Risk assessment method, device, electronic device and storage medium

Abstract

The embodiments of the present application disclose a risk assessment method, device, electronic device and storage medium. The method includes extracting a first feature vector from the acquired data to be evaluated; determining a first assessment score of the data to be evaluated based on the first feature vector and a first risk assessment model; determining a second assessment score of the data to be evaluated based on the first feature vector and the second risk assessment model; and determining a target risk type of the data to be evaluated based on the first assessment score and the second assessment score.

Description

Technical Field

[0001] The embodiments of the present application relate to computer technology, and in particular to a risk assessment method, device, electronic device and storage medium. Background Art

[0002] With the continuous development of electronic devices, the functions of electronic devices are becoming more diversified. While this makes it easier for users to use, it also greatly increases the difficulty of security management of electronic devices. For example, with the use of electronic device payment functions, users can pay using the payment code of the electronic device. Although the payment function brings convenience to users' lives, there are certain risks when users perform payment tasks, such as payment code leakage.

[0003] In the related art, electronic devices solve the security problems caused by the diversification of electronic device functions by performing risk assessment on tasks to be performed. At present, the risk assessment of tasks to be performed needs to rely on manual operations, such as manually evaluating task data and warning users who perform high-risk businesses. The high subjectivity of the assessment criteria leads to low accuracy of risk assessment. Summary of the invention

[0004] The present application provides a risk assessment method, device, electronic device and storage medium, which can improve the accuracy of risk assessment.

[0005] In a first aspect, an embodiment of the present application provides a risk assessment method, comprising:

[0006] Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm;

[0007] Scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0008] Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0009] A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

[0010] In a second aspect, an embodiment of the present application further provides a risk assessment device, including:

[0011] A first acquisition module, used for acquiring data to be evaluated, and extracting a first feature vector from the data to be evaluated by a feature extraction algorithm;

[0012] A first scoring module, used for scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0013] A second scoring module is used to score the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0014] A determination module is used to determine the target risk type of the data to be evaluated based on the first evaluation score and the second evaluation score.

[0015] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements a risk assessment method when executing the computer program:

[0016] Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm;

[0017] Scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0018] Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0019] A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

[0020] In a fourth aspect, an embodiment of the present application further provides a storage medium comprising electronic device executable instructions, wherein the electronic device executable instructions are used to execute the risk assessment method described in the embodiment of the present application when executed by an electronic device processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Other features, objects and advantages of the present application will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings.

[0022] Figure 1 It is a schematic diagram of the first scenario of the risk assessment method provided in an embodiment of the present application.

[0023] Figure 2 It is a schematic diagram of the second scenario of the risk assessment method provided in an embodiment of the present application.

[0024] Figure 3 It is a first flow chart of the risk assessment method provided in the embodiment of the present application.

[0025] Figure 4 It is a schematic diagram of the third scenario of the risk assessment method provided in the embodiment of the present application.

[0026] Figure 5It is a schematic diagram of the structure of the autoencoder provided in an embodiment of the present application.

[0027] Figure 6 It is a second flow chart of the risk assessment method provided in the embodiment of the present application.

[0028] Figure 7 It is a schematic diagram of the structure of the risk assessment device provided in an embodiment of the present application.

[0029] Figure 8 It is a first structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0030] Fig. 9 It is a second structural schematic diagram of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0032] The embodiment of the present application provides a risk assessment method, which is applied to electronic devices. The execution subject of the risk assessment method can be the risk assessment device provided in the embodiment of the present application, or an electronic device integrating the risk assessment device, the risk assessment device can be implemented in hardware or software, and the electronic device can be a smart phone, tablet computer, PDA, laptop computer, desktop computer, etc., which is equipped with a processor and has processing capabilities.

[0033] See also Figure 1 , Figure 1 A schematic diagram of the first scenario of the risk assessment method provided in an embodiment of the present application. When the client detects a payment request for payment task A based on user triggering, the client sends the payment request for payment task A to the server. After receiving the payment request sent by the client, the server performs a risk assessment on payment task A in combination with the first risk assessment model and the second risk assessment model. If the risk of payment task A is not high, the server responds to the payment request for payment task A, processes payment task A, and sends a "payment successful" notification to the client. If the risk of payment task A is high, in order to improve security, the server prohibits responding to the payment request for payment task A and sends an identity authentication request to the client.

[0034] See also Figure 2 , Figure 2A second scenario schematic diagram of the risk assessment method provided for an embodiment of the present application. When the client detects a payment request for payment task B based on a user-triggered payment task B, the client performs a risk assessment on payment task B in combination with the first risk assessment model and the second risk assessment model. If the risk of payment task B is not high, the client sends the payment request for payment task B to the server, so that the server processes payment task B according to the payment request. If the risk of payment task B is high, the client requires the user to reconfirm whether payment task B is to be executed, and requires the user to provide identity verification. After the user reconfirms and the identity verification is qualified, the client sends the payment request for payment task B to the server, so that the server processes payment task B according to the payment request.

[0035] See also Figure 3 , Figure 3 This is a schematic diagram of the first process of the risk assessment method provided in the embodiment of the present application. The process of the risk assessment method is as follows:

[0036] 101. Obtain data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm.

[0037] In an embodiment of the present application, when a task to be performed is detected, the electronic device obtains data to be evaluated corresponding to the task to be performed, and extracts a first feature vector from the data to be evaluated through a feature extraction algorithm for risk scoring by a risk assessment model.

