Risk control strategy generation method, device, storage medium and program product

Abstract

The present application provides a risk control strategy generation method, device, storage medium and program product, the method comprising: dividing N cheating users into M cheating user groups, N and M are both integers greater than 1; determining P characteristic indicators of the first cheating user group in the M cheating user groups arranged from high to low in importance, P is an integer greater than 1; generating a target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators. Thereby improving the efficiency and accuracy of generating the risk control strategy, and the risk control strategy is targeted at the cheating user group.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a risk control strategy generation method, device, storage medium, and program product. Background Art

[0002] At present, many companies often encounter cheating users on their product pages. For example, some short video applications (Application, APP) are normally just a means of entertainment for users, but some cheating users use the APP to sell products and spread bad information. Based on this, risk control is crucial for companies.

[0003] Currently, enterprises generally adopt manually formulated risk control strategies. However, when manual experience is insufficient, on the one hand, the efficiency of the risk control strategy is low, and on the other hand, the accuracy of the risk control strategy is low. Furthermore, since cheating users generally appear in gangs, that is, cheating user groups, the current manually formulated risk control strategies are not targeted at cheating user groups. Summary of the invention

[0004] The present application provides a risk control strategy generation method, device, storage medium and program product, thereby improving the efficiency and accuracy of generating risk control strategies, and the risk control strategies are targeted at cheating user groups.

[0005] In a first aspect, a risk control strategy generating method is provided, comprising: dividing N cheating users into M cheating user groups, where N and M are both integers greater than 1; determining P feature indicators of a first cheating user group among the M cheating user groups, arranged in descending order of importance, where P is an integer greater than 1; and generating a target risk control strategy corresponding to the first cheating user group according to the P feature indicators.

[0006] In a second aspect, a risk control strategy generating device is provided, comprising: a division module, a first determination module and a generation module, wherein the division module is used to divide N cheating users into M cheating user groups, N and M are both integers greater than 1; the first determination module is used to determine P feature indicators of the first cheating user group among the M cheating user groups, arranged in descending order of importance, P being an integer greater than 1; the generation module is used to generate a target risk control strategy corresponding to the first cheating user group according to the P feature indicators.

[0007] According to a third aspect, an electronic device is provided, comprising: a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the method in the first aspect or its various implementations.

[0008] According to a fourth aspect, a computer-readable storage medium is provided for storing a computer program, wherein the computer program enables a computer to execute the method according to the first aspect or its various implementations.

[0009] According to a fifth aspect, a computer program product is provided, comprising computer program instructions, wherein the computer program instructions enable a computer to execute the method according to the first aspect or its various implementations.

[0010] According to a sixth aspect, a computer program is provided, which enables a computer to execute the method according to the first aspect or its various implementations.

[0011] Through the technical solution provided by the present application, the efficiency and accuracy of generating risk control strategies are improved, and the risk control strategies are targeted at cheating user groups. Further, in the present application, the first server can set a preset threshold corresponding to a suitable recall rate, so as to ensure the recall rate and accuracy of the target risk control strategy. Furthermore, in the present application, if the accuracy of the target risk control strategy is greater than the preset accuracy, the target risk control strategy is controlled to go online, so as to ensure the accuracy of the online risk control strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 An application scenario diagram provided for an embodiment of the present application;

[0014] Figure 2 A flow chart of a risk control strategy generation method provided in an embodiment of the present application;

[0015] Figure 3 A flowchart of another risk control strategy generation method provided in an embodiment of the present application;

[0016] Figure 4 A schematic diagram of a risk control strategy generating device provided in an embodiment of the present application;

[0017] Figure 5 It is a schematic block diagram of an electronic device 500 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0020] As mentioned above, the risk control strategies currently adopted by enterprises are generally manually formulated. However, when manual experience is insufficient, on the one hand, the efficiency of obtaining risk control strategies is low, and on the other hand, the accuracy of the obtained risk control strategies is low. Furthermore, since cheating users generally appear in gangs, that is, cheating user groups, the current manually obtained risk control strategies are not targeted at cheating user groups.

