User security level identification method, system, electronic device and medium for a model constructed by integrated boosting trees

Abstract

The present invention discloses a method, system, device and medium for identifying the user security level of a model constructed by an integrated boosting tree. The method includes: inputting the screened feature data into the constructed rule model based on the integrated boosting tree for iteration, and recording the prediction ability of the rule model in each iteration; selecting decision trees in the rule model according to the prediction ability of the rule model at different iteration times; extracting optimized rules whose hit rate and accuracy meet preset conditions according to the decision trees, and forming an optimized rule set with the optimized rules; identifying the data to be analyzed based on the rule set, and determining the security level of the object corresponding to the data to be analyzed according to the identification result. Thereby, it improves rule mining that matches the actual application scenario and accurate classification and identification in the processing of massive information, determines the user security level, especially accurately identifies blacklisted enterprises and gives reminders to ensure enterprise security.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information processing, and in particular, to a method, system, electronic device, and computer-readable medium for identifying the user security level of a model for constructing an integrated boosting tree. Background Art

[0002] In the current massive data environment, different application scenarios require different automated processing such as mining analysis and feature processing of corresponding data information, especially automated processing such as information search, analysis, evaluation, abnormal data identification, or object identification in their respective application scenarios to cope with the rapid iteration of various automated information processing control strategies based on big data information such as data risk, data management, and data monitoring. For example, in the identification of abnormal data in data monitoring analysis (such as finding abnormal objects such as enterprises and user behaviors from data information), in response to the rapid iteration of strategies for coping with risk changes, a complete automated data information processing framework from sampling to feature processing, then to large-scale rule search, evaluation, and output (including accurately identifying behaviors and objects with potential security risks through data information) is required. In addition, in the information processing within this framework system, finding more effective rules from massive data can affect the processing efficiency and the accuracy of processing results. Therefore, in order to find more effective rules outside the existing model and strategy system, more effective rule mining needs to be provided.

[0003] Currently, common rule mining is mainly based on single decision trees such as CHAID, batch mining based on random forests such as skope-rules, and integrated gradient boosting trees such as rulefit. In information processing such as data analysis, data security identification, and data management, strategy rules are often constructed based on decision trees. However, single decision trees often cannot reflect enough information in the sample space. In practical applications, preprocessing work such as clustering and sampling of evaluation samples is often required, which is time-consuming, laborious, inefficient, and does not yield ideal results. Therefore, considering the characteristics of more fully traversing the sample space and deeper mining of the integrated boosting tree model to construct strategy rules can obtain more effective rules for application in the information processing framework system, thereby improving the efficiency of big data operation processing and more accurately finding abnormal objects that need to be identified in massive data, such as identifying whether an enterprise is abnormal to determine the enterprise blacklist.

[0004] Therefore, it is necessary to improve the model-based user security level identification scheme in information processing, especially the identification of abnormal data / objects based on the integrated boosting tree model in big data processing. Summary of the Invention

[0005] In view of this, the main object of the present invention is to propose a model-based anomaly recognition method, system, electronic device and computer-readable medium, in order to solve the technical problem of how to perform effective rule extraction based on an ensemble boosting tree model to process big data and achieve more accurate object recognition; furthermore, it can also solve the technical problem of how to use the model to mine or optimize the extraction of rules under specified limit conditions required for the recognition of whether there are anomalies in big data processing.

[0006] To solve the above technical problems, a user security level recognition method for a model constructed by an ensemble boosting tree is proposed in the first aspect of the present invention, including: inputting the selected feature data into the constructed rule model based on the ensemble boosting tree for iteration, and recording the prediction ability of the rule model in each iteration; selecting decision trees in the rule model according to the prediction ability of the rule model at different iteration times; extracting optimized rules whose hit rate and accuracy meet preset conditions according to the decision trees, and forming an optimized rule set with the optimized rules; based on the rule set, identifying the data to be analyzed, and performing security grading on the object corresponding to the data to be analyzed according to the identification result.

[0007] According to a preferred embodiment of the present invention, selecting decision trees in the rule model according to the prediction ability of the rule model at different iteration times specifically includes: determining the iteration number when the prediction ability of the rule model is the highest during the iteration process; selecting decision trees with a prediction ability higher than a preset ability value according to the iteration number when the prediction ability is the highest; and, extracting optimized rules whose hit rate and accuracy meet preset conditions according to the decision trees, and forming an optimized rule set with the optimized rules, specifically includes: performing a traversal algorithm on each decision tree of the rule model under the specified maximum extraction number of trees to extract each leaf node in the tree; performing logical semantic structure parsing of the information of the selected leaf nodes into rules; de-duplicating and screening all the rules to form an optimized rule set.

[0008] According to a preferred embodiment of the present invention, performing a binary tree in-order traversal recursive algorithm on each decision tree of the selected rule model under the specified maximum extraction number of trees to extract each leaf node in the tree specifically includes: under the maximum extraction number of trees, using the binary tree in-order traversal recursive algorithm to extract the information of each leaf node in each decision tree CART of the rule model, where the information of each leaf node includes: the logic on the node, the iteration number, and the weight value corresponding to the classification.

[0009] According to a preferred embodiment of the present invention, the information of the selected leaf nodes is parsed into a regular logical semantic structure, which specifically includes: under the weight value limit of the predetermined leaf nodes, arranging the last leaf nodes of each decision tree CART in descending order of weight values, and selecting the first n leaf nodes, where n is a natural number greater than or equal to 1 and represents a preset number of selections; for the information of the selected first n leaf nodes, associating them horizontally according to the hierarchical logic from the root to the leaf of the decision tree CART and stacking them vertically according to the ascending order of the number of iterations, extracting rules and forming a structured rule set.

[0010] According to a preferred embodiment of the present invention, all the rules are de-duplicated and screened to form an optimized rule set, which specifically includes: judging according to the sub-logic from the leaf node to the root node, and performing logical semantic de-duplication on the rules in the structured rule set; the de-duplication includes one or several combinations of merging, intersection, and union; and, according to the preset hit rate and gain thresholds of a single rule, screening the rules in the de-duplicated rule set to form the optimized rule set.

[0011] According to a preferred embodiment of the present invention, before inputting the selected feature data into the constructed rule model based on the ensemble boosting tree for iteration and recording the gain of the rule model at a specified number of iterations, it specifically includes: constructing a rule model by using the focal loss function FocalLoss as the optimization objective and under the given maximum number of layers parameter max_depth and minimum number of leaf node samples parameter min_child_weight; inputting the selected feature data into the rule model for iteration, for example, the rule model adopts the XGBOOST model, and when calculating the first derivative of the focal loss function FocalLoss, passing in the global bias base_score parameter can effectively improve the model iteration efficiency; and recording the change in the prediction ability (such as gain) of the rule model at a specified number of iterations.

