Method and device for constructing target behavior model, computer device and storage medium

Abstract

The application relates to a target behavior model construction method and device, computer equipment and a storage medium. The method comprises the following steps: performing behavior detection on object interaction data generated in an article interaction process to obtain a behavior feature set of a target behavior; determining the frequency of a target behavior feature in the behavior feature set; when the frequency of the target behavior feature in the behavior feature set reaches a preset threshold, searching for a feature combination comprising the target behavior feature and at least one other behavior feature in the behavior feature set; and when the frequency of the feature combination in the behavior feature set reaches the preset threshold, constructing a target behavior model for behavior detection based on the feature combination. The method can improve the efficiency of target behavior model construction.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a target behavior model construction method and device, computer equipment and storage medium. BACKGROUND

[0002] With the continuous development of Internet technology, the flow and transfer of numerical resources through the network are more and more popular with users, so the security and legality of the flow and transfer of numerical resources are widely concerned. In the existing scheme, whether the behavior mode of the flow and transfer of numerical resources of the user matches the pre-constructed abnormal behavior model is determined to detect abnormal users.

[0003] However, the construction process of the existing abnormal behavior model usually relies on manual experience to analyze user data, resulting in low efficiency of the construction of the abnormal behavior model and high labor cost. SUMMARY

[0004] Therefore, it is necessary to provide a target behavior model construction method and device, computer equipment and storage medium capable of improving the construction efficiency of the target behavior model.

[0005] A target behavior model construction method, the method comprising:

[0006] behavior detection on object interaction data generated in an article interaction process to obtain a behavior feature set of a target behavior;

[0007] determining a frequency of occurrence of a target behavior feature in the behavior feature set;

[0008] when the frequency of occurrence of the target behavior feature in the behavior feature set reaches a preset threshold, searching for a feature combination comprising the target behavior feature and at least one other behavior feature in the behavior feature set;

[0009] when the frequency of occurrence of the feature combination in the behavior feature set reaches the preset threshold, constructing a target behavior model for behavior detection based on the feature combination.

[0010] A target behavior model construction device, characterized in that the device comprises:

[0011] a feature set determination module configured to perform behavior detection on object interaction data generated in an article interaction process to obtain a behavior feature set of a target behavior;

[0012] a frequency determination module configured to determine a frequency of occurrence of a target behavior feature in the behavior feature set;

[0013] The feature combination searching module is configured to search, when the frequency of occurrence of the target behavior feature in the behavior feature set reaches a preset threshold, a feature combination including the target behavior feature and at least one other behavior feature in the behavior feature set.

[0014] The model constructing module is configured to construct a target behavior model for behavior detection based on the feature combination when the frequency of occurrence of the feature combination in the behavior feature set reaches the preset threshold.

[0015] In an embodiment, the feature combination searching module is further configured to:

[0016] determine a set of behavior objects having the same target behavior feature;

[0017] search, in the behavior feature set, at least one behavior feature of the set of behavior objects other than the target behavior feature;

[0018] combine the target behavior feature and the at least one behavior feature to obtain a feature combination.

[0019] In an embodiment, the feature combination searching module is further configured to:

[0020] determine the frequency of occurrence of the feature combination in the behavior feature set;

[0021] delete the feature combination corresponding to the frequency that does not reach the preset threshold to obtain the feature combination corresponding to the frequency that reaches the preset threshold;

[0022] construct a target behavior model for behavior detection based on the feature combination corresponding to the frequency that reaches the preset threshold.

[0023] In an embodiment, the apparatus further comprises:

[0024] The node tree constructing module is configured to construct a node tree with each behavior feature in the behavior feature set as a node;

[0025] The feature combination searching module is further configured to:

[0026] search, with the node corresponding to the target behavior feature as a starting point, at least one node in the node tree that has a connection relationship with the starting point;

[0027] combine the behavior feature corresponding to the at least one node and the behavior feature corresponding to the starting point to obtain a feature combination.

[0028] In an embodiment, the frequency determining module is further configured to:

[0029] Obtain the root node or leaf node from the node tree;

[0030] The behavioral features corresponding to the root node or the leaf node are used as target behavioral features, and the frequency of the target behavioral features appearing in the behavioral feature set is determined.

[0031] In one embodiment, the frequency determination module is further configured to:

[0032] Determine the number of times the leaf node appears in the set of behavioral features;

[0033] When the number of times reaches the threshold, the step of taking the behavioral feature corresponding to the root node or the leaf node as the target behavioral feature is executed.

[0034] When the number of occurrences does not reach the threshold, search for the child node of the root node in the node tree, or search for the parent node of the leaf node in the node tree; take the behavioral feature corresponding to the child node or the parent node as the target behavioral feature; determine the frequency of the target behavioral feature in the behavioral feature set.

[0035] In one embodiment, the node tree building module is further configured to:

[0036] A node chain is constructed using the behavioral features corresponding to each behavioral object in the behavioral feature set as nodes;

[0037] Using nodes corresponding to the same behavioral characteristics as connection points, connect the node chains corresponding to each behavioral object to obtain a node tree.

[0038] In one embodiment, the feature set determination module is further configured to:

[0039] Acquire object interaction data generated during item interaction;

[0040] The object interaction data is transformed to obtain object interaction features;

[0041] The interaction features of the objects are subjected to behavior detection, and the behavior objects are determined based on the detection results;

[0042] The object interaction characteristics of each of the aforementioned behavioral objects are used as behavioral characteristics to form a set of behavioral characteristics.

[0043] In one embodiment, the type of the object interaction data includes numerical and categorical types, and the feature set determination module is further configured to:

[0044] Obtain the quantile corresponding to the numerical object interaction data;

[0045] Based on the quantiles, feature transformation is performed on the numerical object interaction data to obtain numerical interaction features;

[0046] The numerical interaction features and the categorical object interaction data are used as object interaction features.

