Methods, systems, apparatus, and media for automatically identifying user anomalous behavior

Abstract

A method for automatically identifying user abnormal behavior is disclosed, comprising: obtaining a user behavior sequence; inputting the user behavior sequence into a non-deterministic automatic state machine to retrieve a user behavior sub-sequence matching a behavior pattern expression in the user behavior sequence, the behavior pattern expression being compatible with a regular expression; and taking the retrieved user behavior sub-sequence as a user abnormal behavior candidate. A system, apparatus and medium for automatically identifying user abnormal behavior are also disclosed.

Description

Technical Field

[0001] This application relates to user behavior recognition, and more particularly to methods, systems, apparatus and media for automatically recognizing abnormal user behavior. Background Technology

[0002] When a user operates on a product or service (including but not limited to web products or services), their series of actions constitute the user's behavioral sequence on that product or service.

[0003] In some cases, users exhibit anomalous behaviors within a product or service's sequence of actions. These anomalous behaviors may stem from flaws in product design, among other things. Existing technologies for identifying anomalous behavior may suffer from shortcomings such as poor automation, complexity, lack of flexibility, and scalability.

[0004] Therefore, there is a need for a simple, flexible, and scalable solution for identifying abnormal user behavior. Summary of the Invention

[0005] To overcome the shortcomings of the prior art, one or more embodiments of this specification propose a scheme based on a nondeterministic automatic state machine and utilizing behavioral pattern expressions compatible with regular expressions.

[0006] One or more embodiments of this specification achieve their above-mentioned objectives through the following technical solutions.

[0007] In one aspect, a method for automatically identifying abnormal user behavior is provided, comprising: acquiring a sequence of user behaviors in a product or service, wherein each user behavior in the sequence has a user behavior identifier; inputting the user behavior sequence into a nondeterministic automatic state machine to retrieve a subsequence of user behaviors that matches a behavior pattern expression compatible with a regular expression; and if a subsequence of user behaviors that matches the behavior pattern expression is retrieved, outputting the subsequence of user behaviors as a candidate for abnormal user behavior.

[0008] Preferably, when retrieving a user behavior subsequence that matches the behavior pattern expression in the user behavior sequence, different characters in the behavior pattern expression are instantiated as user behavior identifiers in sequence according to the order in which different user behavior identifiers appear in the user behavior subsequence.

[0009] Preferably, one or more user behaviors have one or more attributes, and the behavior pattern expression has additional configuration, which is associated with the attributes of the user behavior.

[0010] Preferably, the attribute includes one or more of the following: the user identifier that performed the user action, the timestamp of the user action, the associated business category or business identifier of the user action, and the associated page category or page identifier of the user action.

[0011] Preferably, the abnormality degree of the user's abnormal behavior candidate is calculated based on one or more of the following: the request rate, the number of requests, and the concentration of requests associated with the user's abnormal behavior candidate.

[0012] Preferably, after determining that the abnormal behavior candidate is an abnormal behavior, the abnormal behavior is automatically notified to the administrator of the product or service.

[0013] Preferably, the behavioral pattern expression is derived from input by the administrator of the product or service.

[0014] Preferably, the method further includes: providing the administrator of the product or service with an expression customization function to help the administrator customize the behavior pattern expression.

[0015] Preferably, the method includes: providing a verification dataset comprising multiple sequences of user behaviors to verify whether the behavioral pattern expression entered by the administrator yields the expected result.

[0016] On the other hand, a system for automatically identifying abnormal user behavior is provided, comprising: a data acquisition module for acquiring a sequence of user behaviors in a product or service, wherein each user behavior in the sequence has a user behavior identifier; a behavior pattern expression matching module for inputting the user behavior sequence into a nondeterministic automatic state machine to retrieve a subsequence of user behaviors that matches a behavior pattern expression compatible with regular expressions; and a user abnormal behavior candidate generation module for outputting a subsequence of user behaviors as a candidate of user abnormal behavior if a subsequence of user behaviors that matches the behavior pattern expression is retrieved.

[0017] Preferably, when retrieving a user behavior subsequence that matches the behavior pattern expression in the user behavior sequence, different characters in the behavior pattern expression are instantiated as user behavior identifiers in sequence according to the order in which different user behavior identifiers appear in the user behavior subsequence.

[0018] Preferably, one or more user behaviors have one or more attributes, and the behavior pattern expression has additional configuration, which is associated with the attributes of the user behavior.

[0019] Preferably, the system further includes an anomaly calculation module, which can calculate the anomaly degree of the user's abnormal behavior candidate based on one or more of the following: request-for-help rate, number of requests for help, and request-for-help concentration associated with the user's abnormal behavior candidate.

[0020] In another aspect, an apparatus for automatically identifying abnormal user behavior is provided, comprising: a memory; and a processor configured to perform the method described above.

[0021] In another aspect, a computer-readable storage medium is provided that stores instructions which, when executed by a computer, cause the computer to perform the methods described above.