[0012] According to a preferred embodiment of the present invention, before inputting the selected feature data into the rule model for iteration, it further includes: calculating the first derivative of the focal loss function of the constructed rule model, and determining the function parameters corresponding to the minimum value of the focal loss function according to the first derivative; determining the basic parameters according to the function parameters and substituting them into the rule model.

[0013] According to a preferred embodiment of the present invention, a regular model is constructed under a given maximum number of layers parameter max_depth and a minimum number of samples in leaf nodes parameter min_child_weight, which specifically includes: presetting a set of parameter search spaces; the parameter search space includes one or more maximum number of layers parameters max_depth and one or more minimum number of samples in leaf nodes parameters min_child_weight; providing different given maximum number of layers parameters max_depth and minimum number of samples in leaf nodes parameters min_child_weight by performing random search in the parameter search space to generate one or more regular models; and inputting the screened feature data into the regular model for iteration. For example, when calculating the first derivative of the focal loss function FocalLoss, the global bias base_score parameter is passed in to improve the iteration efficiency, and the gain change of the regular model at a specified number of iterations is recorded, which specifically includes: using the training set and validation set with the feature data to iterate one or more regular models, and selecting the regular model with the difference between the evaluation index AUC of the training set iteration model and the evaluation index AUC of the validation set iteration model within a preset range and the highest gain as the optimal regular model.

[0014] According to a preferred embodiment of the present invention, the screened feature data specifically includes: eliminating the feature data with high missing rate, high sparsity rate, and high cardinality according to the calculated missing rate and sparsity rate indexes of all feature data; performing type processing on the remaining feature data after the elimination to form numerical feature variables for input into the regular model.

[0015] According to a preferred embodiment of the present invention, performing type processing on the remaining feature data after the elimination to form numerical feature variables for input into the regular model specifically includes: judging the data type of the remaining feature data; performing label encoding on the categorical variables of the feature data according to the data type to form categorical digital encodings, which are used as all feature variables for input into the model.

[0016] According to a preferred embodiment of the present invention, the data to be analyzed is identified based on the rule set, and the object corresponding to the data to be analyzed is classified for security according to the identification result. Specifically, it includes: evaluating the stability of the rule set according to time information and / or analyzing the rule set according to the exchange feature Swap, determining the combined index of the rule set, associating the result of the evaluation and / or the result of the analysis, and outputting; inputting the data to be analyzed into the rule model; determining whether there is an abnormal situation in the data to be analyzed under the combined index of the rule set determined by the rule model; if so, identifying the object corresponding to the data to be analyzed with the abnormal situation as a blacklist object.

[0017] According to a preferred embodiment of the present invention, the data to be analyzed is enterprise user data obtained during business supervision; the object corresponding to the data to be analyzed is an enterprise user; the identification as a blacklist object specifically includes: identifying the enterprise user corresponding to the data to be analyzed with the abnormal situation and adding the enterprise user to the blacklist of risk control management.

[0018] To solve the above technical problems, a user security level identification system for an integrated boosting tree construction model according to a second aspect of the present invention includes: a model iteration module for inputting the selected feature data into a constructed rule model based on an integrated boosting tree for iteration and recording the prediction ability of the rule model at each iteration; a rule extraction module for selecting decision trees in the rule model according to the prediction ability of the rule model at different iteration times, and for extracting optimized rules whose hit rate and accuracy meet preset conditions according to the decision trees, and forming the optimized rules into an optimized rule set; a security level module for identifying the data to be analyzed based on the rule set and classifying the object corresponding to the data to be analyzed according to the identification result.

[0019] To solve the above technical problems, a third aspect of the present invention proposes an electronic device, including: a processor and a memory storing computer-executable instructions, and the computer-executable instructions, when executed by the processor, execute the method of the first aspect described above.

[0020] To solve the above technical problems, a fourth aspect of the present invention proposes a computer-readable medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by a processor, the method of the first aspect described above is implemented.

[0021] To solve the above technical problems, a fifth aspect of the present invention proposes a computer-executable program, and when the computer-executable program is executed, the method of the first aspect described above is implemented.

[0022] The present invention constructs a specific integrated boosting tree model, extracts policy rules from the model, optimizes the rule combination, and then evaluates and outputs. By using this high-efficiency automated rule mining, during the process of feature analysis and processing of big data, it determines effective rules extracted from the model to more accurately identify abnormal situations (including but not limited to: abnormal data, data with security hazards and risks, user / enterprise objects, etc.), thereby improving the efficiency of computer information processing, reducing the cost of big data processing and consumption of computing resources, and enhancing the computing speed and the accuracy of identifying whether there are abnormalities.

[0023] In particular, this specific model mainly extracts each leaf node of each decision tree in the rule model (such as: XGBOOST) through a recursive traversal algorithm based on a binary tree, then parses it into a rule logic semantic structure and removes duplicates, and finally outputs a rule set under specified limiting conditions, determining effective rules more efficiently and improving the efficiency and accuracy of information processing.

[0024] Furthermore, the more effective and accurate batch rules mined and extracted by applying this model can further improve the accuracy of abnormal identification in big data.

[0025] Therefore, it can effectively help improve the efficiency of information processing and analysis in the big data scenario, identify abnormal situations (abnormal behaviors, abnormal objects, etc.) with risks or security hazards, and has obvious promotion in aspects such as network data security, data analysis management, rapid construction, evaluation, and online implementation of risk control strategies. Furthermore, by determining blacklist enterprises according to the classification and identification process of batch effective rules mined by the model, it can more accurately identify abnormal situations in the relevant data of small and micro enterprises (monitored public opinion data, behavioral data, etc.), and more accurately and efficiently determine the security hazards existing in the corresponding small and micro enterprises, adapt to the rapid iteration of risk control strategies in various application scenarios, so as to escort small and micro enterprises and ensure the data and property security of relevant enterprises and users. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to make the technical problems solved by the present invention, the technical means adopted, and the technical effects obtained more clear, the specific embodiments of the present invention will be described in detail below with reference to the drawings. However, it should be noted that the drawings described below are only the drawings of the exemplary embodiments of the present invention, and those skilled in the art can obtain the drawings of other embodiments without creative efforts.