[0047] In one embodiment, the feature combination includes a first feature combination and a second feature combination that includes the first feature combination;

[0048] The frequency determination module is further configured to determine the frequencies of the first feature combination and the second feature combination in the behavioral feature set, respectively;

[0049] The device further includes: a confidence determination module, configured to determine the confidence level of the second feature combination based on the frequency of the first feature combination appearing in the behavioral feature set and the frequency of the second feature combination appearing in the behavioral feature set;

[0050] The model building module is also used for:

[0051] When the confidence level of the second feature combination reaches the confidence level condition, a target behavior model for behavior detection is constructed based on the second feature combination.

[0052] In one embodiment, the feature combination includes numerical behavioral features and categorical behavioral features; the model building module is further configured to:

[0053] The behavioral characteristics of the category type are used as category type judgment parameters;

[0054] The numerical behavioral characteristics are used as numerical judgment parameters;

[0055] Using the categorical judgment parameters and the numerical judgment parameters as behavior detection conditions, a target behavior model for behavior detection is constructed.

[0056] In one embodiment, the behavioral feature set includes a sub-behavioral feature set corresponding to each behavioral object, and the frequency determination module is further configured to:

[0057] Select the target behavioral feature from the set of behavioral features;

[0058] Obtain the total number of sub-behavioral feature sets in the behavioral feature set, and the number of target sub-behavioral feature sets in the sub-behavioral feature set that contain the target behavioral feature;

[0059] Based on the number of the target sub-behavioral feature sets and the total number, the frequency of the target behavioral feature appearing in the behavioral feature sets is determined.

[0060] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0061] Behavior detection is performed on the object interaction data generated during the object interaction process to obtain a set of behavioral features of the target behavior;

[0062] Determine the frequency of the target behavioral characteristic in the set of behavioral characteristics;

[0063] When the frequency of the target behavior feature in the behavior feature set reaches a preset threshold, a feature combination including the target behavior feature and at least one other behavior feature is searched in the behavior feature set.

[0064] When the frequency of the feature combination appearing in the behavioral feature set reaches the preset threshold, a target behavior model for behavior detection is constructed based on the feature combination.

[0065] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0066] Behavior detection is performed on the object interaction data generated during the object interaction process to obtain a set of behavioral features of the target behavior;

[0067] Determine the frequency of the target behavioral characteristic in the set of behavioral characteristics;

[0068] When the frequency of the target behavior feature in the behavior feature set reaches a preset threshold, a feature combination including the target behavior feature and at least one other behavior feature is searched in the behavior feature set.

[0069] When the frequency of the feature combination appearing in the behavioral feature set reaches the preset threshold, a target behavior model for behavior detection is constructed based on the feature combination.

[0070] A computer program includes computer instructions stored in a computer-readable storage medium, a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the following steps:

[0071] Behavior detection is performed on the object interaction data generated during the object interaction process to obtain a set of behavioral features of the target behavior;

[0072] Determine the frequency of the target behavioral characteristic in the set of behavioral characteristics;

[0073] When the frequency of the target behavior feature in the behavior feature set reaches a preset threshold, a feature combination including the target behavior feature and at least one other behavior feature is searched in the behavior feature set.

[0074] When the frequency of the feature combination appearing in the behavioral feature set reaches the preset threshold, a target behavior model for behavior detection is constructed based on the feature combination.

[0075] The aforementioned method, apparatus, computer equipment, and storage medium for constructing the target behavior model, after detecting the behavior of object interaction data generated during the interaction process of items to obtain a set of behavior features of the target behavior, determines the frequency of the target behavior features in the set of behavior features, and when the frequency of the target behavior features in the set of behavior features reaches a preset threshold, searches for feature combinations including the target behavior features and at least one other behavior feature in the set of behavior features. When the frequency of the feature combination in the set of behavior features reaches the preset threshold, the target behavior model for behavior detection can be directly constructed based on the feature combination without the need for manual labor, thus improving the efficiency of constructing the target behavior model. Attached Figure Description

[0076] Figure 1 This is an application environment diagram of a method for constructing a target behavior model in one embodiment;

[0077] Figure 2 This is a flowchart illustrating the method for constructing a target behavior model in one embodiment;

[0078] Figure 3 This is a schematic diagram of a node chain in one embodiment;

[0079] Figure 4 This is a schematic diagram of a node tree in one embodiment;

[0080] Figure 5 This is a schematic diagram illustrating the statistical distribution of object interaction data in one embodiment;

[0081] Figure 6 This is a flowchart illustrating the method for constructing a target behavior model in another embodiment;

[0082] Figure 7 This is a flowchart illustrating the method for constructing a target behavior model in another embodiment;

[0083] Figure 8 This is a structural block diagram of a device for constructing a target behavior model in one embodiment;

[0084] Figure 9 A structural block diagram of a device for constructing a target behavior model in another embodiment;

[0085] Figure 10 This is an internal structural diagram of a computer device in one embodiment;

[0086] Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0087] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0088] The method for constructing the target behavior model provided in this application can be implemented based on cloud technology. Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is a general term encompassing network technology, information technology, integration technology, management platform technology, and application technology applied in cloud computing business models. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to a backend system for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0089] Cloud computing is a computing model that distributes computing tasks across a large pool of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" appear infinitely scalable, readily available, on-demand, and expandable, with payment based on usage.

[0090] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0091] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0092] Cloud storage is a new concept that extends and develops from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that uses cluster applications, grid technology and distributed storage file systems to bring together a large number of storage devices of various types in the network (storage devices are also called storage nodes) to work together through application software or application interfaces to provide data storage and business access functions to the outside world.

[0093] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product and service layer, and an application service layer.

[0094] The underlying blockchain platform can include modules for user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user identities and blockchain addresses (access management). Under authorization, it also monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), and then encrypt the business information using a consensus algorithm (consensus management). The encryption process involves transmitting the encrypted data to the shared ledger (network communication) and storing it in a consistent manner. The smart contract module is responsible for contract registration, issuance, triggering, and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). Based on the contract terms, the module calls keys or other events to trigger execution and complete the contract logic. It also provides functions for contract upgrades and cancellations. The operation and monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization during product launch, such as alarms, network status monitoring, and node device health status monitoring.