[0021] In order to solve the above technical problems, the present application provides a method for automatically generating risk control strategies for cheating user groups, thereby improving the efficiency and accuracy of generating risk control strategies, and the risk control strategies are targeted at cheating user groups.

[0022] This application can be applied to the following application scenarios, but is not limited to these:

[0023] Figure 1 An application scenario diagram provided for an embodiment of the present application, such as Figure 1As shown, the first server 110 can retrieve the identification of the cheating user provided by the risk warning system from the second server 120. The first server 110 can also retrieve the identification of the cheating user who has been reported, banned, and blocked from the third server 130. Furthermore, the first server 110 can combine expert experience and / or the key characteristic indicators currently intercepted online to obtain the characteristic data of these cheating users under the key characteristic indicators through the identification of the cheating users obtained above. Based on this, the first server 110 can group the cheating users based on the characteristic data of the cheating users obtained, and generate a risk control strategy corresponding to each cheating user group.

[0024] It should be understood that the cheating users provided by the risk prediction system are actually suspected cheating users, so the characteristic data of these cheating users is a kind of pre-perception data. The cheating users who have been reported, banned, and blocked are actually cheating users, so the characteristic data of these cheating users is a kind of post-perception data.

[0025] It should be understood that Figure 1 This is just an example of an application scenario. The identifiers of cheating users who are reported, banned, and intercepted may come from different servers; or the identifiers of cheating users who are reported and banned may come from the same server, and the identifier of cheating users who are blocked may come from another server; or the identifiers of cheating users who are reported and blocked may come from the same server, and the identifier of cheating users who are banned may come from another server; or the identifiers of cheating users who are banned and blocked may come from the same server, and the identifier of reported cheating users may come from another server. This application does not impose any restrictions on this.

[0026] It should be noted that in this application, the characteristic index refers to an index about user characteristics, such as: the danger score of the user account is greater than the first preset danger score, the memory of the user device is less than the preset memory, the nickname of the user, the personal signature of the user, the title of the user's contribution, the video of the user's contribution, the request information sent by the user is intercepted, the danger score of the user's behavior model is greater than the second preset danger score, etc. The characteristic data corresponds to the characteristic index, and the characteristic data refers to the specific value under the corresponding characteristic index. For example, when the characteristic index is that the danger score of the user account is greater than the first preset danger score, the data of a certain user under the characteristic index can be 0 or 1, where 1 means that the danger score of the user account is greater than the first preset danger score, and 0 means that the danger score of the user account is less than or equal to the first preset danger score. When the characteristic index is that the memory of the user device is less than the preset memory, the data of a certain user under the characteristic index can be 0 or 1, where 1 means that the memory of the user device is less than the preset memory, and 0 means that the memory of the user device is greater than or equal to the preset memory. When the characteristic index is the nickname of the user, the data of a certain user under the characteristic index can be A nickname. When the characteristic index is the title of the user's contribution, the data of a certain user under the characteristic index can be B contribution title. When the characteristic indicator is a user's contributed video, the data of a user under the characteristic indicator may be C contributed video. When the characteristic indicator is that a request message sent by a user is intercepted, the data of a user under the characteristic indicator may be 0 or 1, wherein 1 indicates that the request message sent by the user is intercepted, and 0 indicates that the request message sent by the user is not intercepted. When the characteristic indicator is that the risk score of the user's behavior model is greater than the second preset risk score, the data of a user under the characteristic indicator may be 0 or 1, wherein 1 indicates that the risk score of the user's behavior model is greater than the second preset risk score, and 0 indicates that the risk score of the user's behavior model is less than or equal to the second preset risk score.

[0027] Optionally, the first preset risk score is the same as or different from the second preset risk score, and this application does not impose any limitation on this.

[0028] Optionally, in the present application, the first server may obtain the characteristic data of these cheating users under key characteristic indicators by using the above-obtained identifiers of the cheating users in a table lookup manner, but is not limited thereto.

[0029] Optionally, the first server, the second server, and the third server may all be independent physical servers, or a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services, which is not limited in this application.

