module 304.

[0089] The target data determination module 301 is used to receive user behavior data sent by the first client and determine target data based on the user behavior data.

[0090] The result acquisition module 302 is used to input the target data into the trained random forest model and obtain the results of each classification tree in the trained random forest model.

[0091] The classification result acquisition module 303 is used to determine the classification result corresponding to the user behavior data based on the proportion of abnormal results to all results in each classification tree.

[0092] The classification result sending module 304 is used to send the classification results to the second client for display.

[0093] Figure 4 A schematic diagram of a behavioral data classification and processing device provided in this application embodiment. Figure 2 .like Figure 4 As shown, the behavior data classification and processing device 300 also includes a behavior data acquisition module 305, a value data acquisition module 306, a standard data determination module 307, and a model acquisition module 308.

[0094] The behavior data acquisition module 305 is used to acquire historical user behavior data.

[0095] The assignment data acquisition module 306 is used to receive assignment information sent by the third client and assign values ​​to historical user behavior data according to the assignment information to obtain the assigned historical user behavior data, wherein the assigned historical user behavior data includes normal data and abnormal data.

[0096] The standard data determination module 307 is used to determine standard historical user behavior data based on the assigned historical user behavior data.

[0097] The model acquisition module 308 is used to train a random forest model using standard historical user behavior data to obtain a trained random forest model.

[0098] Continue to refer to Figure 4 .like Figure 4 As shown, the standard data determination module 307 is specifically used to calculate new abnormal data based on all abnormal data as base data, and to add the new abnormal data to the abnormal data until the amount of abnormal data reaches a first preset proportion of the assigned historical user behavior data. The assigned historical user behavior data containing abnormal data that reaches the first preset proportion is determined as standard historical user behavior data.

[0099] Continue to refer to Figure 4 .like Figure 4 As shown, the standard data determination module 307 is also used to take any one of the abnormal data as the basic data and another abnormal data as the auxiliary data, and perform a difference between the basic data and the auxiliary data to obtain new abnormal data.

[0100] Continue to refer to Figure 4 .like Figure 4As shown, the model acquisition module 308 is also used to extract a preset number of data points with replacement from the standard historical user behavior data as a training set, and use the remaining unextracted data as a test set. The initial random forest model is trained using the training set to obtain the random forest model to be determined. If the classification accuracy obtained by inputting the test set into the random forest model to be determined is less than a second preset proportion, the steps of determining the standard historical user behavior data based on the assigned historical user behavior data are repeated, and the steps of establishing the training and test sets and training the model continue until the classification accuracy exceeds the second preset proportion, at which point the trained random forest model is obtained.

[0101] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. For an example, please refer to [link to example]. Figure 5 As shown, the electronic device 500 may include a processor 501 and a memory 502 communicatively connected to the processor 501.

[0102] Memory 502 stores computer-executed instructions.

[0103] The processor 501 executes computer execution instructions stored in the memory 502 to implement the data classification processing method provided in any of the above embodiments.

[0104] Optionally, the memory 502 can be either standalone or integrated with the processor 501. When the memory 502 is a device independent of the processor 501, the electronic device may further include a bus for connecting the memory 502 and the processor 501.

[0105] This application also provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the technical solution of the data classification processing method in any of the above embodiments. Its implementation principle and beneficial effects are similar to those of the data classification processing method. Please refer to the implementation principle and beneficial effects of the data classification processing method. It will not be repeated here.

[0106] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the technical solution of the data classification processing method in any of the above embodiments. Its implementation principle and beneficial effects are similar to those of the data classification processing method, and can be found in the implementation principle and beneficial effects of the data classification processing method, which will not be repeated here.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0108] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0109] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0110] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0111] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0112] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0113] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0114] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0115] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0116] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0117] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0118] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method of processing behavioral data classification, characterized by, Applied to a server, comprising: receiving user behavior data sent by a first client, and determining target data according to the user behavior data; the user behavior data is data generated by at least one of the following operations on the first client: browsing, inputting, clicking; inputting the target data into a trained random forest model to obtain the results of each classification tree in the trained random forest model; determining a classification result corresponding to the user behavior data according to the proportion of abnormal results in all results in the results of each classification tree; the classification result includes a risk level, and the risk level is divided according to the proportion of abnormal results in total results; sending the classification result to a second client for display; Before the receiving user behavior data sent by a first client, further comprising: obtaining historical user behavior data; receiving assignment information sent by a third client, and converting data in the historical user behavior data into corresponding numerical values according to the assignment information, and adding the judgment of whether the historical user behavior data is abnormal data into the historical behavior data to obtain assigned historical user behavior data; taking any abnormal data in all abnormal data as basic data, determining another abnormal data closest to the basic data as auxiliary data according to the values of various data types in any abnormal data, performing difference value on the basic data and the auxiliary data to obtain new abnormal data, and adding the new abnormal data to the abnormal data until the data amount of the abnormal data reaches a first preset proportion of the assigned historical user behavior data; determining the assigned historical user behavior data with a data amount of abnormal data reaching the first preset proportion as standard historical user behavior data; training a random forest model using the standard historical user behavior data to obtain the trained random forest model.

2. The method of claim 1, wherein, The training of a random forest model using the standard historical user behavior data to obtain the trained random forest model comprises: extracting a preset number of data from the standard historical user behavior data with replacement as a training set, and taking the remaining data not extracted as a test set; training an initial random forest model using the training set to obtain a to-be-determined random forest model; if the correct rate of the classification result obtained by inputting the test set into the to-be-determined random forest model is less than a second preset proportion, re-executing the step of determining standard historical user behavior data according to the assigned historical user behavior data, and continuing to execute the steps of establishing the training set and the test set and model training until the correct rate of the classification result obtained exceeds the second preset proportion, and obtaining the trained random forest model.

3. A behavior data classification processing apparatus characterized by comprising: Comprising: a target data determination module configured to receive user behavior data sent by a first client, and determine target data according to the user behavior data; the user behavior data is data generated by at least one of the following operations on the first client: browsing, inputting, clicking; The result obtaining module is configured to input the target data into the trained random forest model to obtain results of each classification tree in the trained random forest model; and the classification result includes a risk level, which is divided according to a proportion of the abnormal result in total results. The classification result obtaining module is configured to determine a classification result corresponding to the user behavior data according to a proportion of abnormal results in results of each classification tree. The classification result sending module is configured to send the classification result to the second client for display. Further comprising: The behavior data obtaining module is configured to obtain historical user behavior data. The value assignment data obtaining module is configured to receive value assignment information sent by the third client, convert data in the historical user behavior data into corresponding numerical values according to the value assignment information, and add a judgment of whether the historical user behavior data is abnormal data into the historical behavior data to obtain value-assigned historical user behavior data. The standard data determining module is configured to take any abnormal data in all abnormal data as basic data, determine another abnormal data closest to the basic data as auxiliary data according to values of various data types in the basic data, perform a difference between the basic data and the auxiliary data to obtain new abnormal data, and add the new abnormal data to the abnormal data until a data amount of the abnormal data reaches a first preset proportion of the value-assigned historical user behavior data. The value-assigned historical user behavior data with a data amount of abnormal data reaching the first preset proportion is determined as standard historical user behavior data. The model obtaining module is configured to train a random forest model using the standard historical user behavior data to obtain the trained random forest model.

4. An electronic device, comprising: It comprises: A processor and a memory connected to the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the behavior data classification processing method in any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the behavior data classification processing method in any one of claims 1 to 2.

6. A computer program product, characterised in that, It comprises a computer program, which is executed by the processor to implement the behavior data classification processing method in any one of claims 1 to 2.

Images