[0022] Compared with the prior art, one or more embodiments of this specification can achieve one or more of the following technical effects:

[0023] It can simultaneously discover multiple different categories of anomalous behavior instances that satisfy anomalous behavior patterns;

[0024] Allows the reuse of administrators' accumulated historical experience to customize the abnormal behavior patterns to be identified;

[0025] By using syntax compatible with regular expressions, it is flexible, efficient, and has a low learning curve.

[0026] It should be understood that the technical effects achieved by one or more embodiments of this specification are not limited to the above-mentioned effects, and one or more embodiments of this specification do not need to achieve all of the above-mentioned technical effects. Attached Figure Description

[0027] The above-described invention and the following detailed embodiments will be better understood when read in conjunction with the accompanying drawings. It should be noted that the drawings are merely examples of the claimed invention. In the drawings, the same reference numerals represent the same or similar elements.

[0028] Figure 1 A schematic flowchart illustrating an example method for automatically identifying abnormal user behavior according to an embodiment of this specification is shown.

[0029] Figure 2A-2B Example schematic diagrams showing the state transition diagrams of two nondeterministic automatic state machines are provided.

[0030] Figure 3 This diagram illustrates the process of determining whether a user behavior subsequence matches a behavior pattern expression according to an embodiment of this specification.

[0031] Figure 4 This diagram illustrates an application process for automatically identifying abnormal user behavior according to embodiments of this specification.

[0032] Figure 5 A schematic block diagram of an example system for automatically identifying abnormal user behavior according to an embodiment of this specification is shown.

[0033] Figure 6 A schematic block diagram of an apparatus for implementing a method according to one or more embodiments of this specification is shown. Detailed Implementation

[0034] The following detailed description is sufficient to enable any person skilled in the art to understand the technical content of one or more embodiments of this specification and to implement them accordingly. Furthermore, based on the specification, claims, and drawings disclosed in this specification, those skilled in the art can easily understand the objectives and advantages associated with one or more embodiments of this specification.

[0035] When a user uses a product or service, a sequence of user actions needs to be performed within the product or service. In the embodiments of this specification, a product or service refers to any product or service that a user can use on a computing device. Categories of products or services may include, but are not limited to, computer programs, mobile applications, applets, web pages, etc. Examples of products or services may include, but are not limited to: shopping apps, multimedia applications, news websites, social media programs, word processing programs, various traditional programs, and various other types of products or services. Any other products or services not listed herein but which may be conceived by those skilled in the art may be used.

[0036] User behavior refers to the actions a user takes within a product or service. Examples of user behavior include, but are not limited to: logging in, browsing, clicking, adding to favorites, adding to cart, purchasing, and making payments.

[0037] A user behavior sequence (or simply "behavior sequence") refers to a series of user actions in chronological order. For example, a user logging into a shopping application or website, opening a product description page, clicking to purchase a product, and executing a payment constitute a user behavior sequence within the shopping application. In the embodiments of this specification, the user behavior sequence may also be referred to as a "behavior sequence," "behavior trajectory," or "user behavior trajectory."

[0038] In real-world applications, abnormal user behavior may occur, typically manifesting as a sequence or subsequence of unusual user actions. For example, if the product design is flawed, users may frequently execute one or more subsequences of user actions. Similarly, if the application's page layout is unreasonable, users may need to access the same page multiple times or require accessing a "detour" page. Other causes of abnormal user behavior may also exist, such as fraudulent activities or malicious purchase attempts. In the embodiments described in this specification, abnormal user behavior can be defined by the product or service administrator as needed through customized behavior pattern expressions.

[0039] In order to identify design flaws in products or services and / or detect fraudulent activities, there is a need to identify abnormal user behavior.

[0040] One conceivable approach to identifying anomalous user behavior is frequent subsequence mining, also known as "frequent sequence mining," "frequent pattern mining," etc. A simple example of frequent subsequence mining is to discover frequently occurring user behavior subsequences. For instance, this can be achieved by calculating the frequency of occurrence of a user behavior subsequence and comparing that frequency with a specified threshold to select user behavior subsequences with a frequency greater than the specified threshold as anomalous user behavior or a candidate for anomalous user behavior.

[0041] For example, suppose a user frequently performs the sequence of actions: "browse the enterprise code homepage -> click on payment rules -> click on fee policy details -> click to return to the enterprise code homepage -> open the enterprise code to scan and pay." If this sequence's frequency exceeds a specified frequency, then this frequent subsequence can be identified using a frequent subsequence mining algorithm. However, using frequent subsequence mining to identify abnormal user behavior is not without its drawbacks.

[0042] First, this scheme can only identify frequently occurring abnormal behaviors, and cannot identify less frequent (frequency less than a specified threshold) behaviors.

[0043] Second, this solution can only identify this specific user behavior, but cannot identify behaviors with similar patterns.

[0044] Third, in this approach, product or service administrators cannot customize the specific patterns of anomalous behavior they wish to detect.

[0045] Another conceivable approach is to use machine learning algorithms to automatically identify frequent subsequences, thereby recognizing anomalous user behavior. However, this approach also has drawbacks.