[0030] The technical solution of this application will be described in detail below:

[0031] Figure 2A flow chart of a method for generating a risk control strategy provided in an embodiment of the present application, which can be Figure 1 The first server in the embodiment is executed, but not limited thereto. The following takes the first server as the execution subject as an example to exemplify the method for generating a risk control strategy. Figure 2 As shown, the method comprises the following steps:

[0032] S210: Divide the N cheating users into M cheating user groups, where N and M are both integers greater than 1;

[0033] S220: Determine P characteristic indicators of the first cheating user group among the M cheating user groups, which are arranged in descending order of importance, where P is an integer greater than 1;

[0034] S230: Generate a target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators.

[0035] Optionally, the first cheating user group is any cheating user group among the M cheating user groups.

[0036] Optionally, combined Figure 1 In the scenario diagram shown, any of the N cheating users may be a cheating user provided by the risk warning system, reported, banned or blocked, and this application does not impose any restriction on this.

[0037] Optionally, in order to reduce the load of the first server, in the present application, the first server 110 may combine expert experience and / or key characteristic indicators currently intercepted online to obtain characteristic data of N cheating users under these key characteristic indicators.

[0038] For example, assuming that the key characteristic indicators intercepted online in combination with expert experience and / or the following include: the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, the user's nickname, the user's personal signature, the user's contribution title, the user's contribution video, the request information sent by the user is intercepted, and the risk score of the user's behavior model is greater than the second preset risk score. Then the first server can obtain the characteristic data of N cheating users on these characteristic indicators.

[0039] It should be understood that, assuming that the first server obtains Q feature data of each cheating user, the Q feature data of each cheating user constitute a Q-dimensional vector, and each element in the Q-dimensional vector is a feature data.

[0040] Optionally, the first server may calculate the similarity between every two cheating users among the N cheating users, that is, calculate the similarity of the Q-dimensional vectors of every two cheating users, and group the N cheating users according to the similarity between every two cheating users among the N cheating users to obtain M cheating user groups.

[0041] Optionally, the first server may classify cheating users whose similarity is greater than a preset similarity into a cheating user group according to the similarity between every two cheating users among the N cheating users.

[0042] For example, assuming that there are five cheating users, namely cheating users 1-5, the first server divides cheating users 1-3 into a cheating user group based on the Q-dimensional vectors of the five cheating users, assuming that cheating user 1 is similar to cheating user 2, and cheating user 1 is similar to cheating user 3, and cheating user 4 is divided into a cheating user group with cheating user 5; assuming that cheating user 4 is similar to cheating user 5, cheating user 4 and cheating user 5 are divided into a cheating user group.

[0043] Optionally, the first server may use any of the following similarity calculation methods to determine the similarity between every two cheating users, but is not limited to: a similarity calculation method based on Euclidean distance, a similarity calculation method based on Manhattan distance, a similarity calculation method based on Chebyshev distance, a similarity calculation method based on Minkowski distance, a similarity calculation method based on standardized Euclidean distance, a similarity calculation method based on Mahalanobis distance, a similarity calculation method based on angle cosine, a similarity calculation method based on Hamming distance, a similarity calculation method based on Jaccard distance and Jaccard similarity coefficient, a similarity calculation method based on correlation coefficient and correlation distance, and a similarity calculation method based on information entropy.

[0044] Optionally, the first server can obtain a target integrated tree model, P first feature data of normal users, and P second feature data of the first cheating user group, where the P first feature data and the P second feature data are all feature data under P feature indicators; train the target integrated tree model through the P first feature data and the P second feature data; after the integrated tree model is trained, output P feature indicators through the integrated tree model.

[0045] Optionally, the target ensemble tree model may be an Extremely Randomized Trees (ExtRa-Trees), but is not limited thereto.

[0046] It should be understood that the training process of the target integration tree by the first server is a supervised training process, in which the labels corresponding to the P first feature data of a normal user are 0, indicating that the user is a normal user, and the labels corresponding to the P second feature data of a cheating user are 1, indicating that the user is a cheating user.

