Risk detection method, device, electronic device and storage medium

Abstract

The embodiments of the present disclosure provide a risk detection method, device, electronic device and storage medium. The method includes: obtaining first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period; determining a risk user to be detected based on the first behavior data; obtaining interaction information of the risk user to be detected in a second application; and determining whether a risk event occurs in the second application for the risk user to be detected based on the interaction information and the type of the external event when a predetermined external event is detected within the second preset time period. Therefore, the embodiments of the present disclosure pre-screen the risk users to be detected based on the behavior data in the first application, thereby reducing the number of users who need to undergo risk event detection, improving detection efficiency, and detecting risk events in combination with predetermined external events, thereby improving the accuracy of risk event detection.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a risk detection method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of communication technology, smart electronic devices, such as mobile phones, have become indispensable tools in all aspects of people's lives. In addition, various applications (APPs) with different functions have emerged in an endless stream. At present, users can use APPs to browse short videos, watch live broadcasts, and conduct online shopping. However, in the process of using certain APPs, some bad information may be spread on the Internet, causing adverse social impacts.

[0003] However, in the related art, when it is necessary to detect whether there is the spread of bad information in a certain APP, all users need to be detected one by one, which has low detection efficiency. Moreover, if the detection is only based on the speech information of users in the APP, certain risk events may not be detected. Therefore, the existing risk detection methods often have low detection accuracy. Summary of the invention

[0004] In order to solve the technical problems described in the background technology, the embodiments of the present disclosure provide a risk detection method, device, electronic device and storage medium. The technical solutions of the present disclosure are as follows:

[0005] According to a first aspect of an embodiment of the present disclosure, a risk detection method is provided, the method comprising:

[0006] Acquire first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period;

[0007] Determining risky users to be detected according to the first behavior data;

[0008] Obtaining interaction information of the risky user to be detected in the second application, wherein the interaction information is interaction information within a second preset time period after the first preset time period;

[0009] When a predetermined external event is detected within the second preset time period, it is determined whether a risk event occurs to the risk user to be detected in the second application program according to the interaction information and the type of the external event.

[0010] Optionally, determining whether a risk event occurs to the risk user to be detected in the second application according to the interaction information and the type of the external event includes:

[0011] In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type;

[0012] When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

[0013] Optionally, the method further includes:

[0014] When the external event is not detected within the second preset time period, it is determined whether the risky user to be detected has a risk event in the second application program according to the interaction information.

[0015] Optionally, determining, according to the interaction information, whether a risk event occurs to the risk user to be detected in the second application program includes:

[0016] In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types;

[0017] In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

[0018] Optionally, the first application includes a video application and a shopping application;

[0019] A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application;

[0020] The step of determining the risk user to be detected according to the first behavior data includes:

[0021] In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model;

[0022] In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model;

[0023] Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected;

[0024] When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected;

[0025] When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

[0026] Optionally, the training process of the risk prediction model includes:

[0027] Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected;

[0028] Obtaining a first number of sample users whose second probability is greater than the first preset threshold;

[0029] When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs;

[0030] Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model;

[0031] Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold;

[0032] The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

[0033] Optionally, the method further includes:

[0034] In the case where it is determined that a risk event occurs to the risk user to be detected in the second application, determining a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations;

[0035] The first risk handling operation is performed.

[0036] According to a second aspect of an embodiment of the present disclosure, a risk detection device is provided, the device comprising:

[0037] A behavior acquisition module, configured to acquire first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period;

[0038] a to-be-detected user determination module, configured to determine a to-be-detected risky user according to the first behavior data;

[0039] An interactive information acquisition module, configured to acquire interactive information of the risky user to be detected in the second application, wherein the interactive information is interactive information within a second preset time period after the first preset time period;

[0040] The first risk determination module is configured to determine whether a risk event occurs in the second application program for the risk user to be detected based on the interaction information and the type of the external event when a predetermined external event is detected within the second preset time period.

[0041] Optionally, the first risk determination module is specifically configured as follows:

[0042] In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type;

[0043] When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

[0044] Optionally, the device also includes: a second risk determination module, configured to determine whether a risk event occurs in the second application for the risky user to be detected based on the interaction information when the external event is not detected within the second preset time period.

[0045] Optionally, the second risk determination module is specifically configured as follows:

[0046] In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types;

[0047] In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

[0048] Optionally, the first application includes a video application and a shopping application;

[0049] A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application;

[0050] The to-be-detected user determination module is specifically configured as follows:

[0051] In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model;

[0052] In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model;

[0053] Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected;

[0054] When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected;

[0055] When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

[0056] Optionally, the device further includes: a model training module, configured to:

[0057] Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected;

[0058] Obtaining a first number of sample users whose second probability is greater than the first preset threshold;

[0059] When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs;

[0060] Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model;

[0061] Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold;

[0062] The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

[0063] Optionally, the device further comprises:

[0064] a processing operation determination module configured to determine, when it is determined that a risk event occurs to the risk user to be detected in the second application, a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations;

[0065] An operation execution module is configured to execute the first risk handling operation.