[0046] First, this solution can only identify specific user behaviors;

[0047] Second, product or service administrators also cannot customize the specific patterns of anomalous behavior they want to discover.

[0048] Third, the algorithm is relatively complex and requires a large amount of data for training and / or testing.

[0049] In the embodiments of this specification, a scheme is proposed to automatically identify abnormal user behavior based on a nondeterministic automatic state machine and using behavior pattern expressions compatible with regular expressions.

[0050] See Figure 1It shows a schematic flowchart of an example method 100 for automatically identifying abnormal user behavior according to an embodiment of this specification.

[0051] like Figure 1 As shown, method 100 may include: in operation 102, obtaining a sequence of user behaviors in a product or service. Each user behavior in the sequence of user behaviors may have a user behavior identifier.

[0052] As mentioned above, a user behavior sequence can refer to a series of user behaviors in chronological order.

[0053] In one example, the user behavior sequence can be received directly from the user device. For instance, the user behavior sequence can be received from the user device in real time.

[0054] In another example, the user behavior sequence can be obtained from any suitable data source. For example, it can be received from a database that stores user behavior history or other data storage. Alternatively, the user behavior sequence can be retrieved from the data storage and processed on a T+1 basis.

[0055] The granularity of user behavior can be set as needed.

[0056] Preferably, a user behavior identifier (e.g., user behavior ID) can be generated for each atomic user behavior. An atomic user behavior is a user behavior that cannot be further subdivided. For example, the user behavior of clicking button B on page A and the user behavior of clicking button C on page A can be considered different user behaviors and assigned different user behavior identifiers. Similarly, the user behavior of clicking the "OK" button on page A and the user behavior of clicking the "OK" button on page B are also considered different user behaviors and assigned different user behavior identifiers.

[0057] In other examples, the same user behavior identifier can be assigned to user behaviors of the same category or for the same purpose. For example, the same user behavior identifier can be assigned to user behaviors that use a first payment method and user behaviors that use a second payment method.

[0058] Various methods can be used to generate user behavior identifiers for each user behavior, such as randomly generated globally unique identifiers, identifiers generated by time, and so on.

[0059] Preferably, a user action may have one or more attributes. Examples of user action attributes may include, but are not limited to, the user performing the user action, the timestamp of the user action, the associated business category or business identifier of the user action, and the associated page category or page identifier of the user action. User action attributes may be used for additional configuration of action pattern expressions, as described below.

[0060] Method 100 may further include, in operation 104, inputting the user behavior sequence into a nondeterministic automaton to retrieve a subsequence of user behavior that matches a behavior pattern expression within the user behavior sequence. Preferably, the behavior pattern expression is compatible with regular expressions. Preferably, the behavior pattern expression may be derived from input by an administrator of the product or service, as will be described in more detail below.

[0061] In computational theory, a nondeterministic automatic state machine (also known as a nondeterministic finite state automaton, nondeterministic finite automaton, or NFA) is a finite state automaton where each pair of states and input symbols can have multiple possible next states. Typically, a nondeterministic automatic state machine consumes a string of input symbols. For each input symbol, the nondeterministic automatic state machine transitions to a new state.

[0062] See Figure 2A-2B This illustrates example diagrams of state transitions for two types of nondeterministic automatic state machines. Figure 2A-2B In this context, a single-layer circle represents the initial or intermediate state, while a double-layer circle represents the accepting state (termination state).

[0063] Figure 2A The diagram illustrates a nondeterministic automaton derived from the regular expression "aabc". For the input character sequence "aabb", starting from state s0, character 'a' is consumed to reach state s1, then the second occurrence of 'a' is consumed to reach state s2, then character 'b' is consumed to reach state s3, and finally character 'c' is consumed to reach state s4. Since s4 is the final accepting state, the input character sequence matches the regular expression. For the input character sequence "abba", starting from state s0, character 'a' is consumed to reach state s1. However, since character 'b' is not on any path from s0 in the nondeterministic automaton, the input character sequence "abba" does not match the corresponding regular expression "aabc".

[0064] In addition to normal characters, regular expressions also contain special characters. For example, "[]" represents a set of characters, such as "[ab]", which means that either "a" or "b" in the set can be selected.

[0065] Therefore, the regular expression "a[bc]" can produce the following result: Figure 2B The diagram shows the state transitions of a nondeterministic automatic state machine.

[0066] In the embodiments of this specification, behavioral pattern expressions are used to represent the user behavior patterns to be identified. User behavior patterns are also referred to as "behavioral patterns" in this specification, which refer to regular, patterned sequences in user behavior trajectories.

[0067] It is important to note that the "behavioral pattern" in this specification is an "abstract sequence of behaviors," which differs from the "frequent subsequences" described above. The behavioral sequence represented by the frequent subsequence is merely a "concrete sequence of behaviors."

[0068] A “behavioral pattern” can actually be viewed as a pattern of patterns, where each specific category of a behavioral pattern (e.g., a frequent subsequence) can be considered a pattern instance. By matching behavioral patterns rather than matching pattern instances of behavioral patterns, embodiments of this specification can provide a higher level of pattern matching compared to frequent subsequence mining.

