User behavior analysis method, system, device and medium based on data mining
By constructing a user behavior analysis model based on data mining and using encoders and classifiers to identify malicious users, the problems of low identification efficiency and low accuracy in existing technologies are solved, and fast and accurate identification of malicious users is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CTRIP TRAVEL INFORMATION TECH (SHANGHAI) CO LTD
- Filing Date
- 2022-03-09
- Publication Date
- 2026-07-21
AI Technical Summary
Existing methods for identifying malicious order-brushing users are inefficient and inaccurate. Manual identification is subjective, rule-based identification is prone to mistakenly identifying legitimate users, and complex rules are difficult to cover most business scenarios and can be easily bypassed by malicious users.
We employ a user behavior analysis method based on data mining. By acquiring user access data, we construct machine learning models of encoders and classifiers to analyze user behavior and identify malicious users.
It enables rapid and accurate identification of malicious users, improves judgment accuracy, and can flexibly and quickly learn new behaviors of malicious users, reducing the possibility of bypassing detection.
Smart Images
Figure CN114579963B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data processing technology, and in particular to a user behavior analysis method, system, device and medium based on data mining. Background Technology
[0002] In the internet sector, with the continuous enrichment of products and activities, the overlap between products, activities, and between products and activities is becoming increasingly frequent and complex. This makes it easy for vulnerabilities to emerge, allowing malicious users to exploit them for profit, thus forming a black market industry chain. These individuals and their actions severely damage the normal user experience of products and the actual results achieved by activities, consistently causing significant losses to companies. Therefore, the ability to quickly identify existing vulnerabilities and the malicious users behind them is crucial for daily operations.
[0003] Current methods for identifying malicious users engaging in fraudulent activities primarily rely on simple, strong rules such as daily manual checks and IP or device aggregation. However, these methods all have inherent limitations. While manual identification boasts high accuracy, it is inefficient and subject to subjectivity—inconsistent judgment standards among individuals can degrade user experience. Rule-based identification, on the other hand, while simple rules can cover most business scenarios, suffers from low accuracy and the potential to mistakenly penalize legitimate users, harming the user experience. Complex rules require a strong understanding of specific business operations and struggle to cover most scenarios. Furthermore, these rules are easily detected by professional malicious groups, who can then quickly evade detection and blocking by altering their behavior patterns, such as frequently changing IP addresses or frequently used devices. Summary of the Invention
[0004] To address the problems in the existing technology, the purpose of this invention is to provide a user behavior analysis method, system, device, and medium based on data mining, which can quickly analyze user behavior based on data mining and achieve rapid and accurate identification of malicious users.
[0005] This invention provides a user behavior analysis method based on data mining, comprising the following steps:
[0006] Obtain the user's predicted access data, which includes the pages visited by the user and the order in which the pages were visited;
[0007] Based on the access data to be predicted and the embedding vectors of each page, the sequence vector to be predicted is obtained;
[0008] The sequence vector to be predicted is input into the trained encoder to obtain the encoded vector to be predicted;
[0009] The encoding vector to be predicted is input into the classifier to obtain the classification result output by the classifier.
[0010] In some embodiments, obtaining the sequence vector to be predicted based on the access data to be predicted and the embedding vectors of each page includes the following steps:
[0011] The access data to be predicted is divided into at least one access by a user;
[0012] For each visit, determine the pages the user visits and the order in which they visit;
[0013] For each visit, the embedding vectors of the pages visited are concatenated in the order of the pages visited to obtain a visit sequence;
[0014] The access sequences corresponding to the at least one access are combined to obtain the sequence vector to be predicted.
[0015] In some embodiments, the access data to be predicted further includes auxiliary classification data;
[0016] The sequence vector to be predicted is input into the trained encoder to obtain the encoded vector to be predicted, including the following steps:
[0017] The sequence vector to be predicted is input into the trained encoder to obtain the output vector of the encoder;
[0018] Based on the auxiliary classification data, an auxiliary feature vector is obtained according to a preset auxiliary vector generation rule;
[0019] The output vector of the encoder is concatenated with the auxiliary feature vector, and the concatenated vector is used as the encoding vector to be predicted.