[0066] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, the electronic device comprising:

[0067] processor;

[0068] a memory for storing instructions executable by the processor;

[0069] The processor is configured to execute the instructions to implement the risk detection method provided by the present disclosure.

[0070] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device implements the risk detection method provided by the present disclosure.

[0071] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, which implements the risk prediction method provided by the present disclosure when executed by a processor.

[0072] The technical solution provided by the embodiment of the present disclosure can obtain the first behavior data of the user in the first application within a first preset time period, so as to screen out the risk users to be detected from these users based on the first behavior data, and then obtain the interaction information of the risk users to be detected in the second application within a second preset time period, and when a predetermined external event is detected within the second preset time period, determine whether a risk event occurs in the second application for the risk users to be detected based on the interaction information and the type of the external event, wherein the second preset time period is after the first preset time period.

[0073] It can be seen that in the embodiments of the present disclosure, when it is necessary to detect whether a risk event will occur in the second application within the second preset time period, the user can first be pre-selected based on the user's behavior data in the first application within the first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risk users to be detected, and then only obtaining the interaction information of the risk users to be detected in the second application within the second preset time period. Therefore, in the embodiments of the present disclosure, the risk users to be detected are pre-selected based on the behavior data in the first application, thereby reducing the number of user detections and thus improving the detection efficiency. In addition, when detecting whether a risk event will occur in the second application for the risk user to be detected within the second preset time period, the type of predetermined external events that occurred within the second preset time period will also be considered, so that the detection result is consistent with the external event, thereby improving the detection accuracy.

[0074] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 is a flow chart of a risk detection method according to an exemplary embodiment;

[0076] Figure 2 is a flow chart showing another risk detection method according to an exemplary embodiment;

[0077] Figure 3is a block diagram of a risk detection device according to an exemplary embodiment;

[0078] Figure 4 is a block diagram of an electronic device according to an exemplary embodiment;

[0079] Figure 5 is a block diagram of another electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0080] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0081] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0082] In order to solve the problems of low efficiency and accuracy in the prior art methods for detecting risk events in APPs, the embodiments of the present disclosure provide a risk detection method, device, system, electronic device and storage medium.

[0083] According to a first aspect of an embodiment of the present disclosure, a risk detection method is provided, such as Figure 1 As shown, the risk detection method may include the following steps:

[0084] Step 101: Obtain the first behavior data of the user in the first application.

[0085] The first behavior data is data within a first preset time period. The first application includes other applications before the second application. That is, the first behavior data obtained in step 101 includes the behavior data of the user in at least one application other than the first application within the first preset time period.

[0086] Step 102: Determine risk users to be detected based on the first behavior data.

[0087] The risky users to be detected are users with a relatively high probability of having a risk event in the second application within the second preset time period.

[0088] It can be seen from this that the embodiments of the present disclosure can pre-select users based on their behavioral data in the first application within a first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risky users to be detected.

[0089] In addition, the first behavior data includes information (including text, pictures, voice, video, etc.) published by the user through the first application during the use of the first application, as well as the browsing information of the user in the first application. Therefore, the user's intention can be judged to a certain extent from the user's behavior data in the first application, and whether the user is a risk user to be detected can be predicted based on the user's behavior data in the first application.

[0090] Step 103: Obtain the interaction information of the risky user to be detected in the second application.

[0091] The interactive information is the interactive information within a second preset time period after the first preset time period. For example, when the second application is an application with a live broadcast function, the interactive information may include the interactive information of the risk user to be detected in the live broadcast room, for example, the interactive information includes voice information, subtitle information, video screen information, etc. during the live broadcast process.

[0092] Step 104: When a predetermined external event is detected within the second preset time period, determine whether a risk event occurs to the risky user in the second application based on the interaction information and the type of the external event.

[0093] The external events include at least one of natural events, social events, and events of entering predetermined holidays. Natural events refer to objective facts caused by objective phenomena, such as fire, earthquake, flood, transportation interruption, etc. Social events refer to objective facts caused by various unpredictable major changes in society.

[0094] In addition, the above-mentioned risk event is a dissemination event of bad information, that is, a dissemination event of information belonging to a predetermined information type, wherein the predetermined information type is a type of bad information.

[0095] In addition, there is a wealth of information on the Internet, so it is possible to extract "hot words" on the Internet within the second preset time period (i.e., keywords involved in content information that has been viewed more than a preset number of times), and then determine whether a predetermined external event is detected within the second preset time period based on these hot words. That is, if there are words involving a predetermined external event among the Internet hot words obtained within the second preset time period, then the predetermined external event is detected within the second preset time period.