[0069] In this specification, behavioral pattern expressions are used to represent user behavior patterns. Behavioral pattern expressions can consist of characters and special characters.

[0070] In one example, only the uppercase letters "AZ" can be used as characters in the behavior pattern expression. Due to the "match-time instantiation" technique described below, using only 26 uppercase letters as characters is sufficient, as there are usually no more than 26 different user behavior identifiers involved in the behavior pattern to be matched.

[0071] In another example, uppercase and lowercase letters "a-zA-Z" can be used as characters in the behavior pattern expression. In other examples, alphanumeric characters such as "0-9a-zA-Z" can be used as characters in the behavior pattern expression. Other characters that can be conceived by those skilled in the art can be used.

[0072] Special characters are characters used to implement the syntax of expressions.

[0073] In the embodiments described in this specification, the behavior pattern expressions are compatible with regular expressions, meaning that the syntax of the behavior pattern expressions is a subset of the syntax of regular expressions. In other words, the syntax of the behavior pattern expressions can be found in the syntax of regular expressions. Since regular expressions are a commonly used technology in the software field, using behavior pattern expressions that are compatible with regular expressions can reduce the learning cost for administrators, thereby improving user experience and efficiency.

[0074] Preferably, in the embodiments of this specification, the syntax of the behavior pattern expression is as follows:

[0075] The dot (.) matches any single character.

[0076] ^ Matches the beginning of the input string.

[0077] $ matches the end position of the input string.

[0078] (pattern) Matches the pattern and retrieves the substring that matches it.

[0079] X|Y matches either X or Y.

[0080] [XYZ] Character set. Matches any single character contained within it.

[0081] {n,m} where m and n are both non-negative integers, and n <= m. The minimum number of matches is n and the maximum number of matches is m.

[0082] Therefore, the characters “.”, “^”, “(”, “)”, “|”, “[”, “]”, “{”, “,”, and “}” mentioned above are all special characters in behavior pattern expressions. These special characters can be processed in the same way as regular expressions.

[0083] In other embodiments, other applicable regular expression syntaxes may also be used.

[0084] To make it easier to understand, several examples of behavioral patterns are described below.

[0085] The ABAC pattern: A user first performs operation A, encounters a problem, then performs operation B, resolves the problem, performs operation A again, and finally accesses the success page C. For example, the trajectory "attempting out-of-pocket medical insurance payment -> real-name authentication -> attempting out-of-pocket medical insurance payment -> successful out-of-pocket payment" conforms to the ABAC pattern, therefore this behavioral sequence is an instance of the "ABAC" user behavior pattern. However, it's understandable that multiple instances of the ABAC pattern may exist. For example, "viewing products -> adding to cart -> viewing products -> making payment" also conforms to the ABAC pattern, therefore this behavioral sequence is also an instance of the "ABAC" user behavior pattern. In the frequent subsequences or machine learning solutions described above, these are usually handled separately.

[0086] ABC{3,} repeating pattern: For example, it can represent a user jumping back and forth between three operations, A, B, and C. For example, the trajectory "Enterprise Code Homepage -> Enterprise Management -> Complete Enterprise Information -> Enterprise Code Homepage -> Enterprise Management -> Complete Enterprise Information -> Enterprise Code Homepage -> Enterprise Management -> Complete Enterprise Information" conforms to the ABC{3,} repeating pattern. This trajectory is a specific example of the pattern.

[0087] SABST Detour Pattern: Here, S represents the starting point, T represents the ending point, and AB represents the detour. It indicates that the user took a detour AB from S to T. For example, the trajectory "Enterprise Code Homepage -> Payment Rules Click -> Fee Policy Details -> Enterprise Code Homepage -> Enterprise Code Scan to Pay" conforms to the SABST Detour Pattern. Therefore, this behavioral sequence is also a pattern instance of the "SABST" user behavior pattern. Here, S is "Enterprise Code Homepage", T is "Enterprise Code Scan to Pay", and AB is "Payment Rules Click -> Fee Policy Details", indicating that the user checked the fee policy details before using the enterprise code to pay, and their real intention was to find out which merchants support enterprise codes.

[0088] Other user behavior patterns also exist, such as the repetitive pattern ABABAB and the detour pattern SABCST (where ABC represents a detour).

[0089] There may be many behavioral patterns in a user behavior sequence, some of which are normal and some are abnormal. For example, the ABAC pattern mentioned above is normal, while the ABC{3,} repetition pattern and the SABST detour pattern are abnormal.

[0090] In the embodiments of this specification, product or service administrators continuously accumulate various abnormal behaviors during the management process, summarize abnormal behavior patterns from them, and customize corresponding behavior pattern expressions. In the embodiments of this specification, corresponding tools can be provided to administrators to help them generate behavior pattern expressions, which will be described below.