[0027] Figure 1 is the main flowchart of an embodiment of the model-based abnormal identification method according to the present invention;

[0028] Figure 2 is the main structural block diagram of an embodiment of the model-based abnormal identification system according to the present invention;

[0029] Figure 3 is a structural block diagram of an embodiment of an electronic device according to the present invention;

[0030] Figure 4 is a structural block diagram of an embodiment of a computer-readable medium according to the present invention;

[0031] Figure 5 is a schematic diagram of an embodiment for screening the rule effects and combining and optimizing the mined rule set in the technical solution of the present invention;

[0032] Figure 6 is a schematic diagram of the calculation result of an embodiment regarding stability evaluation in the technical solution of the present invention;

[0033] Figure 7 is a schematic diagram of the calculation result of an embodiment regarding Swap analysis in the technical solution of the present invention;

[0034] Figure 8 is a schematic diagram of an embodiment of the rule set output after screening and removing duplicates of the mined rules in the technical solution of the present invention. Detailed Embodiments

[0035] Exemplary embodiments of the present invention will now be described more fully with reference to the accompanying drawings. Although the exemplary embodiments can be implemented in many specific ways, it should not be understood that the present invention is limited to the embodiments described herein. On the contrary, these exemplary embodiments are provided to make the content of the present invention more complete and to more conveniently convey the inventive concept to those skilled in the art.

[0036] On the premise of conforming to the technical concept of the present invention, the structures, performances, effects or other features described in a specific embodiment can be combined in any suitable manner into one or more other embodiments.

[0037] In the process of introducing the specific embodiments, the detailed descriptions of the structures, performances, effects or other features are for those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can implement the present invention with technical solutions that do not contain the above-mentioned structures, performances, effects or other features under specific circumstances.

[0038] The flowcharts in the accompanying drawings are merely illustrative of the process flow and do not necessarily include all of the content, operations, and steps in the flowcharts, nor do they necessarily imply that all of the steps in the flowcharts must be executed in the order shown. For example, some of the steps in the flowcharts may be separated, some may be combined or partially combined, and so on. The execution order shown in the flowcharts may be changed according to actual circumstances without departing from the spirit of the present invention.

[0039] Frames in the accompanying drawings Figure 1 The term "functional entity" generally refers to a functional entity and does not necessarily correspond to a physically independent entity. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0040] The same reference numerals in the accompanying drawings represent the same or similar elements, components or parts, and thus repeated descriptions of the same or similar elements, components or parts may be omitted below. It should also be understood that although the first, second, third and other numbered adjectives may be used herein to describe various devices, elements, components or parts, these devices, elements, components or parts should not be limited by these adjectives. In other words, these adjectives are only used to distinguish one from another. For example, the first device may also be called the second device, but this does not deviate from the essential technical solution of the present invention. In addition, the terms "and / or" and "and / or" refer to all combinations including any one or more of the listed items.

[0041] An embodiment of the method of the present invention mainly includes: step S110, inputting the screened feature data into the constructed rule model based on the integrated boosting tree to iterate and record the prediction ability of the rule model under a specified number of iterations, such as gain; step S120, selecting a decision tree in the rule model according to the prediction ability of the rule model under different numbers of iterations; and, extracting optimization rules whose hit rate and accuracy meet preset conditions based on the decision tree, and forming the optimization rules into an optimized rule set; step S130, identifying the data to be analyzed based on the rule set, and performing security classification on the objects corresponding to the data to be analyzed according to the identification results.

[0042] [Example 1]

[0043] like Figure 1 FIG. 1 is a main flow chart of an embodiment of a method according to the present invention, which at least includes steps S110 , S120 and S130 .

[0044] In step S110, the filtered feature data is input into the constructed rule model based on the ensemble boosting tree for iteration, and the prediction ability of the rule model under each iteration is recorded. It mainly includes filtering feature data, constructing a rule model, and iterative training. In one embodiment, before inputting the filtered feature data into the rule model for iteration, the first-order derivative of the focusing loss function of the constructed rule model is calculated, and the function parameters corresponding to the minimum value of the focusing loss function are determined according to the first-order derivative; the basic parameters are determined according to the function parameters and substituted into the rule model.

[0045] In one embodiment, in the construction stage of the rule model, appropriate features can be screened first, and after variable processing, for example, the XGBOOST model can be used as the rule model and iterative training can be performed using the input feature data.

[0046] In one embodiment, to screen features, the feature numbers in various historical and / or real-time information to be analyzed in the current scenario can be extracted, and the feature data with high missing rates, high sparsity rates, and high cardinality are removed according to the calculated missing rate and sparsity rate metrics of all feature data.

[0047] In one embodiment, for variable processing, the remaining feature data after the removal can be processed in terms of type to form numerical feature variables for input into the rule model. Preferably, the data types of the remaining feature data can be judged; the categorical variables of the feature data are encoded with labels (label_encoding) according to the data types to form categorical digital encodings, which are used as all feature variables for input into the model.

[0048] Specifically, the missing rate and sparsity rate metrics of all input feature data can be calculated first to ensure that the rules determined by the feature data in the iteration of the rule model have a sufficient hit rate. Here, the sparsity rate can be expressed as: the proportion of the value with the highest frequency of occurrence in the feature data. Thus, the feature data with high missing rates, high sparsity rates, and high cardinality categories are removed. Further, the data types of the remaining feature data after the removal can be judged. Still further, the categorical variables of the feature data can be converted, such as classifying and labeling the remaining feature data, that is, performing label encoding (label_encoding) on the categorical variables, to ensure that all feature variables finally input into the model are numerical, that is, digitally encoded, for example, different classifications are represented by labels such as 1, 2, 3, 4...

[0049] In one embodiment, an XGBoost model is constructed based on the rule model selection of an integrated boosting tree. Preferably, the XGBoost model can be constructed by using the Focal Loss function as the optimization objective and under the given maximum number of levels parameter max_depth and minimum number of samples in leaf nodes parameter min_child_weight; the screened feature data is input into the XGBoost model for iteration, the global bias base_score parameter is passed in when calculating the first derivative of the Focal Loss function, and the change in the prediction ability (such as gain) of the XGBoost model at the specified number of iterations is recorded. Further, for the construction of the XGBoost model under the given maximum number of levels parameter max_depth and minimum number of samples in leaf nodes parameter min_child_weight, a set of parameter search spaces can be preset first; the parameter search space includes one or more maximum number of levels parameters max_depth and one or more minimum number of samples in leaf nodes parameters min_child_weight; different given maximum number of levels parameters max_depth and minimum number of samples in leaf nodes parameters min_child_weight are provided by random search in the parameter search space, so that one or more XGBoost models can be generated; then the screened feature data is input into each XGBoost model for iteration, the global bias base_score parameter is passed in when calculating the first derivative of the Focal Loss function, and the gain change of the XGBoost model at the specified number of iterations is recorded. Furthermore, the training set and validation set with the feature data can be used to iterate one or more XGBoost models, and the XGBoost model with the difference between the evaluation index AUC of the training set iteration model and the evaluation index AUC of the validation set iteration model within the preset range and the highest gain is selected as the optimal XGBoost model and used online by this model subsequently.