[0020] In some embodiments, the auxiliary classification data includes at least one of the user's business scenario type, access duration, dwell time on each page, and personal information data.
[0021] In some embodiments, the following steps are also included:
[0022] Retrieve access data for all pages within a preset time range;
[0023] Based on the access data of all pages, construct a relationship network including all pages;
[0024] Based on the relationship network, an embedding vector for each page node is generated using a graph embedding method.
[0025] In some embodiments, constructing a relationship network including all pages based on the access data of all pages includes the following steps:
[0026] Treat each page as a separate node;
[0027] Add a connecting line between two nodes that have a jump relationship;
[0028] For two nodes connected by a line, the weight of the line is calculated based on the number of times the user jumps from the first node to the second node and the total number of times the user jumps out of the first node within a preset time range.
[0029] In some embodiments, the following steps are also included:
[0030] Collect sample access data from users, including the pages accessed by users and the order in which the pages were accessed;
[0031] Based on the sample access data and the embedding vectors of each page, a sample sequence vector is obtained, and sample tags are added to the sample sequence vector.
[0032] The encoder is trained based on the sample sequence vectors, and the trained encoder is saved.
[0033] The sample sequence vector is input into the trained encoder to obtain the sample encoding vector;
[0034] A classifier is trained based on the sample encoding vector and the corresponding sample label.
[0035] In some embodiments, inputting the sample sequence vector into a trained encoder to obtain a sample encoding vector includes the following steps:
[0036] The sample sequence vector is input into the trained encoder to obtain the output vector of the encoder;
[0037] Extract sample auxiliary classification data from the sample access data;
[0038] Based on the sample auxiliary classification data, and according to the preset auxiliary vector generation rules, the sample auxiliary feature vector is obtained;
[0039] The output vector of the encoder is concatenated with the sample auxiliary feature vector, and the concatenated vector is used as the sample encoding vector.
[0040] In some embodiments, the sample sequence vector includes multiple access sequences, each access sequence corresponding to one access;
[0041] After obtaining the sample sequence vector based on the sample access data and the embedding vectors of each page, the following steps are also included:
[0042] Randomly select one or more sequences from one or more sample sequence vectors;
[0043] The extracted sequences are randomly combined to obtain a new sequence vector, which is then added to the sample sequence vector.
[0044] In some embodiments, the encoder employs a multi-layer bidirectional LSTM model based on an attention mechanism; and / or, the classifier is a multi-layer deep neural network, and the multi-layer deep neural network includes a residual module.
[0045] This invention also provides a user behavior analysis system based on data mining, used to implement the aforementioned user behavior analysis method based on data mining, the system comprising:
[0046] The data acquisition module is used to acquire the user's predicted access data, which includes the pages accessed by the user and the order in which the pages were accessed.
[0047] The vector acquisition module is used to obtain the sequence vector to be predicted based on the access data to be predicted and the embedding vectors of each page;
[0048] The vector encoding module is used to input the sequence vector to be predicted into the trained encoder to obtain the encoded vector to be predicted.
[0049] The behavior analysis module is used to input the encoding vector to be predicted into the classifier and obtain the classification result output by the classifier.
[0050] This invention also provides a user behavior analysis device based on data mining, comprising:
[0051] processor;
[0052] A memory in which executable instructions of the processor are stored;
[0053] The processor is configured to execute the steps of the data mining-based user behavior analysis method by executing the executable instructions.
[0054] This invention also provides a computer-readable storage medium for storing a program that, when executed by a processor, implements the steps of the data mining-based user behavior analysis method.
[0055] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure.