[0091] Preferably, when retrieving a user behavior subsequence that matches the behavior pattern expression from the user behavior sequence, different characters in the behavior pattern expression are instantiated as user behavior identifiers sequentially according to the order in which different user behavior identifiers appear in the user behavior subsequence. Characters that have already been instantiated will not be instantiated again; that is, only newly appearing characters are instantiated. Special characters used to implement the syntax of the expression will not be instantiated.

[0092] See Figure 3 This diagram illustrates a process 300 for determining whether a user behavior subsequence matches a behavior pattern expression according to an embodiment of this specification. This process 300 may be referred to as the "match-time instantiation" technique.

[0093] During the actual matching process, special characters used to represent the syntax of the expression will be handled according to the original processing method of the non-deterministic automatic state machine. Therefore, the processing of special characters is omitted in procedure 300. The term "character" used below refers to ordinary characters.

[0094] like Figure 3As shown, process 300 may include: in operation 302, determining whether the nondeterministic automatic state machine has reached the accepting state. First, determining whether the nondeterministic automatic state machine has reached the accepting state is for the case where no ordinary characters exist in the behavior pattern expression. If so, in operation 304, determining that the user behavior subsequence matches the behavior pattern expression.

[0095] If not, in operation 306, proceed to the next character of the behavior pattern expression (or the first character if it is the beginning of the behavior pattern expression) and determine whether the character has been instantiated (i.e., whether it is a new character (i.e., not previously appearing in the behavior pattern expression).

[0096] If not, process 300 can proceed to operation 308, instantiating the character as the next user action identifier in the behavior pattern expression (or the first user action identifier if it is the beginning of a user action subsequence), that is, using the next user action identifier as an instance of the character.

[0097] If so, process 300 can proceed to operation 310, which directly calls the user behavior identifier that instantiates the character as an instance of the character.

[0098] Next, in operation 312, it can be determined whether the next user action identifier matches an instance of the character. In other words, it can be determined whether the next user identifier is consistent with an instance of the character. It can be understood that for a character that has just been instantiated (from operation 308), the next user identifier must be consistent with an instance of that character (because the character was obtained by instantiating the next user identifier). For a previously instantiated character (from operation 310), if the next user identifier matches the user action identifier that instantiated the character, then the two match; otherwise, they do not match.

[0099] If there is no match, process 300 can proceed to operation 314 to determine that the user behavior subsequence does not match the behavior pattern expression.

[0100] If a match is found, process 300 can return to operation 302 to determine whether the acceptance state has been reached.

[0101] By selecting user behavior subsequences from the user behavior sequence in various ways conceivable to those skilled in the art (e.g., sequentially increasing by index) and performing the above matching process, it is possible to retrieve user behavior subsequences from the user behavior sequence that match the behavior pattern expression.

[0102] Through the above methods, the nondeterministic automatic state machine in the embodiments of this specification can accept user behavior subsequences as input, instead of only accepting character sequences as input. Using the above-described "match-time instantiation" technique, the embodiments of this specification allow matching of a large number of user behavior sequences to be performed using only a small number of characters (e.g., 26 letters).

[0103] In a preferred embodiment of this specification, additional configurations may be provided for the behavior pattern expression. For example, these additional configurations may be associated with attributes of user behavior. For instance, in such additional configurations, one or more characters of the behavior pattern expression may be configured to include or exclude only one or more user identifiers, one or more business categories or business identifiers, and one or more page categories or page identifiers. For example, in the behavior pattern expression ABA, character A may be specified to include only "Medical Insurance Homepage," while character B may exclude "Medical Insurance Homepage."

[0104] For example, in additional configurations, multiple user behaviors can be specified to use the same user behavior identifier. For instance, a set of user behaviors of a certain type can be specified to use the same user behavior identifier.

[0105] When using additional configurations, these configurations can be taken into account when instantiating user behavior identifiers. For example, assuming that the character A in the behavior pattern expression ABA is specified to include only "Medical Insurance Homepage", then when instantiating user behavior identifiers, only user behavior identifiers related to "Medical Insurance Homepage" can be used as instances of the character "A".

[0106] Additional configuration allows product or service administrators to configure rules for finding user behavior patterns more flexibly.

[0107] Method 100 may further include: in operation 106, if a user behavior subsequence matching the behavior pattern expression is retrieved in the user behavior sequence, the user behavior subsequence may be output as a candidate for abnormal user behavior.

[0108] For example, user anomalous behavior candidates can be output to storage for saving (e.g., saving to an anomalous behavior candidate set), output to other modules (e.g., an anomaly calculation module) for further processing, transmitted to other devices (e.g., transmitted to the user device of the product or service administrator), or output to a display device. User anomalous behavior candidates can be output in any other way.

[0109] If no user behavior subsequence matching the behavior pattern expression is found in the user behavior sequence, it means that there is no abnormal user behavior in the user behavior sequence that matches the pattern expression.

[0110] In practical applications, not all user behavior subsequences that conform to the behavior pattern expression are abnormal user behaviors.

