A method for determining a user suspected of risk and related devices

Abstract

An embodiment of the present invention provides a method for determining a risk-suspected user and related devices, which can quickly determine risk-suspected users and improve calculation efficiency. The method includes: determining a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set; sequentially traversing the threshold sets corresponding to each rule in the target rule set to obtain a target threshold set; determining the influence degree of each threshold in the target threshold set on the fusion target to obtain an influence degree set; determining an optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set; determining whether a target indicator is higher than a target threshold, where the target indicator is an indicator corresponding to a user to be determined as a risk-suspected user, and the target threshold is the threshold corresponding to the target indicator in the optimal threshold set; if so, determining that the target user is a risk-suspected user.

Description

Technical Field

[0001] The present invention relates to the technical field of information processing, and particularly to a method for determining a risk-suspected user and related devices. Background Art

[0002] In the field of risk control, the method of using a model to identify malicious accounts or groups is often adopted. Here, the model refers to a classification algorithm in machine learning, such as logistic regression and Gradient Boosting Decision Tree (GBDT), etc. However, if some business rules are not added for constraint, the effect of the model cannot meet the business requirements in many cases. Therefore, how to integrate the results obtained from the risk control model with the rules is a very important issue.

[0003] Generally speaking, the method to solve the problem of integrating the results of the risk control model with the rules is the enumeration method, which lists all possible thresholds that need to integrate the rules and integrates them with the model results.

[0004] However, this method can work when there are few rules or thresholds. But once there are a large number of possible rules and thresholds, such a search space will be very large, and the fusion value of the rules and the model results cannot be obtained quickly, thus resulting in the inability to quickly determine risk-suspected users. Summary of the Invention

[0005] The embodiments of the present invention provide a method for determining a risk-suspected user and related devices, which can quickly determine risk-suspected users and improve the calculation efficiency.

[0006] The first aspect of the embodiments of the present invention provides a method for determining a risk-suspected user, and the method includes:

[0007] Determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set;

[0008] Traverse the threshold set corresponding to each rule in the target rule set in turn to obtain a target threshold set, and the thresholds in the target threshold set correspond to the rules in the target rule set;

[0009] Determine the influence degree of each threshold in the target threshold set on the fusion target to obtain an influence degree set;

[0010] Determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, and the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0011] Determine whether the target metric is higher than the target threshold, where the target metric is the metric corresponding to the user suspected of having a risk to be determined, and the target threshold is the threshold corresponding to the target metric in the set of optimal thresholds;

[0012] If so, determine that the target user is a user suspected of having a risk.

[0013] Optionally, the traversing the threshold sets corresponding to each rule in the target set in sequence to obtain the target threshold set includes:

[0014] Step 1, traverse the first threshold set to obtain a first target threshold. The first threshold set is the threshold set corresponding to a first rule, and the first rule is any rule in the target rule set. The first target threshold is included in the first threshold set, and the first target threshold is the threshold when the maximum value of the fusion target calculated with a second target threshold in the threshold set corresponding to the first rule. The second target threshold is the threshold corresponding to the rule in the first rule set, and the first rule set is the rule set in the target rule set except the first rule;

[0015] Step 2, based on the first target threshold, traverse the second threshold set to obtain a second target threshold. The second threshold set is the threshold set corresponding to a second rule, and the second rule is any rule in the first rule set. The second threshold is included in the second threshold set, and the second target threshold is the threshold when the maximum value of the fusion target calculated with a third target threshold in the threshold set corresponding to the second rule. The third target threshold is the threshold corresponding to the rule in the second rule set and the first target threshold, and the second rule set is the rule set in the first rule set except the second rule;

[0016] Step 3, repeat Step 2 until all the rules in the target rule set are traversed to obtain the target threshold set, and both the first target threshold and the second target threshold are included in the target threshold set.

[0017] Optionally, the determining the set of optimal thresholds corresponding to the target rule set according to the influence degree set and the target threshold set includes:

[0018] Iteratively obtain through the following formula until a preset iteration termination condition is reached to obtain the set of optimal thresholds corresponding to the target rule set:

[0019]

[0020] where, md i (s + 1) is the optimal threshold value of rule i in the (s + 1)-th round, mdi (s) is the optimal threshold value of the rule i in the s-th round, where the rule i is the i-th rule in the target rule set, d i is the threshold set corresponding to the rule i, d is any threshold in the threshold value set of the rule i, inf i (s) is the value of the influence degree corresponding to the rule i in the s-th round, γ is the learning rate, U 1 and U 2 is a uniform distribution with a mean of 0 and a variance of 1, U 1 and U 2 are independent of each other, and random sampling is performed in each iteration calculation, F s-1 is the target value of the fusion target obtained in the (s - 1)-th iteration, F s is the target value of the fusion target obtained in the s-th iteration.

[0021] Optionally, the method further includes:

[0022] Determine whether the number of iterations reaches a preset value. If so, it is determined that the preset iteration termination condition is satisfied;

[0023] Or,

[0024] Determine whether the rule thresholds converge. If so, it is determined that the preset iteration termination condition is satisfied.

