Abnormal behavior detection method, computing device and readable storage medium

Abstract

The present invention discloses an abnormal behavior detection method, a computing device and a readable storage medium, the method comprising the steps of: obtaining a behavior data sample set, the behavior data sample set comprising a plurality of behavior data samples; inputting the behavior data samples in the behavior data sample set into a trained autoencoder for processing to obtain output data; determining a sample error corresponding to each behavior data sample based on the input behavior data sample and the output data; determining a first threshold based on the sample errors corresponding to all behavior data samples; obtaining a first risk score corresponding to each behavior data sample based on the sample error of each behavior data sample and the first threshold; and determining whether the behavior data sample is abnormal based at least on the first risk score.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an abnormal behavior detection method, a computing device and a readable storage medium. Background Art

[0002] In the field of machine learning, labeled data is extremely valuable. In practical applications, labeling data sometimes incurs a lot of manpower and material costs, and also brings poor user experience to users. For example, on some car media platforms, users leave information about their car purchase intentions, that is, users leave their mobile phone numbers and other information about the car models they are interested in. This has always been the focus of attention of various car dealers and car media platforms. If such data is to be labeled, it is necessary to manually call back the mobile phone number left by the user to find out whether the behavior is voluntary or to confirm the authenticity of the behavior information. In the phone call, it is also difficult to confirm all behaviors. The phone call may not only make users feel that their personal information is violated, but also generate a lot of manpower and material output. Therefore, in practical applications, training on unlabeled data has a broad application scenario.

[0003] In the field of detecting abnormal user behavior, existing detection methods based on machine learning process features of business scenario data, train models, and conduct risk assessments based on model results. However, their disadvantage is that business personnel cannot understand the specific reasons why the model gives results, and the reliability of the results is insufficient.

[0004] Therefore, there is an urgent need for a method that can use unlabeled data to detect abnormal behavior and improve the accuracy of detection. Summary of the invention

[0005] To this end, the present invention provides an abnormal behavior detection method, a computing device, and a readable storage medium, in an effort to solve or at least alleviate at least one of the above problems.

[0006] According to one aspect of the present invention, there is provided an abnormal behavior detection method, which is executed in a computing device, and the method includes the steps of: obtaining a behavior data sample set, the behavior data sample set including a plurality of behavior data samples; inputting the behavior data samples in the behavior data sample set into a trained autoencoder for processing to obtain output data; determining a sample error corresponding to each behavior data sample based on the input behavior data sample and the output data; determining a first threshold based on the sample errors corresponding to all behavior data samples; obtaining a first risk score corresponding to each behavior data sample based on the sample error of each behavior data sample and the first threshold; and determining whether the behavior data sample is abnormal based at least on the first risk score.

[0007] Optionally, the abnormal behavior detection method according to the present invention also includes the steps of: evaluating the behavior data sample set based on a predetermined abnormal behavior detection strategy to obtain a second risk score corresponding to each behavior data sample; fusing the first risk score and the second risk score to obtain a third risk score corresponding to each behavior data sample.

[0008] Optionally, in the abnormal behavior detection method according to the present invention, the step of determining whether the behavior data sample is abnormal based on at least the first risk score includes: determining whether the behavior data sample is abnormal based on a third risk score.

[0009] Optionally, in the abnormal behavior detection method according to the present invention, the step of determining whether the behavior data sample is abnormal based on the third risk score includes: determining a threshold of the risk assessment level based on the third risk score corresponding to all behavior data samples; and determining the risk assessment level corresponding to the behavior data sample based on the threshold of the risk assessment level.

[0010] Optionally, in the abnormal behavior detection method according to the present invention, before the step of inputting the behavior data samples in the behavior data sample set into the trained autoencoder for processing, it also includes: preprocessing the behavior data sample set.

[0011] Optionally, in the abnormal behavior detection method according to the present invention, the behavior data sample includes at least one behavior data, wherein the step of preprocessing the behavior data sample set includes: if the behavior data included in a behavior data sample in the behavior data sample set has missing values, and the number of missing values ​​exceeds a first predetermined value of the total number of behavior data, then the behavior data sample is discarded; if the behavior data included in a behavior data sample in the behavior data sample set has missing values, but the number of missing values ​​does not exceed the first predetermined value of the total number of behavior data, then the missing values ​​of the behavior data sample are filled.