[0050] Specifically, for the evaluation and identification of the data to be analyzed based on the rule mining of building an XGBoost model, the model needs to be iteratively trained. During the iterative process of finding the optimal solution of the XGBoost model, derivatives are taken to obtain the extreme values. Among them, through the input feature data or each sample, the complexity of each decision tree CART is iteratively calculated in the model, and based on this, the regularization term of the objective function of the model is calculated, that is, the complexity of the tree is determined by the variable part. The training loss of the objective function of the model, that is, the loss function part, preferably adopts the Focal Loss function. By using this specific loss function and passing in a parameter such as the global bias parameter base_score when calculating the first derivative of the loss function, the optimal objective function can be calculated. In this way, the iterative speed of the model can be effectively improved / accelerated, so that the AUC and lift of the model can reach a nearly saturated level with fewer iterations. Further, in addition to using the Focal Loss function to calculate the training loss to optimize the objective, the model can also be built under the given parameters of the maximum number of layers max_depth and the minimum number of samples in leaf nodes min_child_weight, and then record the change in lift of the model at the specified number of iterations during the iterative training. Further, since the parameters max_depth and min_child_weight have a decisive effect on the hit rate of the rules mined and extracted by the final model and the lift of the model, increasing the parameter max_depth and decreasing the parameter min_child_weight can obtain rules with higher lift, but it is also easy to overfit and reduce the hit rate hit. Therefore, preferably, a set of parameter search spaces are set, and random search is used to generate several XGBoost models, and then iterate and record in the foregoing manner, and select the model with the AUC difference between the training set and the validation set within an acceptable range and the highest achievable lift during this period as the model actually used for construction. Furthermore, the optimal model can be selected and the change in lift at the specified number of iterations recorded during its iterative training can be recorded, and further used for rule mining online.

[0051] In step S120, the rule extraction is mainly performed based on the prediction ability recorded during the model iteration, such as the number of iterations at the highest gain and each decision tree generated during the iterative model process, and an optimized rule set is generated. Specifically, determine the number of iterations at the highest gain of the prediction ability of the rule model during the iterative process, and select the decision trees with a gain higher than a preset ability value such as a preset threshold according to the number of iterations at the highest gain. For example: select the number of iterations at the highest gain recorded during the iterative process of the rule model and the decision trees generated before that.

[0052] In one embodiment, policy rules can be extracted / mined from the iteratively trained model. For rule extraction and preliminary screening, the number of iterations when the lift recorded in the previous stage is the highest and the previous CART trees can be selected for rule extraction. By traversing the information of each leaf node in each tree, it is transformed into a structured rule logic semantic format. At the same time, the top n nodes with the highest leaf weight values are selected from each tree, and the rules extracted from all CART trees are compared for duplicate logical terms, and duplicate removal is performed.

[0053] In one embodiment, for the method of extracting or mining rules based on a rule model, the number of iterations when the gain lift recorded in the iteration of the model is the highest can also be selected as the maximum number of extraction trees. Specifically, for a rule model using the XGBOOST model, the record file of the XGBOOST model can be converted into a json format, and the number of iterations when the gain recorded in the iteration of the XGBOOST model is the highest can be selected as the maximum number of trees for extracting rules.

[0054] In one embodiment, under the given maximum number of extraction trees, a traversal algorithm is used to traverse each decision tree of the rule model to extract each leaf node in the tree. Specifically, under the maximum number of extraction trees, the in-order traversal recursive algorithm of the binary tree is used to extract the information of each leaf node of each decision tree CART of the XGBOOST model. The information of each leaf node includes: the logic on the node, the number of iterations, and the weight value corresponding to the classification.

[0055] Then, the information of the selected leaf nodes is parsed for the logical semantic structure of the rules. Specifically, under the weight value limit of the predetermined leaf nodes, the last leaf nodes of each decision tree CART are arranged in descending order of the weight value, and the top n leaf nodes are selected, where n is a natural number greater than or equal to 1, representing the preset number of selections. For the information of the selected top n leaf nodes, they are associated horizontally according to the hierarchical logic from the root to the leaf of the decision tree CART and superimposed vertically according to the increasing order of the number of iterations, and rules are extracted to form a structured rule set.

[0056] All the rules are then de-duplicated and screened to form an optimized rule set. Specifically, according to the sub-logic from the leaf node to the root node, logical semantic de-duplication is performed on the rules in the structured rule set. The de-duplication includes one or several combinations of merging, intersection, and union; and, according to the preset hit rate and gain thresholds of a single rule, the rules in the de-duplicated rule set are screened to form the optimized rule set.

[0057] Preferably, the method for parsing, extracting, and pre-screening rules from the XGBoost model mainly extracts each leaf node of each decision tree in XGBoost through a recursive traversal algorithm based on a binary tree, then parses it into a rule logic semantic structure and removes duplicates, and finally outputs a rule set under specified limiting conditions, such as a rule set under limiting conditions where the gain lift effect is better and the hit rate is higher.

[0058] Specifically, for example:

[0059] First, the XGBoost model finds the extreme value, and the set objective function can be the hit rate and recognition effect, etc. Convert the XGBoost model file into the json format, so as to save and read the data information of the model, including hyperparameters during training, etc. XGBoost can generate many trees during the training process, and each tree has its corresponding logic after generation.

[0060] Second, under the number of decision trees with the maximum extraction rules set in advance or specified, or at the iteration number when the gain lift is the highest recorded in the previous iterative training stage, determine the maximum extraction quantity. For each CART decision tree among the multiple CART trees generated by XGBoost iteration, the in-order traversal recursive algorithm of the binary tree in the data structure can be used to extract the information of all leaf nodes in the CART tree. The information on each leaf node includes: the node generation logic, i.e., the logic on the node, the iteration number it is in, i.e., during the training process, and the weight value. The greater the weight value, the better the classification and recognition effect.

[0061] Third, for further processing, under the weight value limit of the predetermined leaf nodes, such as the weight threshold, for the last leaf nodes of each CART tree, sort them in descending order of the weight value, retain the top n leaf nodes with higher weight values, and remove the rest. For other leaf nodes, for each CART tree from left to right, i.e., from the root to the leaf, according to the logic of these leaf nodes, remove the leaf nodes with poor classification and recognition effects.

[0062] Fourth, structure the filtered leaf node information, associating it horizontally according to the hierarchical logic from the root to the leaf, and stacking it vertically in ascending order of the number of iterations, so as to extract one or more rules through the structural analysis of the logical semantics as the rule set extracted by the model. After the extracted rules are structurally analyzed, the rule set information can be expressed in a tabular structure such as Table 1. In Table 1, the rule number can be, for example, the rule number corresponding to a certain CART tree. For example, rule number 1 is a rule corresponding to tree number 0; Feature 1 can be, for example, the root node feature; Value 1 can represent Rule 1, etc. Thus, according to the actual classification and recognition scenarios, the structure is set, and then the logical semantics of the extracted rules are structurally analyzed to obtain forms such as tables that are convenient for output.