[0025] Optionally, determining the influence degree of each threshold corresponding to the rule in the target threshold set on the fusion target to obtain the influence degree set includes:

[0026] Obtain the influence degree set through the following formula:

[0027]

[0028] where F is the fusion target, inf i is the influence degree of the rule i on the fusion target F, where the rule i is the i-th rule in the target rule set, md i the threshold value corresponding to the rule i in the target threshold set, △ i is the interval of the threshold set corresponding to the rule i, F(x) is the target value obtained when the threshold of the rule i takes x and the rule values of other rules in the target rule set remain unchanged.

[0029] The second aspect of the embodiments of the present invention provides a device for determining a risk-suspected user, including:

[0030] A first determination unit, configured to determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set;

[0031] A traversal unit for traversing in sequence the threshold sets corresponding to each rule in the target rule set to obtain a target threshold set, where the thresholds in the target threshold set correspond to the rules in the target rule set;

[0032] A second determination unit for determining the influence degree of each threshold in the target threshold set on the fusion target to obtain an influence degree set;

[0033] A third determination unit for determining the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, where the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0034] A judgment unit for judging whether a target index is higher than a target threshold, where the target index is an index corresponding to a user suspected of having a risk to be determined, and the target threshold is the threshold corresponding to the target index in the optimal threshold set;

[0035] A fourth determination unit, if the target index is higher than the target threshold, determines that the target user is a user suspected of having a risk.

[0036] Optionally, the traversal unit is specifically used for:

[0037] Step 1: Traverse the first threshold set to obtain a first target threshold, where the first threshold set is the threshold set corresponding to a first rule, the first rule is any rule in the target rule set, the first target threshold is included in the first threshold set, and the first target threshold is the threshold when the maximum value of the fusion target calculated with a second target threshold is obtained in the threshold set corresponding to the first rule, the second target threshold is the threshold corresponding to the rule in the first rule set, and the first rule set is the rule set in the target rule set except the first rule;

[0038] Step 2: Based on the first target threshold, traverse the second threshold set to obtain a second target threshold, where the second threshold set is the threshold set corresponding to a second rule, the second rule is any rule in the first rule set, the second threshold is included in the second threshold set, and the second target threshold is the threshold when the maximum value of the fusion target calculated with a third target threshold is obtained in the threshold set corresponding to the second rule, the third target threshold is the threshold corresponding to the rule in the second rule set and the first target threshold, and the second rule set is the rule set in the first rule set except the second rule;

[0039] Step 3: Repeat Step 2 until all the rules in the target rule set are traversed to obtain the target threshold set, where the first target threshold and the second target threshold are both included in the target threshold set.

[0040] Optionally, the third determination unit is specifically configured to:

[0041] Obtain through iteration using the following formula until a preset iteration termination condition is reached, so as to obtain the optimal threshold set corresponding to the target rule set:

[0042]

[0043] where md i (s + 1) is the optimal threshold value of rule i in the (s + 1)-th round, md i (s) is the optimal threshold value of rule i in the s-th round, and rule i is the i-th rule in the target rule set, d i is the threshold set corresponding to rule i, d is any threshold value in the threshold value set of rule i, inf i (s) is the value of the influence degree corresponding to rule i in the s-th round, γ is the learning rate, U 1 and U 2 are uniformly distributed with a mean of 0 and a variance of 1, U 1 and U 2 are independent of each other, and random sampling is performed for each iteration calculation, F s-1 is the target value of the fusion target obtained in the (s - 1)-th round of iteration, and F s is the target value of the fusion target obtained in the s-th round of iteration.

[0044] Optionally, the judgment unit is further configured to:

[0045] Judge whether the number of iterations reaches a preset value. If so, it is determined that the preset iteration termination condition is satisfied;

[0046] Or,

[0047] Judge whether the rule threshold converges. If so, it is determined that the preset iteration termination condition is satisfied.

[0048] Optionally, the second determination unit is specifically configured to:

[0049] Obtain the influence degree set through the following formula:

[0050]

[0051] where F is the fusion target, inf iis the influence degree of rule i on the fusion target F, where rule i is the i-th rule in the target rule set, md i is the threshold value corresponding to rule i in the target threshold set, △ i is the interval of the threshold set corresponding to rule i, F(x) is the target value obtained when the threshold of rule i takes x and the values of the rules other than rule i in the target rule set remain unchanged.

[0052] The third aspect of the embodiments of the present invention provides an electronic device, including a memory and a processor. When the processor executes a computer management program stored in the memory, it implements the steps of the method for determining a risk-suspected user as described in the first aspect above.

[0053] The fourth aspect of the embodiments of the present invention provides a computer-readable storage medium, on which a computer management program is stored. When the computer management program is executed by a processor, it implements the steps of the method for determining a risk-suspected user as described in the first aspect above.