[0095] The platform's product service layer provides the basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the specific characteristics of their business needs, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders.

[0096] The method for constructing the target behavior model provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. The method for constructing the target behavior model described above can be applied to terminal 102 or server 104, and can also be applied to... Figure 1 The system shown includes terminal 102 and server 104, and is implemented through interaction between terminal 102 and server 104. Taking the above-mentioned target behavior model construction method executed on terminal 102 as an example, terminal 102 performs behavior detection on the object interaction data generated during the item interaction process to obtain a set of behavior features of the target behavior; determines the frequency of the target behavior features in the set of behavior features; when the frequency of the target behavior features in the set of behavior features reaches a preset threshold, searches for feature combinations including the target behavior features and at least one other behavior feature in the set of behavior features; when the frequency of the feature combination in the set of behavior features reaches a preset threshold, constructs a target behavior model for behavior detection based on the feature combination.

[0097] Among them, terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets and portable wearable devices, and server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0098] In one embodiment, such as Figure 2 As shown, a method for constructing a target behavior model is provided, which can be applied to... Figure 1 Taking a computer device (terminal or server) as an example, the following steps are included:

[0099] S202, perform behavior detection on the object interaction data generated during the object interaction process to obtain a set of behavioral features of the target behavior.

[0100] In this context, the items involved in the item interaction process are those traded online or offline. Object interaction data refers to the data generated when objects interact with items. This data includes the object's own attribute data and transaction data generated during the transaction. The object's attribute data includes its gender, age, province, and device used. Transaction data includes the number of transactions, transaction amount, transaction intervals, and the number of transactions during specific periods within a preset time frame. Object interaction data is categorical and numerical. Specifically, gender, province, and device used are categorical object interaction data, while age and transaction data are numerical object interaction data. The behavioral feature set is a collection of object interaction features for each behavioral object. These features can be obtained by transforming the object interaction data.

[0101] Specifically, after acquiring the object interaction data of each object, the computer device performs behavior detection on each object based on the object interaction data to determine the behavior object, and extracts behavioral features based on the object interaction data of the behavior object to obtain a set of behavioral features of the target behavior. The behavior detection performed on each object can also be called anomaly detection, and abnormal objects are identified through anomaly detection.

[0102] In one embodiment, the computer device acquires object interaction data generated by each object during the interaction process, performs feature conversion on the object interaction data of each object to obtain object interaction features, performs behavior detection on the object interaction features, and determines the behavior object based on the detection results; and combines the object interaction features of each behavior object as behavior features to form a behavior feature set.

[0103] Specifically, the computer device performs feature transformation on the object interaction data of each object to obtain the object interaction features corresponding to each object. Then, based on the object interaction features of each object, behavior detection is performed on each object to determine the behavior object. The object interaction features corresponding to each behavior object are determined as behavior features. For each behavior object, its corresponding behavior features are combined to obtain a sub-behavior feature set. That is, each behavior object corresponds to a sub-behavior feature set, and multiple sub-behavior object feature sets together constitute the behavior object feature set. During feature transformation, only numerical object interaction data can be transformed, while categorical object interaction data remains unchanged.

[0104] As shown in Table 1, the computer device acquires object interaction data from object 1 to object m, and performs feature transformation on each object interaction data to obtain the object interaction features corresponding to each object. The object interaction features of the m objects are shown in Table 2, where "1" indicates the existence of the corresponding object interaction feature and "0" indicates the absence of the corresponding object interaction feature. Then, based on the object interaction features of each object, behavior detection is performed on each object. Four objects out of the m objects are detected as behavior objects, and the object interaction features of these four behavior objects are shown in Table 3. The behavior object features of each behavior object are then combined to obtain a set of sub-behavior features, and the sub-behavior feature sets are then combined to obtain the behavior feature set of the target behavior. For ease of explanation, different behavioral characteristics are represented by corresponding letters: "Male" is denoted as A, "Female" as B, "Age greater than 20" as C, "Guangdong" as D, "Jiangxi" as E, equipment brand A as F, equipment brand B as G, "Number of transactions greater than 10,000" as H, "Transaction amount greater than 1,000 yuan" as I, "Transaction interval less than 100ms" as J, and "Number of transactions greater than 100 in the early morning" as K. Therefore, the behavioral characteristics corresponding to behavioral object 1 are "A, D, G, H, I, J, K", the behavioral characteristics corresponding to behavioral object 2 are "B, D, F, I, K", the behavioral characteristics corresponding to behavioral object 3 are "A, C, E, F, I", and the behavioral characteristics corresponding to behavioral object 4 are... The sub-behavioral feature set 1, derived from the behavioral object features of behavioral object 1, is (A, D, G, H, I, J, K). The sub-behavioral feature set 2, derived from the behavioral object features of behavioral object 2, is (B, D, G, I, K). The sub-behavioral feature set 3, derived from the behavioral object features of behavioral object 3, is (A, C, E, F, I). Similarly, the sub-behavioral feature set 4, derived from the behavioral object features of behavioral object 4, is (A, D, G, I, J, K). The behavioral feature set obtained by combining the sub-behavioral feature sets of these four behavioral objects is (sub-behavioral feature set 1, sub-behavioral feature set 2, sub-behavioral feature set 3, sub-behavioral feature set 4). Table 4 is the algebraic representation of this behavioral feature set.

[0105] Table 1 Object Interaction Data Table

[0106]

[0107] Table 2 Object Interaction Characteristics Table

[0108]

[0109] Table 3. Object Interaction Characteristics of Behavioral Objects

[0110]

[0111] Table 4. Set of behavioral characteristics of the behavioral object

[0112]

[0113] In this embodiment, the computer device performs feature transformation on the object interaction data generated during the interaction process of the object to obtain object interaction features. This allows for the detection of behavioral objects based on the object interaction features, improving the accuracy of behavioral object detection. Furthermore, when determining the behavioral feature set based on the object interaction features of the behavioral objects, it ensures that the behavioral features in the behavioral feature set are accurate.