[0038] Different tasks to be performed correspond to different data to be evaluated. For example, the data to be evaluated corresponding to the task to be performed "membership recharge of application A" is different from the data to be evaluated corresponding to the task to be performed "download application A". In addition, the data to be evaluated can be multi-dimensional data, and the data to be evaluated includes at least task data, account data, and device data.

[0039] For example, suppose that the electronic device currently has a task to be performed: downloading application B from the application store. The data to be evaluated corresponding to the task to be performed at least includes: task data (such as: name of the downloaded application, download time, download location, etc.), account data (such as: total number of times the account logs into the application store, the time set of the account logs into the application store, the login location set of the account logs into the application store, the total number of times the account downloads applications, the type of applications downloaded by the account, etc.), device data (such as: total number of times the device logs into the application store, the time set of the device logs into the application store, the login location set of the device logs into the application store, the total number of times the device downloads applications, the type of applications downloaded by the device, etc.).

[0040] It is understandable that the same device can log in to multiple accounts, and one account can also log in to multiple devices. Therefore, when the electronic device obtains the data to be evaluated, it obtains both the account data and the device data, which can make the data to be evaluated more comprehensive, thereby improving the accuracy of risk assessment.

[0041] The feature extraction algorithm is used to extract features from data and generate feature vectors based on the features. For example, assume that the electronic device extracts 1,000 features from the data to be evaluated through a feature extraction algorithm, and then generates a 1,000-dimensional first feature vector based on the 1,000 features for the risk assessment model to perform risk assessment.

[0042] In some embodiments, after the electronic device acquires the data to be evaluated, the electronic device performs cleaning and completion processing on the data to be evaluated, and then extracts a first feature vector from the processed data to be evaluated through a feature extraction algorithm.

[0043] 102. Score the data to be evaluated according to the first eigenvector and the first risk assessment model to obtain a first evaluation score.

[0044] In the embodiment of the present application, after obtaining the first eigenvector, the electronic device inputs the first eigenvector into a first risk assessment model, scores the data to be assessed using the first risk assessment model, and obtains a first assessment score.

[0045] Among them, the first risk assessment model adopts an unsupervised algorithm, which can be used to perform risk scoring on the data to be assessed. For example, the first risk assessment model can be obtained by training a pre-built cluster analysis model. For example, the first risk assessment model can be obtained by training a pre-built isolation forest model. Alternatively, the first risk assessment model can also be other models that can perform risk scoring on the data to be assessed through an unsupervised algorithm, which is not specifically limited in the embodiments of the present application.

[0046] 103. Score the data to be evaluated according to the first eigenvector and the second risk assessment model to obtain a second evaluation score.

[0047] In the embodiment of the present application, after obtaining the first feature vector, the electronic device inputs the first feature vector into the second risk assessment model, scores the data to be assessed through the second risk assessment model, and obtains a second assessment score.

[0048] Among them, the second risk assessment model adopts a supervised algorithm, which can be used to perform risk scoring on the data to be assessed. For example, the second risk assessment model can be obtained by training a pre-built classification model. For example, the second risk assessment model can be obtained by training a pre-built neural network model. Alternatively, the second risk assessment model can also be other models that can perform risk scoring on the data to be assessed through a supervised algorithm, which is not specifically limited in the embodiments of the present application.

[0049] 104. Determine a target risk type of the data to be evaluated based on the first evaluation score and the second evaluation score.

[0050] In an embodiment of the present application, after obtaining the first evaluation score and the second evaluation score, the electronic device can determine the target evaluation score of the data to be evaluated based on the first evaluation score and the second evaluation score, and then determine the preset risk type corresponding to the target evaluation score as the target risk type of the data to be evaluated.

[0051] For example, when determining the target evaluation score of the data to be evaluated according to the first evaluation score and the second evaluation score, the electronic device may take the sum of the first evaluation score and the second evaluation score as the target evaluation score of the data to be evaluated.

[0052] For example, when determining the target evaluation score of the data to be evaluated according to the first evaluation score and the second evaluation score, the electronic device can determine the first weight coefficient corresponding to the first evaluation score and the second weight coefficient corresponding to the second evaluation score according to the type of the data to be evaluated. Based on the first weight coefficient, the second weight coefficient, the first evaluation score and the second evaluation score, the target evaluation score of the data to be evaluated is calculated.

[0053] Among them, when the first risk assessment model is more accurate for the type of data to be assessed using the first risk assessment model than the second risk assessment model, the first weight coefficient corresponding to the first assessment score is greater than the second weight coefficient corresponding to the second assessment score. Compared with the first risk assessment model, when the second risk assessment model is more accurate for the type of data to be assessed using the second risk assessment model, the first weight coefficient corresponding to the first assessment score is less than the second weight coefficient corresponding to the second assessment score.

[0054] In another embodiment, after obtaining the first evaluation score, the electronic device can directly determine the target risk type of the data to be evaluated based on the first evaluation score. For example, when the first risk evaluation model is obtained by training a pre-built isolation forest model, the value range of the first evaluation score is between 0 and 1. The smaller the first evaluation score, the lower the risk level of the target risk type of the data to be evaluated, and the larger the first evaluation score, the higher the risk level of the target risk type of the data to be evaluated.

[0055] In another embodiment, after obtaining the second evaluation score, the electronic device can directly determine the target risk type of the data to be evaluated based on the second evaluation score. For example, when the second risk evaluation model is obtained by training a pre-built classification model, the size of the second evaluation score is positively correlated or negatively correlated with the risk level of the target risk type of the data to be evaluated.