[0054] In summary, it can be seen that in the embodiments provided by the present invention, first, a rule set and a threshold combination corresponding to each rule in the rule set are determined. Then, a relationship between the threshold corresponding to the rule and the fusion target is established by traversing to determine a temporarily optimal threshold combination, and based on this temporarily optimal threshold combination, the influence degree of the current rule on the target value of the fusion target is determined. Then, according to the influence degree and the temporarily optimal threshold combination, an optimal threshold set is determined, and based on this optimal threshold set, it is determined whether the user is a risk-suspected user. In this way, the best rule threshold value can be found without using the existing enumeration method, making it faster and more accurate to determine the risk-suspected user according to the best rule threshold and improving the calculation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a schematic flowchart of a method for determining a risk-suspected user provided by an embodiment of the present invention;

[0056] Figure 2 is a schematic virtual structure diagram of a device for determining a risk-suspected user provided by an embodiment of the present invention;

[0057] Figure 3 is a schematic hardware structure diagram of a device for determining a risk-suspected user provided by an embodiment of the present invention;

[0058] Figure 4 is a schematic diagram of an embodiment of an electronic device provided by an embodiment of the present invention;

[0059] Figure 5 is a schematic diagram of an embodiment of a computer-readable storage medium provided by an embodiment of the present invention. Detailed implementation manners

[0060] In the description and claims of the present invention and the above-mentioned drawings, the terms "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments described herein can be implemented in an order different from that shown or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments.

[0061] The method for determining a risk-suspected user will be described below from the perspective of a device for determining a risk-suspected user. The device for determining a risk-suspected user may be a server or a service unit in the server.

[0062] Please refer to Figure 1 , Figure 1 , which is a schematic diagram of an embodiment of the method for determining a risk-suspected user provided by an embodiment of the present invention. The method for determining a risk-suspected user is applied to a live broadcast platform. The method for determining a risk-suspected user includes:

[0063] 101. Determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set.

[0064] In this embodiment, the device for determining a risk-suspected user can determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set. It can be understood that in different business scenarios, the rule sets to be fused are different. Here, the rules included in the target rule set and the thresholds corresponding to the rules in the target rule set can be selected according to business experience and business scenarios. The target rule set can be expressed as:

[0065] {r i ∈R, d∈d i};

[0066] where R is the target rule set, r i is the i-th rule in the target rule set. The i-th rule can be, for example, a rule such as user level or user payment amount, d iLet \(T_i\) be the set of thresholds corresponding to the \(i\)-th rule, and \(d\) be any one of the thresholds in the set of thresholds corresponding to the \(i\)-th rule.

[0067] It should be noted that for the convenience of search, the values of the thresholds in the set of thresholds corresponding to the \(i\)-th rule are generally equally spaced, that is:

[0068]

[0069] where, is the \(k\)-th threshold in the set of thresholds corresponding to rule \(i\), and \(\Delta\) i is the value interval of the thresholds in the set of thresholds corresponding to rule \(i\).

[0070] 102. Traverse the set of thresholds corresponding to each rule in the target rule set in turn to obtain the target threshold set.

[0071] In this embodiment, after the risk-suspected user determination device obtains the target rule set and the set of thresholds corresponding to each rule in the target rule set, it can traverse the set of thresholds corresponding to each rule in the target rule set in turn to obtain the target threshold set, where the thresholds in the target threshold set correspond to the rules in the target rule set, that is, each threshold in the target threshold set can find a corresponding rule in the target rule set.

[0072] In one embodiment, the risk-suspected user determination device traverses the set of thresholds corresponding to each rule in the target set in turn to obtain the target threshold set, including:

[0073] Step 1. Traverse the first threshold set to obtain the first target threshold. The first threshold set is the set of thresholds corresponding to the first rule, and the first rule is any one of the rules in the target rule set. The first target threshold is included in the first threshold set, and the first target threshold is the threshold when the maximum value of the fusion target calculated with the second target threshold in the set of thresholds corresponding to the first rule. The second target threshold is the threshold corresponding to the rule in the first rule set, and the first rule set is the set of rules in the target rule set except the first rule;

[0074] Step 2. Based on the first target threshold, traverse the second threshold set to obtain the second target threshold. The second threshold set is the set of thresholds corresponding to the second rule, and the second rule is any one of the rules in the first rule set. The second threshold is included in the second threshold set, and the second target threshold is the threshold when the maximum value of the fusion target calculated with the third target threshold in the set of thresholds corresponding to the second rule. The third target threshold is the threshold corresponding to the rule in the second rule set and the first target threshold, and the second rule set is the set of rules in the first rule set except the second rule;

[0075] Step 3: Repeat Step 2 until all the rules in the target rule set are traversed, obtaining a target threshold set. The first target threshold and the second target threshold are both included in the target threshold set.

[0076] In this embodiment, the device for determining risk-suspected users establishes the relationship between the threshold corresponding to the rule and the fusion target by means of traversal. The following is a specific description:

[0077] 1. For Rule 1 (i.e., the first rule), the threshold of Rule 1 takes values d ∈ d 1 , and for each threshold value taken by Rule 1, it is calculated with the thresholds of other rules in the target rule set except Rule 1 (the thresholds of these other rules can be randomly selected or selected according to the actual situation. For example, the 3rd threshold is selected for all, and there is no specific limitation). In this way, for each threshold value in Rule 1, a target value of the fusion target F is obtained. The threshold value when the fusion target F reaches the maximum target value is marked as md 1 , that is, this first target threshold;

[0078] 2. Fix the threshold md of Rule 1 r , and the threshold of Rule 2 takes values d ∈ d 2 . For each threshold value taken by Rule 2, it is calculated with the thresholds of other rules in the target rule set except Rule 2 (here, for the selection of the thresholds of other rules, except that the threshold of the first rule is determined as the first target threshold, the other thresholds can be randomly selected or selected according to the actual situation. For example, the 3rd threshold is selected for all, and there is no specific limitation). In this way, for each threshold value in Rule 2, a target value of the fusion target F is obtained. The threshold value when the fusion target F reaches the maximum target value is marked as md 2 , that is, this second target threshold.