[0012] Optionally, in the abnormal behavior detection method according to the present invention, the step of filling the missing values ​​of the behavior data sample includes: if the behavior data corresponding to the missing values ​​included in the behavior data sample belongs to a continuous variable in the behavior data sample set, then taking the behavior data samples with values ​​corresponding to the behavior data in the behavior data sample set, performing mean calculation on the values ​​corresponding to the behavior data, and taking the result of the mean calculation as the missing value; if the behavior data corresponding to the missing values ​​included in the behavior data sample belongs to a discrete variable in the behavior data sample set, then taking the behavior data samples with values ​​corresponding to the behavior data in the behavior data sample set, and taking the mode of the values ​​corresponding to the behavior data as the missing value.

[0013] Optionally, in the abnormal behavior detection method according to the present invention, the step of determining the first threshold based on the sample errors corresponding to all behavior data samples includes: taking a second predetermined value of sample errors as the first threshold in descending order of the sample errors corresponding to all behavior data samples.

[0014] Optionally, in the abnormal behavior detection method according to the present invention, the first risk score corresponding to each behavior data sample is calculated by the following formula: mnodel_score(x i )=sigmoid(log(RMSE i )-log(threshold))where model_score(x i ) is the behavior data sample x i The corresponding first risk score, RMSE i Behavior data sample x i The corresponding root mean square error, threshold is the first threshold.

[0015] Optionally, in the abnormal behavior detection method according to the present invention, the behavior data sample includes behavior data within a predetermined period.

[0016] Optionally, in the abnormal behavior detection method according to the present invention, the behavior data includes at least one of: mobile phone number, recent search times for the reserved vehicle series, recent browse times for the reserved vehicle series, average browsing time for each reserved vehicle series, and recent reservation times for the mobile phone number.

[0017] Optionally, in the abnormal behavior detection method according to the present invention, the predetermined abnormal behavior detection strategy includes: at least one of the number of times the same behavior data appears within the first predetermined time and whether the relevant pages of the reserved car series are browsed within the second predetermined time before the user behavior.

[0018] According to another aspect of the present invention, a computing device is provided, comprising: one or more processors; and a memory; one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include instructions for executing the above-mentioned abnormal behavior detection method.

[0019] According to another aspect of the present invention, a computer-readable storage medium storing one or more programs is provided. The one or more programs include instructions. When the instructions are executed by a computing device, the computing device executes the above-mentioned abnormal behavior detection method.

[0020] According to the abnormal behavior detection method of the present invention, the behavioral data samples in the data sample set are evaluated based on the autoencoding model, and the risks contained in the behavioral data are scored based on the sample error and the threshold determined therefrom, so as to effectively detect abnormal behaviors and help purify platform data. Based on the risk score, the risk level of the behavioral data samples can be more clearly and intuitively known, providing effective data support for refined and differentiated precision marketing.

[0021] In addition, in a large number of application scenarios, data samples are unlabeled. It is reasonable and effective to use an unsupervised anomaly detection model, which can save a lot of manual labeling work.

[0022] However, due to the complexity of actual application scenarios, the use of unsupervised models alone often does not produce good results. Therefore, an abnormal behavior detection strategy is introduced to evaluate the behavioral data samples. A risk scoring scheme that combines the autoencoder and the abnormal behavior detection strategy is creatively proposed, which increases the reliability of abnormal behavior detection and greatly reduces the possible accidental injuries caused by unsupervised models. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0024] Figure 1 A schematic diagram of a computing device 100 according to one embodiment of the present invention is shown;

[0025] Figure 2 A flowchart of an abnormal behavior detection method 200 according to an embodiment of the present invention is shown; and

[0026] Figure 3 A flow chart of an abnormal behavior detection method 300 according to another embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] In various industries, user intention to leave information, that is, users leave information such as mobile phone numbers for products they are interested in for consultation, is very important information. Taking the automobile industry as an example, user intention to buy a car leaving information, that is, users leave information such as mobile phone numbers for a certain car model they are interested in, has always been the focus of automobile media platforms and dealers. The real leaving behavior greatly reflects the user's intention to buy a car, which is a very valuable marketing clue for the platform and dealers. However, false information from malicious users or competitors occupies a large amount of platform resources, and manual screening and filtering out false information also generates unnecessary cost expenditures. Although the platform can prevent the appearance of false information by adding SMS verification codes, the user's willingness to leave information will also be greatly reduced. Therefore, without adding SMS verification codes, how to effectively filter false information has become a key research topic for automobile media platforms.