[0056] From the above, it can be seen that in the embodiment of the present application, the electronic device scores the data to be evaluated in two ways: scoring the data to be evaluated by a first risk assessment model and scoring the data to be evaluated by a second risk assessment model, and finally combining the scoring results of the two methods to comprehensively determine the target risk type of the data to be evaluated, which can improve the accuracy of risk assessment.

[0057] See also Figure 4 , Figure 4 A third scenario diagram of the risk assessment method provided in an embodiment of the present application. In some embodiments, when the data to be assessed is scored according to the first feature vector and the first risk assessment model to obtain a first assessment score, the electronic device may perform the following:

[0058] The first feature vector is encoded by a coding algorithm to obtain a second feature vector, wherein the first feature vector is a discrete feature and the second feature vector is a continuous feature;

[0059] Based on the second eigenvector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score.

[0060] The encoding algorithm is used to encode the feature vector so that the vector elements of the feature vector are transformed from discrete features to continuous features. The encoding algorithm in this scheme is trained based on a pre-built autoencoder (AE).

[0061] For example, the electronic device obtains a plurality of sample vectors to form a first training set. Then, the first training set is used to train the autoencoder to update the model parameters of the autoencoder. Finally, based on the encoder in the autoencoder after the model parameters are updated, a coding algorithm is constructed. The autoencoder includes an encoder and a decoder.

[0062] See also Figure 5 , Figure 5 Schematic diagram of the structure of the autoencoder provided in the embodiment of the present application. When training, the autoencoder will perform encoding and decoding operations on each sample vector X. The encoding operation refers to mapping the sample vector X to the feature space through the encoder to obtain the abstract feature vector Z. The decoding operation refers to mapping the abstract feature vector Z back to the original space through the decoder to obtain the reconstructed vector It can be understood that when the sample vector X and the reconstruction vector When the error is minimized, the autoencoder training is completed.

[0063] It should be noted that because the feature vector whose vector elements are discrete features is not suitable for risk scoring using the first risk assessment model, the feature vector whose vector elements are discrete features is converted into a feature vector whose vector elements are continuous features through an encoding algorithm, making it suitable for risk scoring using the first risk assessment model, thereby improving the accuracy of risk assessment.

[0064] See also Figure 6 , Figure 6 This is a second flow chart of the risk assessment method provided in the embodiment of the present application. The process of the risk assessment method is as follows:

[0065] 201. Obtain data to be evaluated, and perform feature extraction on the data to be evaluated using a feature extraction algorithm to obtain a first numerical feature and a text feature.

[0066] The first numerical feature refers to a feature expressed by a numerical value, such as: the electronic device extracts the feature of "the number of times the device downloads application C: 5" through a feature extraction algorithm, and obtains the first numerical feature: "5". The text feature refers to a feature expressed by text, such as: the electronic device extracts the feature of "the location where the device downloads application C: Beijing" through a feature extraction algorithm, and obtains the text feature: "Beijing".

[0067] 202. Normalize the first numerical feature and convert the text feature to convert the text feature into a second numerical feature.

[0068] The purpose of the normalization process is to normalize the numerical value representing the first numerical feature so that the numerical value representing the first numerical feature is within a specified numerical range (such as a numerical range of 0 to 1).

[0069] The purpose of the conversion process in this solution is to convert the text feature into a second numerical feature, wherein the second numerical feature also refers to a feature represented by a numerical value.

[0070] For example, when the electronic device converts the text feature "Beijing" into the second numerical feature, it determines whether the electronic device is located in Beijing. If the electronic device is located in Beijing, the text feature "Beijing" is converted into the second numerical feature: "1"; if the electronic device is not located in Beijing, the text feature "Beijing" is converted into the second numerical feature: "0".

[0071] 203. Generate a first feature vector based on the first numerical feature and the second numerical feature.

[0072] In the embodiment of the present application, after obtaining the first numerical feature and the second numerical feature, the electronic device generates a first feature vector according to the first numerical feature and the second numerical feature in accordance with a preset order of each feature.

[0073] For example, assume that the electronic device obtains 2 first numerical features and 1 second numerical feature. The 2 first numerical features are: 0.05 (obtained from the number of times the account downloads application D "5"), 0.1 (obtained from the number of times the account logs in "100"), and the 1 second numerical feature is: 1 (obtained from the download location "Beijing"). If the number of account logins is a vector element of the first dimension, the account downloads application D is a vector element of the second dimension, and the download location is a vector element of the third dimension, then the preset order of the first numerical feature "0.05" is 2, the preset order of the first numerical feature "0.1" is 1, and the preset order of the second numerical feature "1" is 3. The first feature vector generated by the electronic device is (0.1, 0.05, 1).

[0074] 204. Determine a weight value corresponding to each vector element in the second risk assessment model according to an arrangement order of vector elements in the first feature vector, wherein the vector element includes a first numerical feature and a second numerical feature.

[0075] In the embodiment of the present application, after generating the first feature vector, the electronic device determines the weight value corresponding to each vector element in the second risk assessment model according to the arrangement order of the vector elements in the first feature vector. For example, for the vector elements arranged in the second dimension in the first feature vector, the weight values ​​corresponding to the second risk assessment model are also arranged in the second dimension.

[0076] The weight value can represent the importance of the feature represented by the vector element. The larger the weight value, the more important the feature represented by the vector element. The smaller the weight value, the less important the feature represented by the vector element.

[0077] It should be noted that, because the fourth eigenvector used to train the second risk assessment model and the first eigenvector have the same content represented by the same dimensional vector elements, such as the second dimensional vector elements of the fourth eigenvector and the first eigenvector both represent the number of account logins, the weight value corresponding to each vector element in the second risk assessment model can represent the importance of the feature represented by the vector element.