[0079] 3. Traverse all the rules in the target rule set in the above manner in turn, thereby determining the target threshold set, marked as md 1 , md 2 ,..., md R .

[0080] For example, there are 4 rules, namely A, B, C, and D, in the target rule set, and each rule corresponds to 3 thresholds. When traversing to obtain the target threshold set, any rule is randomly selected. For example, rule A corresponds to thresholds A1, A2, and A3. For threshold A1, any one threshold is randomly selected from the thresholds corresponding to rules B, C, and D, and is calculated with threshold A1 to determine the target value of the fusion target F. The target values of the fusion target F for thresholds A2 and A3 in rule A are also calculated and determined in this way. The threshold when the target maximum value of the fusion target F is reached is marked as md A ; For rule B, which corresponds to thresholds B1, B2, and B3, the target value of the fusion target F is calculated in the same way as rule A. However, when calculating, the thresholds corresponding to rule B are only calculated with the unmarked rules (that is, only calculated with the thresholds corresponding to rule C and rule D), and the threshold md corresponding to rule B is obtained B ; And so on, when determining the threshold md corresponding to rule C C the thresholds corresponding to rule C are only calculated with the thresholds corresponding to rule D

[0081] It should be noted that before determining the target threshold set, the fusion target also needs to be specified. In the risk control scenario, it is necessary to identify risk users as much as possible without misidentifying normal users. Therefore, the following two indicators are defined (of course, other indicators can also be added according to the actual situation. Here, two indicators are used as examples for illustration, and the specific ones are not limited):

[0082] Coverage rate U = the number of truly risky users among the users identified after fusion / the total number of truly risky users;

[0083] Accuracy rate P = the number of truly risky users among the users identified after fusion / the number of risky users identified after fusion;

[0084] Taking into account the influence of these two indicators, the final fusion target is defined as follows

[0085]

[0086] It should be noted that recall rate and accuracy rate are mutually exclusive. An increase in the recall rate will result in a decrease in the accuracy rate. Therefore, the advantage of designing this formula is that it can comprehensively consider these two indicators. The design principle of the above formula for the fusion target is to use the harmonic mean of the recall rate and the accuracy rate, that is, after taking the reciprocals of the recall rate and the accuracy rate and finding their arithmetic mean, then taking the reciprocal of this arithmetic mean. The advantage of doing this compared to directly finding the arithmetic mean is that it can be unaffected by extreme values. For example, for a very high recall rate but a low accuracy rate, the value obtained by using this formula will be relatively small, which is more reasonable

[0087] 103. Determine the influence degree of each threshold corresponding rule in the target threshold set on the fusion target to obtain an influence degree set.

[0088] In this embodiment, after obtaining the target threshold set, the determination device for risk-suspected users can determine the influence degree of each threshold corresponding rule in the target threshold set on the fusion target to obtain an influence degree set. Specifically, the influence degree set can be obtained through the following formula:

[0089]

[0090] where F is the fusion target, inf i is the influence degree of rule i on the fusion target F, rule i is the i-th rule in the target rule set, md i is the threshold value corresponding to rule i in the target threshold set, △ i is the interval of the threshold set corresponding to rule i, and F(x) is the target value obtained when the threshold of rule i takes x and the rule values of other rules in the target rule set remain unchanged.

[0091] It should be noted that the above formula is used to calculate the influence of the change of the threshold corresponding to rule i on the overall target. This formula is based on the idea of derivatives in mathematics and approximately calculates the derivative of function F at md i through the formula. Since the form of F is unknown and its derivative at a certain point cannot be directly calculated, this formula is designed to approximately calculate the derivative.

[0092] 104. Determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set.

[0093] In this embodiment, the determination device for risk-suspected users can determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set. Specifically, it can be obtained by iterating the following formula until the preset iteration termination condition is reached to obtain the optimal threshold set:

[0094]

[0095] where md i (s + 1) is the optimal threshold value of rule i in the (s + 1)-th round, md i (s) is the optimal threshold value of rule i in the s-th round, rule i is the i-th rule in the target rule set, d i is the threshold set corresponding to rule i, d is any threshold in the threshold value set of rule i, inf i(s) is the value of the influence degree corresponding to rule i in the s-th round, γ is the learning rate (where the value of the learning rate can be 1 or 10, etc. The advantage of doing this is to control the learning speed each time. If the learning is too slow, it will be difficult to converge; if the learning is too fast, it may oscillate repeatedly and fail to find the minimum value), U 1 and U 2 are uniformly distributed with a mean of 0 and a variance of 1, and U 1 and U 2 are independent of each other. Random sampling will be performed in each iterative calculation, F s-1 is the target value of the fusion target obtained in the (s - 1)-th round of iteration, and F s is the target value of the fusion target obtained in the s-th round of iteration. When the preset iterative termination condition is reached, the optimal threshold combination obtained is the determined best rule threshold, that is, the optimal threshold set, marked as:

[0096] opt i = md i (m).