[0029] The present invention proposes an abnormal behavior detection method in combination with an autoencoder algorithm. By constructing an autoencoder, an unsupervised model training is performed on the user's information, as well as the user's browsing behavior, browsing time, browsing car type, search behavior and other multi-dimensional data before leaving information. The user's behavior data is scored through the model, or the user's behavior data is scored in combination with an abnormal behavior detection strategy, so as to improve the accuracy of detecting abnormal user information leaving behavior.

[0030] The present invention provides an abnormal behavior detection method, which is executed in a computing device. Figure 1 FIG. 1 is a schematic diagram of a computing device 100 according to an embodiment of the present invention. It should be noted that: Figure 1 The computing device 100 shown is only an example. In practice, the computing device used to implement the abnormal behavior detection method of the present invention can be any type of device, and its hardware configuration can be different from the above. Figure 1 The computing device 100 shown is the same as Figure 1 The computing device 100 shown is different. In practice, the computing device used to implement the abnormal behavior detection method of the present invention can be Figure 1 The hardware components of the computing device 100 shown are increased or deleted, and the present invention does not limit the specific hardware configuration of the computing device.

[0031] The structural block diagram of the computing device 100 is as follows: Figure 1 As shown, in a basic configuration 102, computing device 100 typically includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0032] Depending on the desired configuration, the processor 104 can be any type of processor, including but not limited to: a microprocessor (μP), a microcontroller (μC), a digital information processor (DSP), or any combination thereof. The processor 104 can include one or more levels of cache such as a first-level cache 110 and a second-level cache 112, a processor core 114, and registers 116. An example processor core 114 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 can be used with the processor 104, or in some implementations, the memory controller 118 can be an internal part of the processor 104.

[0033] Depending on the desired configuration, the system memory 106 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 106 may include an operating system 120, one or more applications 122, and program data 124. In some embodiments, the application 122 may be arranged to operate on the operating system using the program data 124. The program data 124 includes instructions, and in the computing device 100 according to the present invention, the program data 124 includes instructions for executing a program to debug the abnormal behavior detection method 200 or 300 of the present invention.

[0034] The computing device 100 further includes a storage device 132, which includes a removable storage 136 and a non-removable storage 138, and both the removable storage 136 and the non-removable storage 138 are connected to the storage interface bus 134. In the present invention, data related to each event occurring during program execution and time information indicating the occurrence of each event can be stored in the storage device 132, and the operating system 120 is suitable for managing the storage device 132. The storage device 132 can be a disk.

[0035] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0036] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be carried out in a manner that encodes information in the signal. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0037] The computing device 100 can be implemented as a server, such as a file server, a database server, an application server, and a WEB server, etc., or can be implemented as a part of a small-sized portable (or mobile) electronic device, such as a cellular phone, a personal digital assistant (PDA), a personal media player device, a wireless network browsing device, a personal head-mounted device, an application-specific device, or a hybrid device that can include any of the above functions. The computing device 100 can also be implemented as a personal computer including a desktop computer and a notebook computer configuration. In some embodiments, the operating system 120 of the computing device 100 is configured to execute an abnormal behavior detection method according to the present invention.

[0038] Figure 2 FIG. 2 is a flow chart of an abnormal behavior detection method 200 according to an embodiment of the present invention. The method 200 is suitable for being executed in the computing device 100 as described above. Figure 2 As shown, the method 200 starts at step S210 .

[0039] In step S210, a behavior data sample set is obtained, where the behavior data sample set includes a plurality of behavior data samples.

[0040] According to an embodiment of the present invention, the behavior data sample may include behavior data within a predetermined period, for example, behavior data collected within one day. The behavior data includes at least one of: the number of mobile phone numbers left, the number of recent searches for the car series left, the number of recent views of the car series left, the average browsing time of the car series left, and the number of recent views of the mobile phone number. The behavior data may also include: the number of views of the car series, the time of viewing the car series, the number of views of the car series word-of-mouth information, the time of viewing the car series word-of-mouth information, the type of the car series to which the car series is viewed, the number of searches for the car series, the number of searches for the car series, the frequency of searches for the car series, the number of views with the same mobile phone number, the frequency of views with the same mobile phone number, forum posting and replying behavior, such as the car series mentioned by the user in the forum posting or replying, the number of times the user mentioned a certain car series in the forum posting or replying, and the section where the user posted or replied belongs to which car series, etc. Leaving information means that the user left information, and leaving information for the car series means that the car series is the user's intended car series, and the user left information for the car series.