[0096] From the above, it can be seen that the risk detection method of the embodiment of the present disclosure can obtain the first behavior data of the user in the first application within the first preset time period, and thus screen out the risk users to be detected from these users based on the first behavior data, and then obtain the interaction information of the risk users to be detected in the second application within the second preset time period, and when a predetermined external event is detected within the second preset time period, determine whether a risk event occurs in the second application for the risk user to be detected based on the interaction information and the type of the external event, wherein the second preset time period is after the first preset time period.

[0097] It can be seen that the risk detection method of the embodiment of the present disclosure, when it is necessary to detect whether a risk event will occur in the second application within the second preset time period, can first pre-select users based on the user's behavior data in the first application within the first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risk users to be detected, and then only obtain the interaction information of the risk users to be detected in the second application within the second preset time period. Therefore, the risk detection method of the embodiment of the present disclosure pre-selects the risk users to be detected based on the behavior data in the first application, thereby reducing the number of users to be detected, thereby improving the detection efficiency. In addition, when detecting whether a risk event will occur in the second application for the risk user to be detected within the second preset time period, the type of predetermined external event that occurs within the second preset time period will also be considered, so that the detection result is consistent with the external event, thereby improving the detection accuracy.

[0098] According to a second aspect of the embodiments of the present disclosure, a risk prediction method is provided, such as Figure 2 As shown, the risk prediction method may include the following steps:

[0099] Step 201: Obtain the first behavior data of the user in the first application.

[0100] The first behavior data is data within a first preset time period. The first application includes other applications except the second application.

[0101] Step 202: Determine risky users to be detected based on the first behavior data.

[0102] The risky users to be detected are users with a relatively high probability of having a risk event in the second application within the second preset time period.

[0103] It can be seen from this that the risk detection method of the embodiment of the present disclosure, when it is necessary to detect whether a risk event will occur in the second application within the second preset time period, can first pre-select users based on the user's behavior data in the first application within the first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risk users to be detected, and then only obtain the interaction information of the risk users to be detected in the second application within the second preset time period. Therefore, the risk detection method of the embodiment of the present disclosure pre-selects risk users to be detected based on the behavior data in the first application, thereby reducing the number of user detections and improving detection efficiency.

[0104] Step 203: Obtain the interaction information of the risky user to be detected in the second application.

[0105] The interaction information is interaction information within a second preset time period after the first preset time period.

[0106] Optionally, when the second application is an application with a live broadcast function, obtaining the interaction information of the risky user to be detected in the second application includes:

[0107] The interaction information of the risky user to be detected in the target live broadcast room of the second application is obtained, and the target live broadcast room is a live broadcast room whose live broadcast theme belongs to a preset type of theme.

[0108] For example, the risk user to be detected participated in 100 live broadcast rooms, of which 30 live broadcast rooms have themes of preset types. The probability of risk events occurring in the live broadcast rooms with preset themes is relatively high. Therefore, only the interaction information of the risk user to be detected in these 30 live broadcast rooms can be obtained, that is, only the interaction information of the risk user to be detected in the live broadcast rooms that meet the conditions can be obtained, thereby reducing the data collection process under the premise of ensuring the accuracy of risk detection, and further reducing the operating space occupied by the risk detection process to a certain extent.

[0109] Step 204: When a predetermined external event is detected within the second preset time period, determine whether a risk event occurs to the risky user in the second application based on the interaction information and the type of the external event.

[0110] Optionally, determining whether a risk event occurs to the risk user to be detected in the second application according to the interaction information and the type of the external event includes:

[0111] In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type;

[0112] When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

[0113] For example, the above-mentioned correspondence relationship includes a correspondence between the first event and the first information type and the second information type. If the type of the external event occurring within the second preset time period belongs to the above-mentioned first event, then information belonging to the first information type or information belonging to the second information type appears in the second application, which will be judged as the occurrence of a risk event; and if the type of the external event occurring within the second preset time period does not belong to the first event, then information belonging to the first information type or information belonging to the second information type appears in the second application, which will not be judged as the occurrence of a risk event.

[0114] It can be seen that in the embodiments of the present disclosure, when detecting whether a risk event will occur to the risk user to be detected in the second application within the second preset time period, the type of predetermined external events occurring within the second preset time period will also be considered, so that the detection results are consistent with the external events, thereby improving the detection accuracy.

[0115] The process of determining whether information of the target information type exists in the interactive information includes:

[0116] Extracting keywords from the interactive information;

[0117] If there is a predetermined word belonging to the target information type or a synonym of the predetermined word belonging to the target information type in the keywords, it is determined that information of the target information type exists in the interactive information.

[0118] Step 205: When the external event is not detected within the second preset time period, determine whether the risky user to be detected has a risk event in the second application based on the interaction information.

[0119] Optionally, determining, according to the interaction information, whether a risk event occurs to the risk user to be detected in the second application program includes:

[0120] In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types;

[0121] In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

[0122] That is, in an embodiment of the present disclosure, when no predetermined external event is detected within the second preset time period, if there is information of the target information type in the interactive information, a risk event occurs to the risk user to be detected in the second application; if there is no information of the target information type in the interactive information, no risk event occurs to the risk user to be detected in the second application.