[0047] It should be understood that the Q feature data of each cheating user include binary data and text data. For example, assuming that the feature indicators corresponding to the Q feature data include: the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, the user's nickname, the user's personal signature, the user's contribution title, the user's contribution video, the request information sent by the user is intercepted, and the risk score of the user's behavior model is greater than the second preset risk score. Then the first server can obtain the feature data of N cheating users on these feature indicators. Then the feature data corresponding to the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, the request information sent by the user is intercepted, and the risk score of the user's behavior model is greater than the second preset risk score are all binary data. The feature data corresponding to the user's nickname, the user's personal signature, the user's contribution title, and the user's contribution video are all text data.

[0048] Optionally, the P first feature data are P binary data, the Q feature data of the first cheating user group include: binary data and text data, and the P second feature data are P binary data among the Q feature data of the first cheating user group, where Q is an integer greater than 1; correspondingly, the P feature indicators are P binary feature indicators. In other words, for the target ensemble tree model, the first server trains the target ensemble tree model through the binary feature data of normal users and cheating users. After the target ensemble tree model is trained, P binary feature indicators arranged from high to low in importance are obtained.

[0049] Optionally, after obtaining the P characteristic indicators corresponding to the first cheating user group, the first server may form a target risk control strategy with the P characteristic indicators.

[0050] It should be understood that the present application does not limit the manner in which characteristic indicators constitute the target risk control strategy.

[0051] Exemplarily, it is assumed that the P characteristic indicators corresponding to the first cheating user group include: the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, the request information sent by the user is intercepted, and the risk score of the user's behavior model is greater than the second preset risk score. Then the first server can combine the P characteristic indicators in the current order, that is, combine the P characteristic indicators in order from high to low importance to obtain the target risk control strategy. Therefore, for this example, the target risk control strategy obtained is: the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, the request information sent by the user is intercepted, and the risk score of the user's behavior model is greater than the second preset risk score. Alternatively, the first server can combine the P characteristic indicators in order from low to high importance to obtain the target risk control strategy. Therefore, for this example, the target risk control strategy obtained is: the risk score of the user's behavior model is greater than the second preset risk score, the request information sent by the user is intercepted, the memory of the user device is less than the preset memory, and the risk score of the user account is greater than the first preset risk score.

[0052] It should be understood that if the target risk control strategy includes more feature indicators, its accuracy will be higher, however, its recall rate will be lower. On the contrary, if the target risk control strategy includes fewer feature indicators, its accuracy will be lower, however, its recall rate will be higher. Based on this, in order to ensure the recall rate and accuracy of the target risk control strategy, a suitable preset threshold can be set for the recall rate. That is to say, the P feature indicators corresponding to the first cheating user group may not all be added to the target risk control strategy. Instead, the feature indicators are taken out one by one in order of importance from high to low, and it is determined whether the recall rate of the risk control strategy composed of the taken feature indicators is greater than the preset threshold and has the minimum recall rate. Specifically, S230 can be implemented by the following steps: Figure 3 As shown, S230 includes the following steps:

[0053] S310: The first characteristic indicator among the P characteristic indicators is used to form a first risk control strategy;

[0054] S320: Determine whether the recall rate of the first risk control strategy for the first cheating user group is greater than or equal to a preset threshold. If the recall rate of the first risk control strategy for the first cheating user group is equal to the preset threshold, execute S330. If the recall rate of the first risk control strategy for the first cheating user group is greater than the preset threshold, execute S340.

[0055] S330: Determine the first risk control strategy as the target risk control strategy;

[0056] S340: The first risk control strategy and the next characteristic indicator form a second risk control strategy;

[0057] S350: Determine whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to, or less than a preset threshold. If the recall rate of the second risk control strategy for the first cheating user group is equal to the preset threshold, execute S360. If the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold, execute S370. If the recall rate of the second risk control strategy for the first cheating user group is less than the preset threshold, execute S380.