[0111] For example, one example of the SABST detour model, "Enterprise Code Homepage -> Payment Rules Click -> Fee System Details -> Enterprise Code Homepage -> Enterprise Code Scan to Pay," represents abnormal user behavior. This product design flaw causes some users to have to go to the fee system details to view the list of supported merchants before using Enterprise Code payments, resulting in a poor user experience. Conversely, another example of the SABST detour model, "Enterprise Code Homepage -> Credit Limit Application Submission -> Credit Limit Application Successful -> Enterprise Code Homepage -> Enterprise Code Scan to Pay," is normal. This indicates that some users need to apply for a credit limit before using the Enterprise Code, which does not harm the user experience.

[0112] In one example, it can be automatically determined whether a candidate for abnormal user behavior is indeed abnormal user behavior. In another example, it can be automatically determined the anomalousness of a candidate for abnormal user behavior, that is, the probability that the candidate for abnormal user behavior is indeed abnormal user behavior.

[0113] For example, when abnormal user behavior involves design flaws in a product or service, the anomalousness of the candidate user behavior can be calculated based on one or more of the following: help rate, number of help requests, and help concentration associated with the candidate user behavior. Generally, the higher the help rate, number of help requests, and help concentration, the higher the anomalousness.

[0114] When abnormal user behavior involves other factors (such as fraud, malicious purchases, etc.), other parameters can be used to calculate the abnormality degree of the candidate user behavior.

[0115] The anomalousness of the candidate abnormal behavior can be compared with a specified threshold to determine whether the candidate user's abnormal behavior is indeed abnormal. If the help request rate, number of help requests, or concentration of help requests are greater than the specified threshold, it indicates that the user frequently seeks help regarding functions related to the user's behavior subsequence, suggesting a design flaw in that function.

[0116] In a preferred embodiment of this specification, once the candidate abnormal behavior is determined to be abnormal, the abnormal behavior can be automatically notified to the administrator of the product or service. For example, abnormal behaviors can be pushed to the administrator of the product or service periodically. Alternatively, the discovery of abnormal behavior can trigger the transmission of abnormal behavior to the administrator of the product or service.

[0117] As can be seen, the abnormal behavior recognition scheme according to the preferred embodiments of this specification can automatically identify candidate abnormal user behaviors, and even automatically identify abnormal user behaviors, based on behavioral pattern expressions. These behavioral pattern expressions typically originate from input by the product or service administrator. For example, the product or service administrator can customize the behavioral pattern expression based on their historical experience (e.g., a summary of abnormal user behaviors they have encountered in the past). Compared to the frequent subsequence mining methods or machine learning methods described above, the method in the embodiments of this specification offers a high degree of flexibility and customizability.

[0118] To help product or service administrators better develop and test behavioral pattern expressions, this specification also provides customization and validation features for user pattern expressions.

[0119] See Figure 4 It illustrates a schematic diagram of an application process 400 for automatically identifying abnormal user behavior according to an embodiment of this specification.

[0120] like Figure 4 As shown, expression customization features can be provided to product or service administrators (such as...). Figure 4 (As shown in 402), to help the administrator customize the behavior pattern expression.

[0121] For example, tools or interfaces can be provided to allow administrators to input or select one or more abnormal behavior sequences or subsequences for which behavior pattern expressions are to be developed. Tools or interfaces for inputting behavior pattern expressions can also be provided to administrators. Subsequently, users can be shown whether their provided behavior pattern expressions correctly match the input or selected abnormal behavior sequences or subsequences, enabling administrators to input the correct behavior pattern expressions according to their actual needs.

[0122] like Figure 4 As shown, expression validation functionality can be provided to product or service administrators (such as...). Figure 4 (As shown in 404), to verify whether the behavioral pattern expression entered by the user can achieve the expected result.

[0123] For example, a validation dataset (such as...) can be provided. Figure 4 As shown in Figure 406, this validation toolset can include multiple user behavior sequences. The validation dataset can typically be a dataset containing a large number of user behavior sequences (such as...). Figure 4The validation dataset is a subset of (as shown in Figure 408). This validation dataset typically includes more sequences than those in the expression customization feature and may include anomalous behavior sequences or subsequences that do not conform to the behavior pattern. Through the expression validation feature, administrators can verify on a smaller but still sufficiently representative dataset whether their behavior pattern expressions produce the expected results—that is, whether they match the user behavior subsequences they expect to identify and do not match other user behavior subsequences.

[0124] After customization and validation, the behavioral pattern expressions customized by the administrator can be officially put into use. For example, they can be used as a combination of the preceding text. Figure 1 The introduced method uses behavioral pattern expressions to generate candidates for anomalous behaviors (such as...). Figure 4 As shown in 410). This behavior pattern expression can be applied to the entire user behavior dataset (such as...). Figure 4 (As shown in 406) is used to identify all abnormal behavior candidates that match the behavior pattern expression.

[0125] like Figure 4 As shown, after generating anomalous behavior candidates, the anomalousness of the anomalous behavior candidates can be calculated (e.g., Figure 4 (As shown in 412). For example, the abnormality degree of abnormal behavior candidates can be calculated based on the number of requests for help, the request rate, and the concentration of requests for help, as described above.