[0123] Optionally, the first application includes a video application and a shopping application;

[0124] A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application;

[0125] The step of determining the risk user to be detected according to the first behavior data includes:

[0126] In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model;

[0127] In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model;

[0128] Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected;

[0129] When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected;

[0130] When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

[0131] It can be seen that in the embodiment of the present disclosure, a risk prediction model is pre-established, and the input data of the risk prediction model includes the above-mentioned first click depth, video information, second click depth and historical records. Therefore, when using the risk prediction model to determine whether a user belongs to a risk user to be detected, it is necessary to obtain the user's above-mentioned first click depth, video information, second click depth and historical records. However, there may be some users who have not used video applications or shopping applications, resulting in the lack of at least one of the above four items of information in the user's first behavior data. In this case, the missing information can be set as preset information (for example, the specific data in the missing information is set to 0), so that the supplemented first behavior data is input into the risk prediction model, and then the probability that the user belongs to a risk user to be detected is output.

[0132] The above-mentioned click depth can also be called browsing depth, which can be understood as starting from the first page and continuing to click for multiple times to display the second page. The click depth is the number of clicks experienced from the first page to the second page. The above-mentioned video information may include video content, video type, viewing time, comment information, number of followers, number of favorites, and number of shares. The above-mentioned historical records may include browsing records and shopping records.

[0133] It should be noted that the first application is not limited to the above-mentioned video application and shopping application. For example, it may also include a live broadcast application. When the first application includes the live broadcast application, the input data of the risk prediction model also includes the user's interactive information in the live broadcast room of the live broadcast application, the average number of people in the live broadcast room during the first preset time period, the atmosphere information of the live broadcast room, and the IP address of the live broadcast room.

[0134] Among them, natural language processing (AI branch) (Natural Language Processing, NLP) models (such as text classification (TextCNN), Chinese text classification (TextRNN), attention mechanism (AttentionMechanism)) and speech recognition models (RNN) can be used to identify the chat topics and chat content of the live broadcast room, extract keywords from them, and then determine the atmosphere of the live broadcast room through the extracted keywords.

[0135] To summarize, the content, video type, viewing time, comment information, number of followers, number of favorites, and number of shares of the videos watched by the user in the video application within the first preset time period, the average number of people in the live broadcast room of the user in the live broadcast application within the first preset time period, the atmosphere information and interaction information, the IP address of the live broadcast room, and the browsing history and shopping history of the user in the shopping application within the first preset time period can be collected as the first behavior data, so as to input the first behavior data into a pre-established risk prediction model and output the first probability that the user is a risk user to be detected.

[0136] Optionally, the training process of the risk prediction model includes:

[0137] Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected;

[0138] Obtaining a first number of sample users whose second probability is greater than the first preset threshold;

[0139] When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs;

[0140] Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model;

[0141] Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold;

[0142] The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

[0143] For example, if there are 1,000 sample users, the second behavior data of these 1,000 sample users in the first application within a third preset time period can be obtained, so that the second behavior data of a sample user is used as a training sample, and the 1,000 sample users are manually marked as which are risk users to be detected and which are not; then, each training sample is processed using the preset values ​​of the machine learning algorithm parameters to obtain the second probability that each sample user belongs to a risk user to be detected.

[0144] Among them, it can be set that the sample users whose second probability is greater than the first preset threshold belong to the risk users to be detected, and then the first number of the second probabilities greater than the first preset threshold among the second probabilities obtained this time can be counted, and then the second number of sample users marked as risk users to be detected among the aforementioned 1000 sample users can be compared, so that when the first number is significantly different from the second number (that is, the absolute value of the difference between the first number and the second number is greater than the second preset threshold), the value of the machine learning algorithm parameter is modified.

[0145] Then, based on the values ​​of the modified machine learning algorithm parameters, each training sample is processed again to obtain the second probability that each sample user is a risk user to be detected, until the first number of users whose probability of being risk users to be detected among the 1000 sample users predicted at a certain time is greater than the first preset threshold, and is slightly different from the second number of users marked as risk users to be detected among the 1000 sample users (that is, the absolute value of the difference between the first number and the second number is greater than the second preset threshold), then the training process of the risk prediction model is completed.

[0146] Among them, the above-mentioned first click depth, video information, second click depth and historical records can, to a certain extent, indicate which information the user tends to pay attention to. By training these behavioral data of sample users, a risk prediction model can be generated to predict whether the user pays attention to bad information, that is, a risk prediction model can be generated to predict whether the user belongs to the risk user to be detected.

[0147] In addition, the above-mentioned machine learning algorithm can specifically be one of the random forest algorithm, deep neural network algorithm, logistic regression algorithm, and collaborative filtering algorithm.