[0058] S360: Determine the second risk control strategy as the target risk control strategy;

[0059] S370: Determine whether there is a next characteristic indicator; if there is a next characteristic indicator, execute the second risk control strategy and the next characteristic indicator to form a third risk control strategy, and use the third risk control strategy as the new second risk control strategy, and execute S350; if there is no next characteristic indicator, execute S360;

[0060] S380: Determine the previous risk control strategy of the second risk control strategy as the target risk control strategy.

[0061] Exemplarily, assuming that the preset threshold corresponding to the recall rate is set to 60%, and there are a total of the following three characteristic indicators, which are arranged in order of importance from high to low: the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, and the request information sent by the user is intercepted. Based on this, the first server can form a risk control strategy with the risk score of the user account being greater than the first preset risk score. Assuming that the recall rate of the risk control strategy for the first cheating user group is less than 60%, it is determined that the target risk control strategy cannot be obtained. Assuming that the recall rate of the risk control strategy for the first cheating user group is equal to 60%, the risk control strategy is determined as the target risk control strategy. Assuming that the recall rate of the risk control strategy for the first cheating user group is greater than 60%, the risk score of the user account is greater than the first preset risk score and the memory of the user device is less than the preset memory are formed into a risk control strategy. If the recall rate of the risk control strategy for the first cheating user group is less than 60%, the risk score of the user account is greater than the first preset risk score and is determined as the target risk control strategy. Strategy, assuming that the recall rate of the risk control strategy for the first cheating user group is equal to 60%, then the risk control strategy is determined as the target risk control strategy, assuming that the recall rate of the risk control strategy for the first cheating user group is greater than 60%, then the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, and the request information sent by the user is intercepted to form a risk control strategy, if the recall rate of the risk control strategy for the first cheating user group is less than 60%, then the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory to form the target risk control strategy, assuming that the recall rate of the risk control strategy for the first cheating user group is equal to 60%, then the risk control strategy is determined as the target risk control strategy, assuming that the recall rate of the risk control strategy for the first cheating user group is greater than 60%, and there is no next characteristic indicator, then the risk control strategy consisting of the risk score of the user account is greater than the first preset risk score, the memory of the user device is less than the preset memory, and the request information sent by the user is intercepted is determined as the target risk control strategy.

[0062] Optionally, after obtaining the target risk control strategy, the first server can directly launch the target risk control strategy. Alternatively, it should be understood that in order to ensure that the launched risk control strategy has a certain accuracy, in this application, the first server can determine the accuracy of the target risk control strategy to determine whether the target risk control strategy can be launched. Specifically, the accuracy of the first server can be determined in the following optional manner.

[0063] Optionally, the first server may obtain the number of suspected cheating users in the target user group according to the target risk control strategy; then determine the number of actual cheating users among the suspected cheating users; determine the ratio of the number of actual cheating users to the number of suspected cheating users, and obtain the accuracy of the target risk control strategy.

[0064] For example, assuming that the target user group includes 10,000 users, the number of suspected cheating users in the target user group obtained through the target risk control strategy is 1,000. That is to say, the number of users among these 10,000 users who meet the target risk control strategy is 1,000, and the number of users among these 1,000 users who are actually reported, banned, and blocked is 800. Then the accuracy of the target risk control strategy is 800 / 1000=80%.

[0065] Furthermore, if the accuracy of the target risk control strategy is greater than the preset accuracy, the target risk control strategy is controlled to go online.

[0066] Optionally, the preset accuracy rate may be 50%, 60%, 70%, etc., and this application does not impose any limitation on this.

[0067] In summary, the present application provides a method for generating an automated risk control strategy for a cheating user group, thereby improving the efficiency and accuracy of generating the risk control strategy, and the risk control strategy is targeted at the cheating user group. Furthermore, in the present application, the first server can set a preset threshold corresponding to a suitable recall rate, so as to ensure the recall rate and accuracy of the target risk control strategy. Furthermore, in the present application, if the accuracy of the target risk control strategy is greater than the preset accuracy rate, the target risk control strategy is controlled to go online, so as to ensure the accuracy of the online risk control strategy.