[0056] The user behavior analysis method, system, device, and medium based on data mining of the present invention have the following beneficial effects:
[0057] This invention analyzes user access data for various pages within the most recent day or other recent time periods. Using daily user behavior as a starting point, it builds a machine learning model including an encoder and classifier to directly determine whether the user's access data corresponds to malicious behavior. This can also serve as an initial screening tool to assist manual identification, further improving the accuracy of the judgment. Compared to traditional rule-based methods that focus on IP or device IDs, this method maintains high accuracy while more flexibly and quickly learning new malicious user behaviors and adjusting countermeasures, making it difficult for malicious users to bypass detection by changing their behavior. This method can be applied to the online travel agency (OTA) industry to analyze user access data from online travel apps or websites, effectively filtering malicious user behaviors, such as fraudulent order placement. This method can also be applied to other fields, such as shopping platforms. Attached Figure Description
[0058] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.
[0059] Figure 1 This is a flowchart of a user behavior analysis method based on data mining according to an embodiment of the present invention;
[0060] Figure 2 This is a schematic diagram of the structure of a user behavior analysis network according to an embodiment of the present invention;
[0061] Figure 3 This is a schematic diagram of the encoder structure according to an embodiment of the present invention;
[0062] Figure 4 This is a schematic diagram of the structure of a classifier according to an embodiment of the present invention;
[0063] Figure 5 This is a flowchart illustrating the pre-acquisition of embedding vectors for each page according to an embodiment of the present invention;
[0064] Figure 6 This is a flowchart of the training process of an encoder and classifier according to an embodiment of the present invention;
[0065] Figure 7 This is a flowchart illustrating the process of obtaining a sequence vector to be predicted according to an embodiment of the present invention;
[0066] Figure 8 This is a flowchart illustrating the process of obtaining the encoding vector to be predicted according to an embodiment of the present invention;
[0067] Figure 9 This is a schematic diagram of the structure of a user behavior analysis system based on data mining according to an embodiment of the present invention;
[0068] Figure 10 This is a schematic diagram of the structure of a user behavior analysis device based on data mining according to an embodiment of the present invention;
[0069] Figure 11 This is a schematic diagram of the structure of a computer-readable storage medium according to an embodiment of the present invention. Detailed Implementation
[0070] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.
[0071] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.
[0072] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined. Therefore, the actual execution order may change depending on the specific circumstances.
[0073] like Figure 1 As shown, this embodiment of the invention provides a user behavior analysis method based on data mining, including the following steps:
[0074] S210: Obtain the user's access data to be predicted, the access data to be predicted includes the pages accessed by the user and the order in which the pages were accessed;
[0075] The access data to be predicted can be the user's access data to various pages within the most recent day. A user may make multiple accesses within a day. The access data includes the pages accessed by the user in each access and the order in which the pages are accessed. In other embodiments, the access data to be predicted can be, for example, the user's access data within the most recent three days or the user's access data within a week. The time range can be set as needed.
[0076] S220: Based on the access data to be predicted and the embedding vectors of each page, obtain the sequence vector to be predicted;
[0077] S230: Input the sequence vector to be predicted into the trained encoder to obtain the encoded vector to be predicted;
[0078] S240: Input the encoding vector to be predicted into the classifier and obtain the classification result output by the classifier. The classification result output by the classifier may include, for example, the probability that the user's access data to be predicted belongs to a malicious user.
[0079] In the user behavior analysis method of this invention, by analyzing user access data for various pages within the most recent day or other recent time periods, and taking daily user access behavior as the starting point, a machine learning model including an encoder and a classifier is built to directly determine whether the user's access data corresponds to malicious behavior. This method can also serve as an initial screening tool to assist manual identification, further improving the accuracy of the judgment. Compared to traditional rule-based methods that start from IP or device IDs, this method maintains high accuracy while more flexibly and quickly learning new behaviors of malicious users and adjusting response strategies, making it difficult for malicious users to bypass detection by changing their behavior.