[0148] In addition, the second behavior data in the training sample includes the first click depth, video information, second click depth and historical records. As mentioned above, the video information and historical records may include multiple pieces of information, so the second behavior data in the training sample may include multiple pieces of feature information.

[0149] In this case, before adopting the preset values ​​of the machine learning algorithm parameters and processing the predetermined training samples through the machine learning algorithm, multiple information in the training samples can be mapped into an embedding vector respectively, so that the embedding vectors belonging to the same sample user are used as a processed training sample, and then the preset values ​​of the machine learning algorithm parameters are adopted, and the processed training samples are further processed through the machine learning algorithm.

[0150] It should be noted here that in the embodiment of the present disclosure, each item of information included in a training sample is mapped to an embedding vector. For example, if a training sample includes five items of information, it is mapped to five embedding vectors, that is, one item of information corresponds to one embedding vector.

[0151] Among them, for picture feature information, voice feature information, and text feature information, graph embedding and graph convolutional network (graph CNN) can be used to map them into embedding vectors.

[0152] Optionally, the method further includes:

[0153] In the case where it is determined that a risk event occurs to the risk user to be detected in the second application, determining a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations;

[0154] Execute the first risk handling operation. It can be seen that in the embodiments of the present disclosure, different risk handling operations are preset, and different risk handling operations correspond to different probability value ranges. Therefore, when the first probability that a certain user belongs to a risk user to be detected is within the aforementioned different probability value ranges, different risk handling operations will be taken.

[0155] Optionally, the greater the probability value, the higher the level of the risk handling operation, that is, the greater the probability value, the more stringent the risk handling operation. For example, when the second application is an application with a live broadcast function, risk handling operations such as warning live broadcast users, prompting live broadcast room managers, and closing the live broadcast room can be set.

[0156] Among them, by adopting the risk detection method of the embodiment of the present disclosure, when a risk event is detected, risk handling operations can be taken in a timely manner to suppress the spread of bad information.

[0157] In addition, from the above content, it can be known that the situations in which a risk event occurs in the second application for a risk user to be detected include the following two situations:

[0158] Case 1: a predetermined external event is detected within the second preset time period, and there is information of the target information type in the interactive information (i.e., the interactive information of the user to be detected in the second application within the second preset time period), and the type of the external event is the same as the type of the target event;

[0159] The target information type includes at least one of predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between predetermined information types and event types.

[0160] Case 2: No predetermined external event is detected within the second preset time period, and there is information of the target information type in the interactive information (ie, the interactive information of the user to be detected in the second application within the second preset time period).

[0161] Among them, comparing the above-mentioned situation one and situation two, if there is a predetermined external event within the second preset time period, it is necessary to strengthen the handling operation of the risk event to avoid the risk event bringing more severe impact during the occurrence of the predetermined external event.

[0162] Therefore, the correspondence between different probability value ranges and risk levels can be determined in advance, so that after it is determined that a risk event occurs for the risk user to be detected in the second application, the first target risk level corresponding to the probability value range in which the first probability is located is determined according to the predetermined correspondence between the different probability value ranges and the risk levels; then, if no external event is detected within the second preset time period, the first target risk handling operation corresponding to the first target risk level is determined directly according to the predetermined correspondence between the risk level and the risk handling operation, thereby executing the first target risk handling operation.

[0163] When an external event is detected within a second preset time period, the first target risk level is increased by a first preset number of levels to obtain a second target risk level, and then the second target risk handling operation corresponding to the second target risk level is determined according to the correspondence between the predetermined risk level and the risk handling operation, so as to execute the second target risk handling operation.

[0164] As can be seen from the above, in the embodiments of the present disclosure, different probability value ranges can be pre-set to correspond to different risk levels, and different risk levels can correspond to different risk handling operations. Moreover, after determining the first target risk level corresponding to the probability value range in which the first probability is located, it is also possible to further increase the first target risk level when a predetermined external event is detected within a second preset time period, obtain a second target risk level, and then perform the risk handling operation corresponding to the second target risk level, so that during the occurrence of a predetermined external event, the handling measures for the risk event can be strengthened, and the negative impact of the risk event can be further reduced.

[0165] To summarize, the embodiments of the present disclosure determine a risk user to be detected based on the user's first behavior data in a first application within a first preset time period, thereby obtaining interaction information of the risk user to be detected in a second application within a second preset time period, and then when a predetermined external event is detected within the second preset time period, determine whether a risk event occurs for the risk user to be detected in the second application based on the interaction information and the type of the external event; when no predetermined external event is detected within the second preset time period, determine whether a risk event occurs for the risk user to be detected in the second application based on the interaction information.