[0063] Table 1

[0064] Rule number Tree number Feature 1 Symbol 1 Value 1 …… Feature n Symbol n Value n 1 0 F1 < 0.5 …… 2 1 F2 >＝ 1.5 …… 3 2 F3 <3 1,nan ……

[0065] Fifth, further, perform logical semantic deduplication. For example, it can be to traverse and judge and deduplicate all the structured rules selected from the leaf nodes to the root nodes. The following deduplication strategies can be specifically adopted:

[0066] 1) Merging method: For any two rules whose sub-logics before the current judgment level are the same, if the sub-logic at the judgment level can form a complete set, then these two rules are merged into one and retained in the logic of the parent node. For example:

[0067] Rule Rule_1: A > 0.5 and B < 3 and C > 1

[0068] Rule Rule_2: A > 0.5 and B < 3 and C <= 1

[0069] The deduplicated logic is: A > 0.5 and B < 3

[0070] The merging method usually plays an auxiliary role in pruning. When two leaf nodes from the same parent node of a certain tree can both be extracted as rules under the preset leaf node weight limit, it means that a rule with a better gain (or classification and recognition) effect and a higher hit rate can also be obtained at its parent node.

[0071] 2) Intersection method: For any two rules whose sub-logics before the current judgment level are the same, if the sub-logic at the judgment level can form a non-empty intersection, then retain one of the logics that form the intersection. For example:

[0072] Rule Rule_1: A > 0.5 and B < 3 and C > 1

[0073] Rule_2: A > 0.5 and B < 3 and C > 8

[0074] The logic after duplicate removal is: A > 0.5 and B < 3 and C > 8

[0075] The intersection method is beneficial to improving the gain lift (or classification recognition) effect of a single rule, but there may be a risk of overfitting due to too low a hit rate.

[0076] 3) Union method: For any two rules with the same sub-logic before the current judgment level, if the sub-logics at the judgment level can form a union, then retain one of the logics that form the union. For example:

[0077] Rule_1: A > 0.5 and B < 3 and C > 1

[0078] Rule_2: A > 0.5 and B < 3 and C > 8

[0079] The logic after duplicate removal is: A > 0.5 and B < 3 and C > 1

[0080] The union method is beneficial to improving the hit rate of a single rule, but it may reduce the overall gain lift of the rule set or the classification recognition effect.

[0081] Furthermore, a strategy of using the merging method + one of the intersection method / union method can be adopted to perform logical semantic duplicate removal of rules, and only remove duplicates up to the level where the leaf nodes are located, so as to avoid significantly reducing the gain lift of the final rule set or the classification recognition effect. Further, for duplicate removal at the remaining levels, screening can be performed by setting the hit rate hit and gain lift of single rules subsequently to obtain an ideal optimal rule set.

[0082] Output the rule set obtained after screening and duplicate removal. For example, as shown in Table 2: The rule corresponding to rule number 51 with tree number 3: Its root node feature, i.e., feature 1, is s_score; logical symbol 1 is <; value 631.495, missing; logical and1 is and; one leaf node, i.e., feature 2, is drawhisrjnum; logical symbol 2 is less than; and so on.

[0083] Extract the strategy rule set from the iteratively trained XGBOOST model. Compared with the derivative method of a single-tree decision tree, it has improvements in both the breadth of data feature utilization and the depth of sample information mining. It also improves the efficiency of batch rule mining and the classification recognition hit rate or accuracy of the data to be analyzed, which is beneficial to quickly adapting to strategy evaluation and iteration in the actual business scenario, such as precisely capturing users corresponding to risky or data security hidden danger behaviors, especially enterprise users. Further, an example output of this rule set isFigure 8 as shown

[0084] Table 2

[0085]

[0086]

[0087] In step S130, the data to be analyzed is identified based on the rule set, and the object corresponding to the data to be analyzed is classified for security according to the identification result. Mainly, the optimized rule set after screening and deduplication is evaluated, and then the rule set extracted by the model is used to identify the data to be analyzed, realizing the classification and identification of the data, finding out the existing abnormal situations, and accurately finding out the objects corresponding to the data with abnormal situations, such as enterprise users with risks or potential safety hazards, and putting them into the blacklist or giving a reminder.

[0088] In one implementation, the stability of the rule set is evaluated according to the time information and / or the rule set is analyzed according to the swap feature Swap to determine the combined index of the rule set, and the result of the evaluation and / or the result of the analysis are associated and output; the data to be analyzed is input into the rule model; it is determined whether there is an abnormal situation in the data to be analyzed under the combined index of the rule set determined by the rule model; if so, the object corresponding to the data to be analyzed with the abnormal situation is identified as a blacklist object. Further, the data to be analyzed is enterprise user data obtained during business supervision; the object corresponding to the data to be analyzed is an enterprise user; the identification as a blacklist object specifically includes: identifying the enterprise user corresponding to the data to be analyzed with the abnormal situation and adding the enterprise user to the blacklist of risk control management.

[0089] Specifically, for the obtained optimized rule set, that is, the rule output, rule effect screening can be performed, that is, it is determined that these rules are accurate and effective for the classification and identification of data. For example: input sample data outside the time to be evaluated, calculate the hit rate hit and gain lift and other indicators of all rules in the optimized rule set output by previous mining on this sample, and preset a threshold or limit value to remove, that is, filter out the rules with too low hit rate and gain lift.

[0090] Furthermore, rule combination optimization can be performed. That is, the remaining rules after filtering are sorted in descending order according to the gain lift index. In this way, under the condition that the gain lift meets the requirements, the overall hit rate is improved by taking the union of single rules, and a rule set with relatively balanced or ideal gain lift and hit rate and as few rules as possible is obtained, so as to realize the further combination optimization of rules. A preferred combination optimization process: under the minimum requirements of the hit rate and gain lift of the given rule set, find the rule combination that can maximize the classification index f1_score, and thus generate the final rule set. Here, f1-score is used as the final evaluation method for classification recognition, which is the harmonic mean of precision and recall, with a maximum of 1 and a minimum of 0. Refer to Figure 5 the process shown in Figure 5 the tree and rule correspondence table shown in the left table. Take the first four tree numbers from 0 to 3, for the last three rule numbers and weight values (the weight values are limited to 3) of each tree, and the maximum depth copy is 4 (duplicate removal is not performed); then traverse the single rule situation in descending order of gain lift in the aforementioned manner, and the effect of the single rule is as Figure 5 shown in the 2nd to 4th columns of the right table. The effect of the combined rule set finally obtained is as Figure 5 shown in the 5th column to the last column of the right table (the f1_score in the last column), with a hit rate hit greater than 1% and a gain lift greater than 3 among the top ten.

[0091] Furthermore, after the rules are evaluated, they are output, such as stability evaluation and Swap analysis, etc., in order to evaluate the hit rate and effect of the overall algorithm after training, including this rule model, in the abnormal recognition process during actual application, and then output the rule set after the evaluation is completed.