[0114] In one embodiment, a computer device acquires object interaction data generated by each object during the interaction process, and performs behavior detection on each object based on the object interaction data of each object to determine the behavior object. The device then performs feature transformation on the object interaction data of the behavior object to obtain the object interaction features of the behavior object. For each behavior object, the object interaction features are used as behavior features to obtain a set of sub-behavior features. Finally, the sub-behavior feature sets of each behavior object are combined to obtain the behavior feature set of the target behavior.

[0115] As shown in the table above, the computer device acquires object interaction data from object 1 to object m, and performs behavior detection on the object interaction data of each object. It detects that 4 of the 4 objects are behavior objects, and the object interaction data of these 4 behavior objects is shown in Table 5 below. Then, feature transformation is performed on the object interaction data of each behavior object in Table 5 below to obtain the object interaction features of the behavior objects as shown in Table 3 above. For each behavior object, its object interaction features are used as behavior features to obtain a sub-behavior feature set. The sub-behavior feature sets of each behavior object are combined to obtain the behavior feature set shown in Table 4.

[0116] Table 5. Abnormal Object Interaction Data Table

[0117]

[0118] In one embodiment, a computer device may use a historically constructed target behavior model to perform behavior detection on object interaction data generated during item interaction, thereby obtaining a set of behavior features of objects exhibiting abnormal behavior. Based on this set of behavior features, a new target behavior model for behavior detection can be constructed, so that the new target behavior model can be used to perform behavior detection on object interaction data generated during subsequent item interactions.

[0119] S204, Determine the frequency of the target behavioral feature in the behavioral feature set.

[0120] The target behavioral feature can be any behavioral feature in the behavioral feature set. For example, if the target behavioral feature is behavioral feature “C” in the behavioral feature set corresponding to Table 4, then the frequency of “C” in the behavioral feature set corresponding to Table 4 is determined.

[0121] Specifically, the computer device can extract non-repeating behavioral features from each sub-behavioral feature set in the behavioral feature set to obtain a behavioral feature sequence. Then, each behavioral feature in the behavioral feature sequence is identified as a target behavioral feature, and for each target behavioral feature, its frequency of occurrence in the behavioral feature set is determined.

[0122] For example, for the set of behavioral features corresponding to Table 4, the extracted sequence of behavioral features is “A, B, C...J, K”. Then, each behavioral feature in the sequence can be identified as a target behavioral feature, and for each target behavioral feature, its frequency of occurrence in the set of behavioral features can be determined.

[0123] In one embodiment, S204 specifically includes the following steps: selecting a target behavioral feature from the behavioral feature set; obtaining the total number of sub-behavioral feature sets in the behavioral feature set, and the number of target sub-behavioral feature sets in the sub-behavioral feature set where the target behavioral feature appears; and determining the frequency of the target behavioral feature appearing in the behavioral feature set based on the number and total number.

[0124] The total number of sub-behavioral feature sets is the total number of behavioral objects corresponding to the behavioral feature sets. The target sub-behavioral feature set refers to the sub-behavioral feature set that contains the target features.

[0125] For example, the behavioral feature set corresponding to Table 4 contains 4 sub-behavioral feature sets. When the target behavioral feature is "B", the target sub-behavioral feature set corresponding to the target behavioral feature is the sub-behavioral feature set corresponding to behavioral object 2. Then the frequency of the target behavioral feature "B" in the behavioral feature set is 1 / 4. When the target behavioral feature is "A", the target sub-behavioral feature set corresponding to the target behavioral feature is the sub-behavioral feature set corresponding to behavioral object 1, behavioral object 3 and behavioral object 4 respectively. That is, there are 3 target sub-behavioral feature sets. Then the frequency of the target behavioral feature "A" in the behavioral feature set is 3 / 4.

[0126] In this embodiment, the computer device selects target behavior features from the behavior feature set, obtains the total number of sub-behavior feature sets in the behavior feature set, and the number of target sub-behavior feature sets in the sub-behavior feature set where the target behavior feature appears. Based on the number and total number of target sub-behavior feature sets, the frequency of the target behavior feature appearing in the behavior feature set is determined. Then, based on the target behavior features with a frequency greater than a threshold, other feature combinations that frequently appear in the behavior feature set can be mined to construct a target behavior model for behavior detection, thereby improving the efficiency of constructing the target behavior model.

[0127] S206, when the frequency of the target behavior feature in the behavior feature set reaches a preset threshold, search for a feature combination in the behavior feature set that includes the target behavior feature and at least one other behavior feature.

[0128] It is understandable that when the frequency of a target behavioral feature in the behavioral feature set reaches a preset threshold, it can be determined that the target behavioral feature is a frequently occurring feature in the behavioral object feature set. Thus, other behavioral features that frequently appear simultaneously with the target behavioral feature can be further searched in the behavioral feature set.

[0129] In one embodiment, a computer device searches for a feature combination that includes a target behavioral feature and at least one other behavioral feature in a set of behavioral features, comprising the following steps: determining a set of behavioral objects that have the same target behavioral feature; searching for at least one behavioral feature in the set of behavioral objects that is different from the target behavioral feature; and combining the target behavioral feature and the at least one behavioral feature to obtain a feature combination.

[0130] Among them, the set of behavioral objects is the group of behavioral objects. A set of behavioral objects with the same target behavioral characteristics means that the target behavioral characteristics exist in the sub-behavioral characteristic sets corresponding to each behavioral object in the set of behavioral objects.

[0131] In one embodiment, a computer device can extract non-repeating behavioral features from each sub-behavioral feature set in a behavioral feature set to obtain a behavioral feature sequence. For a target behavioral feature in the behavioral feature sequence whose frequency reaches a preset threshold, the behavioral object corresponding to the target sub-behavioral feature set in the sub-behavioral feature set that contains the target behavioral feature is determined as a behavioral object set. In each target sub-behavioral feature set, at least one behavioral feature different from the target behavioral feature is searched. The target behavioral feature and the searched behavioral feature are then combined to obtain a feature combination.