[0166] It can be seen from this that the risk detection method of the embodiment of the present disclosure, when it is necessary to detect whether a risk event will occur in the second application within the second preset time period, can first pre-select users based on the user's behavior data in the first application within the first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risk users to be detected, and then only obtain the interaction information of the risk users to be detected in the second application within the second preset time period. Therefore, the risk detection method of the embodiment of the present disclosure pre-selects the risk users to be detected based on the behavior data in the first application, thereby reducing the number of user detections and thereby improving detection efficiency. In addition, when detecting whether a risk event will occur in the second application for the risk user to be detected within the second preset time period, the type of predetermined external events occurring within the second preset time period will also be considered, so that the detection result is consistent with the external events, thereby improving the detection accuracy.

[0167] In addition, the embodiments of the present disclosure predict which users are risky users to be detected based on the user's behavior data in the first application in advance, so that these users can be focused on detecting whether risk events occur in the second application. Therefore, the embodiments of the present disclosure can predict in advance which users are more likely to have risk events in the second application, so that when risk events are detected in these users in the second application, measures can be taken in advance to handle them, so as to handle risk events earlier, thereby reducing the adverse effects of risk events to a greater extent.

[0168] Among them, in order to ensure the healthy development of the application, it is possible to predict in advance which users are more likely to have risk events during the use of the application. However, the traditional risk control model cannot effectively predict the risk events that may occur in the future from a probabilistic perspective. Among them, sudden changes in user behavior in the application and unconventional operations may be precursors to risk events. Therefore, the embodiments of the present disclosure can comprehensively detect the probability of risk events occurring to users through the user's behavior data in the application, plus information such as specific scenarios, periods, and major events that are about to occur, so that risk events can be handled more promptly.

[0169] In summary, the embodiments of the present disclosure comprehensively use computer vision (CV), NLP, voice and other algorithm technologies to process the user's behavioral data in the first application to form structured data, and input the formed structured data into a pre-established risk prediction model, and determine the risky users to be detected according to the probability value output by the risk prediction model, so as to conduct risk prediction and response for specific time periods, important holidays, major events, and combined with the interactive information of the risky users to be detected in the second application.

[0170] Therefore, the embodiments of the present disclosure can form a large-scale data structure based on the user's behavioral data in the application, which is convenient for in-depth business value mining, and predicts the risk probability based on actual scenario conditions, time periods, and the occurrence of major events. It can effectively respond to risk events and form a more powerful risk control model system, which can effectively reduce the negative impact and financial losses caused by adverse events.

[0171] According to a third aspect of an embodiment of the present disclosure, a risk detection device is provided, such as Figure 3 As shown, the risk detection device 300 includes:

[0172] The behavior acquisition module 301 is configured to acquire first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period;

[0173] A to-be-detected user determination module 302 is configured to determine a to-be-detected risk user according to the first behavior data;

[0174] The interactive information acquisition module 303 is configured to acquire the interactive information of the risky user to be detected in the second application, wherein the interactive information is the interactive information within a second preset time period after the first preset time period;

[0175] The first risk determination module 304 is configured to determine whether a risk event occurs in the second application program for the risk user to be detected based on the interaction information and the type of the external event when a predetermined external event is detected within the second preset time period.

[0176] Optionally, the first risk determination module 304 is specifically configured to:

[0177] In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type;

[0178] When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

[0179] Optionally, the device also includes: a second risk determination module 305, which is configured to determine whether a risk event occurs in the second application for the risk user to be detected based on the interaction information when the external event is not detected within the second preset time period.

[0180] Optionally, the second risk determination module 305 is specifically configured as follows:

[0181] In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types;

[0182] In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

[0183] Optionally, the first application includes a video application and a shopping application;

[0184] A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application;

[0185] The to-be-detected user determination module 302 is specifically configured as follows:

[0186] In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model;

[0187] In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model;

[0188] Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected;

[0189] When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected;

[0190] When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

[0191] Optionally, the device further includes: a model training module 306, configured to:

[0192] Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected;

[0193] Obtaining a first number of sample users whose second probability is greater than the first preset threshold;

[0194] When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs;

[0195] Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model;

[0196] Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold;

[0197] The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

[0198] Optionally, the device further comprises:

[0199] The processing operation determination module 307 is configured to determine, when it is determined that the risky user to be detected has a risk event in the second application, a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations;

[0200] The operation execution module 308 is configured to execute the first risk handling operation.

[0201] From the above, it can be seen that the risk detection device of the embodiment of the present disclosure is able to obtain the first behavior data of the user in the first application within the first preset time period, and thus screen out the risk users to be detected from these users based on the first behavior data, and then obtain the interaction information of the risk users to be detected in the second application within the second preset time period, and when a predetermined external event is detected within the second preset time period, determine whether a risk event occurs in the second application for the risk user to be detected based on the interaction information and the type of the external event, wherein the second preset time period is after the first preset time period.