[0092] Among them, for stability evaluation, according to the time information of the input data, calculate the hit rate hit and gain lift of the rule set in different time periods, as Figure 6 shown in the evaluation. Set the objective, such as the objective function of the XGBOOST model. After training a stable model with historical data input and putting in actual data, determine the results calculated in this model, such as the hit rate hit and gain lift. If they are not good, make adjustments, such as adding more decision trees to improve the calculation results to meet the target requirements, etc., and if they are good, no adjustment is needed, etc., to evaluate the stability.

[0093] Among them, Swap analysis is as Figure 7As shown, according to the incoming swap features such as the model score f1_score, etc., the corresponding rejection situations can be calculated at different thresholds of the swap features, and then swapped with the rejection situations of the ruleset, so as to obtain the changes in the hit rate and lift of the ruleset at different thresholds, thereby evaluating the additional improvement of the ruleset outside the existing model or strategy.

[0094] Among them, after evaluation, the ruleset output can be performed. The optimized ruleset after combination, the situation of combined index changes, and the structured table related to the logical semantics of association rules (such as Table 1) are output to generate the corresponding combined optimization report (including rule outputs such as Figure 8 ). Various evaluation stabilities and Swap analyses (such as combined rule evaluation information), and even information on the model construction process and feature encoding can be added to the report as the basis for evaluating the effectiveness of the final strategy rules.

[0095] Subsequently, based on the information in the report, further model adjustment and optimization of rule combination quality assurance, etc. can be carried out. That is, an evaluation report is provided, and the model can be further adjusted as a reference later.

[0096] Thus, the actual data to be analyzed input can be classified and identified according to the ruleset mined from the model, so as to accurately and efficiently determine the data to be analyzed with abnormal situations, and identify the corresponding object of this data, such as an enterprise user, as a blacklist user and put it into the blacklist. Furthermore, various reminder services can be provided to prompt that the enterprise user is a blacklist user, etc.

[0097]

Example 1

[0098] In the risk control scenario of coping with risk changes, to achieve rapid strategy iteration, an automated processing process is required, which includes discarding samples, processing data features, conducting a large number of searches, evaluations, and outputs of rules (such as classifying and identifying enterprise users with abnormal situations). To find more effective rules outside the existing model and strategy system, effective rule mining processing needs to be embedded. Building strategy rules based on decision trees is one of the commonly used risk control methods in the current consumer finance field. However, since a single decision tree often cannot reflect enough information in the sample space, in actual applications, preprocessing work such as clustering and sampling of evaluation samples is often required, which is time-consuming and laborious and often fails to achieve ideal results. On the one hand, the ensemble boosting tree model samples during the construction of each decision tree and the splitting of each node in each round of iteration, enabling full traversal of the corner information in the sample space, and the clustering index can be directly used for tree construction, achieving the purpose of automatic clustering. On the other hand, each round of iteration takes into account the deficiencies in the previous predictions, and the entire model mines sample information more deeply. Therefore, considering a better way of batch mining rules based on the ensemble boosting tree can be more effective and accurate. Thus, the XGBOOST model algorithm is specifically adopted to form a classification and recognition tree model, which iteratively generates multiple decision trees. Each decision tree has its own branches (sub-branches) and leaves (leaf nodes). These branches are the rules mined through iterative training data and can further optimize the rules. The following will combine an example of an application scenario where abnormal situations are accurately and efficiently discovered through classification and recognition from the data to be analyzed, so as to identify enterprise users that should be included in the blacklist.

[0099] First, build the XGBOOST model and conduct iterative training of the model. Specifically, appropriate feature data can be selected and input into the model for iteration. The model can use the Focal loss function as the optimization objective, and specific parameters are passed in when calculating the first derivative of the loss function to calculate the optimal value to improve the iteration speed. When building the model, search for the given maximum depth / number of layers max_depth parameter and the minimum number of leaf nodes min_child_weight parameter. When the set limit conditions such as lift, hit rate, AUC, etc. meet the conditions, select the optimal model. During iteration, it is necessary to record the lift change of the model at the specified number of iterations. The max_depth parameter reflects the tree depth of the decision tree generated by iteration, and the minimum number of samples contained in the leaf node reflects the depth and weight value. Generally, if the number of layers is too large, the logical amount will be excessive; the min_child_weight parameter reflects the parameter weight of the leaf node during construction.

[0100] From the constructed and iteratively trained XGBoost model, through parsing, extracting, and pre-screening rules. It mainly extracts each leaf node of each decision tree in XGBoost through a recursive traversal algorithm based on a binary tree, then parses it into a rule logic semantic structure and removes duplicates, and finally outputs a rule set under specified limiting conditions.

[0101] See the foregoing steps S110 and S120 specifically.

[0102] For the rule set extracted based on the model, perform effect screening and combinatorial optimization of the rules, and execute an evaluation to output the combinatorially optimized rule set after the evaluation. Among them, the data to be analyzed can be input into the model, and through the rule set extracted and finally output by the model, classification and recognition are performed to determine whether there are abnormal situations in the data to be analyzed, such as abnormal behaviors of the objects reflected by these data, for example: a user fails to repay the loan within the preset threshold time limit multiple times, an enterprise user frequently conducts loan operations, and so on. Thus, each object corresponding to the data to be analyzed with corresponding abnormal situations, such as the behavior subject: enterprise users, etc., is regarded as an object with risks and potential safety hazards and put into the blacklist, and further, it can also remind others or the enterprise user itself of the existence of risks, etc.

[0103] See the foregoing step S130 specifically.

[0104]

Embodiment 2

[0105] Figure 2 It is a functional module architecture block diagram of an embodiment of the system according to the present invention. The system at least includes:

[0106] A model iteration module 210, configured to input the screened feature data into a constructed rule model based on an ensemble boosting tree for iteration, and record the prediction ability of the rule model in each iteration.

[0107] In one implementation, the model iteration module 210 may include:

[0108] A rule model construction sub-module 2101, configured to construct the rule model by using a focal loss function as an optimization target and under given maximum layer number parameters and minimum leaf node sample number parameters. Further, the sub-module 2101 constructs the rule model under the given maximum layer number parameters and minimum leaf node sample number parameters, specifically including: presetting a group of parameter search spaces; the parameter search space includes one or more maximum layer number parameters and one or more minimum leaf node sample number parameters; providing different given maximum layer number parameters and minimum leaf node sample number parameters by performing random search in the parameter search space to generate one or more rule models.

[0109] The model iteration record sub-module 2102 is used to input the filtered feature data into the rule model for iteration, and record the change in the prediction ability of the rule model under a specified number of iterations.