[0078] 205. Adjust the size of each vector element according to the corresponding weight value to obtain a third eigenvector.

[0079] In the embodiment of the present application, after determining the weight value corresponding to each vector element in the second risk assessment model, the size of each vector element is adjusted according to the size of the corresponding weight value. If the corresponding weight value is large, it means that the vector element corresponding to this weight value is more important, and the electronic device can increase the value of the vector element so that the vector element can be distinguished from other vector elements.

[0080] In some embodiments, when adjusting the size of each vector element according to the size of the corresponding weight value, the electronic device may increase the value of the preset number of vector elements with the largest corresponding weight value. For example, assuming that the weight values ​​corresponding to the 7 vector elements are recorded as: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, and the preset number is 3, the electronic device increases the value of the vector element corresponding to the weight value of 0.5, the vector element corresponding to 0.6, and the vector element corresponding to 0.7. Among them, the preset number is pre-set in the electronic device, and the preset number can be determined autonomously by the electronic device or manually by the user.

[0081] 206. Score the data to be evaluated according to the third eigenvector and the first risk assessment model to obtain a first evaluation score.

[0082] In the embodiment of the present application, after obtaining the third eigenvector, the electronic device inputs the third eigenvector into the first risk assessment model, scores the data to be assessed using the first risk assessment model, and obtains a first assessment score.

[0083] For example, assume that the first risk assessment model is trained by a pre-built isolation forest model. After obtaining the third eigenvector, the electronic device inputs the third eigenvector into the first risk assessment model, determines the average path length corresponding to each vector element in the second risk assessment model, and obtains and outputs the first assessment score based on the average path length of each vector element. Among them, the first risk assessment model includes at least two isolated trees. The number of nodes traversed by the vector element in each isolated tree is used as the path length of the vector element in the isolated tree. The average path length corresponding to the vector element in the second risk assessment model is the average value of the path length of the vector element in each isolated tree.

[0084] It should be noted that because the third eigenvector adjusts the value of the vector element corresponding to the large weight value so that the vector element is distinguished from other vector elements, when the data to be evaluated is scored through the first risk assessment model, the electronic device can use the sub-score obtained based on the vector element as an important component of the first evaluation score.

[0085] 207. Score the data to be evaluated according to the first eigenvector and the second risk assessment model to obtain a second evaluation score.

[0086] In the embodiment of the present application, after obtaining the first feature vector, the electronic device inputs the first feature vector into the second risk assessment model, scores the data to be assessed through the second risk assessment model, and obtains a second assessment score.

[0087] For example, assuming that the second risk assessment model is obtained by a pre-built classification model. After obtaining the first feature vector, the electronic device inputs the first feature vector into the second risk assessment model, and then determines the weight value corresponding to each vector element in the second risk assessment model according to the arrangement order of the vector elements in the first feature vector, and performs weighted summation processing based on the weight value and the vector element to obtain and output the second assessment score.

[0088] 208. Determine a target risk type of the data to be evaluated based on the first evaluation score and the second evaluation score.

[0089] In an embodiment of the present application, after obtaining the first evaluation score and the second evaluation score, the electronic device can determine the target evaluation score of the data to be evaluated based on the first evaluation score and the second evaluation score, and then determine the preset risk type corresponding to the target evaluation score as the target risk type of the data to be evaluated.

[0090] 209. When the risk level of the target risk type is lower than or equal to the preset level, the pending tasks corresponding to the data to be evaluated are executed.

[0091] In the embodiment of the present application, after determining the target risk type of the data to be evaluated, when the risk level of the target risk type is lower than or equal to the preset level, the electronic device can execute the task to be executed corresponding to the data to be evaluated. When the risk level of the target risk type is lower than or equal to the preset level, the electronic device can prohibit the task to be executed corresponding to the data to be evaluated, and output a prompt message to the user, such as a prompt message that "the risk level of the task to be executed is high".

[0092] From the above, it can be seen that in the embodiment of the present application, before processing a task to be executed, the electronic device first performs a risk assessment through the data to be evaluated corresponding to the task to be executed, executes the task to be executed when the risk level is lower than or equal to the preset level, and prohibits the execution of the task to be executed when the risk level is higher than the preset level, and outputs a prompt message to the user, thereby improving the safety of the electronic device.

[0093] In some embodiments, the second risk assessment model is a classification model, and the electronic device may further perform the following:

[0094] Obtain multiple sample evaluation data;

[0095] extracting a fourth feature vector from the sample evaluation data by a feature extraction algorithm;

[0096] Obtaining a sample risk type of each sample assessment data, and forming a training set according to the fourth eigenvector and the sample risk type;

[0097] The classification model is trained using the training set to update the model parameters of the classification model.

[0098] The specific implementation of extracting the fourth feature vector from the sample evaluation data by the feature extraction algorithm can refer to the specific implementation of extracting the first feature vector from the data to be evaluated by the feature extraction algorithm above. It should be noted that one sample evaluation data can extract one fourth feature vector. One fourth feature vector corresponds to one sample risk type.

[0099] In addition, the present application embodiment does not specifically limit the method for obtaining the sample risk type in the solution. For example, the electronic device can obtain the sample risk type by receiving the sample risk type set by the user for the sample assessment data. For example, the electronic device can automatically determine the sample risk type of the sample assessment data, etc.

[0100] In some embodiments, when obtaining the sample risk type of each sample assessment data, the electronic device may perform the following steps:

[0101] The sample evaluation data is scored using the first risk evaluation model and the corresponding fourth eigenvector to obtain a third evaluation score, and the sample risk type of the sample evaluation data is determined based on the third evaluation score.