[0041] Examples of collected behavioral data samples are shown in the following table:

[0042]

[0043] Table 1

[0044] The behavior data sample examples shown in Table 1 include the behavior data such as the user's mobile phone number, the number of searches for the car series in the past three days, the number of views of the car series in the past three days, the number of views of the car series in the past three days, the average browsing time, the number of times the mobile phone number has been left in the past three days, and the number of times the mobile phone number has been left within 1 hour. In this example, the first two rows of behavior data samples, i.e., the behavior data corresponding to the user's mobile phone numbers 130****5678 and 130****1234, all have corresponding values, the data is complete, and there are no missing values, while the third row of behavior data samples, i.e., the behavior data corresponding to the user's mobile phone number 130****0000, only has a value for the number of times the mobile phone number has been left within 1 hour, and the values ​​of other behavior data are missing. In the data preprocessing stage, the behavior data with missing values ​​will be processed.

[0045] It should be noted that the abnormal behavior detection method of the present invention is applicable to the behavior data sample set of the present invention, and may also be applicable to other behavior data sample sets, for example, user behavior data sample sets of industries other than the automotive industry, but is not limited thereto.

[0046] In step S220, the behavior data samples in the behavior data sample set are input into the trained autoencoder for processing to obtain output data.

[0047] Optionally, before the behavior data samples in the behavior data sample set are input into the trained autoencoder, the behavior data sample set is preprocessed.

[0048] Specifically, the behavior data samples are processed according to their sparsity, including processing missing values ​​in the behavior data samples. Some data samples have missing values. For example, in the behavior data sample in the third row of Table 1, i.e., the behavior data corresponding to the user's mobile phone number 130****0000, only the number of times the user left information within 1 hour has a value, and the values ​​of other behavior data are all missing, i.e., other behavior data have missing values.

[0049] Regarding the step of processing the missing values ​​of the behavior data samples in the behavior data sample set, first, determine whether the behavior data sample has missing values. If the behavior data in the behavior data sample does not have missing values, no processing is performed. If the behavior data included in the behavior data sample has missing values, and the number of missing values ​​exceeds the first predetermined value of the total number of behavior data, the behavior data sample is discarded. Since when the number of missing values ​​exceeds the first predetermined value of the total number of behavior data, the number of missing values ​​is too large, it can be inferred that the data quality of this behavior data sample is low, so the behavior data sample is discarded to improve the quality of the behavior data sample, thereby improving the accuracy of abnormal behavior detection. If the behavior data included in the behavior data sample has missing values, but the number of missing values ​​does not exceed the first predetermined value of the total number of behavior data, the missing values ​​of the behavior data sample are filled.

[0050] Regarding the steps of filling the missing values ​​of the behavior data samples, first, determine what type of variable the behavior data corresponding to the missing value belongs to in the behavior data sample set. If the behavior data corresponding to the missing value included in the behavior data sample belongs to a continuous variable in the behavior data sample set, then take the behavior data sample with a value corresponding to the behavior data in the behavior data sample set, perform mean calculation on the value corresponding to the behavior data, and use the result of the mean calculation as the missing value. For example, in a behavior data sample set containing many behavior data samples, the value of a behavior data included in behavior data sample 1 is 6, the value of the same behavior data included in behavior data sample 2 is 10, and the value of the same behavior data included in behavior data sample 3 is missing, and the remaining behavior data samples are omitted here. If behavior data sample 3 meets the condition that the number of missing values ​​does not exceed the first predetermined value of the total number of behavior data, and the behavior data belongs to a continuous variable in this behavior data sample set, then take the value 6 of the behavior data corresponding to data sample 1, the value 10 of the behavior data corresponding to data sample 2, and the value corresponding to the same behavior data in the remaining behavior data samples, perform mean calculation, and use the result of the mean calculation as the missing value of the behavior data in data sample 3 for filling.

