A method and apparatus for anomaly detection

Abstract

The present specification discloses a method and device for anomaly detection, wherein at least one service feature corresponding to the service behavior of a user is determined based on service information of the user performing a service, so that the accuracy of anomaly detection of each abnormal behavior of the user by the service platform can be improved while guaranteeing the safety of the user by comprehensively determining multiple service features and performing anomaly detection on the service behavior of the user.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method and apparatus for anomaly detection. Background Technology

[0002] With the continuous development of internet technology, more and more enterprises and users can provide or perform a variety of businesses through the internet.

[0003] However, during the execution of various business processes, some users have performed abnormal behaviors that do not conform to the preset rules and consensus of such business processes. Such abnormal behaviors often have an impact on the business parties or other users.

[0004] Therefore, how to accurately and effectively detect abnormal user behavior is an urgent problem to be solved. Summary of the Invention

[0005] This specification provides a method and apparatus for anomaly detection, which partially solves the aforementioned problems existing in the prior art.

[0006] The following technical solution is adopted in this specification:

[0007] This specification provides a method for anomaly detection, including:

[0008] In response to the user's business execution, obtain the business information of the user executing the business;

[0009] Based on the business information, the business behavior of the user when performing the business is determined as the business behavior to be detected, and at least one business feature corresponding to the business behavior to be detected is determined. The business feature includes at least one of the following: historical behavior feature, target behavior feature, and entity feature. The historical behavior feature is used to characterize the features of abnormal conditions in the historical business behavior performed by the user. The target behavior feature is used to characterize the behavior features of the user when performing the business behavior to be detected. The entity feature is used to characterize the features of the entity object associated with the business performed by the user.

[0010] Based on at least one of the aforementioned business characteristics, anomaly detection is performed on the business behavior to be detected.

[0011] Optionally, when the at least one business feature includes the historical behavior feature, determining the at least one business feature corresponding to the business behavior to be detected specifically includes:

[0012] Based on the business information, retrieve the historical business transactions performed by the user;

[0013] Based on the chronological order in which the user performed each historical service, the user's historical behavior during the performance of each historical service is sorted to obtain a historical behavior sequence;

[0014] Based on the historical behavior sequence, the historical behavior features corresponding to the business behavior to be detected are determined.

[0015] Optionally, based on the historical behavior sequence, the historical behavior features corresponding to the business behavior to be detected are determined, specifically including:

[0016] The historical behavior sequence is input into a preset attention mechanism network to determine the attention weight corresponding to each historical behavior in the historical behavior sequence. For each historical behavior, the further away the time when the user performs the historical behavior is from the current time, the smaller the attention weight corresponding to the historical behavior. For different historical behaviors within the same time period, the attention weight corresponding to abnormal historical behavior is greater than the attention weight corresponding to normal historical behavior.

[0017] By using the attention weight corresponding to each historical behavior in the historical behavior sequence, the feature vector of each historical behavior in the historical behavior sequence is weighted to determine the historical behavior features corresponding to the business behavior to be detected.

[0018] Optionally, when the at least one business feature includes the entity feature, determining the at least one business feature corresponding to the business behavior to be detected specifically includes:

[0019] Based on the business information, obtain entity information of entity objects associated with the business, wherein the entity information includes at least one of the user's attribute information and the attribute information of the merchants involved in the business;

[0020] Based on the entity information, determine the entity features corresponding to the business behavior to be detected.

[0021] Optionally, at least one business feature corresponding to the business behavior to be detected is determined, specifically including:

[0022] The reference information used for anomaly detection of the business behavior to be detected is input into the feature extraction layer of the pre-trained detection model, so that at least one business feature of the business behavior to be detected can be obtained through the feature extraction layer, wherein the reference information is obtained based on the business information.

[0023] Based on at least one of the aforementioned business characteristics, anomaly detection is performed on the business behavior to be detected, specifically including:

[0024] The at least one business feature is input into the strategy layer of the detection model to obtain the probability value of the business behavior to be detected as an abnormal behavior output by the strategy layer.