[0132] In one embodiment, the computer device searches for at least one behavioral feature that is different from the target behavioral feature in the target sub-behavioral feature set, which includes: acquiring each behavioral feature in the target sub-behavioral feature set other than the target behavioral feature, determining the frequency of each behavioral feature in the behavioral feature set, identifying behavioral features with a frequency reaching a preset threshold as candidate behavioral features, and selecting at least one behavioral feature from the candidate behavioral features.

[0133] For example, in the behavioral feature set corresponding to Table 3, the preset threshold is 0.5, the frequency corresponding to the target behavioral feature "B" is 0.25, and the frequency corresponding to the target behavioral feature "A" is 0.75. Then, the behavioral object set containing the target behavioral feature "A" is searched in the behavioral feature set. This behavioral object set includes behavioral object 1, behavioral object 3, and behavioral object 4. Then, at least one other behavioral feature besides the target behavioral feature "A" is searched in the sub-behavioral feature set 1 corresponding to behavioral object 1, the sub-behavioral feature set 3 corresponding to behavioral object 3, and the sub-behavioral feature set 4 corresponding to behavioral object 4. In the sub-behavioral feature set 3, the frequencies of behavioral features “C”, “E” and “A” are all less than the preset threshold of 0.5, while the frequencies of behavioral features “I” and “J” are greater than the preset threshold of 0.5. Therefore, behavioral features “I” and “J” are determined as candidate behavioral features. At least one behavioral feature is selected from the candidate behavioral features “I” and “J”, and the selected behavioral feature is combined with the target behavioral feature “A” to obtain a feature combination, such as feature combination “A, I”, feature combination “A, J”, or feature combination “A, I, J”.

[0134] In this embodiment, the computer device determines a set of behavioral objects with the same target behavioral characteristics, and searches for at least one behavioral characteristic in the set of behavioral objects that is different from the target behavioral characteristics. The target behavioral characteristics and at least one behavioral characteristic are combined to obtain a feature combination. This avoids searching for feature combinations that rarely appear in the set of behavioral characteristics, thereby improving the efficiency of feature combination determination.

[0135] In one embodiment, when the frequency of the target behavior feature appearing in the behavior feature set reaches a preset threshold, a 2-element feature combination that includes the target behavior feature and another behavior feature is searched in the behavior feature set. When the frequency of the 2-element feature combination appearing in the behavior feature set reaches the preset threshold, a 3-element feature combination that includes the 2-element feature combination and another behavior feature is searched in the behavior feature set, and so on, until all feature combinations are found. The feature combination search process can be implemented using the Apriori or FP-growth algorithm.

[0136] S208, When the frequency of feature combination in the behavioral feature set reaches a preset threshold, construct a target behavior model for behavior detection based on the feature combination.

[0137] Specifically, after obtaining each feature combination, the computer device determines the frequency of each feature combination in the set of behavioral features, and constructs a target behavior model for behavior detection based on the feature combinations whose frequency reaches a preset threshold.

[0138] The frequency of each feature combination appearing in the behavioral feature set is also called the support of the feature combination. It represents the probability that each behavioral feature in the feature combination appears in the behavioral feature set at the same time. It can be calculated using the following formula:

[0139] (1)

[0140] in, The support is the feature combination that includes target behavioral feature X and behavioral feature Y. This refers to the number of times a feature combination containing target behavioral feature X and behavioral feature Y appears in the behavioral feature set. This represents the total number of sub-behavioral feature sets within the behavioral feature set.

[0141] In one embodiment, S208 includes the following steps: determining the frequency of feature combinations appearing in the behavioral feature set; deleting feature combinations whose frequency does not reach a preset threshold to obtain feature combinations whose frequency reaches the preset threshold; and constructing a target behavior model for behavior detection based on the feature combinations whose frequency reaches the preset threshold. This ensures that the feature combinations corresponding to the constructed target behavior model are common abnormal behavior patterns of the behavioral object, thereby improving the accuracy of behavior detection when performing behavior detection based on the constructed target behavior model.

[0142] Specifically, after obtaining the feature combination, the computer device acquires the number of sub-behavioral feature sets that contain the feature combination in the sub-behavioral feature set, and determines the frequency of the occurrence of the behavior feature set in the behavior feature set based on the number of sub-behavioral feature sets that contain the feature combination and the total number of sub-behavioral feature sets in the behavior feature set. When the frequency of the feature combination in the behavior feature set reaches a preset threshold, a target behavior model for behavior detection is constructed based on the feature combination.

[0143] For example, if the frequency of the feature combination {A, I, J} is greater than a preset threshold, a target behavior model for behavior detection is constructed based on the feature combination {A, I, J}. That is, the obtained target behavior model contains three behavior features "A, I, J". When using the target behavior model to detect object interaction data in the future, as long as the object interaction data of an object has all three features, the object is determined to be a behavior object.

[0144] In the above embodiments, after the computer device performs behavior detection on the object interaction data generated during the interaction process of the object and obtains a set of behavior features of the target behavior, it determines the frequency of the target behavior features in the set of behavior features. When the frequency of the target behavior features in the set of behavior features reaches a preset threshold, it searches for feature combinations including the target behavior features and at least one other behavior feature in the set of behavior features. When the frequency of the feature combination in the set of behavior features reaches the preset threshold, a target behavior model for behavior detection can be directly constructed based on the feature combination without the need for manual labor, thus improving the efficiency of constructing the target behavior model.

[0145] In one embodiment, the method for constructing the target behavior model further includes a process of constructing a node tree. Specifically, a node tree can be constructed using each behavior feature in the behavior feature set as a node. Then, based on the constructed node tree of the behavior feature set, feature combinations that include the target behavior feature and at least one other behavior feature are searched within the behavior feature set. Each path on the node tree corresponds to a feature combination method.

[0146] In one embodiment, constructing a node tree using each behavioral feature in the behavioral feature set as a node includes: constructing a node chain using the behavioral features corresponding to each behavioral object in the behavioral feature set as nodes; and connecting the node chains corresponding to each behavioral object using nodes corresponding to the same behavioral feature as connection points to obtain a node tree.