[0051] If the behavior data corresponding to the missing value included in the behavior data sample belongs to a discrete variable in the behavior data sample set, then the behavior data sample with a value corresponding to the behavior data in the behavior data sample set is taken, and the mode of the value corresponding to the behavior data is taken as the missing value. For example, in a behavior data sample set containing many behavior data samples, the value of a behavior data included in behavior data sample 1 is 8, the value of the same behavior data included in behavior data sample 2 is 10, and the value of the same behavior data included in behavior data sample 3 is missing, and the remaining behavior data samples are omitted here. If behavior data sample 3 meets the condition that the number of missing values ​​does not exceed the first predetermined value of the total number of behavior data, and the behavior data belongs to a discrete variable in this behavior data sample set, then the value of the behavior data corresponding to data sample 1 is 8, the value of the behavior data corresponding to data sample 2 is 10, and the values ​​corresponding to the same behavior data in the remaining behavior data samples are taken, and the mode thereof is obtained to fill the missing value of the behavior data in data sample 3.

[0052] Discarding behavioral data samples with too many missing values ​​and filling in behavioral data samples with fewer missing values ​​can eliminate low-quality samples and improve the quality of samples with fewer missing values, overcome the problem of abnormal behavior detection errors caused by missing values, and improve the accuracy of abnormal behavior detection.

[0053] Regarding the selection of the first predetermined value, for example, it can be set to 50%. Of course, the first predetermined value can also be set according to the actual business scenario. For example, if the number of samples in the specific behavior data sample set collected is small, the first predetermined value is set to a larger percentage, such as 80%, so as to retain as many behavior data samples as possible. If the number of samples in the specific behavior data sample set collected is small, the first predetermined value is set to a smaller percentage, such as 20%, so as to eliminate data samples with incomplete information as much as possible. The present invention does not limit the selection of the specific numerical value of the first predetermined value.

[0054] Preprocessing the behavior data sample set may also include: processing abnormal values ​​in the behavior data samples, feature derivation, data segmentation, data encoding, etc.

[0055] According to one embodiment of the present invention, abnormal values ​​of behavior data in a behavior data sample are processed. Whether the value corresponding to each behavior data included in the data sample is an abnormal value can be defined by a person skilled in the art according to specific business. For example, if the value corresponding to the number of times a mobile phone number for leaving information within 1 hour is greater than 60, the value corresponding to the behavior data is determined as an abnormal value.

[0056] According to one embodiment of the present invention, in the case where the original features are not sufficient to establish a good auto-encoding model, it is necessary to derive features, that is, to construct new features, wherein the features refer to the behavioral data in the behavioral data sample. Feature derivation can be done in a counting manner, for example, counting the number of searches for the reserved vehicle series in the past week, and can also be based on existing features. In-depth analysis, for example, the location of the reserved mobile phone number, whether the reserved mobile phone number is a virtual operator, and the information filled in by the user can also be added to the features, such as the user's age, gender, education, occupation and other information.

[0057] According to an embodiment of the present invention, features are segmented according to specific business needs. For example, the number of views of a certain car series in the past three days is segmented into 0-5 times, 5-10 times, 10-15 times...

[0058] In step S230, based on the input behavior data sample and the output data, a sample error corresponding to each behavior data sample is determined, wherein the sample error may be a root mean square error.

[0059] The sample error corresponding to each behavior data sample can be constructed by the following formula:

[0060]

[0061] Among them, RMSE i For sample x i The root mean square error, x t For sample xi The t-th feature of (the t-th input to the encoder), p t is the output value after decoding the tth feature, and N is the total number of features.

[0062] Optionally, the sample error may also be the average error.

[0063] Then, in step S240, a first threshold is determined based on sample errors corresponding to all behavior data samples.

[0064] Specifically, all behavior data samples are sorted in descending order according to the sample errors corresponding to them, and the second predetermined value of sample errors is taken as the first threshold. Optionally, the 95% percentile value is selected, that is, the second predetermined value is selected as 95%*N, where N is the number of all behavior data samples. If the sample error between a certain input behavior data sample and the output data is greater than the first threshold, the behavior data sample is identified as abnormal behavior.

[0065] However, as time goes by, the distribution of positive and negative samples will also change, which will cause the distribution of sample errors to change, and then lead to instability in the first risk score derived by the model. In order to reduce accidental injuries, the present invention creatively adopts a method of dynamically adding thresholds, redetermining the first threshold every predetermined period according to the specific quantile of the sample error of the full amount of samples in the period, and dynamically adjusting the abnormal proportion of each predetermined period, so that the result of the autoencoder model reaches a stable state relative to the changing business data. For example, the first threshold is redetermined every day according to the 95% quantile of the full amount of the day's root mean square error, so as to achieve the purpose of dynamically adjusting the first threshold according to the determined abnormal proportion every day.