[0068] The following is an example to illustrate the technical solution of this application:

[0069] The first server can retrieve the identifier of the cheating user provided by the risk warning system, retrieve the identifier of at least one of the cheating users who have been reported, banned, and intercepted. Further, the first server can combine expert experience and / or the key feature indicators currently intercepted online to obtain the feature data of these cheating users under the key feature indicators through the identifier of the cheating user obtained above, wherein the first server can combine expert experience and online interception experience to determine the key features, such as: the account risk score is greater than the preset value, the device memory is less than the preset value, the nickname, the signature, the submitted video, the submitted title, the user's request information is intercepted, and the risk score of the behavior model is higher than the preset value. These key features constitute multi-dimensional features, which include: text feature indicators and binary feature indicators. Based on this, it can be understood that the multi-dimensional feature data of each cheating user can constitute a feature vector. Further, the first server can calculate the similarity of each two cheating users based on the feature vectors of each two cheating users, and divide similar users into a cheating user group.

[0070] Furthermore, the first server can obtain the target integrated tree model, the characteristic data of normal users, and the characteristic data of the cheating user group, and train the target integrated tree model through the characteristic data of normal users and the characteristic data of the cheating user group; after the integrated tree model is trained, the integrated tree model outputs P characteristic indicators of the cheating user group arranged from high to low in importance. Furthermore, the first server can extract characteristic indicators one by one in order from high to low in importance, and determine whether the recall rate of the risk control strategy composed of the extracted characteristic indicators is greater than the preset threshold and has the minimum recall rate. If the recall rate of the risk control strategy composed of the extracted characteristic indicators is greater than the preset threshold and has the minimum recall rate, the risk control strategy is determined as the target risk control strategy. Finally, if the target risk control strategy reaches the correct rate, the target risk control strategy is controlled to go online.

[0071] Figure 4 A schematic diagram of a risk control strategy generation device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the device includes: a division module 410, a first determination module 420 and a generation module 430, wherein the division module 410 is used to divide N cheating users into M cheating user groups, N and M are both integers greater than 1; the first determination module 420 is used to determine P feature indicators of the first cheating user group in the M cheating user groups, which are arranged from high to low in importance, and P is an integer greater than 1; the generation module 430 is used to generate a target risk control strategy corresponding to the first cheating user group according to the P feature indicators.

[0072] Optionally, the device also includes: an acquisition module 440, wherein, before the division module 410 divides the N cheating users into M cheating user groups, the acquisition module 440 is used to obtain Q feature data of each cheating user among the N cheating users, Q is an integer greater than 1; accordingly, the division module 410 is specifically used to: determine the similarity between every two cheating users among the N cheating users according to the Q feature data of each of the N cheating users; group and divide the N cheating users according to the similarity between every two cheating users among the N cheating users to obtain M cheating user groups.

[0073] Optionally, the division module 410 is specifically configured to: according to the similarity between every two cheating users among the N cheating users, divide the cheating users whose similarity is greater than a preset similarity into a cheating user group.

[0074] Optionally, the first determination module 420 is specifically used to: obtain a target integrated tree model, P first feature data of normal users, and P second feature data of the first cheating user group, where the P first feature data and the P second feature data are all feature data under P feature indicators; train the target integrated tree model through the P first feature data and the P second feature data; after the integrated tree model is trained, output P feature indicators through the integrated tree model.

[0075] Optionally, the P first feature data are P binarized data, the Q feature data of the first cheating user group include: binarized data and text data, the P second feature data are the P binarized data among the Q feature data of the first cheating user group, and Q is an integer greater than 1; accordingly, the P feature indicators are P binarized feature indicators.