[0147] Specifically, after obtaining the set of behavioral features of the target behavior, the computer device counts the number of times each behavioral feature appears in the set of behavioral features, and sorts the behavioral features in each sub-behavioral feature set in descending order of frequency to obtain each sorted sub-behavioral feature set. Then, the behavioral features of each sorted sub-behavioral feature set are used as nodes to construct a node chain. After obtaining each node chain, the nodes corresponding to the same behavioral feature are used as connection points to connect the node chains corresponding to each behavioral object to obtain a node tree.

[0148] For example, for the behavioral feature set corresponding to Table 4, after sorting the behavioral features in each sub-behavioral feature set according to the frequency of their occurrence in the behavioral feature set, the resulting sorted behavioral feature set corresponds to Table 6. In some embodiments, an empty set can be used as the root node to construct a node tree, that is, the root node does not correspond to any behavioral feature. It can be understood that since behavioral feature I appears in every sub-behavioral feature set in Table 6, a node tree can be constructed with behavioral feature I as the root node. The sorted sub-behavioral feature set for behavioral object 1 can be constructed as follows: Figure 3 The node chain shown is a node in the node tree, and then the behavioral features in the sorted sub-behavioral feature set of behavioral object 2 are added sequentially to it. Figure 3 In the node tree, when adding behavior features, for those already existing in the tree, the occurrence count of the behavior feature is directly increased at the corresponding node. For those not yet existing, a branch of the node chain is added to the tree. After adding the behavior features to the sorted sub-behavior feature set of behavior object 2, the same method is used to add the behavior features to the sorted sub-behavior feature sets of behavior objects 3 and 4 respectively. The node chains corresponding to each behavior object are connected using nodes with the same behavior feature as connection points, resulting in... Figure 4 The node tree shown is an example of a node tree where solid lines connect nodes with shared behavioral characteristics, and dashed lines connect nodes with the same behavioral characteristics.

[0149] Table 6. Set of behavioral characteristics of the behavioral object

[0150]

[0151] In the above embodiments, the computer device constructs a node tree using each behavioral feature in the behavioral feature set as a node, thereby quickly finding feature combinations whose frequency reaches the preset threshold based on the constructed node tree, and then constructing a target behavior model for behavior detection based on the feature combinations, thus improving the efficiency of constructing the target behavior model.

[0152] In one embodiment, the computer device can search for a feature combination that includes a target behavioral feature and at least one other behavioral feature within a node tree of a constructed behavioral feature set. Specifically, this process includes the following steps: starting from the node corresponding to the target behavioral feature, searching for at least one node in the node tree that is connected to the starting point; and combining the behavioral feature corresponding to the at least one node with the behavioral feature corresponding to the starting point to obtain a feature combination. The connection to the starting node can be a direct connection or an indirect connection belonging to the same node chain.

[0153] For example,Figure 4 In the node tree shown, if the target behavior feature is H, then H can be used as the starting node to search for at least one node in the node tree that is connected to H. When the number of nodes searched is 1, feature combinations {H, J}, {H, K}, {H, G}, etc. can be obtained. When the number of nodes searched is 2, feature combinations {H, J, K}, {H, J, G}, etc. If the target abnormal node is I, then I can be used as the starting node to search for at least one node in the node tree that is connected to I. When the number of nodes searched is 1, feature combinations {I, A}, {I, D}, {I, G}, {I, E}, etc. When the number of nodes searched is 2, feature combinations {I, A, D}, {I, A, C}, {I, D, G}, {I, A, E}, etc. can be obtained.

[0154] In the above embodiments, the computer device uses the node corresponding to the target behavior feature as the starting point, searches for at least one node in the node tree that has a connection relationship with the starting point, combines the behavior feature corresponding to at least one node with the behavior feature corresponding to the starting point to obtain a feature combination, and can then quickly determine the feature combination whose frequency reaches the preset threshold, and construct a target behavior model for behavior detection based on the feature combination, thereby improving the efficiency of constructing the target behavior model.

[0155] In one embodiment, a computer device can determine the frequency of a target behavioral feature in a set of behavioral features based on a constructed node tree, specifically including the following steps: obtaining a root node or a leaf node in the node tree; taking the behavioral feature corresponding to the root node or leaf node as the target behavioral feature, and determining the frequency of the target behavioral feature in the set of behavioral features.

[0156] Specifically, after determining the target behavior feature, the computer device identifies the target node corresponding to the target behavior feature in the node tree, accumulates the number of occurrences of the target node to obtain the number of times the target behavior feature appears in the behavior feature set, and calculates the frequency of occurrence of the target behavior feature based on the total number of the sub-behavioral feature sets corresponding to the behavior feature set.

[0157] In one embodiment, when the behavioral feature corresponding to the root node is taken as the target behavioral feature, the root node is directly determined as the target node, the number of occurrences corresponding to the root node is determined as the number of occurrences of the target behavioral feature in the behavioral feature set, and the ratio of the number of occurrences corresponding to the root node to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set is determined as the frequency of occurrence of the target behavioral feature in the behavioral feature set.

[0158] In one embodiment, when the behavioral feature corresponding to the leaf node is taken as the target behavioral feature, all nodes corresponding to the target behavioral feature are determined as target nodes, and the number of times the target behavioral feature appears in the behavioral feature set is obtained based on the number of times the target node appears. The ratio of the number of times the target behavioral feature appears in the behavioral feature set to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set is determined as the frequency of the target behavioral feature in the behavioral feature set.

[0159] For example, Figure 4 In the corresponding node tree, when the behavioral feature H corresponding to the leaf node "H:1" is the target behavioral feature, then the node "H:1" corresponding to the target behavioral feature H is determined as the target node. The number of times the target behavioral feature H appears in the behavioral feature set is 1. The behavioral feature set contains 4 sub-behavioral feature sets. The ratio of the number of times the target behavioral feature appears in the behavioral feature set to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set is 0.25, which is determined as the frequency of the target behavioral feature H appearing in the behavioral feature set.