[0066] According to another embodiment of the present invention, the autoencoder used can be obtained by training. Among them, the autoencoder can be a variational autoencoder. The variational autoencoder includes three parts: an encoder, a decoder, and a loss function. The difference between the behavior data sample input to the variational autoencoder and the output data output by the variational autoencoder can be known by calculating the loss function. The loss can be reconstructed by gradient descent to reduce the difference between the input and output data.

[0067] In a large number of application scenarios, for example, in automobile media platforms, users' willingness to leave information is usually to inquire about car prices and other car purchase information. In scenarios like this, most of the information left is true, and only a small number of malicious users will leave false mobile phone numbers. In this way, the number of positive samples (i.e., abnormal information-leaving behavior data samples) is far less than that of negative samples (i.e., normal information-leaving behavior data samples). Due to the large difference in the number of positive and negative samples, the effect of fitting negative samples by the trained model will be better than that of fitting positive samples, causing overfitting for negative samples with a large sample ratio. In this way, the overall effect of the model is poor, which greatly reduces the generalization ability of the model.

[0068] In this regard, the positive and negative samples can be distinguished by the determined first threshold, and the behavioral data samples with sample errors greater than the first threshold are determined as positive samples, and the behavioral data samples with sample errors less than the first threshold are determined as negative samples. Then, sample balance can be achieved by increasing the number of minority samples by oversampling, or by reducing the number of majority samples by undersampling. Different penalty weights can also be adopted for positive and negative samples, for example, high weights for minority samples and low weights for majority samples. The method of dynamically adjusting the first threshold as described above can reduce false positives, that is, reduce the situation where negative samples are mistakenly classified as positive samples, and improve the accuracy of the model.

[0069] In step S250, a first risk score corresponding to each behavior data sample is obtained based on the sample error of each behavior data sample and the first threshold determined in the above steps.

[0070] The first risk score corresponding to each behavior data sample can be calculated by the following formula:

[0071] mnodel_score(x i )=sigmoid(log(RMSE i )-log(threshold))

[0072] Among them, mnodel_score(x i ) is the behavior data sample x i The corresponding first risk score, RMSE i Behavior data sample x i The corresponding root mean square error, threshold is the first threshold.

[0073] The outliers obtained by the autoencoder need to be transformed by logarithmic transformation and sigmoid function to map the first risk score obtained by the autoencoder model to the interval [0,1], so that the first risk score can be integrated with the risk score obtained by other methods in the same numerical dimension.

[0074] In step S260, it is determined whether the behavior data sample is abnormal based on at least the first risk score.

[0075] According to one embodiment of the present invention, whether a behavior data sample is abnormal can be determined based only on the first risk score. First, based on the first risk scores corresponding to all behavior data samples, a threshold of the risk assessment level is determined, and secondly, based on the determined threshold of the risk assessment level, a risk assessment level corresponding to the behavior data sample is determined. According to one embodiment of the present invention, the risk assessment level can be composed of multiple levels, and then based on the threshold of each risk assessment level, it is determined to which risk assessment level the behavior data sample belongs.

[0076] Optionally, the threshold of the risk assessment level can be set according to business needs, or it can be determined by referring to the 3σ criterion. For example, if the first risk score conforms to the rule of normal distribution, the threshold of the risk assessment level can be set to four levels: μ-σ, μ, and μ+σ, where μ represents the average value of all first risk scores, σ represents the standard deviation of all first risk scores, and the behavior data samples with the first risk score between 0 and μ-σ have the lowest risk, the behavior data samples with the first risk score between μ-σ and μ have a lower risk, the behavior data samples with the first risk score between μ and μ+σ have a higher risk, and the behavior data samples with the first risk score between μ+σ and 1 have the highest risk.

[0077] After step S260, the following steps may also be included: Figure 3 The steps shown, Figure 3 FIG. 3 is a diagram showing an abnormal behavior detection method 300 according to another embodiment of the present invention. The method 300 starts with step S310 .