[0102] In this solution, the electronic device automatically determines the sample risk type of the sample assessment data through the first risk assessment model, which can reduce manual operations and save time in determining the sample risk type, thereby shortening the training time of the second risk assessment model and improving the training efficiency of the second risk assessment model.

[0103] It should be noted that based on this scheme, the sample risk type of sample assessment data is automatically determined through the first risk assessment model, which improves the training efficiency of the second risk assessment model. The electronic device can train the second risk assessment model in a short time, such as the electronic device trains the second risk assessment model at a preset time interval (such as 30 minutes), thereby improving the real-time performance of the second risk assessment model.

[0104] In some embodiments, when determining the sample risk type of the sample assessment data according to the third assessment score, the electronic device may perform the following steps:

[0105] When the third evaluation score is within the preset interval, the preset risk type corresponding to the third evaluation score is used as the sample risk type of the sample evaluation data;

[0106] When the third evaluation score is not within the preset interval, the sample risk type set by the user for the sample evaluation data is obtained.

[0107] The electronic device is pre-set with at least two preset intervals. Different preset intervals correspond to different sample risk types. The sample risk type corresponding to the preset interval where the third evaluation score is located is the sample risk type of the sample evaluation data.

[0108] It should be noted that, when setting the preset interval in advance, considering that some sample risk types corresponding to the third assessment scores are unstable, in order to improve the accuracy of the sample risk types and the training effect of the second risk assessment model, the electronic device only considers the third assessment scores of the corresponding sample risk types that are stable when setting the preset interval. For the third assessment scores of the corresponding sample risk types that are unstable, the user manually determines the sample risk type. This can improve the training effect of the second risk assessment model and improve the training efficiency of the second risk assessment model to a certain extent.

[0109] For example, assume that the sample risk types include risk-free types and risky types. The first risk assessment model is trained by a pre-built isolation forest model, and the value range of the third assessment score is between 0 and 1. Because the sample assessment data with a third assessment score near 0.5 is difficult to distinguish between risk-free types and risky types, the preset intervals pre-set by the electronic device include risk-free intervals (such as [0, 0.2]) and risky intervals (such as [0.8, 1]).

[0110] Figure 7 300 is a schematic diagram of the structure of the risk assessment device provided in the embodiment of the present application. The device is used to execute the risk assessment method provided in the above embodiment, and has the corresponding functional modules and beneficial effects of the execution method. The risk assessment device 300 specifically includes: a first acquisition module 301, a first scoring module 302, a second scoring module 303 and a determination module 304, wherein:

[0111] A first acquisition module 301 is used to acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm;

[0112] A first scoring module 302, configured to score the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0113] A second scoring module 303 is used to score the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0114] The determination module 304 is used to determine the target risk type of the to-be-assessed data according to the first assessment score and the second assessment score.

[0115] In some embodiments, when scoring the data to be evaluated based on the first feature vector and the first risk assessment model to obtain a first assessment score, the first scoring module 302 may be used to:

[0116] Encoding the first feature vector by using a coding algorithm to obtain a second feature vector, wherein the first feature vector is a discrete feature and the second feature vector is a continuous feature;

[0117] Based on the second feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score.

[0118] In some embodiments, when extracting the first feature vector from the data to be evaluated by using a feature extraction algorithm, the first acquisition module 301 may be used to:

[0119] Extracting features from the data to be evaluated by a feature extraction algorithm to obtain a first numerical feature and a text feature;

[0120] Normalizing the first numerical feature and converting the text feature to convert the text feature into a second numerical feature;

[0121] A first feature vector is generated based on the first numerical feature and the second numerical feature.

[0122] In some embodiments, the first risk assessment model is obtained by training a pre-built isolation forest model, and the second risk assessment model is obtained by training a pre-built classification model;

[0123] When scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score, the first scoring module 302 may be used to:

[0124] Determining, according to the arrangement order of vector elements in the first feature vector, a weight value corresponding to each vector element in the second risk assessment model, wherein the vector element includes the first numerical feature and the second numerical feature;

[0125] According to the corresponding weight value, the size of each vector element is adjusted to obtain a third eigenvector;

[0126] The data to be evaluated is scored according to the third eigenvector and the first risk assessment model to obtain a first assessment score.

[0127] In some embodiments, when adjusting the size of each vector element according to the size of the corresponding weight value, the first scoring module 302 may be used to:

[0128] Increase the values ​​of the preset number of vector elements with the largest corresponding weight values.

[0129] In some embodiments, after determining the target risk type of the to-be-assessed data according to the first assessment score and the second assessment score, the risk assessment device 300 further includes:

[0130] The execution module is used to execute the task to be executed corresponding to the data to be evaluated when the risk level of the target risk type is lower than or equal to a preset level.

[0131] In some embodiments, the second risk assessment model is a classification model, and the risk assessment device 300 further includes:

[0132] A second acquisition module is used to acquire multiple sample evaluation data;

[0133] an extraction module, configured to extract a fourth feature vector from the sample evaluation data by using the feature extraction algorithm;

[0134] A third acquisition module is used to obtain the sample risk type of each sample evaluation data, and form a training set according to the fourth eigenvector and the sample risk type;

[0135] A training module is used to train the classification model using the training set to update the model parameters of the classification model.

[0136] In some embodiments, when obtaining the sample risk type of each sample assessment data, the third obtaining module may be used to:

[0137] The sample evaluation data is scored using the first risk evaluation model and the corresponding fourth eigenvector to obtain a third evaluation score, and the sample risk type of the sample evaluation data is determined based on the third evaluation score.