[0080] like Figure 2 and Figure 3 As shown, in this embodiment, the encoder employs a multi-layer bidirectional LSTM (Long Short-Term Memory) model based on an attention mechanism. A simple fully connected layer is used to compute the attention mechanism, whereby all hidden states from the LSTM model's computation process are input into the fully connected layer to calculate weights. Then, the weighted average of each hidden state according to its corresponding weight is used as the encoding of the input behavior sequence. To handle variable-length user access sequences, padding is applied to the access sequences; that is, behaviors shorter than a preset length are padded, and behaviors exceeding a preset length are segmented. Simultaneously, the influence of the padding position is eliminated during the attention mechanism computation.
[0081] like Figure 2 and Figure 4 As shown, the classifier is a multi-layer deep neural network (DNN), and the multi-layer deep neural network includes a residual block.
[0082] like Figure 2 and 5 As shown, in this embodiment, the user behavior analysis method based on data mining further includes the step of pre-obtaining the embedding vectors of each page, constructing a relationship network (Graph) between access nodes based on the access behavior of all users, and training a Node2Vec model based on the relationship network to obtain the embedding vector for each node. Specifically, it includes the following steps:
[0083] S110: Obtain access data for all pages within a preset time range. For example, page access data for all users can be obtained by redirecting to the network from the page.
[0084] S120: Based on the access data of all pages, construct a relationship network including all pages;
[0085] S130: Based on the relationship network, generate the embedding vector of each page node using a graph embedding method.
[0086] like Figure 5 As shown, in this embodiment, step S120: constructing a relationship network including all pages based on the access data of all pages includes the following steps:
[0087] S121: Treat each page as a separate node;
[0088] S122: Add a connecting line between two nodes that have a jump relationship;
[0089] For example, when a single user navigates from page A to page B, there are two nodes representing pages A and B respectively, and there is a link between A and B. The link between A and B can be directed or undirected.
[0090] S123: For two nodes connected by a line, calculate the weight of the connection based on the number of jumps from the first node to the second node and the total number of jumps from the first node within a preset time range. For example, for nodes A (page A) and B (page B) connected by two lines, the weight is calculated by dividing the number of jumps from page A to page B in the past 7 days by the total out-degree of page A, i.e., (A→B) / A out degree As weights, Python implements the network using the networkx module to build networks.
[0091] In other implementations, the weight between two nodes can be calculated using other methods depending on the specific scenario, or no weight may be set.
[0092] In this embodiment, step S130 uses the Node2Vec graph embedding method. This method simply generates a fixed-length random sequence by performing a biased random walk on the constructed graph network, and then calculates the embedding vector for each page using the traditional word embedding method Word2Vec. The Python implementation is primarily achieved using the Node2Vec class in the PyTorch module. Besides the pre-calculated embedding vectors, new embedding vectors are learned along with the model and added to the pre-calculated embedding vectors during the pre-training of the encoder. Therefore, the pre-calculated embedding vectors can be considered as the initialization of the final embedding vectors.
[0093] like Figure 6 As shown, in this embodiment, the user behavior analysis method further includes training steps for the encoder and classifier, specifically including the following steps:
[0094] S140: Collect sample access data of users, the sample access data including the pages accessed by users and the order in which the pages were accessed;
[0095] S150: Based on the sample access data and the embedding vector of each page, obtain the sample sequence vector and add sample labels to the sample sequence vector; specifically, label according to the recognition rules, for example, positive samples are positive and the rest are negative, and construct sample labels;
[0096] S160: Train the encoder based on the sample sequence vector and save the trained encoder;
[0097] As described above, the encoder employs a 3-layer bidirectional LSTM model combined with an attention mechanism, and simultaneously uses hierarchical attention to extract multiple sequences. The model structure is as follows: Figure 3 As shown, SequenceEmbedding is the sequence vector, Attention Layer is the attention layer, Hidden State is the hidden state, LSTMCell is the LSTM unit, and Seq Emb1~4 are the vectors of each sequence.