[0078] In step S310, the behavior data sample set is evaluated based on a predetermined abnormal behavior detection strategy to obtain a second risk score corresponding to each behavior data sample.

[0079] In the scenario of leaving information on the car media platform, the predetermined abnormal behavior detection strategy includes: the number of times the same behavior data appears within the first predetermined time, and whether the relevant pages of the behavior car series are browsed within the second predetermined time before the user behavior. For example, the number of times the same user device leaves information on the same car series within 10 minutes, the more times, the higher the possibility that the information left by the user device is abnormal behavior; another example: the user with the same mobile phone number did not browse the relevant industry of the car series within 1 hour before leaving information on a certain car series, then the possibility that the user's information is abnormal behavior is high. Therefore, some abnormal behaviors can also be effectively screened out through the predetermined abnormal behavior detection strategy. Among them, the specific values ​​of the first predetermined time and the second predetermined time can be set by those skilled in the art according to the specific application scenario, and the present invention does not limit it by comparison.

[0080] Specifically, the second risk score can be generated by the following formula:

[0081]

[0082] Among them, rules_score(x i ) is the sample x i The second risk score, r j (x i ) is the sample x i The characteristic value of the j-th abnormal behavior detection strategy.

[0083] The behavior data sample set is evaluated by a predetermined abnormal behavior detection strategy, and the obtained abnormal values ​​need to be transformed by logarithm and sigmoid function to map the second risk score to the interval [0, 1], so that the second risk score can be integrated with the risk score obtained by other methods in the same numerical dimension.

[0084] Then, in step S320, the first risk score and the second risk score are fused to obtain a third risk score corresponding to each behavior data sample.

[0085] According to one embodiment of the present invention, the third risk score is constructed by the following formula:

[0086] final_score(x i )=a*model_score(x i )+b*rules_score(x i )

[0087] a+b=1

[0088] Among them, final_score(x i ) is the sample x i The third risk score, model_score(x i ) is the sample x i The first risk score, rules_score(x i ) is the sample x i a is the weight assigned to the first risk score, and b is the weight assigned to the second risk score.

[0089] The present invention judges whether the behavior data sample is abnormal behavior and the abnormal behavior level by fusing the risk score obtained by the autoencoder with the risk score obtained by the predetermined abnormal behavior detection strategy. The final score not only combines the advantages of the autoencoder model and the abnormal behavior detection strategy, but also has a certain degree of interpretability and increases the reliability and accuracy of the results.

[0090] According to one embodiment of the present invention, the step of step S260 includes: determining whether the behavior data sample is abnormal based on the third risk score. Whether the behavior data sample is abnormal can be determined in combination with the first risk score and the second risk score. First, based on the third risk score corresponding to all behavior data samples, the threshold of each risk assessment level is determined. Secondly, based on the threshold of each risk assessment level, the risk assessment level corresponding to the behavior data sample is determined.

[0091] Optionally, the threshold of the risk assessment level can be set according to business needs, or it can be determined by referring to the 3σ criterion. For example, if the third risk score conforms to the rule of normal distribution, the threshold of the risk assessment level can be set to four levels: μ-σ, μ, and μ+σ, where μ represents the average value of all third risk scores, σ represents the standard deviation of all third risk scores, and the behavior data samples with the third risk score between 0 and μ-σ have the lowest risk, the behavior data samples with the third risk score between μ-σ and μ have a lower risk, the behavior data samples with the third risk score between μ and μ+σ have a higher risk, and the behavior data samples with the third risk score between μ+σ and 1 have the highest risk.

[0092] According to the abnormal behavior detection method of the present invention, the behavioral data samples in the data sample set are evaluated based on the autoencoding model, and the risks contained in the behavioral data are scored based on the sample error and the threshold determined therefrom, so as to effectively detect abnormal behaviors and help purify platform data. Based on the risk score, the risk level of the behavioral data samples can be more clearly and intuitively known, providing effective data support for refined and differentiated precision marketing.

[0093] In addition, in a large number of application scenarios, data samples are unlabeled. It is reasonable and effective to use an unsupervised anomaly detection model, which can save a lot of manual labeling work.

[0094] However, due to the complexity of actual application scenarios, the use of unsupervised models alone often does not produce good results. Therefore, an abnormal behavior detection strategy is introduced to evaluate the behavioral data samples. A risk scoring scheme that combines the autoencoder and the abnormal behavior detection strategy is creatively proposed, which increases the reliability of abnormal behavior detection and greatly reduces the possible accidental injuries caused by unsupervised models.