[0025] Based on the probability value, anomaly detection is performed on the business behavior to be detected.

[0026] Optionally, the reference information used for anomaly detection of the business behavior to be detected is input into the feature extraction layer of a pre-trained detection model, so that at least one business feature of the business behavior to be detected can be obtained through the feature extraction layer, specifically including:

[0027] For each piece of reference information, the reference information is input into the embedding layer of the detection model so that the interaction features after information interaction of different dimensions contained in the reference information are obtained through the embedding layer, which are used as the interaction features corresponding to the reference information.

[0028] The interaction features corresponding to each reference information are input into the feature extraction layer to obtain at least one business feature of the business behavior to be detected.

[0029] Optionally, training the detection model specifically includes:

[0030] Obtain sample reference information;

[0031] The sample reference information is input into the detection model to obtain the probability value of the sample's historical behavior corresponding to the sample reference information output by the detection model as an abnormal behavior, which is used as the probability value to be optimized.

[0032] The detection model is trained with the optimization objective of minimizing the deviation between the probability value to be optimized and the actual result of whether the sample's historical behavior is abnormal.

[0033] This specification provides an anomaly detection device, comprising:

[0034] The acquisition module is used to respond to the user's business execution and acquire the business information of the user executing the business.

[0035] The feature extraction module is used to determine the user's business behavior when performing the business based on the business information, as the business behavior to be detected, and to determine at least one business feature corresponding to the business behavior to be detected. The business feature includes at least one of the following: historical behavior features, target behavior features, and entity features. The historical behavior features are used to characterize the features of abnormal conditions in the user's historical business behavior. The target behavior features are used to characterize the behavior features of the user when performing the business behavior to be detected. The entity features are used to characterize the features of the entity objects associated with the business performed by the user.

[0036] The detection module is used to perform anomaly detection on the business behavior to be detected based on the at least one business characteristic.

[0037] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for anomaly detection.

[0038] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method for anomaly detection.

[0039] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0040] The anomaly detection method provided in this specification requires first responding to the user's business execution, obtaining the business information of the user's business execution, and then determining the business behavior of the user when executing the business based on the business information, which is taken as the business behavior to be detected, and determining at least one business feature corresponding to the business behavior to be detected. The business feature includes at least one of the following: historical behavior features, target behavior features, and entity features. The historical behavior features are used to characterize the features of abnormal situations in the user's historical business behavior, the target behavior features are used to characterize the behavior features of the user when executing the business behavior to be detected, and the entity features are used to characterize the features of the entity objects associated with the business executed by the user. Finally, anomaly detection is performed on the business behavior to be detected based on at least one business feature.

[0041] As can be seen from the above methods, at least one business characteristic corresponding to a user's business behavior can be determined based on the business information of the user's business execution. In this way, multiple business characteristics can be comprehensively determined to detect anomalies in the user's business behavior, thereby providing security for the user and improving the accuracy of the business platform in detecting various abnormal user behaviors. Attached Figure Description

[0042] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0043] Figure 1 This is a flowchart illustrating an anomaly detection method provided in this specification;

[0044] Figure 2 This is a schematic diagram of the structure of a detection model provided in this specification;

[0045] Figure 3 This is a schematic diagram of an anomaly detection device provided in this specification;

[0046] Figure 4 This specification provides a corresponding Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0048] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0049] Figure 1 This is a flowchart illustrating an anomaly detection method provided in this specification, including the following steps:

[0050] S101: In response to the user's business execution, obtain the business information of the user executing the business.

[0051] In this specification, the business platform can respond to the user's business execution, obtain the business information of the user's business execution, and then perform anomaly detection on the business behavior corresponding to the user's business information. The business information may include: the time of business execution, the information uploaded by the user during the business execution, the user's operation information when executing the business, the account information used by the user when executing the business, etc.