[0097] It should be noted that in the above formula, is the update of the rule threshold parameter through learning. In the formula, -γinf i (s) implements a gradient descent method, which is a method for finding the optimal value based on optimization theory. The formula in the present invention further performs a non-linear transformation on the basis of the gradient using the function to control the result between 0 and 1. The significance of its design is that the optimization of the threshold can be fine-tuned on the existing result, and using this function can control the adjustment amount. This term is for randomly jumping out to prevent entering the local optimal solution. It can be seen that when F s-1 > F s , it means that the s-th round of iteration does not increase the objective function. At this time, a jump-out operation is required, so this term will be added to the result of the non-linearized gradient. The principle of the design of this term is: is a normal distribution random sampling method, which can sample from a normal distribution with a mean of 0 and a variance of 1. ln(F s-1 / F s ) measures the intensity of the sampling. Since F s-1 / F s may be very large or very small, the logarithm is used to transform the scale, which is a commonly used method in mathematics. It should be noted that this term will only take effect when s > 1.

[0098] It should be noted that the advantage of the above change is to prevent F s-1 / F sis too large or too small. If logarithmic transformation is not used, then when F s-1 / F s is very large, the change range of the optimal parameter is too large, resulting in repeated oscillation of the objective function and unable to converge, and the obtained optimal parameter is inaccurate; when F s-1 / F s is very small, the random jump value is meaningless, so the purpose of jumping out of the local optimal solution cannot be achieved.

[0099] 105. Determine whether the target index is higher than the target threshold. If so, execute step 106.

[0100] In this embodiment, after determining the optimal threshold set, the risk suspect user determination device can determine whether the target index is higher than the target threshold. The target index is the index corresponding to the user to be determined as a risk suspect (such as the behavior frequency, the number of devices used, and the number of IPs used, etc.), and the target threshold is the threshold corresponding to the target index in the optimal threshold set. If so, execute step 106. It can be understood that when there are multiple target indexes, a threshold value can be set, that is, when the number of indexes higher than the target threshold in the target indexes reaches the threshold value, step 106 is executed; otherwise, other operations are performed. For example, if the target index is 5 and the threshold value is 4, only when 4 of the target indexes are higher than the corresponding target threshold in the optimal threshold set, step 106 is executed.

[0101] 106. Determine that the target user is a risk suspect user.

[0102] In this embodiment, when the target index is higher than the target threshold, the risk suspect user determination device can determine that the target user is a risk suspect user. That is to say, after the optimal rule threshold combination, if the relevant indexes of the user are all higher than the thresholds of the corresponding rules, then the user is considered to be at risk of suspicion, and the user will be determined as a risk suspect user and added to the blacklist to restrict its subsequent behavior; otherwise, the user will not be processed.

[0103] In summary, it can be seen that in the embodiment provided by the present invention, first, the rule set and the threshold combination corresponding to each rule in the rule set are determined, and then the relationship between the threshold corresponding to the rule and the fusion target is established by traversing to determine the temporarily optimal threshold combination, and based on the temporarily optimal threshold combination, the influence degree of the current rule on the target value of the fusion target is determined. Then, according to the influence degree and the temporarily optimal threshold combination, the optimal threshold set is determined, and based on the optimal threshold set, it is determined whether the user is a risk suspect user. In this way, the best rule threshold value can be found without using the existing enumeration method, making it faster and more accurate to determine the risk suspect user according to the best rule threshold and improving the calculation efficiency.

[0104] The following is an illustration with specific examples:

[0105] Suppose there are two rules, Rule A and Rule B, in the target rule set, and their selectable thresholds are as follows:

[0106] Rule A: 9, 10, 11, △ 1 = 1, △ 1 is the interval of the threshold set corresponding to Rule A;

[0107] Rule B: 5, 6, 7, 8, △ 2 = 1, △ 2 is the interval of the threshold set corresponding to Rule B;

[0108] Determine the target threshold set, that is, determine the temporarily optimal thresholds for Rule A and Rule B. Specifically:

[0109] For Rule A:

[0110] Take the threshold of Rule A as 9, randomly take the threshold of B as 6, and calculate to get F = 0.35;

[0111] Take the threshold of Rule A as 10, randomly take the threshold of B as 7, and calculate to get F = 0.40;

[0112] Take the threshold of Rule A as 11, randomly take the threshold of B as 6, and calculate to get F = 0.35.

[0113] It can be seen from this that when the threshold of Rule A is 10, it is the threshold when the fusion target F takes the maximum value. Therefore, the threshold corresponding to Rule A can be marked as md 1 = 10.

[0114] For Rule B, at this time, the threshold of Rule A has been marked. Then, when calculating, directly use the marked threshold, that is, select the threshold of Rule A as 10:

[0115] Take the threshold of B as 5, take the threshold of Rule A as 10, and calculate to get F = 0.35;

[0116] Take the threshold of B as 6, take the threshold of Rule A as 10, and calculate to get F = 0.32;

[0117] Take the threshold of B as 7, take the threshold of Rule A as 10, and calculate to get F = 0.38;

[0118] Take the threshold of B as 8, take the threshold of Rule A as 10, and calculate to get F = 0.34;

[0119] It can be seen from this that when the threshold of Rule B is 7, it is the threshold when the fusion target F takes the maximum value. Therefore, the threshold corresponding to Rule B can be marked as md 2= 7, from which the target threshold set md can be obtained 1 = 10, md 2 = 7.