[0098] S170: Input the sample sequence vector into the trained encoder to obtain the sample encoding vector;
[0099] S180: Based on the sample encoding vector and the corresponding sample label, train a classifier, save the trained classifier, and use it for subsequent classification of real user behavior data to be predicted.
[0100] During training, the classifier classifies sample encoding vectors and obtains the classification result as the probability that the sample encoding vector belongs to malicious user behavior. The sample label indicates whether the sample encoding vector belongs to malicious user behavior or non-malicious user behavior. The loss function value can be calculated based on the classification result and sample label. The classifier is then optimized based on the loss function value and trained until the loss function value is less than a preset threshold, at which point training is complete.
[0101] In this embodiment, step S170, which involves inputting the sample sequence vector into the trained encoder to obtain the sample encoding vector, includes the following steps:
[0102] The sample sequence vector is input into the trained encoder to obtain the output vector of the encoder;
[0103] Sample auxiliary classification data is extracted from the sample access data. The auxiliary classification data includes at least one of the following: user's business scenario type, access duration, dwell time on each page, and personal information data.
[0104] Based on the sample auxiliary classification data and a preset auxiliary vector generation rule, a sample auxiliary feature vector is obtained. The auxiliary features may include, for example, the user's business scenario type, access duration, dwell time on each page, username, user age, user region, etc.
[0105] The output vector of the encoder is concatenated with the sample auxiliary feature vector, and the concatenated vector is used as the sample encoding vector.
[0106] In this embodiment, the sample sequence vector includes multiple access sequences, each access sequence corresponding to one access. Step S150: After obtaining the sample sequence vector based on the sample access data and the embedding vectors of each page, the following steps are further included:
[0107] Randomly select one or more sequences from one or more sample sequence vectors;
[0108] The extracted sequences are randomly combined to obtain a new sequence vector, which is then added to the sample sequence vector.
[0109] Therefore, in this embodiment, randomly combining samples to construct augmented samples can address the issue of insufficient sample size and reduce the impact of mislabeled data. The specific construction method used is as follows:
[0110] (1) Randomize a sequence number N ~ Uniform(1,5)
[0111] (2) A random positive sample sequence number N d ~Uniform(1,N)
[0112] (3) Randomly select N d A sequence of positive samples, NN d negative sample sequences
[0113] (4) Disassemble and reassemble the extracted sequence.
[0114] (5) If N d If the value is greater than 0, it is a positive sample; otherwise, it is a negative sample.
[0115] For example, the number of random sequences N is 4, and the number of random positive sample sequences N is 4. d Given a value of 3, three positive sample sequences and one negative sample sequence are randomly selected. The selected sequences are then shuffled and combined in order. Since there are positive sample sequences, the resulting vector is a positive sample vector. Here, positive samples refer to samples from malicious users, and negative samples refer to samples from non-malicious users.
[0116] Therefore, the user behavior analysis method of this invention can achieve malicious user behavior mining. Through a deep learning model framework, based on a small amount of labeled data, it can quickly summarize the behavioral patterns of malicious users engaging in fraudulent activities during specific events and replicate and extend these patterns to all users. It can also identify undiscovered malicious users and monitor the behavior of existing users. Furthermore, with simple adjustments, it can be quickly extended to other events. Specifically, this invention employs a semi-supervised approach, which reduces the need for a large sample size. Data augmentation reduces the impact of mislabeling on the model, enhances its robustness, and is compatible with various types of user access behaviors of different lengths, supporting multiple types of downstream tasks.