[0052] The services performed by users can be of various types, such as: users submitting merchant information through the application (App) provided by the electronic map service platform to complete the service of optimizing the electronic map; users performing payment services for purchasing goods through the App provided by the e-commerce service platform; and users performing evaluation services for evaluating meals through the App provided by the food delivery service platform.

[0053] The time of execution of a transaction can refer to the moment when the user performs the transaction. For example, if a user performs a payment transaction at a certain moment, that moment can be used as the time of execution of the payment transaction.

[0054] The information uploaded by users during the execution of business operations can refer to various types of information uploaded by users during the execution of business operations, such as: text information describing the basic information of merchants when users perform the above-mentioned electronic map optimization business in the App, text information in which users evaluate merchants, multimedia information such as images or videos of the merchants provided by users, etc.

[0055] User operation information during business execution refers to the information collected by the business platform through the front-end program. For example, when a user performs the aforementioned optimized electronic map service in the App, information such as the user's click operation, text editing operation, and page dwell time can be collected on the displayed merchant information entry page as user operation information during business execution.

[0056] In this specification, the executing entity used to implement the anomaly detection method can refer to a designated device set up on the business platform, such as a server, or a designated device such as a desktop computer or a laptop computer. For ease of description, the following description will only use the server as the executing entity to illustrate the anomaly detection method provided in this specification.

[0057] S102: Based on the business information, determine the business behavior of the user when performing the business as the business behavior to be detected, and determine at least one business feature corresponding to the business behavior to be detected. The business feature includes at least one of the following: historical behavior feature, target behavior feature, and entity feature. The historical behavior feature is used to characterize the features of abnormal conditions in the historical business behavior performed by the user. The target behavior feature is used to characterize the behavior features of the user when performing the business behavior to be detected. The entity feature is used to characterize the features of the entity object associated with the business performed by the user.

[0058] S103: Based on the at least one business characteristic, perform anomaly detection on the business behavior to be detected.

[0059] Once the server obtains the business information of the user's business execution, it can determine the business behavior (i.e., the event in computer terminology; an operation that can be recognized by a computer is an event, which is the business behavior here) based on the business information, and use it as the business behavior to be detected.

[0060] This can be understood as follows: when a user completes a corresponding business operation on the app's operation page, an event is triggered, which is a business behavior. The application can then send the business information corresponding to this business behavior to the server. The server can determine the business behavior performed by the user based on the obtained business information, and then perform anomaly detection on this business behavior to determine whether the business behavior is abnormal.

[0061] Furthermore, for the business behavior to be detected, the server determines at least one business feature corresponding to the business behavior to be detected, and then performs anomaly detection on the business behavior to be detected based on the determined at least one business feature. The business feature can be at least one of the following: historical behavior features, target behavior features, entity features.

[0062] Among them, historical behavior features are used to characterize whether there are any abnormal situations in the user's historical business behavior. The user's historical behavior features can reflect the possibility that the user's business behavior to be detected is abnormal to a certain extent. For example, if the user has a lot of abnormal behaviors in his / her historical behavior, then the user's current business behavior to be detected may be abnormal to some extent.

[0063] Specifically, the server can query the historical business performed by the user based on the acquired business information. Then, it can sort the historical behaviors of the user when performing each historical business according to the chronological order of the execution time to obtain a historical behavior sequence. Finally, it can determine the historical behavior characteristics corresponding to the business behavior to be detected based on the historical behavior sequence.

[0064] Furthermore, the importance of different historical user actions for anomaly detection of the business behavior to be detected may vary. For example, historical actions of the same type as the business behavior to be detected are of higher reference importance than historical actions of different types. Similarly, historical actions that are further removed from the current time are of lower reference importance than historical actions that are closer to the current time. In addition, considering people's cognitive habits, abnormal historical actions are of higher reference importance than normal historical actions.