[0120] After obtaining the target threshold set, that is, obtaining the temporary optimal threshold md of rule A 1 = 10, the temporary optimal threshold md of rule B 2 = 7, it is possible to substitute md 1 = 10, md 2 = 7 into the following formula for calculation to obtain the influence degrees of rule A and rule B on the fusion target: From this, the influence degree inf of rule A on the fusion target F can be obtained 1 is 0.02, and the influence degree inf of rule B on the fusion target 2 is -0.015.

[0121] After that, substitute the influence degree of rule A on the fusion target F and the influence degree of rule B on the fusion target into the following formula for iteration to obtain the optimal thresholds of rule A and rule B:

[0122]

[0123] When performing the first round of iteration through the above formula, there is no |N(0,1)|I(F s <F s-1 ) term.

[0124]

[0125] Therefore: md 1 (1) = 11;

[0126]

[0127] Therefore: md 2 (1) = 6;

[0128] Substitute the thresholds of rule A and rule B obtained in the first round into the above formula respectively and continue the iterative calculation until the preset iteration termination condition is reached, and determine the optimal thresholds of rule A and rule B. Then, determine whether the target user is a risk suspect user according to the optimal thresholds of rule A and rule B. Thus, it is not necessary to use the existing enumeration method to find the best rule threshold value in the rule combination, making it faster and more accurate to determine risk suspect users according to the best rule threshold and improving the calculation efficiency.

[0129] The method for determining a risk-suspected user in the embodiments of the present invention has been described above. Next, a device for determining a risk-suspected user in the embodiments of the present invention will be described.

[0130] Please refer to Figure 2 , a schematic virtual structure diagram of a device for determining a risk-suspected user in the embodiments of the present invention. The device for determining a risk-suspected user includes:

[0131] A first determination unit 201, configured to determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set;

[0132] A traversal unit 202, configured to sequentially traverse the threshold sets corresponding to each rule in the target rule set to obtain a target threshold set, where the thresholds in the target threshold set correspond to the rules in the target rule set;

[0133] A second determination unit 203, configured to determine the influence degree of each threshold in the target threshold set on the fusion target corresponding to the rule to obtain an influence degree set;

[0134] A third determination unit 204, configured to determine an optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, where the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0135] A judgment unit 205, configured to judge whether a target index is higher than a target threshold, where the target index is an index corresponding to a user to be determined as a risk-suspected user, and the target threshold is the threshold corresponding to the target index in the optimal threshold set;

[0136] A fourth determination unit 206, if the target index is higher than the target threshold, then determine that the target user is a risk-suspected user.

[0137] Optionally, the traversal unit 202 is specifically configured to:

[0138] Step 1: Traverse a first threshold set to obtain a first target threshold. The first threshold set is a threshold set corresponding to a first rule, and the first rule is any rule in the target rule set. The first target threshold is included in the first threshold set, and the first target threshold is the threshold when the maximum value of the fusion target calculated with a second target threshold is obtained in the threshold set corresponding to the first rule. The second target threshold is a threshold corresponding to a rule in a first rule set, and the first rule set is a rule set in the target rule set other than the first rule;

[0139] Step 2: Traverse the second threshold set based on the first target threshold to obtain a second target threshold. The second threshold set is the threshold set corresponding to the second rule, the second rule is any rule in the first rule set, the second threshold is included in the second threshold set, and the second target threshold is the threshold when the maximum value of the fusion target calculated with the third target threshold in the threshold set corresponding to the second rule. The third target threshold is the threshold corresponding to the rule in the second rule set and the first target threshold. The second rule set is the rule set in the first rule set except the second rule;

[0140] Step 3: Repeat Step 2 until all rules in the target rule set are traversed to obtain the target threshold set. The first target threshold and the second target threshold are both included in the target threshold set.

[0141] Optionally, the third determination unit 204 is specifically configured to:

[0142] Obtain through iteration using the following formula until a preset iteration termination condition is reached to obtain the optimal threshold set corresponding to the target rule set:

[0143]

[0144] where, md i (s + 1) is the optimal threshold value of rule i in the (s + 1)-th round, md i (s) is the optimal threshold value of rule i in the s-th round. The rule i is the i-th rule in the target rule set, d i is the threshold set corresponding to rule i, d is any threshold in the threshold value set of rule i, inf i (s) is the value of the influence degree corresponding to rule i in the s-th round, γ is the learning rate, U 1 and U 2 are uniformly distributed with a mean of 0 and a variance of 1, U 1 and U 2 are independent of each other, and random sampling is performed for each iteration calculation. F s-1 is the target value of the fusion target obtained in the (s - 1)-th round of iteration, and F s is the target value of the fusion target obtained in the s-th round of iteration.

[0145] Optionally, the judgment unit 205 is further configured to:

[0146] Judge whether the number of iterations reaches a preset value. If so, it is determined that the preset iteration termination condition is satisfied;

[0147] Or,

[0148] Determine whether the rule threshold converges. If so, determine that the preset iteration termination condition is satisfied.