[0117] like Figure 7 As shown, in this embodiment, step S220, obtaining the sequence vector to be predicted based on the access data to be predicted and the embedding vectors of each page, includes the following steps:
[0118] S221: Divide the access data to be predicted into at least one access by a user;
[0119] S222: For each visit, determine the pages the user visits and the order in which the pages are visited;
[0120] S223: For each access, the embedding vectors of the accessed pages are concatenated in the order of access to obtain an access sequence; the embedding vector of the page is the embedding vector of each page obtained by the aforementioned graph embedding method.
[0121] For example, a user visits a page N times a day; the visit sequence includes:
[0122] Sequence 1: [Page A -> Page B -> ... -> Page B] =>
[0123] Sequence 2: [Page A -> Page C -> ... -> Page D] => ... =>
[0124] Sequence N: [Page A -> Page C -> ... -> Page D]
[0125] S224: Combine the access sequences corresponding to the at least one access to obtain the sequence vector to be predicted.
[0126] like Figure 8 As shown, in this embodiment, the access data to be predicted further includes auxiliary classification data. In this embodiment, the auxiliary classification data includes at least one of the user's business scenario type, access duration, dwell time on each page, and personal information data. Step S230: Inputting the sequence vector to be predicted into the trained encoder to obtain the encoding vector to be predicted includes the following steps:
[0127] S231: Input the sequence vector to be predicted into the trained encoder to obtain the output vector of the encoder. The encoder adopts a multi-layer bidirectional LSTM model based on an attention mechanism, for example, using... Figure 3 The structure shown;
[0128] S232: Based on the auxiliary classification data and a preset auxiliary vector generation rule, an auxiliary feature vector is obtained. The auxiliary features may include, for example, the user's business scenario type, access duration, dwell time on each page, username, user age, user region, etc.
[0129] The pre-defined auxiliary vector generation rules here may include, for example, rules for identifying the user's business scenario type and the feature values corresponding to each business scenario type, statistical methods for access duration, feature representation rules for duration, feature representation rules for username, feature representation rules for age, and feature values corresponding to each region.
[0130] S233: The output vector of the encoder is concatenated with the auxiliary feature vector, and the concatenated vector is used as the encoding vector to be predicted.
[0131] like Figure 9 As shown, this embodiment of the invention also provides a user behavior analysis system based on data mining, used to implement the aforementioned user behavior analysis method based on data mining. The system includes:
[0132] The data acquisition module M100 is used to acquire the user's predicted access data, which includes the pages accessed by the user and the order in which the pages were accessed.
[0133] The vector acquisition module M200 is used to obtain the sequence vector to be predicted based on the access data to be predicted and the embedding vectors of each page;
[0134] The vector encoding module M300 is used to input the sequence vector to be predicted into the trained encoder to obtain the encoded vector to be predicted.
[0135] The behavior analysis module M400 is used to input the encoding vector to be predicted into the classifier and obtain the classification result output by the classifier.
[0136] In the user behavior analysis system of this invention, by analyzing user access data for various pages within the most recent day or other recent time periods, and using daily user access behavior as the starting point, a machine learning model including an encoder and a classifier is built to directly determine whether the user's access data corresponds to malicious behavior. This can also serve as an initial screening tool to assist manual identification, further improving the accuracy of the judgment. Compared to traditional rule-based methods that start from IP or device IDs, this system maintains high accuracy while more flexibly and quickly learning new malicious user behaviors to adjust response strategies, making it difficult for malicious users to bypass detection by changing their behavior.
[0137] In this embodiment, the user behavior analysis system based on data mining further includes a page vector acquisition module for acquiring the embedding vectors of each page. Specifically, the page vector acquisition module is used to acquire access data of all pages within a preset time range, for example, page access data of all users can be obtained from a page navigation network; based on the access data of all pages, a relationship network including all pages is constructed; and based on the relationship network, an embedding vector of each page node is generated using a graph embedding method. The method for constructing the relationship network (Graph) can adopt the steps S121-S123 described above.