[0065] Based on this, the server can input the historical behavior sequence into a preset attention mechanism network to determine the attention weight corresponding to each historical behavior in the historical behavior sequence. The attention weight corresponding to each historical behavior can reflect the reference importance of the historical behavior when performing anomaly detection on the user's business behavior to be detected. Then, the feature vector of each historical behavior in the historical behavior sequence can be weighted by the attention weight corresponding to each historical behavior in the historical behavior sequence to determine the historical behavior features corresponding to the business behavior to be detected.

[0066] In this specification, target behavioral features are behavioral characteristics used to characterize the user's actions when performing the business behavior to be detected. These features are extracted based on the business information corresponding to the target behavior. It should be noted that, in this specification, the business that needs to be detected for anomalies can be a real-time business that the user is currently executing, or a business request that was previously submitted but has not yet been completed.

[0067] The aforementioned business requests that have been submitted but not yet executed may refer to business that does not require high timeliness. For example, when a user applies for a small loan, the server needs to conduct a qualification review for a period of time before responding to the user's application.

[0068] In this specification, entity features are used to characterize the features of entity objects associated with the services performed by the user. For example, if the user performs the aforementioned service of optimizing electronic maps, the entity objects associated with the service performed by the user are the user themselves and the merchant corresponding to the merchant information submitted by the user. As another example, if the service performed by the user is a restaurant review service, the entity objects associated with the service performed by the user are the user themselves, the restaurant reviewed by the user, and the merchant to which the reviewed restaurant belongs.

[0069] Specifically, the server can obtain entity information of entity objects associated with the business based on the business information of the business behavior to be detected, and then determine the entity characteristics corresponding to the business behavior to be detected based on the entity information.

[0070] Taking the aforementioned optimized electronic map service as an example, the entity information at this time includes at least one of the following: user attribute information and merchant attribute information involved in the service. User attribute information may include, for example, the user's account registration time, user credit data, user interest information, user age, user occupation, etc. Merchant attribute information involved in the service may include, for example, merchant name, merchant address, merchant type, and type of goods sold by the merchant.

[0071] As can be seen from the above, the server can determine at least one business characteristic of the business behavior to be detected based on the business information of the business behavior to be detected, and then perform anomaly detection on the business behavior to be detected based on the determined at least one business characteristic of the business behavior to be detected.

[0072] However, since the dimensions of business characteristics and the content of information of different user business behaviors may vary, the universality of the above-mentioned anomaly detection methods may be affected.

[0073] Therefore, to enable the anomaly detection method provided in this specification to perform anomaly detection on various business behaviors in different scenarios based on feature information of different dimensions, the server can determine various reference information for anomaly detection of the business behavior to be detected based on the user's business information. Then, this reference information can be input into a pre-trained detection model to obtain the probability value that the business behavior to be detected is an abnormal behavior. Based on this probability value, anomaly detection can then be performed on the business behavior to be detected. Figure 2 As shown.

[0074] Figure 2 This is a schematic diagram of the structure of a detection model provided in this specification.

[0075] Combination Figure 2 The server can input reference information into the feature extraction layer of a pre-trained detection model through the input layer. The feature extraction layer can then obtain at least one business feature of the business behavior to be detected. This at least one business feature can then be input into the strategy layer of the detection model. The strategy layer outputs a probability value that the business behavior to be detected is an abnormal behavior. Based on this probability value, anomaly detection can be performed on the business behavior to be detected.

[0076] It is worth noting that the reference value of each business feature may vary under different conditions. For example, if a user has limited historical behavior, the reference value of historical behavior features obtained based on that user's historical behavior will be reduced. Therefore, after receiving at least one business feature, the strategy layer can determine the weight corresponding to each business feature through an attention mechanism network, thereby weighting at least one business feature to obtain a fused feature. Based on this fused feature, the probability value of the business behavior to be detected being an abnormal behavior can then be determined.