[0126] After calculating the anomalousness of the candidate anomalous behaviors, the anomalous behavior can be determined. For example... Figure 4 As shown, the abnormal behavior can then be pushed to the product or service administrator (e.g., Figure 4 shown in 414).

[0127] See Figure 5 The diagram shows a schematic block diagram of an example system 500 for automatically identifying abnormal user behavior according to an embodiment of this specification.

[0128] like Figure 5 As shown, system 500 may include a data acquisition module 502, used to acquire a user behavior sequence in a product or service, wherein each user behavior in the user behavior sequence has a user behavior identifier. Specific details of the operation of the data acquisition module 502 can be found in the description of operation 102 above.

[0129] like Figure 5As shown, system 500 may include a behavior pattern expression matching module 504, used to input the user behavior sequence into a nondeterministic automaton to retrieve user behavior subsequences that match a behavior pattern expression, which is compatible with regular expressions. Preferably, when retrieving user behavior subsequences that match a behavior pattern expression from the user behavior sequence, different characters in the behavior pattern expression are instantiated as user behavior identifiers according to the order of appearance of different user behavior identifiers in the user behavior subsequence. Preferably, one or more user behaviors have one or more attributes, and the behavior pattern expression has additional configurations associated with the attributes of the user behaviors. Specific details of the operation of the behavior pattern expression matching module 504 can be found in the description of operation 104 above.

[0130] like Figure 5 As shown, system 500 may include a user abnormal behavior candidate generation module 506, which is used to output a user behavior subsequence as a user abnormal behavior candidate if a user behavior subsequence matching the behavior pattern expression is retrieved. Specific details of the operation of the user abnormal behavior candidate generation module 506 can be found in the description of operation 106 above.

[0131] Optionally, the system 500 may also include an anomaly calculation module. Figure 5 (not shown in the image), which can calculate the abnormality of the user's abnormal behavior candidate based on one or more of the following: the request rate, the number of requests, and the concentration of requests associated with the user's abnormal behavior candidate.

[0132] Optionally, the system 500 may also include an abnormal behavior push module. Figure 5 (not shown in the image), which can be used to automatically notify the administrator of the product or service of the abnormal behavior after determining that the abnormal behavior candidate is an abnormal behavior.

[0133] Optionally, system 500 may also include an expression customization module. Figure 5 (Not shown in the image), which can be used to help the administrator customize the behavior pattern expression.

[0134] Optionally, system 500 may also include an expression validation module. Figure 5 (not shown in the image), which can be used to provide a validation dataset that includes multiple sequences of user behaviors to verify whether the behavioral pattern expression entered by the administrator can produce the expected results.

[0135] For operational details of each of the above modules, please refer to the description of method 100 above.

[0136] Figure 6A schematic block diagram of an apparatus 600 for implementing a method according to one or more embodiments of this specification is shown. The apparatus can be used to implement any of the methods described herein (e.g., method 100). The apparatus can also be implemented as any computing device or resource allocation device described herein. The apparatus may include a processor 610 and a memory 615, the processor being configured to perform any of the methods described above. The memory may include main memory and / or persistent storage for storing, for example, user behavior sequences, behavior pattern expressions, help data, etc. The memory can also be used to store any instructions, variables, intermediate data, etc., that may be used during the execution of the method.

[0137] The device 600 may include a network connectivity element 625, such as a network connectivity device that can connect to other devices via a wired or wireless connection. The wireless connection may be, for example, a WiFi connection, a Bluetooth connection, or a 3G / 4G / 5G network connection. For instance, the network connectivity element can connect to a network to obtain data (such as user behavior sequences, help requests, etc.) and other various types of data. It can also receive user input from other devices or transmit data to other devices for display via the network connectivity element.

[0138] The device may also optionally include other peripheral components 620, such as input devices (e.g., keyboard, mouse) and output devices (e.g., display). For example, the user can input the weights of each target via the input device. Corresponding information, such as candidate abnormal user behavior or abnormal user behavior, can also be output to the user via the output device.

[0139] Each of these modules can communicate directly or indirectly with each other, for example, via one or more buses (e.g., bus 605).

[0140] The device can be a physical computing device or a virtual computing device with computing capabilities. Examples of physical computing devices include, but are not limited to, mainframes, minicomputers, personal computers, etc. Examples of virtual computing devices can include various types of virtual machines (such as VMware virtual machines or VirtualBox virtual machines) or virtual containers (such as Docker virtual containers).

[0141] It should be understood that although the device 600 shown above is a single computing device, it should be understood that the device 600 can actually be a collection of computing devices, such as a computing device cluster, a virtual machine cluster, a computing cloud, a storage cloud, etc.

[0142] Furthermore, this application also discloses a computer-readable storage medium including computer-executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods of the embodiments described herein.

[0143] In addition, this application also discloses an apparatus including a processor and a memory storing computer-executable instructions that, when executed by the processor, cause the processor to perform the methods of the embodiments described herein.

[0144] In addition, this application also discloses a system including means for implementing the methods of the various embodiments described herein.