[0149] Optionally, the second determination unit 203 is specifically configured to:

[0150] Obtain the influence degree set through the following formula:

[0151]

[0152] where F is the fusion target, inf i is the influence degree of rule i on the fusion target F, and rule i is the i-th rule in the target rule set, md i is the threshold value corresponding to rule i in the target threshold set, △ i is the interval of the threshold set corresponding to rule i, F(x) is the target value obtained when the threshold of rule i takes x and the values of the rules other than rule i in the target rule set remain unchanged.

[0153] Above Figure 2 The determination device for risk-suspected users in the embodiments of the present invention has been described from the perspective of modular functional entities. Below, the determination device for risk-suspected users in the embodiments of the present invention will be described in detail from the perspective of hardware processing. Please refer to Figure 3 , an embodiment of the determination device 300 for risk-suspected users in the embodiments of the present invention includes:

[0154] An input device 301, an output device 302, a processor 303, and a memory 304 (where the number of processors 303 can be one or more, Figure 3 and one processor 303 is taken as an example here). In some embodiments of the present invention, the input device 301, the output device 502, the processor 303, and the memory 304 can be connected through a bus or other means. Among them, Figure 3 taking the connection through the bus as an example here.

[0155] Among them, by calling the operation instructions stored in the memory 304, the processor 303 is configured to execute the following steps:

[0156] Determine a set of target rules that can be fused and a set of thresholds corresponding to each rule in the set of target rules;

[0157] Traverse in sequence the set of thresholds corresponding to each rule in the set of target rules to obtain a set of target thresholds, and the thresholds in the set of target thresholds correspond to the rules in the set of target rules;

[0158] Determine the influence degree of each threshold corresponding to the rules in the target threshold set on the fusion target to obtain an influence degree set;

[0159] Determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, and the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0160] Judge whether the target index is higher than the target threshold, where the target index is the index corresponding to the user suspected of risk to be determined, and the target threshold is the threshold corresponding to the target index in the optimal threshold set;

[0161] If so, determine that the target user is a user suspected of risk.

[0162] By calling the operation instructions stored in the memory 304, the processor 303 is further configured to execute Figure 1 Any one of the corresponding embodiments.

[0163] Please refer to Figure 4 , Figure 4 which is a schematic diagram of an embodiment of an electronic device provided by an embodiment of the present invention.

[0164] As Figure 4 shown, an embodiment of the present invention provides an electronic device, including a memory 410, a processor 420, and a computer program 411 stored on the memory 420 and operable on the processor 420. When the processor 420 executes the computer program 411, the following steps are implemented:

[0165] Determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set;

[0166] Traverse in sequence the threshold sets corresponding to each rule in the target rule set to obtain a target threshold set, and the thresholds in the target threshold set correspond to the rules in the target rule set;

[0167] Determine the influence degree of each threshold corresponding to the rules in the target threshold set on the fusion target to obtain an influence degree set;

[0168] Determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, and the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0169] Judge whether the target index is higher than the target threshold, where the target index is the index corresponding to the user suspected of risk to be determined, and the target threshold is the threshold corresponding to the target index in the optimal threshold set;

[0170] If so, determine that the target user is a risk suspect user.

[0171] In a specific implementation process, when the processor 420 executes the computer program 411, it can implement Figure 1 any one of the corresponding embodiments.

[0172] Since the electronic device introduced in this embodiment is the device used for determining a risk suspect user in an embodiment of the present invention, based on the method introduced in the embodiment of the present invention, those skilled in the art can understand the specific implementation manners and various variations of the electronic device in this embodiment. Therefore, the specific implementation of how this electronic device implements the method in the embodiment of the present invention will not be described in detail here. As long as the device used by those skilled in the art to implement the method in the embodiment of the present invention belongs to the scope protected by the present invention.

[0173] Please refer to Figure 5 , Figure 5 which is a schematic diagram of an embodiment of a computer-readable storage medium provided by an embodiment of the present invention.

[0174] As Figure 5 shown, this embodiment provides a computer-readable storage medium 500, on which a computer program 511 is stored. When the computer program 511 is executed by a processor, the following steps are implemented:

[0175] Determine a target rule set that can be fused and a threshold set corresponding to each rule in the target rule set;

[0176] Traverse the threshold set corresponding to each rule in the target rule set in sequence to obtain a target threshold set, and the thresholds in the target threshold set correspond to the rules in the target rule set;

[0177] Determine the influence degree of each threshold in the target threshold set on the fusion target to obtain an influence degree set;

[0178] Determine the optimal threshold set corresponding to the target rule set according to the influence degree set and the target threshold set, and the thresholds in the optimal threshold set correspond to the rules in the target rules;

[0179] Judge whether the target index is higher than the target threshold, where the target index is the index corresponding to the user to be determined as a risk suspect, and the target threshold is the threshold corresponding to the target index in the optimal threshold set;

[0180] If so, determine that the target user is a risk suspect user.

[0181] In a specific implementation process, when the computer program 511 is executed by a processor, it can implementFigure 1 Any implementation manner in the corresponding embodiment.