[0160] In one embodiment, the computer device can also directly search for nodes other than the root node and leaf nodes in the node tree, determine the behavioral features corresponding to the searched nodes as target behavioral features, determine all nodes corresponding to the target behavioral features as target nodes, obtain the number of times the target behavioral feature appears in the behavioral feature set based on the number of times the target node appears, and determine the frequency of the target behavioral feature in the behavioral feature set as the ratio of the number of times the target behavioral feature appears in the behavioral feature set to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set.

[0161] For example, Figure 4 In the corresponding node tree, the behavioral feature corresponding to the child node "D:2" is determined as the target behavioral feature. Then, the nodes "D:2" and "D:1" corresponding to the target behavioral feature D are both determined as target nodes. The values ​​corresponding to the target nodes are added together, and the number of times the target behavioral feature D appears in the behavioral feature set is 3. The behavioral feature set contains 4 sub-behavioral feature sets. The ratio of the number of times the target behavioral feature appears in the behavioral feature set to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set, 0.75, is determined as the frequency of the target behavioral feature D in the behavioral feature set.

[0162] In the above embodiments, the computer device obtains the root node or leaf node in the node tree; takes the behavioral features corresponding to the root node or leaf node as the target behavioral features, determines the frequency of the target behavioral features in the behavioral feature set, and then finds the feature combination that meets the preset threshold based on the target behavioral features that meet the preset threshold, thereby improving the search efficiency of feature combination.

[0163] In one embodiment, the computer device may further determine the number of times a leaf node appears in the set of behavioral features; when the number of occurrences reaches a threshold, the step of using the behavioral feature corresponding to the root node or leaf node as the target behavioral feature is executed; when the number of occurrences does not reach the threshold, the child node of the root node is searched in the node tree, or the parent node of the leaf node is searched in the node tree; the behavioral feature corresponding to the child node or parent node is used as the target behavioral feature; and the frequency of the target behavioral feature appearing in the set of behavioral features is determined.

[0164] Among them, the number of times a leaf node appears in the set of behavioral features is the numerical value of the leaf node in the node tree. The numerical value corresponding to the leaf node represents the number of times the combination of behavioral features corresponding to the path where the leaf node is located appears in the set of behavioral features.

[0165] for example, Figure 4 In the tree, the value corresponding to the leaf node "H:1" is 1, which means that the leaf node "H:1" appears 1 time in the behavioral feature set. Therefore, when the frequency threshold is set to 2, the leaf node "H:1" cannot reach the frequency threshold. So, the parent node of the leaf node "H:1", i.e., node "J:2", is searched in the node tree, and the behavioral feature J corresponding to node "J:2" is determined as the target behavioral feature. The target node corresponding to the target behavioral feature J is determined to be "J:2". The frequency of the target behavioral feature J appearing in the behavioral feature set is 2 times. The behavioral feature set contains 4 sub-behavioral feature sets. The ratio of the frequency of the target behavioral feature in the behavioral feature set to the total number of the sub-behavioral feature sets corresponding to the behavioral feature set is 0.5, which is determined as the frequency of the target behavioral feature J in the behavioral feature set.

[0166] In the above embodiments, the computer device searches for the child nodes of the root node in the node tree, or searches for the parent nodes of the leaf nodes in the node tree; the behavioral features corresponding to the child nodes or parent nodes are used as target behavioral features, the frequency of the target behavioral features appearing in the behavioral feature set is determined, and then feature combinations that meet the preset threshold can be found based on the target behavioral features that meet the preset threshold, thereby improving the search efficiency of feature combinations.

[0167] In one embodiment, the computer device may also determine the frequency of each feature combination in the behavioral feature set based on the node tree, specifically including the following steps: determining the number of times the feature combination corresponding to the node appears in the behavioral feature set, and determining the frequency of the feature combination corresponding to the leaf node in the behavioral feature set based on the number of times and the total amount of the sub-behavioral feature set.

[0168] Specifically, the computer device uses a node as the starting point of the path, searches the node tree for other nodes that have a connection relationship with the starting point of the path and are the parent nodes of that node, until the root node is found. Then, it combines the behavioral features corresponding to the starting point of the path and each of the found nodes to obtain a feature combination. This feature combination is the feature combination corresponding to the starting point of the path. The value of the starting point of the path in the node tree is the number of times the feature combination appears in the set of behavioral features.

[0169] For example, Figure 4 The feature combination corresponding to the path HJKGDAI of the leaf node "H:1" is {H, J, K, G, D, A, I}. The value of the leaf node "H:1" is 1, so the feature combination {H, J, K, G, D, A, I} appears 1 time in the behavioral feature set. The total number of sub-behavioral feature sets in the behavioral feature set is 4, so the frequency of the feature combination {H, J, K, G, D, A, I} in the behavioral feature set is 0.25. The feature combination corresponding to the path JKGDAI of the node "J:2" is {J, K, G, D, A, I}. The value of the node "J:2" is 2, so the feature combination {J, K, G, D, A, I} appears 2 times in the behavioral feature set. The total number of sub-behavioral feature sets in the behavioral feature set is 4, so the frequency of the feature combination {J, K, G, D, A, I} in the behavioral feature set is 0.5.

[0170] In one embodiment, the types of object interaction data include numerical and categorical types. The process by which the computer device performs feature conversion on the object interaction data to obtain object interaction features includes the following steps: obtaining the quantiles corresponding to the numerical object interaction data; performing feature conversion on the numerical object interaction data based on the quantiles to obtain numerical interaction features; and using the numerical interaction features and the categorical object interaction data as object interaction features.

[0171] Quantiles are statistically analyzed from numerical object interaction data. Based on the statistical distribution of the object interaction data, the data is divided into several equal parts, and the values ​​corresponding to the division points are called quantiles.