[0138] In some embodiments, when determining the sample risk type of the sample assessment data according to the third assessment score, the third acquisition module may be used to:

[0139] When the third evaluation score is within a preset interval, taking the preset risk type corresponding to the third evaluation score as the sample risk type of the sample evaluation data;

[0140] When the third evaluation score is not within the preset interval, a sample risk type set by a user for the sample evaluation data is obtained.

[0141] As can be seen from the above, in the risk assessment device 300 provided in the embodiment of the present application, the first acquisition module 301 acquires the data to be assessed, and extracts the first feature vector from the data to be assessed through a feature extraction algorithm, and then the first scoring module 302 scores the data to be assessed according to the first feature vector and the first risk assessment model to obtain a first assessment score, and the second scoring module 303 scores the data to be assessed according to the first feature vector and the second risk assessment model to obtain a second assessment score, and finally the determination module 304 determines the target risk type of the data to be assessed according to the first assessment score and the second assessment score. The accuracy of risk assessment can be improved by comprehensively determining the target risk type of the data to be assessed in combination with the scoring results of the first risk assessment model and the second risk assessment model.

[0142] It should be noted that the risk assessment device provided in the embodiment of the present application belongs to the same concept as the risk assessment method in the above embodiment. Any method provided in the risk assessment method embodiment can be run on the risk assessment device. The specific implementation process is detailed in the risk assessment method embodiment, which will not be repeated here.

[0143] The present application also provides an electronic device. Figure 8 , a first structural diagram of an electronic device provided in an embodiment of the present application. The electronic device 400 includes a processor 401 and a memory 402. The processor 401 is electrically connected to the memory 402.

[0144] The processor 401 is the control center of the electronic device 400. It uses various interfaces and lines to connect various parts of the entire electronic device, executes various functions of the electronic device 400 and processes data by running or loading computer programs stored in the memory 402 and calling data stored in the memory 402.

[0145] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the computer programs and modules stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area. The program storage area can store an operating system, a computer program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the electronic device, etc.

[0146] In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0147] In the embodiment of the present application, the processor 401 in the electronic device 400 will load instructions corresponding to the processes of one or more computer programs into the memory 402 according to the following steps, and the processor 401 will run the computer program stored in the memory 402, thereby realizing various functions, as follows:

[0148] Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm;

[0149] Scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0150] Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0151] A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

[0152] Please refer to Fig. 9 , Fig. 9 A second structural diagram of an electronic device provided in an embodiment of the present application, and Figure 8 The difference between the electronic device shown is that the electronic device further includes: a radio frequency circuit 403, a display screen 404, a control circuit 405, an input unit 406, an audio circuit 407, a sensor 408, and a power supply 409. The processor 401 is electrically connected to the radio frequency circuit 403, the display screen 404, the control circuit 405, the input unit 406, the audio circuit 407, the sensor 408, and the power supply 409, respectively.

[0153] The radio frequency circuit 403 is used to send and receive radio frequency signals to communicate with network devices or other electronic devices through wireless communication.

[0154] The display screen 404 may be used to display information input by a user or information provided to a user and various graphical user interfaces of the electronic device. These graphical user interfaces may be composed of images, texts, icons, videos and any combination thereof.

[0155] The control circuit 405 is electrically connected to the display screen 404 and is used to control the display screen 404 to display information.

[0156] The input unit 406 can be used to receive input numbers, character information or user feature information (such as fingerprints), and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. The input unit 406 can include a fingerprint recognition module.

[0157] The audio circuit 407 can provide an audio interface between the user and the electronic device through a speaker and a microphone. The audio circuit 407 includes a microphone. The microphone is electrically connected to the processor 401. The microphone is used to receive voice information input by the user.

[0158] The sensor 408 is used to collect external environment information. The sensor 408 may include one or more sensors such as an environment brightness sensor, an acceleration sensor, and a gyroscope.

[0159] The power supply 409 is used to supply power to various components of the electronic device 400. In some embodiments, the power supply 409 may be logically connected to the processor 401 through a power management system, so that the power management system can manage charging, discharging, power consumption, and other functions.

[0160] although Fig. 9 Not shown, the electronic device 400 may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0161] In the embodiment of the present application, the processor 401 in the electronic device 400 will load instructions corresponding to the processes of one or more computer programs into the memory 402 according to the following steps, and the processor 401 will run the computer program stored in the memory 402, thereby realizing various functions, as follows:

[0162] Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by using a feature extraction algorithm;

[0163] Scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score;

[0164] Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score;

[0165] A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

[0166] In some embodiments, when the to-be-assessed data is scored according to the first feature vector and the first risk assessment model to obtain a first assessment score, the processor 401 is configured to execute:

[0167] Encoding the first feature vector by using a coding algorithm to obtain a second feature vector, wherein the first feature vector is a discrete feature and the second feature vector is a continuous feature;

[0168] Based on the second feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score.

[0169] In some embodiments, when extracting the first feature vector from the data to be evaluated by using a feature extraction algorithm, the processor 401 is configured to execute:

[0170] Extracting features from the data to be evaluated by a feature extraction algorithm to obtain a first numerical feature and a text feature;

[0171] Normalizing the first numerical feature and converting the text feature to convert the text feature into a second numerical feature;

[0172] A first feature vector is generated based on the first numerical feature and the second numerical feature.