[0182] It should be noted that in the above embodiments, the descriptions of each embodiment have their own emphases. For the parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0183] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0184] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, as well as the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0185] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including instruction means, and the instruction means implements the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0187] An embodiment of the present invention also provides a computer program product, which includes computer software instructions. When the computer software instructions run on a processing device, the processing device is caused to execute the process in the method for determining a risk-suspected user in the corresponding embodiment as Figure 1 the process in the method for determining a risk-suspected user in the corresponding embodiment.

[0188] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of the present invention are wholly or partly generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from a website, a computer, a server, or a data center to another website, computer, server, or data center in a wired manner (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or a wireless manner (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or a data center integrating one or more available media. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

[0189] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above may refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0190] In several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other may be indirect couplings or communication connections through some interfaces, devices, or units, and may be in an electrical, mechanical, or other form.

[0191] The unit described as a separation component may or may not be physically separated. The component shown as a unit may or may not be a physical unit, that is, it may be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0192] In addition, each functional unit in various embodiments of the present invention may be integrated in a processing unit, may exist separately as individual physical units, or two or more units may be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0193] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0194] As described above, the above embodiments are only used to illustrate the technical solution of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of various embodiments of the present invention.

Claims

1. A method for determining a user suspected of risk, characterized in that, comprising: determining a set of target rules that can be fused and a set of thresholds corresponding to each rule in the set of target rules; sequentially traversing the set of thresholds corresponding to each rule in the set of target rules to obtain a set of target thresholds, where the thresholds in the set of target thresholds correspond to the rules in the set of target rules; determining the influence degree of the rule corresponding to each threshold in the set of target thresholds on the fusion target to obtain a set of influence degrees; determining a set of optimal thresholds corresponding to the set of target rules according to the set of influence degrees and the set of target thresholds, where the thresholds in the set of optimal thresholds correspond to the rules in the set of target rules; judging whether a target index is higher than a target threshold, where the target index is an index corresponding to a user suspected of risk to be determined, and the target threshold is the threshold corresponding to the target index in the set of optimal thresholds; if so, determining that the target user is a user suspected of risk; The sequentially traversing the set of thresholds corresponding to each rule in the set of target rules to obtain a set of target thresholds includes: Step 1, traversing a first set of thresholds to obtain a first target threshold, where the first set of thresholds is a set of thresholds corresponding to a first rule, the first rule is any rule in the set of target rules, the first target threshold is included in the first set of thresholds, and the first target threshold is the threshold when the maximum value of the fusion target calculated with a second target threshold in the set of thresholds corresponding to the first rule, the second target threshold is a threshold corresponding to a rule in a first set of rules, and the first set of rules is a set of rules in the set of target rules other than the first rule; Step 2, based on the first target threshold, traversing a second set of thresholds to obtain a second target threshold, where the second set of thresholds is a set of thresholds corresponding to a second rule, the second rule is any rule in the first set of rules, the second threshold is included in the second set of thresholds, and the second target threshold is the threshold when the maximum value of the fusion target calculated with a third target threshold in the set of thresholds corresponding to the second rule, the third target threshold is a threshold corresponding to a rule in a second set of rules and the first target threshold, and the second set of rules is a set of rules in the first set of rules other than the second rule; Step 3, repeatedly executing Step 2 until all the rules in the set of target rules are traversed to obtain the set of target thresholds, and the first target threshold and the second target threshold are both included in the set of target thresholds; The determining a set of optimal thresholds corresponding to the set of target rules according to the set of influence degrees and the set of target thresholds includes: iteratively obtaining through the following formula until a preset iteration termination condition is reached to obtain the set of optimal thresholds corresponding to the set of target rules: Among them, md i (s + 1) is the optimal threshold value of rule i in the (s + 1)-th round, md i (s) is the optimal threshold value of the said rule i in the s-th round, and the said rule i is the i-th rule in the said target rule set, d i is the threshold set corresponding to the said rule i, d is any threshold in the threshold value set of the said rule i, inf i (s) is the value of the influence degree corresponding to the said rule i in the s-th round, γ is the learning rate, U 1 and U 2 are uniform distributions with a mean of 0 and a variance of 1, U 1 and U 2 are independent of each other, and random sampling is performed in each iteration calculation, F s-1 is the target value of the said fusion target obtained in the (s - 1)-th iteration, F s is the target value of the said fusion target obtained in the s-th iteration; The method further includes: Determine whether the number of iterations reaches a preset value. If so, it is determined that the preset iteration termination condition is satisfied; or, determine whether the rule threshold converges. If so, it is determined that the preset iteration termination condition is satisfied; The determining the influence degree of the rule corresponding to each threshold in the target threshold set on the fusion target to obtain an influence degree set includes: The influence degree set is obtained through the following formula: where F is the fusion target, inf i is the influence degree of rule i on the fusion target F, and rule i is the i-th rule in the target rule set, md i is the threshold value corresponding to rule i in the target threshold set, Δ i is the interval of the threshold set corresponding to rule i, F(x) is the target value obtained when the threshold of rule i takes x and the values of the rules other than rule i in the target rule set remain unchanged.

2. An electronic device, including a memory and a processor, wherein, When the processor executes the computer management program stored in the memory, the steps of the method for determining a risk suspect user as described in claim 1 are implemented.

3. A computer-readable storage medium, on which a computer management program is stored, wherein: When the computer management program is executed by a processor, the steps of the method for determining a risk suspect user as described in claim 1 are implemented.

Images