[0145] It is understood that the methods according to one or more embodiments of this specification can be implemented in software, firmware, or a combination thereof.

[0146] It should be understood that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments. In particular, for the apparatus and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0147] It should be understood that the foregoing description describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0148] It should be understood that the use of a singular form to describe an element or to show only one element in the accompanying drawings does not imply that the number of such elements is limited to one. Furthermore, modules or elements described or shown as separate herein may be combined into a single module or element, and modules or elements described or shown as single herein may be broken down into multiple modules or elements.

[0149] It should also be understood that the terminology and expressions used herein are for descriptive purposes only, and one or more embodiments described herein should not be limited to these terms and expressions. The use of these terms and expressions does not exclude any illustrative and descriptive equivalent features (or parts thereof), and it should be recognized that various modifications that may exist should also be included within the scope of the claims. Other modifications, variations, and substitutions may also exist. Accordingly, the claims should be considered to cover all such equivalents.

[0150] Similarly, it should be noted that although specific embodiments have been described with reference to the present invention, those skilled in the art should recognize that the above embodiments are merely illustrative of one or more embodiments of this specification, and various equivalent changes or substitutions can be made without departing from the spirit of the invention. Therefore, any changes or modifications to the above embodiments within the scope of the essential spirit of the invention will fall within the scope of the claims of this application.

Claims

1. A method for automatically identifying user abnormal behavior, comprising: obtaining a user behavior sequence of a user in a product or service, wherein each user behavior in the user behavior sequence has a user behavior identifier; inputting the user behavior sequence into a non-deterministic automatic state machine to retrieve a user behavior sub-sequence matching a behavior pattern expression in the user behavior sequence, the behavior pattern expression being compatible with a regular expression, and the behavior pattern expression being used to express a user behavior pattern, the user behavior pattern being an abstract behavior sequence, and the behavior pattern expression having an additional configuration, the additional configuration including at least one of: configuring one or more characters in the behavior pattern expression to include or exclude one or more user identifiers, one or more business categories or business identifiers, or one or more page categories or page identifiers; specifying that multiple user behaviors adopt the same user behavior identifier, wherein when retrieving the user behavior sub-sequence matching the behavior pattern expression in the user behavior sequence, different characters in the behavior pattern expression are instantiated into user behavior identifiers in order according to the occurrence order of different user behavior identifiers in the user behavior sub-sequence, so that the behavior pattern expression can match different specific user behavior sub-sequences; and if the user behavior sub-sequence matching the behavior pattern expression is retrieved, outputting the user behavior sub-sequence as a user abnormal behavior candidate. 2.The method of claim 1, further comprising: calculating an abnormality degree of the user abnormal behavior candidate based on one or more of a help-seeking rate, a help-seeking quantity, and a help-seeking concentration associated with the user abnormal behavior candidate. 3.The method of claim 2, further comprising: after determining that the abnormal behavior candidate is an abnormal behavior, automatically notifying an administrator of the product or service of the abnormal behavior. 4.The method of claim 1, wherein the behavior pattern expression is from an input of an administrator of the product or service. 5.The method of claim 4, further comprising: providing an expression customization function to the administrator of the product or service to help the administrator customize the behavior pattern expression. 6.The method of claim 4, further comprising: providing a verification data set including a plurality of user behavior sequences to verify whether the behavior pattern expression input by the administrator can obtain a desired result. 7.A system for automatically identifying user abnormal behavior, comprising: a data obtaining module for obtaining a user behavior sequence of a user in a product or service, wherein each user behavior in the user behavior sequence has a user behavior identifier; a behavior pattern expression matching module configured to input the user behavior sequence into a non-deterministic automaton state machine to search for a user behavior sub-sequence matching a behavior pattern expression in the user behavior sequence, the behavior pattern expression being compatible with a regular expression, and the behavior pattern expression being used to express a user behavior pattern, the user behavior pattern being an abstract behavior sequence, and the behavior pattern expression having an additional configuration, the additional configuration comprising at least one of: configuring one or more characters in the behavior pattern expression to include or exclude only one or more user identities, one or more business categories or business identities, or one or more page categories or page identities; and specifying that a plurality of user behaviors adopt a same user behavior identity, wherein when searching for the user behavior sub-sequence matching the behavior pattern expression in the user behavior sequence, different characters in the behavior pattern expression are instantiated into user behavior identities in a sequence according to an order of occurrence of different user behavior identities in the user behavior sub-sequence, such that the behavior pattern expression is able to match different specific user behavior sub-sequences; and a user abnormal behavior candidate generation module configured to output the user behavior sub-sequence as a user abnormal behavior candidate if the user behavior sub-sequence matching the behavior pattern expression is searched.

8. The system of claim 7, further comprising: an abnormality degree calculation module configured to calculate an abnormality degree of the user abnormal behavior candidate based on one or more of a help rate, a help quantity, and a help concentration associated with the user abnormal behavior candidate.

9. An apparatus for automatically identifying user abnormal behavior, comprising: a memory; and a processor configured to perform the method of any one of claims 1-6.

10. A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1-6. ​ ​

Images