[0095] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or parts of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0096] In the case where the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the abnormal behavior detection method of the present invention according to the instructions in the program code stored in the memory.

[0097] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0098] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0099] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0100] It should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0101] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0102] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0103] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0104] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0105] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0106] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.

Claims

1. A method for detecting abnormal behavior, executed in a computing device, comprising the steps of: Acquire a behavior data sample set, wherein the behavior data sample set includes a plurality of behavior data samples; Inputting a behavior data sample in a behavior data sample set into a trained autoencoder for processing to obtain output data, wherein the autoencoder is a variational autoencoder, and the variational autoencoder includes an encoder, a decoder, and a loss function. The difference between the behavior data sample input to the variational autoencoder and the output data output by the variational autoencoder is obtained by calculating the loss function, and the loss is reconstructed by gradient descent to reduce the difference between the input and output data; Determine a sample error corresponding to each behavior data sample based on the input behavior data sample and the output data; Determine a first threshold based on the sample errors corresponding to all behavioral data samples, and redetermine the first threshold every predetermined period according to a specific quantile of the sample errors of all samples in the period; Based on the sample error of each behavior data sample and the first threshold, a first risk score corresponding to each behavior data sample is obtained, and the first risk score corresponding to each behavior data sample is calculated by the following formula: model_score(x i )=sigmoid(log(RMSE i )-log(threshold)), where model_score(x i ) is the behavior data sample x i The corresponding first risk score, RMSE i Behavior data sample x i The corresponding root mean square error, threshold is the first threshold; Determining whether a behavior data sample is abnormal at least based on a first risk score, including: evaluating the behavior data sample set based on a predetermined abnormal behavior detection strategy to obtain a second risk score corresponding to each behavior data sample, fusing the first risk score and the second risk score to obtain a third risk score corresponding to each behavior data sample, and determining whether the behavior data sample is abnormal based on the third risk score, specifically including determining a threshold value of a risk assessment level based on the third risk scores corresponding to all behavior data samples, and determining a risk assessment level corresponding to the behavior data sample based on the threshold value of the risk assessment level.

2. The method according to claim 1, wherein: Before the step of inputting the behavior data samples in the behavior data sample set into the trained autoencoder for processing, the method further includes: Preprocess the behavioral data sample set.

3. The method according to claim 2, wherein the behavior data sample comprises at least one behavior data, wherein: The step of preprocessing the behavior data sample set includes: If the behavior data included in a behavior data sample in the behavior data sample set has missing values, and the number of missing values ​​exceeds a first predetermined value of the total number of behavior data, the behavior data sample is discarded; If the behavior data included in a behavior data sample in the behavior data sample set has missing values, but the number of missing values ​​does not exceed a first predetermined value of the total number of behavior data, the missing values ​​of the behavior data sample are filled.

4. The method according to claim 3, wherein: The step of filling the missing values ​​of the behavior data sample includes: If the behavior data corresponding to the missing value included in the behavior data sample belongs to a continuous variable in the behavior data sample set, then the behavior data sample with a value corresponding to the behavior data in the behavior data sample set is taken, the value corresponding to the behavior data is averaged, and the result of the average calculation is used as the missing value; If the behavior data corresponding to the missing value included in the behavior data sample belongs to a discrete variable in the behavior data sample set, then the behavior data sample with a value corresponding to the behavior data in the behavior data sample set is taken, and the mode of the value corresponding to the behavior data is taken as the missing value.

5. The method according to claim 1, wherein: The behavior data sample includes behavior data within a predetermined period.

6. The method according to claim 5, wherein: The behavior data includes at least one of: mobile phone number, recent search times for the retained vehicle series, recent browse times for the retained vehicle series, average browsing time for each retained vehicle series, and recent retention times for the mobile phone number.

7. The method according to claim 1, wherein: The predetermined abnormal behavior detection strategy includes at least one of the number of times the same behavior data appears within a first predetermined time and whether the user browses the relevant pages of the reserved vehicle series within a second predetermined time before the user's behavior.

8. A computing device comprising: one or more processors; and Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for executing any one of the methods according to claims 1 to 7.

9. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a computing device cause the computing device to perform any one of the methods according to claims 1 to 7.

Images