[0202] It can be seen that the risk detection device of the embodiment of the present disclosure, when it is necessary to detect whether a risk event will occur in the second application within the second preset time period, can first pre-select users based on the user's behavior data in the first application within the first preset time period, thereby screening out users with a relatively high probability of risk events occurring in the second application as risk users to be detected, and then only obtain the interaction information of the risk users to be detected in the second application within the second preset time period. Therefore, the risk detection device of the embodiment of the present disclosure pre-selects the risk users to be detected based on the behavior data in the first application, thereby reducing the number of user detections and thereby improving detection efficiency. In addition, when detecting whether a risk event will occur in the second application for the risk user to be detected within the second preset time period, the type of predetermined external events occurring within the second preset time period will also be considered, so that the detection result is consistent with the external events, thereby improving the detection accuracy.

[0203] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0204] According to a fourth aspect of the embodiments of the present disclosure, an electronic device is provided. Figure 4 , the electronic device comprises:

[0205] Processor 410;

[0206] A memory 420 for storing instructions executable by the processor;

[0207] Wherein, the processor is configured to execute the instructions to implement the risk detection method described above.

[0208] According to a fifth aspect of the embodiments of the present disclosure, an electronic device is also provided. Figure 5 As shown, the electronic device 500 may be a mobile phone, a computer, a digital broadcast electronic device, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0209] Reference Figure 5 , the electronic device 500 may include one or more of the following components: a processing component 502, a memory 504, a power component 506, a multimedia component 508, an audio component 510, an input / output (I / O) interface 512, a sensor component 514, and a communication component 516.

[0210] The processing component 502 generally controls the overall operation of the electronic device 500, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 502 may include one or more processors 520 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 502 may include one or more modules to facilitate the interaction between the processing component 502 and other components. For example, the processing component 502 may include a multimedia module to facilitate the interaction between the multimedia component 508 and the processing component 502.

[0211] The memory 504 is configured to store various types of data to support operations on the device 500. Examples of such data include instructions for any application or method operating on the electronic device 500, contact data, phone book data, messages, pictures, videos, etc. The memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0212] The power supply assembly 506 provides power to various components of the electronic device 500. The power supply assembly 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 500.

[0213] The multimedia component 508 includes a screen that provides an output interface between the electronic device 500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 508 includes a front camera and / or a rear camera. When the device 500 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0214] The audio component 510 is configured to output and / or input audio signals. For example, the audio component 510 includes a microphone (MIC), and when the electronic device 500 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 504 or sent via the communication component 516. In some embodiments, the audio component 510 also includes a speaker for outputting audio signals.

[0215] I / O interface 512 provides an interface between processing component 502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0216] The sensor assembly 514 includes one or more sensors for providing various aspects of status assessment for the electronic device 500. For example, the sensor assembly 514 can detect the open / closed state of the device 500, the relative positioning of components, such as the display and keypad of the electronic device 500, and the sensor assembly 514 can also detect the position change of the electronic device 500 or a component of the electronic device 500, the presence or absence of user contact with the electronic device 500, the orientation or acceleration / deceleration of the electronic device 500, and the temperature change of the electronic device 500. The sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 514 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 514 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0217] The communication component 515 is configured to facilitate wired or wireless communication between the electronic device 500 and other devices. The electronic device 500 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 8G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 516 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0218] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the risk detection method described above.

[0219] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, and the instructions can be executed by a processor 520 of an electronic device 500 to complete the above method. Alternatively, for example, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0220] In another aspect of the implementation of the present disclosure, an embodiment of the present disclosure further provides a storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the risk detection method described above.

[0221] According to another aspect of an embodiment of the present disclosure, a computer program product containing instructions is provided, including a computer program, and when the computer program is executed by a processor, the risk detection method described above is implemented.

[0222] The risk detection scheme provided herein is not inherently related to any specific computer, virtual system or other device. Various general systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing a system with the scheme of the present invention is obvious. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be used to implement the content of the present invention described herein, and the description of specific languages ​​above is for the purpose of disclosing the best mode of the present invention.

[0223] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0224] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those expressly recited in each claim. Rather, as reflected in the claims, inventive aspects lie in less than all of the features of the individual embodiments previously disclosed. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present invention.

[0225] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0226] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims, any one of the claimed embodiments may be used in any combination.

[0227] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the information extraction scheme according to the disclosed embodiment. The present invention can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0228] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A risk detection method, characterized in that: The method comprises: Acquire first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period; Determining risky users to be detected according to the first behavior data; Obtaining interaction information of the risky user to be detected in the second application, wherein the interaction information is interaction information within a second preset time period after the first preset time period; In the case where a predetermined external event is detected within the second preset time period, determining whether a risk event occurs to the risk user to be detected in the second application according to the interaction information and the type of the external event; The step of determining whether a risk event occurs to the risk user to be detected in the second application program according to the interaction information and the type of the external event includes: In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type; When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

2. The risk detection method according to claim 1, characterized in that: The method further comprises: When the external event is not detected within the second preset time period, it is determined whether the risky user to be detected has a risk event in the second application program according to the interaction information.