[0077] Furthermore, since there are often correlations between different dimensions of reference information, the interaction features extracted based on these correlations can better assist the feature extraction layer in extracting features from each reference information. A type of reference information often consists of multiple pieces of information, and each piece of information can be considered as corresponding to a dimension. For example, the merchant name, merchant address, and merchant image information in the entity information of a merchant entity can each be considered a dimension of that entity information.

[0078] Furthermore, since there are often correlations between different dimensions of information in the reference information, encoding different dimensions of information based on these correlations can make the encoded interactive features more representative.

[0079] For example, the relationship between merchant address information and merchant image information can be a matching relationship between merchant image information and merchant address information. That is, the server can judge the authenticity of the merchant information submitted by the user based on the degree of matching between the street view of the street presented in the merchant image information and the street view corresponding to the merchant address, and then use this to detect anomalies in the user's business behavior to be detected.

[0080] Based on this, the server can also input each reference information into the embedding layer of the detection model, so that the interaction features after information interaction of different dimensions contained in the reference information can be obtained through the embedding layer, which can be used as the interaction features corresponding to the reference information. Then, the interaction features corresponding to each reference information can be input into the feature extraction layer to obtain at least one business feature of the business behavior to be detected.

[0081] In practical applications, the detection model needs to be trained in advance before it can be deployed on the server to perform anomaly detection on the business behavior to be detected. The execution subject used to train the feature extraction model can be a server or a specified device such as a desktop computer or laptop computer. After the model is trained, it is deployed on the server.

[0082] When training the above detection model on the server, it is necessary to first obtain sample reference information, input the sample reference information into the detection model, and obtain the probability value of the sample's historical behavior corresponding to the sample reference information output by the detection model as the probability value to be optimized. Then, the detection model can be trained with the optimization objective of minimizing the deviation between the probability value to be optimized and the actual result of whether the sample's historical behavior is abnormal.

[0083] As can be seen from the above, the server can use the detection model to determine at least one business feature corresponding to the user's business behavior based on the business information of the user's business execution. Based on the different reference importance of different business features to anomaly detection, the server can determine the attention weight of each business feature. In this way, the server can comprehensively determine multiple business features to perform anomaly detection on multiple user business behaviors.

[0084] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the data protection laws and policies of the country where the application is located, and with authorization from the owner of the relevant device.

[0085] The above describes one or more embodiments of anomaly detection methods provided in this specification. Based on the same idea, this specification also provides corresponding anomaly detection devices, such as... Figure 3 As shown.

[0086] Figure 3 A schematic diagram of an anomaly detection device provided in this specification includes:

[0087] The acquisition module 301 is used to respond to the user's business execution and acquire the business information of the user executing the business.

[0088] The feature extraction module 302 is used to determine the business behavior of the user when performing the business based on the business information, as the business behavior to be detected, and to determine at least one business feature corresponding to the business behavior to be detected. The business feature includes at least one of the following: historical behavior features, target behavior features, and entity features. The historical behavior features are used to characterize the features of abnormal conditions in the historical business behavior performed by the user. The target behavior features are used to characterize the behavior features of the user when performing the business behavior to be detected. The entity features are used to characterize the features of the entity objects associated with the business performed by the user.

[0089] The detection module 303 is used to perform anomaly detection on the business behavior to be detected based on the at least one business feature.

[0090] Optionally, the feature extraction module 302 is specifically used to: query the historical services performed by the user based on the business information; sort the historical behaviors of the user when performing the historical services according to the chronological order of the time of the user's performance of the historical services to obtain a historical behavior sequence; and determine the historical behavior features corresponding to the business behavior to be detected based on the historical behavior sequence.

[0091] Optionally, the feature extraction module 302 is specifically used to input the historical behavior sequence into a preset attention mechanism network to determine the attention weight corresponding to each historical behavior in the historical behavior sequence. Specifically, for each historical behavior, the further away the user performs the historical behavior from the current time, the smaller the attention weight corresponding to that historical behavior. For different historical behaviors within the same time period, the attention weight corresponding to abnormal historical behaviors is greater than the attention weight corresponding to normal historical behaviors. The feature vector of each historical behavior in the historical behavior sequence is weighted using the attention weight corresponding to each historical behavior in the historical behavior sequence to determine the historical behavior features corresponding to the business behavior to be detected.