[0138] In this embodiment, the user behavior analysis system further includes a model training module for training the encoder and the classifier. Specifically, the model training module collects sample access data from users, including the pages accessed by the user and the order in which the pages were accessed; obtains sample sequence vectors based on the sample access data and the embedding vectors of each page, and adds sample labels to the sample sequence vectors; specifically, labels are assigned according to recognition rules, such as positive samples being positive and the rest being negative, to construct sample labels; trains the encoder based on the sample sequence vectors and saves the trained encoder; inputs the sample sequence vectors into the trained encoder to obtain sample encoding vectors; and trains the classifier based on the sample encoding vectors and the corresponding sample labels.
[0139] This invention also provides a user behavior analysis device based on data mining, including a processor; a memory storing executable instructions of the processor; wherein the processor is configured to execute the steps of the user behavior analysis method based on data mining by executing the executable instructions.
[0140] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "platform."
[0141] The following reference Figure 10 To describe an electronic device 600 according to this embodiment of the present invention. Figure 10 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.
[0142] like Figure 10 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.
[0143] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in the above-described section of this specification on user behavior analysis methods based on data mining, according to various exemplary embodiments of the present invention. For example, the processing unit 610 can perform actions such as... Figure 1 The steps are shown in the figure.
[0144] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.
[0145] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.
[0146] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.
[0147] Electronic device 600 can also communicate with one or more external devices 700 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 600, and / or with any device that enables electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0148] In the data mining-based user behavior analysis device, when the program in the memory is executed by the processor, it implements the steps of the data mining-based user behavior analysis method. Therefore, the device can also achieve the technical effects of the data mining-based user behavior analysis method.
[0149] This invention also provides a computer-readable storage medium for storing a program that, when executed by a processor, implements the steps of the data mining-based user behavior analysis method. In some possible implementations, various aspects of the invention can also be implemented as a program product comprising program code that, when executed on a terminal device, causes the terminal device to perform the steps described in the data mining-based user behavior analysis method section of this specification, according to various exemplary embodiments of the invention.
[0150] refer to Figure 11 As shown, a program product 800 for implementing the above-described method according to an embodiment of the present invention is described. It may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may be executed on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0151] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0152] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0153] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0154] When the program in the computer storage medium is executed by the processor, it implements the steps of the user behavior analysis method based on data mining. Therefore, the computer storage medium can also achieve the technical effects of the user behavior analysis method based on data mining.
[0155] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.
Claims
1. A user behavior analysis method based on data mining, characterized in that, Includes the following steps: Obtain the user's predicted access data, which includes the pages visited by the user and the order in which the pages were visited; Based on the access data to be predicted and the embedding vectors of each page, the sequence vector to be predicted is obtained; The sequence vector to be predicted is input into the trained encoder to obtain the encoded vector to be predicted; The encoding vector to be predicted is input into the classifier to obtain the classification result output by the classifier; The method further includes: Retrieve access data for all pages within a preset time range; Based on the access data of all pages, construct a relationship network including all pages, including: treating each page as a node; adding a connection between two nodes with a jump relationship; for two nodes with a connection in the middle, calculating the weight value of the connection based on the number of times the user jumps from the first node to the second node and the total number of times the user jumps out of the first node within a preset time range. Based on the relationship network, an embedding vector for each page node is generated using a graph embedding method. The classifier is trained using the following steps: Based on the sample encoding vector and the corresponding sample label, a classifier is trained and the trained classifier is saved for subsequent classification of real user behavior data to be predicted. During training, the classifier classifies the sample encoding vector and obtains the classification result as the probability that the sample encoding vector belongs to malicious user behavior. The sample label identifies whether the sample encoding vector belongs to malicious user behavior or non-malicious user behavior. The loss function value can be calculated based on the classification result and sample label. The classifier is back-optimized based on the loss function value and trained until the loss function value is less than a preset threshold, at which point training is complete.