[0076] Optionally, the generation module 430 is specifically used to: use the first characteristic indicator of the P characteristic indicators to form a first risk control strategy; determine whether the recall rate of the first risk control strategy for the first cheating user group is greater than or equal to a preset threshold; if the recall rate of the first risk control strategy for the first cheating user group is equal to the preset threshold, determine the first risk control strategy as the target risk control strategy; if the recall rate of the first risk control strategy for the first cheating user group is greater than the preset threshold, use the first risk control strategy and the next characteristic indicator to form a second risk control strategy; determine whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to or less than the preset threshold; if the recall rate of the second risk control strategy for the first cheating user group is equal to the preset threshold, The strategy is determined as the target risk control strategy; if the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold, and there is a next characteristic indicator, the second risk control strategy and the next characteristic indicator are used to form a third risk control strategy, and the third risk control strategy is used as the new second risk control strategy to execute and determine whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to or less than the preset threshold, until the target risk control strategy is obtained; if the recall rate of the second risk control strategy for the first cheating user group is less than the preset threshold, or if the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold, and there is no next characteristic indicator, the previous risk control strategy of the second risk control strategy is determined as the target risk control strategy.

[0077] Optionally, the device also includes: a second determination module 450 and a control module 460, wherein, after the generation module 430 generates a target risk control strategy corresponding to the first cheating user group according to P characteristic indicators, the second determination module 450 is used to determine the accuracy of the target risk control strategy; and the control module 460 is used to control the target risk control strategy to go online if the accuracy of the target risk control strategy is greater than a preset accuracy rate.

[0078] Optionally, the second determination module 450 is specifically used to: obtain the number of suspected cheating users in the target user group according to the target risk control strategy; determine the number of actual cheating users among the suspected cheating users; determine the ratio of the number of actual cheating users to the number of suspected cheating users, and obtain the accuracy of the target risk control strategy.

[0079] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 4 The device shown can execute the above method embodiments, and the above and other operations and / or functions of each module in the device are respectively for implementing the corresponding processes in the above methods, which will not be repeated here for the sake of brevity.

[0080] The above describes the device of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0081] Figure 5 It is a schematic block diagram of an electronic device 500 provided in an embodiment of the present application. The electronic device may be the above-mentioned first server, but is not limited thereto.

[0082] like Figure 5 As shown, the electronic device 500 may include:

[0083] The memory 510 and the processor 520, the memory 510 is used to store the computer program and transmit the program code to the processor 520. In other words, the processor 520 can call and run the computer program from the memory 510 to implement the method in the embodiment of the present application.

[0084] For example, the processor 520 may be configured to execute the above method embodiments according to instructions in the computer program.

[0085] In some embodiments of the present application, the processor 520 may include but is not limited to:

[0086] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0087] In some embodiments of the present application, the memory 510 includes but is not limited to:

[0088] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0089] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 510 and executed by the processor 520 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0090] like Figure 5 As shown, the electronic device may also include:

[0091] The transceiver 530 may be connected to the processor 520 or the memory 510 .

[0092] The processor 520 may control the transceiver 530 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 530 may include a transmitter and a receiver. The transceiver 530 may further include an antenna, and the number of antennas may be one or more.

[0093] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0094] The present application also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0095] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0096] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0097] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0098] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0099] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for generating a risk control strategy, characterized in that: include: Divide N cheating users into M cheating user groups, where N and M are both integers greater than 1; Determine P characteristic indicators of the first cheating user group among the M cheating user groups, which are arranged in descending order of importance, where P is an integer greater than 1; Generating a target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators; The step of generating a target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators includes: The first characteristic indicator among the P characteristic indicators constitutes a first risk control strategy; Determining whether the recall rate of the first risk control strategy for the first cheating user group is greater than or equal to a preset threshold; If the recall rate of the first risk control strategy for the first cheating user group is equal to the preset threshold, determining the first risk control strategy as the target risk control strategy; If the recall rate of the first risk control strategy for the first cheating user group is greater than the preset threshold, the first risk control strategy and the next characteristic indicator are combined into a second risk control strategy; Determining whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to, or less than a preset threshold; If the recall rate of the second risk control strategy for the first cheating user group is equal to the preset threshold, determining the second risk control strategy as the target risk control strategy; If the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold, and there is a next characteristic indicator, the second risk control strategy and the next characteristic indicator are used to form a third risk control strategy, and the third risk control strategy is used as a new second risk control strategy to execute the step of determining whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to, or less than the preset threshold, until the target risk control strategy is obtained; If the recall rate of the second risk control strategy for the first cheating user group is less than the preset threshold, or if the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold and there is no next characteristic indicator, the previous risk control strategy of the second risk control strategy is determined as the target risk control strategy.