[0092] Optionally, the feature extraction module 302 is specifically used to: obtain entity information of entity objects associated with the business based on the business information, wherein the entity information includes at least one of the user's attribute information and the attribute information of the merchants involved in the business; and determine the entity features corresponding to the business behavior to be detected based on the entity information.

[0093] Optionally, the feature extraction module 302 is specifically used to input the reference information used for anomaly detection of the business behavior to be detected into the feature extraction layer of a pre-trained detection model, so as to obtain at least one business feature of the business behavior to be detected through the feature extraction layer, wherein the reference information is obtained based on the business information;

[0094] The detection module 303 is specifically used to input the at least one business feature into the strategy layer of the detection model to obtain the probability value of the business behavior to be detected being an abnormal behavior output by the strategy layer; and to perform anomaly detection on the business behavior to be detected based on the probability value.

[0095] Optionally, the feature extraction module 302 is specifically used to: input the reference information into the embedding layer of the detection model for each reference information, so as to obtain the interaction features after information interaction of different dimensions contained in the reference information through the embedding layer, and use them as the interaction features corresponding to the reference information; input the interaction features corresponding to each reference information into the feature extraction layer to obtain at least one business feature of the business behavior to be detected.

[0096] Optionally, the device further includes:

[0097] The training module 304 is used to acquire sample reference information; input the sample reference information into the detection model to obtain the probability value of the sample's historical behavior corresponding to the sample reference information output by the detection model as an abnormal behavior, which is used as the probability value to be optimized; and train the detection model with the optimization objective of minimizing the deviation between the probability value to be optimized and the actual result of whether the sample's historical behavior is an abnormal behavior.

[0098] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 This provides a method for anomaly detection.

[0099] This instruction manual also provides Figure 4 One of the corresponding Figure 1 A schematic diagram of the structure of an electronic device. (e.g.) Figure 4At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The method for anomaly detection described above. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0100] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0101] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0102] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0103] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0104] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0108] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0109] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0110] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0111] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0112] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0114] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0115] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for anomaly detection, characterized in that, include: In response to the user's business execution, obtain the business information of the user executing the business; Based on the business information, the business behavior of the user when performing the business is determined as the business behavior to be detected, and the business characteristics corresponding to the business behavior to be detected are determined. The business characteristics include: historical behavior characteristics, target behavior characteristics, and entity characteristics. The historical behavior characteristics are used to characterize the characteristics of abnormal situations in the historical business behaviors performed by the user. The target behavior characteristics are used to characterize the behavior characteristics of the user when performing the business behavior to be detected. The entity characteristics are used to characterize the characteristics of the entity objects associated with the business performed by the user. Based on the business characteristics, anomaly detection is performed on the business behavior to be detected; the determination of the business characteristics corresponding to the business behavior to be detected specifically includes: Based on the business information, retrieve the historical business transactions performed by the user; Based on the chronological order in which the user performed each historical service, the user's historical behavior during the performance of each historical service is sorted to obtain a historical behavior sequence; Based on the historical behavior sequence, determine the historical behavior features corresponding to the business behavior to be detected; specifically, determining the historical behavior features corresponding to the business behavior to be detected based on the historical behavior sequence includes: The historical behavior sequence is input into a preset attention mechanism network to determine the attention weight corresponding to each historical behavior in the historical behavior sequence. For each historical behavior, the further away the time when the user performs the historical behavior is from the current time, the smaller the attention weight corresponding to the historical behavior. For different historical behaviors within the same time period, the attention weight corresponding to abnormal historical behavior is greater than the attention weight corresponding to normal historical behavior. By using the attention weight corresponding to each historical behavior in the historical behavior sequence, the feature vector of each historical behavior in the historical behavior sequence is weighted to determine the historical behavior features corresponding to the business behavior to be detected.