[0173] In some embodiments, the first risk assessment model is obtained by training a pre-built isolation forest model, and the second risk assessment model is obtained by training a pre-built classification model;

[0174] When the to-be-assessed data is scored according to the first feature vector and the first risk assessment model to obtain a first assessment score, the processor 401 is configured to execute:

[0175] Determining, according to the arrangement order of vector elements in the first feature vector, a weight value corresponding to each vector element in the second risk assessment model, wherein the vector element includes the first numerical feature and the second numerical feature;

[0176] According to the corresponding weight value, the size of each vector element is adjusted to obtain a third eigenvector;

[0177] The data to be evaluated is scored according to the third eigenvector and the first risk assessment model to obtain a first assessment score.

[0178] In some embodiments, when adjusting the size of each vector element according to the size of the corresponding weight value, the processor 401 is configured to execute:

[0179] Increase the values ​​of the preset number of vector elements with the largest corresponding weight values.

[0180] In some embodiments, after determining the target risk type of the to-be-assessed data according to the first assessment score and the second assessment score, the processor 401 is further configured to execute:

[0181] When the risk level of the target risk type is lower than or equal to a preset level, the task to be executed corresponding to the data to be evaluated is executed.

[0182] In some embodiments, the second risk assessment model is a classification model, and the processor 401 is further configured to execute:

[0183] Obtain multiple sample evaluation data;

[0184] extracting a fourth feature vector from the sample evaluation data by the feature extraction algorithm;

[0185] Obtaining a sample risk type for each sample assessment data, and forming a training set according to the fourth eigenvector and the sample risk type;

[0186] The classification model is trained using the training set to update model parameters of the classification model.

[0187] In some embodiments, when obtaining the sample risk type of each sample assessment data, the processor 401 is configured to execute:

[0188] The sample evaluation data is scored using the first risk evaluation model and the corresponding fourth eigenvector to obtain a third evaluation score, and the sample risk type of the sample evaluation data is determined based on the third evaluation score.

[0189] In some embodiments, when determining the sample risk type of the sample assessment data according to the third assessment score, the processor 401 is configured to execute:

[0190] When the third evaluation score is within a preset interval, taking the preset risk type corresponding to the third evaluation score as the sample risk type of the sample evaluation data;

[0191] When the third evaluation score is not within the preset interval, a sample risk type set by a user for the sample evaluation data is obtained.

[0192] As can be seen from the above, the electronic device provided in this embodiment, after obtaining the data to be evaluated, extracts the first feature vector from the data to be evaluated through a feature extraction algorithm, and then scores the data to be evaluated based on the first feature vector and the first risk assessment model to obtain a first assessment score, and scores the data to be evaluated based on the first feature vector and the second risk assessment model to obtain a second assessment score, and finally determines the target risk type of the data to be evaluated based on the first assessment score and the second assessment score. The target risk type of the data to be evaluated can be comprehensively determined by combining the scoring results of the first risk assessment model and the second risk assessment model, which can improve the accuracy of risk assessment.

[0193] An embodiment of the present application also provides a storage medium, which stores a computer program. When the computer program runs on a computer, the computer executes the risk assessment method in any of the above embodiments, such as: obtaining data to be evaluated, and extracting a first feature vector from the data to be evaluated through a feature extraction algorithm; scoring the data to be evaluated based on the first feature vector and a first risk assessment model to obtain a first assessment score; scoring the data to be evaluated based on the first feature vector and the second risk assessment model to obtain a second assessment score; and determining the target risk type of the data to be evaluated based on the first assessment score and the second assessment score.

[0194] In the embodiment of the present application, the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0195] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0196] It should be noted that, for the risk assessment method of the embodiment of the present application, ordinary testers in the field can understand that all or part of the process of implementing the risk assessment method of the embodiment of the present application can be completed by controlling the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, such as a memory of an electronic device, and executed by at least one processor in the electronic device, and the execution process may include the process of the embodiment of the risk assessment method. Among them, the storage medium can be a disk, an optical disk, a read-only memory, a random access memory, etc.

Claims

1. A risk assessment method, wherein: include: Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by a feature extraction algorithm, wherein the feature extraction algorithm is used to extract features from the data to be evaluated to obtain a first numerical feature and a text feature, the first numerical feature is normalized, and the text feature is converted to convert the text feature into a second numerical feature, and a first feature vector is generated based on the first numerical feature and the second numerical feature, wherein the data to be evaluated includes at least one of the download time and download location of the application, the total number of times the account logs into the application store, the time set, and the login location set, the total number of times the account downloads the application, the total number of times the device logs into the application store, the time set, and the login location set, and the total number of times the device downloads the application; According to the first feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score, wherein the weight value corresponding to each vector element in the second risk assessment model is determined according to the arrangement order of the vector elements in the first feature vector, wherein the vector elements include the first numerical feature and the second numerical feature; according to the size of the corresponding weight value, the size of each vector element is adjusted to obtain a third feature vector; according to the third feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score; Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score; A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

2. The method according to claim 1, wherein: Scoring the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first assessment score includes: Encoding the first feature vector by using a coding algorithm to obtain a second feature vector, wherein the first feature vector is a discrete feature and the second feature vector is a continuous feature; Based on the second feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score.

3. The method according to claim 1, wherein: The step of adjusting the size of each vector element according to the size of the corresponding weight value includes: Increase the values ​​of a preset number of vector elements with the largest corresponding weight values.

4. The method according to claim 1, wherein: After determining the target risk type of the data to be evaluated according to the first evaluation score and the second evaluation score, the method further includes: When the risk level of the target risk type is lower than or equal to a preset level, the task to be executed corresponding to the data to be evaluated is executed.