2. The method according to claim 1, characterized in that Before dividing the N cheating users into M cheating user groups, the method further includes: Obtain Q feature data of each of the N cheating users, where Q is an integer greater than 1; The method of dividing N cheating users into M cheating user groups includes: Determine the similarity between every two cheating users among the N cheating users according to the Q feature data of each of the N cheating users; The N cheating users are divided into groups according to the similarity between every two cheating users among the N cheating users to obtain the M cheating user groups.

3. The method according to claim 2, characterized in that The step of grouping the N cheating users according to the similarity between every two cheating users among the N cheating users to obtain the M cheating user groups includes: According to the similarity between every two cheating users among the N cheating users, the cheating users whose similarity is greater than a preset similarity are divided into a cheating user group.

4. The method according to any one of claims 1 to 3, characterized in that: The step of determining the P characteristic indicators of the first cheating user group, which are arranged in descending order of importance, includes: Obtaining a target integrated tree model, P first feature data of normal users, and P second feature data of the first cheating user group, wherein the P first feature data and the P second feature data are feature data under the P feature indicators; Training the target ensemble tree model by using the P first feature data and the P second feature data; After the integrated tree model is trained, the P feature indicators are outputted through the integrated tree model.

5. The method according to claim 4, characterized in that The P first feature data are P binary data, the Q feature data of the first cheating user group include: binary data and text data, the P second feature data are the P binary data among the Q feature data of the first cheating user group, and Q is an integer greater than 1; Correspondingly, the P feature indices are P binary feature indices.

6. The method according to any one of claims 1 to 3, characterized in that: After generating the target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators, the method further includes: Determine the accuracy of the target risk control strategy; If the accuracy of the target risk control strategy is greater than the preset accuracy, the target risk control strategy is controlled to go online.

7. The method according to claim 6, characterized in that Determining the accuracy of the target risk control strategy includes: Obtaining the number of suspected cheating users in the target user group according to the target risk control strategy; Determining the number of actual cheating users among the suspected cheating users; The ratio of the number of actual cheating users to the number of suspected cheating users is determined to obtain the accuracy of the target risk control strategy.

8. A risk control strategy generation device, characterized in that: include: A division module, used to divide N cheating users into M cheating user groups, where N and M are both integers greater than 1; A first determination module is used to determine P characteristic indicators of a first cheating user group among the M cheating user groups, which are arranged in descending order of importance, where P is an integer greater than 1; A generating module, configured to generate a target risk control strategy corresponding to the first cheating user group according to the P characteristic indicators; Wherein, the generation module is specifically used for: The first characteristic indicator among the P characteristic indicators constitutes a first risk control strategy; Determining whether the recall rate of the first risk control strategy for the first cheating user group is greater than or equal to a preset threshold; If the recall rate of the first risk control strategy for the first cheating user group is equal to the preset threshold, determining the first risk control strategy as the target risk control strategy; If the recall rate of the first risk control strategy for the first cheating user group is greater than the preset threshold, the first risk control strategy and the next characteristic indicator are combined into a second risk control strategy; Determining whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to, or less than a preset threshold; If the recall rate of the second risk control strategy for the first cheating user group is equal to the preset threshold, determining the second risk control strategy as the target risk control strategy; If the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold, and there is a next characteristic indicator, the second risk control strategy and the next characteristic indicator are used to form a third risk control strategy, and the third risk control strategy is used as a new second risk control strategy to execute the step of determining whether the recall rate of the second risk control strategy for the first cheating user group is greater than, equal to, or less than the preset threshold, until the target risk control strategy is obtained; If the recall rate of the second risk control strategy for the first cheating user group is less than the preset threshold, or if the recall rate of the second risk control strategy for the first cheating user group is greater than the preset threshold and there is no next characteristic indicator, the previous risk control strategy of the second risk control strategy is determined as the target risk control strategy.

9. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images