[0110] The parameter determination sub-module 2103 is used to calculate the first derivative of the focal loss function of the constructed rule model before the iteration of the model iteration record sub-module 2102, determine the function parameters corresponding to the minimum value of the focal loss function according to the first derivative; determine the basic parameters according to the function parameters and substitute them into the rule model.

[0111] The specific functions of the model iteration module 210 and its sub-modules are processed as described in step S110 of Embodiment 1 and the application of Example 1.

[0112] The rule extraction module 220 is used to select decision trees in the rule model according to the prediction ability of the rule model at different iteration times, and to extract optimized rules whose hit rate and accuracy meet preset conditions according to the decision trees, and form an optimized rule set with the optimized rules.

[0113] In one implementation, the rule extraction module 220 may include:

[0114] The decision tree selection sub-module 2201 is used to determine the iteration number when the prediction ability of the rule model is the highest during the iteration process, and select decision trees with a prediction ability higher than a preset ability value according to the iteration number when the prediction ability is the highest.

[0115] The rule set formation sub-module 2202 is used to execute a traversal algorithm on each decision tree of the rule model under a specified maximum extraction number to extract each leaf node in the tree; perform logical semantic structure parsing of the information of the selected leaf nodes; de-duplicate and filter all the rules to form an optimized rule set.

[0116] Further, when the sub-module 2202 executes a traversal algorithm on each decision tree of the rule model under a specified maximum extraction number to extract each leaf node in the tree, it specifically includes: under the maximum extraction number, using the in-order traversal recursive algorithm of the binary tree to extract the information of each leaf node in each decision tree CART of the rule model; wherein, the information of each leaf node includes: the logic on the node, the iteration number, and the weight value corresponding to the classification.

[0117] Further, the sub-module 2202 performs parsing on the logical semantic structure of the rules for the information of the filtered leaf nodes, specifically including: under the weight value limit of the predetermined leaf nodes, arranging the last leaf nodes of each of the decision trees CART in descending order of weight values, and selecting the top n leaf nodes, where n is a natural number greater than or equal to 1, representing the preset number of selections; for the information of the top n filtered leaf nodes, associating horizontally according to the hierarchical logic from the root to the leaf of the decision tree CART and stacking vertically according to the ascending order of the iteration times, extracting the rules and forming a structured rule set.

[0118] Further, the sub-module 2202 performs deduplication and screening on all the rules to form an optimized rule set, specifically including: judging according to the sub-logic from the leaf node to the root node, and performing logical semantic deduplication on the rules in the structured rule set; the deduplication includes one or a combination of several of merging, intersection, and union; and, according to the thresholds of the hit rate and prediction ability of the single rule preset, screening the rules in the deduplicated rule set to form the optimized rule set.

[0119] The specific functions of the rule extraction module 220 and its sub-modules are processed as described in step S120 in Embodiment 1 and the application in Example 1.

[0120] The security level module 230 is used to identify the data to be analyzed based on the rule set, and perform security grading on the object corresponding to the data to be analyzed according to the identification result.

[0121] In one embodiment, the security level sub-module 230 may include:

[0122] The analysis sub-module 2301 is used to perform stability evaluation on the rule set according to time information and / or analyze the rule set according to the swap feature Swap, determine the combined index of the rule set, and associate the result of the evaluation and / or the result of the analysis and output.

[0123] The input sub-module 2302 is used to input the data to be analyzed into the rule model.

[0124] The judgment sub-module 2303 is used to judge whether there is an abnormal situation for the data to be analyzed under the combined index of the rule set determined by the rule model.

[0125] The identification sub-module 2304 is used to, if so, identify the object of the data to be analyzed with an abnormal situation as a blacklist object.

[0126] The specific functions of the security level module 230 and its sub-modules are processed as described in step S130 in Embodiment 1 and the application in Example 1.

[0127] Those skilled in the art can understand that each module in the above device embodiments can be distributed in the device as described, or can be correspondingly changed and distributed in one or more devices different from the above embodiments. The modules of the above embodiments can be combined into one module, or further split into multiple sub-modules.

[0128]

Embodiment 3

[0129] The following describes an embodiment of the electronic device of the present invention. This electronic device can be regarded as an implementation in the form of an entity for the above method and device embodiments of the present invention. For the details described in the embodiment of the electronic device of the present invention, they should be regarded as a supplement to the above method or device embodiments; for the details not disclosed in the embodiment of the electronic device of the present invention, they can be implemented with reference to the above method or device embodiments.

[0130] Figure 3 is a structural block diagram of an exemplary embodiment of an electronic device according to the present invention. Figure 3 The electronic device shown is only an example and should not impose any limitations on the functions and usage scope of the embodiments of the present invention.

[0131] As Figure 3 shown, the electronic device 400 of this exemplary embodiment is presented in the form of a general-purpose data processing device. The components of the electronic device 400 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, a bus 430 connecting different electronic device components (including the storage unit 420 and the processing unit 410), a display unit 440, etc.

[0132] Among them, the storage unit 420 stores a computer-readable program, which can be the source program or the code of a read-only program. The program can be executed by the processing unit 410, so that the processing unit 410 executes the steps of various embodiments of the present invention. For example, the processing unit 410 can execute as Figure 1 shown in the steps.

[0133] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and / or a cache storage unit 4202, and may further include a read-only storage unit (ROM) 4203. The storage unit 420 may also include a program / utilities 4204 having a set (at least one) of program modules 4205. Such program modules 4205 include, but are not limited to: operating the electronic device, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0134] The bus 430 can represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an Accelerated Graphics Port, a processor unit, or a local bus using any of the various bus structures.

[0135] The electronic device 400 can also communicate with one or more external devices 100 (such as a keyboard, a display, a network device, a Bluetooth device, etc.), enabling a user to interact with the electronic device 400 via these external devices 100, and / or enabling the electronic device 400 to communicate with one or more other data processing devices (such as a router, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 450, and can also be through the network adapter 460 with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet). The network adapter 460 can communicate with other modules of the electronic device 400 through the bus 430. It should be understood that although Figure 4 not shown in the figure, other hardware and / or software modules can be used in the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices, etc.

[0136]

Example 4

[0137] Figure 4 is a schematic diagram of an embodiment of a computer-readable medium of the present invention. As Figure 4As shown, the computer program can be stored on one or more computer-readable media. The computer-readable media can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electronic device, apparatus, or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. When the computer program is executed by one or more data processing devices, the computer-readable medium can implement the above method of the present invention, that is: obtaining Chinese keywords of each enterprise entity; semantically splitting the keywords according to pictographic elements respectively, and outputting word vectors of the enterprise entity according to the semantic splitting results; identifying the word vectors through a semantic association degree interpretation model to obtain an opinion recognition result of the enterprise entity, the semantic association degree interpretation model is used to identify the semantic relevance between the keyword and each word or Chinese character in the text training data, and taking the word or Chinese character whose semantic relevance meets the threshold as the opinion recognition result to explain the keyword at the semantic level; constructing an enterprise knowledge graph according to the opinion recognition results of each enterprise entity and the economic relationship between the enterprise entities; determining blacklist enterprises according to the enterprise knowledge graph.