2. The user behavior analysis method based on data mining according to claim 1, characterized in that, Based on the access data to be predicted and the embedding vectors of each page, the sequence vector to be predicted is obtained, including the following steps: The access data to be predicted is divided into at least one access by a user; For each visit, determine the pages the user visits and the order in which they visit; For each visit, the embedding vectors of the pages visited are concatenated in the order of the pages visited to obtain a visit sequence; The access sequences corresponding to the at least one access are combined to obtain the sequence vector to be predicted.
3. The user behavior analysis method based on data mining according to claim 2, characterized in that, The access data to be predicted also includes auxiliary classification data; The sequence vector to be predicted is input into the trained encoder to obtain the encoded vector to be predicted, including the following steps: The sequence vector to be predicted is input into the trained encoder to obtain the output vector of the encoder; Based on the auxiliary classification data, an auxiliary feature vector is obtained according to a preset auxiliary vector generation rule; The output vector of the encoder is concatenated with the auxiliary feature vector, and the concatenated vector is used as the encoding vector to be predicted.
4. The user behavior analysis method based on data mining according to claim 3, characterized in that, The auxiliary classification data includes at least one of the following: user's business scenario type, access duration, dwell time on each page, and personal information data.
5. The user behavior analysis method based on data mining according to claim 1, characterized in that, It also includes the following steps: Collect sample access data from users, including the pages accessed by users and the order in which the pages were accessed; Based on the sample access data and the embedding vectors of each page, a sample sequence vector is obtained, and sample tags are added to the sample sequence vector. The encoder is trained based on the sample sequence vectors, and the trained encoder is saved. The sample sequence vector is input into the trained encoder to obtain the sample encoding vector; A classifier is trained based on the sample encoding vector and the corresponding sample label.
6. The user behavior analysis method based on data mining according to claim 5, characterized in that, The sample sequence vector is input into the trained encoder to obtain the sample encoding vector, including the following steps: The sample sequence vector is input into the trained encoder to obtain the output vector of the encoder; Extract sample auxiliary classification data from the sample access data; Based on the sample auxiliary classification data, and according to the preset auxiliary vector generation rules, the sample auxiliary feature vector is obtained; The output vector of the encoder is concatenated with the sample auxiliary feature vector, and the concatenated vector is used as the sample encoding vector.
7. The user behavior analysis method based on data mining according to claim 5, characterized in that, The sample sequence vector includes multiple access sequences, each access sequence corresponding to one access; After obtaining the sample sequence vector based on the sample access data and the embedding vectors of each page, the following steps are also included: Randomly select one or more sequences from one or more sample sequence vectors; The extracted sequences are randomly combined to obtain a new sequence vector, which is then added to the sample sequence vector.
8. The user behavior analysis method based on data mining according to claim 1, characterized in that, The encoder employs a multi-layer bidirectional LSTM model based on an attention mechanism; and / or, The classifier is a multi-layer deep neural network, and the multi-layer deep neural network includes a residual module.
9. A user behavior analysis system based on data mining, characterized in that, The system for implementing the data mining-based user behavior analysis method according to any one of claims 1 to 8, the system comprising: The data acquisition module is used to acquire the user's predicted access data, which includes the pages accessed by the user and the order in which the pages were accessed. The vector acquisition module is used to obtain the sequence vector to be predicted based on the access data to be predicted and the embedding vectors of each page; The vector encoding module is used to input the sequence vector to be predicted into the trained encoder to obtain the encoded vector to be predicted. The behavior analysis module is used to input the encoding vector to be predicted into the classifier and obtain the classification result output by the classifier.
10. A user behavior analysis device based on data mining, characterized in that, include: processor; A memory in which executable instructions of the processor are stored; The processor is configured to perform the steps of the data mining-based user behavior analysis method according to any one of claims 1 to 8 by executing the executable instructions.
11. A computer-readable storage medium for storing a program, characterized in that, When the program is executed by the processor, it implements the steps of the user behavior analysis method based on data mining as described in any one of claims 1 to 8.