5. The method according to claim 1, wherein: The second risk assessment model is a classification model, and the method further includes: Obtain multiple sample evaluation data; extracting a fourth feature vector from the sample evaluation data by the feature extraction algorithm; Obtaining a sample risk type of each sample assessment data, and forming a training set according to the fourth eigenvector and the sample risk type; The classification model is trained using the training set to update model parameters of the classification model.

6. The method according to claim 5, wherein: The step of obtaining the sample risk type of each sample assessment data includes: The sample evaluation data is scored using the first risk evaluation model and the corresponding fourth eigenvector to obtain a third evaluation score, and a sample risk type of the sample evaluation data is determined based on the third evaluation score.

7. The method according to claim 6, wherein: Determining the sample risk type of the sample assessment data according to the third assessment score includes: When the third evaluation score is within a preset interval, taking the preset risk type corresponding to the third evaluation score as the sample risk type of the sample evaluation data; When the third evaluation score is not within the preset interval, a sample risk type set by a user for the sample evaluation data is obtained.

8. A risk assessment device, wherein: include: A first acquisition module is used to acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by a feature extraction algorithm, wherein the feature extraction algorithm is used to extract features of the data to be evaluated to obtain a first numerical feature and a text feature, the first numerical feature is normalized, and the text feature is converted to convert the text feature into a second numerical feature, and a first feature vector is generated based on the first numerical feature and the second numerical feature, wherein the data to be evaluated includes at least one of a download time and a download location of an application, a total number of times an account logs into an application store, a time set, and a login location set, a total number of times an account downloads applications, a total number of times a device logs into an application store, a time set, and a login location set, and a total number of times a device downloads applications; A first scoring module is used to score the data to be evaluated according to the first feature vector and the first risk assessment model to obtain a first evaluation score, wherein the weight value corresponding to each vector element in the second risk assessment model is determined according to the arrangement order of the vector elements in the first feature vector, wherein the vector elements include the first numerical feature and the second numerical feature; according to the size of the corresponding weight value, the size of each vector element is adjusted to obtain a third feature vector; according to the third feature vector and the first risk assessment model, the data to be evaluated is scored to obtain a first evaluation score; A second scoring module, used for scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score; A determination module is used to determine the target risk type of the data to be evaluated based on the first evaluation score and the second evaluation score.

9. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a risk assessment method is implemented: Acquire data to be evaluated, and extract a first feature vector from the data to be evaluated by a feature extraction algorithm, wherein the feature extraction algorithm is used to extract features from the data to be evaluated to obtain a first numerical feature and a text feature, the first numerical feature is normalized, and the text feature is converted to convert the text feature into a second numerical feature, and a first feature vector is generated based on the first numerical feature and the second numerical feature, wherein the data to be evaluated includes at least one of the download time and download location of the application, the total number of times the account logs into the application store, the time set, and the login location set, the total number of times the account downloads the application, the total number of times the device logs into the application store, the time set, and the login location set, and the total number of times the device downloads the application; According to the first feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score, wherein the weight value corresponding to each vector element in the second risk assessment model is determined according to the arrangement order of the vector elements in the first feature vector, wherein the vector elements include the first numerical feature and the second numerical feature; according to the size of the corresponding weight value, the size of each vector element is adjusted to obtain a third feature vector; according to the third feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score; Scoring the data to be evaluated according to the first feature vector and the second risk assessment model to obtain a second evaluation score; A target risk type of the data to be evaluated is determined according to the first evaluation score and the second evaluation score.

10. The electronic device according to claim 9, wherein: The step of scoring the data to be evaluated according to the first feature vector and the first risk evaluation model to obtain a first evaluation score, wherein the processor is configured to execute: Encoding the first feature vector by using a coding algorithm to obtain a second feature vector, wherein the first feature vector is a discrete feature and the second feature vector is a continuous feature; Based on the second feature vector and the first risk assessment model, the data to be assessed is scored to obtain a first assessment score.

11. The electronic device according to claim 9, wherein: According to the size of the corresponding weight value, the size of each vector element is adjusted, and the processor is used to execute: Increase the values ​​of a preset number of vector elements with the largest corresponding weight values.

12. The electronic device according to claim 9, wherein: After determining the target risk type of the data to be evaluated according to the first evaluation score and the second evaluation score, the processor is further configured to execute: When the risk level of the target risk type is lower than or equal to a preset level, the task to be executed corresponding to the data to be evaluated is executed.

13. The electronic device according to claim 9, wherein: The second risk assessment model is a classification model, and the processor is further configured to execute: Obtain multiple sample evaluation data; extracting a fourth feature vector from the sample evaluation data by the feature extraction algorithm; Obtaining a sample risk type of each sample assessment data, and forming a training set according to the fourth eigenvector and the sample risk type; The classification model is trained using the training set to update model parameters of the classification model.

14. The electronic device according to claim 13, wherein: The sample risk type of each sample assessment data is obtained, and the processor is used to execute: The sample evaluation data is scored using the first risk evaluation model and the corresponding fourth eigenvector to obtain a third evaluation score, and a sample risk type of the sample evaluation data is determined based on the third evaluation score.

15. The electronic device according to claim 14, wherein: The determining, according to the third assessment score, the sample risk type of the sample assessment data, the processor being configured to execute: When the third evaluation score is within a preset interval, taking the preset risk type corresponding to the third evaluation score as the sample risk type of the sample evaluation data; When the third evaluation score is not within the preset interval, a sample risk type set by a user for the sample evaluation data is obtained.

16. A storage medium containing instructions executable by an electronic device, wherein: The electronic device executable instructions are used to execute the risk assessment method as described in any one of claims 1 to 7 when executed by the electronic device processor.

Images