[0138] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described in the present invention can be implemented by software, or can be implemented by the way of software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, and the software product can be stored in a computer-readable storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on the network, including several instructions to enable a data processing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the present invention.

[0139] The computer-readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, in which the readable program code is carried. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable storage medium may also be any readable medium other than the readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in connection with an instruction execution electronic device, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination of the foregoing.

[0140] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, executed as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0141] In summary, the present invention may be implemented by a method, apparatus, electronic device, or computer-readable medium for executing a computer program. Some or all of the functions of the present invention may be implemented using a general-purpose data processing device such as a microprocessor or a digital signal processor (DSP) in practice.

[0142] The specific embodiments described above further elaborate on the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices may also implement the present invention. The above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for identifying the user security level of a model integrated with boosted tree construction, characterized in that Including: Input the filtered feature data into the constructed rule model based on the integrated boosting tree for iteration, and record the prediction ability of the rule model at each iteration; Select decision trees in the rule model according to the prediction ability of the rule model at different iteration times, including: determining the iteration number when the prediction ability of the rule model is the highest during the iteration process, and selecting decision trees with a prediction ability higher than the preset ability value according to the iteration number when the prediction ability is the highest; Extract optimized rules whose hit rate and accuracy meet the preset conditions according to the decision trees, and form an optimized rule set with the optimized rules, including: performing a traversal algorithm on each decision tree of the rule model under the specified maximum extraction number to extract each leaf node in the tree, parsing the logical semantic structure of the rules from the information of the selected leaf nodes, and forming an optimized rule set by de-duplicating and screening all the rules; Identify the data to be analyzed based on the rule set, and perform security classification on the object corresponding to the data to be analyzed according to the identification result.

2. The method according to claim 1, wherein Also including: The rule model uses the XGBOOST model. Convert the record file of the XGBOOST model into the json format. Under the specified maximum extraction number, use the inorder traversal recursive algorithm of the binary tree to extract the information of each leaf node of each decision tree CART of the XGBOOST model.

3. The method according to claim 1, wherein Performing a traversal algorithm on each decision tree of the rule model under the specified maximum extraction number to extract each leaf node in the tree, specifically including: Under the specified maximum extraction number, use the inorder traversal recursive algorithm of the binary tree to extract the information of each leaf node of each decision tree CART of the rule model; Among them, the information of each leaf node includes: the logic on the node, the iteration number, and the weight value of the corresponding classification.

4. The method according to claim 1, wherein Parsing the logical semantic structure of the rules from the information of the selected leaf nodes, specifically including: Under the weight value limit of the predetermined leaf nodes, arrange the last leaf nodes of each decision tree CART in descending order of the weight value, and select the first n leaf nodes, where n is a natural number greater than or equal to 1 and represents the preset selection number; For the information of the first n selected leaf nodes, perform horizontal association according to the hierarchical logic from the root to the leaf of the decision tree CART and vertical superposition according to the ascending order of the iteration number, extract the rules and form a structured rule set.

5. The method according to claim 1, wherein De-duplicate and screen all the rules to form an optimized rule set, specifically including: Judging according to the sub-logic from the leaf node to the root node, and performing logical semantic de-duplication on the rules in the structured rule set; The de-duplication includes: one or several combinations of merging, intersection, and union; and, According to the thresholds of the hit rate and prediction ability of the single rule preset, screen the rules in the de-duplicated rule set to form the optimized rule set.

6. The method according to any one of claims 1 to 5, characterized in that, Input the filtered feature data into the constructed rule model based on the integrated boosting tree for iteration, and record the prediction ability of the rule model at each iteration, specifically including: Construct the rule model by using the focal loss function as the optimization objective and under the given maximum number of layers parameter and minimum number of leaf node samples parameter; Input the filtered feature data into the rule model for iteration, and record the change in the prediction ability of the rule model at the specified number of iterations.

7. The method according to claim 6, characterized in that Before inputting the filtered feature data into the rule model for iteration, it further includes: Calculate the first derivative of the focal loss function of the constructed rule model, and determine the function parameters corresponding to the minimum value of the focal loss function according to the first derivative; Determine the basic parameters according to the function parameters and substitute them into the rule model.

8. The method according to claim 6, wherein Construct the rule model under the given maximum number of layers parameter and minimum number of leaf node samples parameter, specifically including: Preset a set of parameter search spaces; The parameter search space includes one or more maximum number of layers parameters and one or more minimum number of leaf node samples parameters; Provide different given maximum number of layers parameters and minimum number of leaf node samples parameters by performing random search in the parameter search space to generate one or more rule models.

9. The method according to any one of claims 1 to 8, characterized in that, Based on the rule set, identify the data to be analyzed, and perform security grading on the object corresponding to the data to be analyzed according to the identification result. Specifically including: Perform stability evaluation on the rule set according to time information and / or analyze the rule set according to the swap feature Swap, determine the combined index of the rule set, and associate the result of the evaluation and / or the result of the analysis and output; Input the data to be analyzed into the rule model; Judge whether there is an abnormal situation in the data to be analyzed under the combined index of the rule set determined by the rule model; If so, identify the object corresponding to the data to be analyzed with abnormal situation as a blacklist object.

10. A user security level recognition system of a model integrating boosted tree construction, characterized in that, It includes: A model iteration module, which is used to input the filtered feature data into the constructed rule model based on the ensemble boosting tree for iteration, and record the prediction ability of the rule model at each iteration; A rule extraction module, which is used to select decision trees in the rule model according to the prediction ability of the rule model at different iteration times, including: determining the iteration number when the prediction ability of the rule model is the highest during the iteration process, and selecting decision trees with a prediction ability higher than the preset ability value according to the iteration number when the prediction ability is the highest; and, which is used to extract optimized rules whose hit rate and accuracy meet the preset conditions according to the decision trees, and form an optimized rule set with the optimized rules, including: performing a traversal algorithm on each decision tree of the rule model under the specified maximum number of extraction trees to extract each leaf node in the tree, parsing the logical semantic structure of the rules for the information of the selected leaf nodes, and de-duplicating and screening all the rules to form an optimized rule set; A security level module, which is used to identify the data to be analyzed based on the rule set, and perform security grading on the object corresponding to the data to be analyzed according to the identification result.

11. An electronic device, comprising a processor and a memory storing computer-executable instructions; characterized in that: The computer-executable instructions, when executed, cause the processor to execute the method according to any one of claims 1 to 9.

12. A computer-readable medium, wherein, The computer-readable medium stores one or more programs, characterized in that: when the one or more programs are executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images