2. The method as described in claim 1, characterized in that, The determination of the business characteristics corresponding to the business behavior to be detected specifically includes: Based on the business information, obtain entity information of entity objects associated with the business, including: the user's attribute information and the attribute information of merchants involved in the business; Based on the entity information, determine the entity features corresponding to the business behavior to be detected.

3. The method as described in claim 1, characterized in that, Determining the business characteristics corresponding to the business behavior to be detected specifically includes: The reference information used to detect anomalies in the business behavior to be detected is input into the feature extraction layer of the pre-trained detection model, so that the business features of the business behavior to be detected can be obtained through the feature extraction layer. The reference information is obtained based on the business information. Based on the aforementioned business characteristics, anomaly detection is performed on the business behavior to be detected, specifically including: The business features are input into the strategy layer of the detection model to obtain the probability value of the business behavior to be detected as an abnormal behavior output by the strategy layer. Based on the probability value, anomaly detection is performed on the business behavior to be detected.

4. The method as described in claim 3, characterized in that, The reference information used for anomaly detection of the business behavior to be detected is input into the feature extraction layer of the pre-trained detection model, so that the business features of the business behavior to be detected can be obtained through the feature extraction layer, specifically including: For each piece of reference information, the reference information is input into the embedding layer of the detection model so that the interaction features after information interaction of different dimensions contained in the reference information are obtained through the embedding layer, which are used as the interaction features corresponding to the reference information. The interaction features corresponding to each reference information are input into the feature extraction layer to obtain the business features of the business behavior to be detected.

5. The method as described in claim 3, characterized in that, Training the detection model specifically includes: Obtain sample reference information; The sample reference information is input into the detection model to obtain the probability value of the sample's historical behavior corresponding to the sample reference information output by the detection model as an abnormal behavior, which is used as the probability value to be optimized. The detection model is trained with the optimization objective of minimizing the deviation between the probability value to be optimized and the actual result of whether the sample's historical behavior is abnormal.

6. An anomaly detection device, characterized in that, The device includes: The acquisition module is used to respond to the user's business execution and acquire the business information of the user executing the business. The feature extraction module is used to determine the business behavior of the user when performing the business based on the business information, as the business behavior to be detected, and to determine the business features corresponding to the business behavior to be detected. The business features include: historical behavior features, target behavior features, and entity features. The historical behavior features are used to characterize the features of abnormal situations in the historical business behaviors performed by the user. The target behavior features are used to characterize the behavior features of the user when performing the business behavior to be detected. The entity features are used to characterize the features of the entity objects associated with the business performed by the user. The detection module is used to perform anomaly detection on the business behavior to be detected based on the business characteristics. When the business feature includes the historical behavior feature, the business feature corresponding to the business behavior to be detected is determined, specifically including: Based on the business information, retrieve the historical business transactions performed by the user; Based on the chronological order in which the user performed each historical service, the user's historical behavior during the performance of each historical service is sorted to obtain a historical behavior sequence; Based on the historical behavior sequence, determine the historical behavior features corresponding to the business behavior to be detected; specifically, determining the historical behavior features corresponding to the business behavior to be detected based on the historical behavior sequence includes: The historical behavior sequence is input into a preset attention mechanism network to determine the attention weight corresponding to each historical behavior in the historical behavior sequence. For each historical behavior, the further away the time when the user performs the historical behavior is from the current time, the smaller the attention weight corresponding to the historical behavior. For different historical behaviors within the same time period, the attention weight corresponding to abnormal historical behavior is greater than the attention weight corresponding to normal historical behavior. By using the attention weight corresponding to each historical behavior in the historical behavior sequence, the feature vector of each historical behavior in the historical behavior sequence is weighted to determine the historical behavior features corresponding to the business behavior to be detected.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 5.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1 to 5.

Images