3. The risk detection method according to claim 2, characterized in that: The determining, according to the interaction information, whether the risky user to be detected has a risk event in the second application program includes: In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types; In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

4. The risk detection method according to claim 1, characterized in that: The first application includes a video application and a shopping application; A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application; The step of determining the risk user to be detected according to the first behavior data includes: In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model; In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model; Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected; When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected; When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

5. The risk detection method according to claim 4, characterized in that: The training process of the risk prediction model includes: Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected; Obtaining a first number of sample users whose second probability is greater than the first preset threshold; When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs; Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model; Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold; The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

6. The risk detection method according to claim 4, characterized in that: The method further comprises: In the case where it is determined that a risk event occurs to the risk user to be detected in the second application, determining a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations; The first risk handling operation is performed.

7. A risk detection device, characterized in that: The device comprises: A behavior acquisition module, configured to acquire first behavior data of a user in a first application, wherein the first behavior data is data within a first preset time period; a to-be-detected user determination module, configured to determine a to-be-detected risky user according to the first behavior data; An interactive information acquisition module, configured to acquire interactive information of the risky user to be detected in the second application, wherein the interactive information is interactive information within a second preset time period after the first preset time period; A first risk determination module is configured to determine whether the risk user to be detected has a risk event in the second application according to the interaction information and the type of the external event when a predetermined external event is detected within the second preset time period; Wherein, the first risk determination module is specifically configured as follows: In the case where there is no information of the target information type in the interactive information, or in the case where there is information of the target information type in the interactive information and the type of the external event is different from the target event type, it is determined that no risk event has occurred to the risk user to be detected in the second application, wherein the target information type includes at least one of the predetermined information types, and the target event type is an event type corresponding to the target information type in the correspondence relationship between the predetermined information type and the event type; When the target information type is present in the interactive information, and the type of the external event is the same as the target event type, it is determined that a risk event occurs to the risk user to be detected in the second application.

8. The risk detection device according to claim 7, characterized in that: The device also includes: a second risk determination module configured to determine whether a risk event occurs in the second application program for the risk user to be detected based on the interaction information when the external event is not detected within the second preset time period.

9. The risk detection device according to claim 8, characterized in that: The second risk determination module is specifically configured as follows: In the case that there is no information of the target information type in the interactive information, determining that the risky user to be detected has not had a risk event in the second application, wherein the target information type includes at least one of the predetermined information types; In a case where information of the target information type exists in the interactive information, it is determined that a risk event occurs to the risky user to be detected in the second application.

10. The risk detection device according to claim 7, characterized in that: The first application includes a video application and a shopping application; A risk prediction model is pre-established, wherein input data of the risk prediction model includes a first click depth on a page in the video application, video information of videos watched in the video application, a second click depth on a page in the shopping application, and historical records in the shopping application; The to-be-detected user determination module is specifically configured as follows: In a case where the first behavior data includes the first click depth, the video information, the second click depth, and the historical records, inputting the first behavior data into the risk prediction model; In the case where at least one of the first click depth, the video information, the second click depth, and the historical records is missing in the first behavior data, setting the missing information in the first behavior data as preset information, and inputting the preset information and the first behavior data into the risk prediction model; Determine the probability value output by the risk prediction model as a first probability that the user is a risky user to be detected; When the first probability is greater than a first preset threshold, determining that the user is a risk user to be detected; When the first probability is less than or equal to the first preset threshold, it is determined that the user is not a risky user to be detected.

11. The risk detection device according to claim 10, characterized in that: The device also includes: a model training module, configured to: Using preset values ​​of machine learning algorithm parameters, and processing predetermined training samples through the machine learning algorithm to obtain a second probability that a sample user to which the training sample belongs is a risk user to be detected; Obtaining a first number of sample users whose second probability is greater than the first preset threshold; When the absolute value of the difference between the first number and the second number is greater than a second preset threshold, adjusting the value of the machine learning algorithm parameter, wherein the second number is the number of risky users to be detected among the sample users to which the training sample belongs; Determine the processing process of the machine learning algorithm corresponding to the target value of the machine learning algorithm parameter as the processing process included in the risk prediction model to obtain the risk prediction model; Wherein, the target value is the value of the machine learning algorithm parameter when the absolute value of the difference between the first number and the second number is less than or equal to the second preset threshold; The training sample includes second behavior data of a sample user in the first application within a third preset time period, and the second behavior data includes the first click depth, the video information, the second click depth and the historical record.

12. The risk detection device according to claim 10, characterized in that: The device also includes: a processing operation determination module configured to determine, when it is determined that a risk event occurs to the risk user to be detected in the second application, a first risk handling operation corresponding to the probability value range in which the first probability is located according to a predetermined correspondence relationship between different probability value ranges and risk handling operations; An operation execution module is configured to execute the first risk handling operation.

13. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the risk detection method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to implement the risk detection method as claimed in any one of claims 1 to 6.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the risk detection method according to any one of claims 1 to 6 is implemented.

Images