[0172] Figure 5The diagram illustrates the statistical distribution of numerical object interaction data in one embodiment. This data is divided into four equal parts: Q1 is the first quartile, Q2 is the second quartile, and Q3 is the third quartile. The first quartile, also known as the "smaller quartile," is the 25th percentile value of the object interaction data arranged in ascending order. The second quartile, also known as the "median," is the 50th percentile value of the object interaction data arranged in ascending order. The third quartile, also known as the "larger quartile," is the 75th percentile value of the object interaction data arranged in ascending order. The difference between the third quartile and the first quartile is called the interquartile range (IQR).

[0173] Specifically, after acquiring the quantiles corresponding to the numerical object interaction data, the computer device selects a target quantile from among the quantiles and performs feature transformation on the numerical object interaction data based on the target quantile to obtain numerical interaction features. For example, if the third and fourth quantiles corresponding to the transaction ratio are 10,000, and the third and fourth quantiles corresponding to the transaction ratio are determined as the target quantile, then the number of transactions greater than the target quantile is considered abnormal. Therefore, when performing feature transformation on the number of transactions, the number of transactions "12300" can be converted into the numerical interaction feature "number of transactions greater than 10,000", and the number of transactions "800" can be converted into the absence of the numerical interaction feature "number of transactions greater than 10,000".

[0174] In the above embodiments, the computer device obtains the quantiles corresponding to the numerical object interaction data; performs feature transformation on the numerical object interaction data based on the quantiles to obtain numerical interaction features; and uses the numerical interaction features and the categorical object interaction data as object interaction features, thereby enabling direct detection of behavioral objects based on the object interaction features, which improves the efficiency of behavior detection.

[0175] In one embodiment, the obtained feature combination includes a first feature combination and a second feature combination, and the second feature combination contains all the behavioral features in the first feature combination and at least one other behavioral feature. The method for constructing the target behavior model further includes: determining the frequency of the first feature combination and the second feature combination in the behavioral feature set; determining the confidence level of the second feature combination based on the frequency of the first feature combination in the behavioral feature set and the frequency of the second feature combination in the behavioral feature set; and constructing a target behavior model for behavior detection based on the second feature combination when the confidence level of the second feature combination reaches the confidence level condition.

[0176] Specifically, when the frequencies of both the first feature combination and the second feature combination appearing in the behavioral feature set are greater than a preset frequency threshold, the confidence level of the second feature combination is determined based on the frequencies of the first and second feature combinations appearing in the behavioral feature set. The frequency of a feature combination appearing in the behavioral feature set is also called the support of the feature combination. Therefore, the confidence level can be calculated using the following formula:

[0177] (2)

[0178] in, The confidence level is the combination of the second feature, which includes the target behavioral feature X, behavioral feature Y, and behavioral feature Z. The support of the second feature combination, which includes target behavioral feature X, behavioral feature Y, and behavioral feature Z, is given. The support is the first feature combination containing target behavioral feature X and behavioral feature Y.

[0179] For example, in the behavioral feature set corresponding to Table 6, the frequency threshold is 0.5, the confidence threshold is 0.6, the frequency of the first feature combination {I, A} is 0.75, and the frequency of the second feature combination {I, A, D} is 0.5. Both frequencies are greater than the frequency threshold of 0.5. Therefore, the confidence of the second feature combination {I, A, D} is calculated to be 0.67, which meets the confidence condition. Thus, a target behavior model for behavior detection is constructed based on the second feature combination {I, A, D}.

[0180] In the above embodiments, the computer device determines the confidence level of the feature combination, and when the confidence level of the feature combination reaches the confidence level condition, constructs a target behavior model for behavior detection based on the feature combination, thereby ensuring that the constructed target behavior model can perform behavior detection more accurately and improving the reliability of the constructed target behavior model.

[0181] In one embodiment, after obtaining feature combinations with frequencies greater than a preset threshold, the computer device can further calculate the lift between the target behavioral feature and at least one other behavioral feature to determine whether the occurrence of the target feature increases the probability of the occurrence of the other at least one behavioral feature. The lift can be calculated using the following formula:

[0182] (3)

[0183] in, Let Z be the degree to which the first feature combination of target behavioral features X and behavioral features Y improves behavioral feature Z. The confidence level is the combination of features that includes target behavioral feature X, behavioral feature Y, and behavioral feature Z. This represents the support of a feature combination containing target behavioral feature X, behavioral feature Y, and behavioral feature Z. When A value greater than 1 indicates an improvement; when... A value of 1 indicates no promotion. A value less than 1 indicates a decrease.

[0184] In one embodiment, the feature combination includes numerical behavioral features and categorical behavioral features. The process by which the computer device constructs a target behavior model for behavior detection based on the feature combination includes: using categorical behavioral features as categorical judgment parameters; using numerical behavioral features as numerical judgment parameters; and using the categorical judgment parameters and numerical judgment parameters as behavior detection conditions to construct a target behavior model for behavior detection.

[0185] Specifically, the computer device extracts each behavioral feature from feature combinations that appear at a preset threshold frequency in the behavioral feature set, and classifies the extracted behavioral features. For categorical behavioral features, the categorical behavioral features are used as categorical judgment parameters; for numerical behavioral features, the numerical behavioral features are used as numerical judgment parameters. Using the categorical judgment parameters and numerical judgment parameters as behavioral detection conditions, a target behavioral model for behavioral detection is constructed. The constructed target behavioral model can be used to directly detect behavior on object interaction data without the need for feature transformation of the object interaction data.

[0186] For example, if the frequency of the feature combination {male, Guangdong, age greater than 20, number of transactions greater than 10,000} in the behavioral feature set reaches a preset threshold, then the behavioral feature "male" in the feature combination is used as the gender parameter, the province "Guangdong" is used as the region parameter, "greater than 20" is used as the age parameter, and "greater than 10,000 transactions" is used as the number of transactions parameter. Thus, using the determined gender parameter, region parameter, age parameter, and number of transactions parameter as behavioral detection conditions, a target behavioral model for behavioral detection is constructed.

[0187] In the above embodiments, the computer device constructs a target behavior model for behavior detection by using categorical behavior features that meet a preset threshold as categorical judgment parameters and numerical behavior features as numerical judgment parameters, and using the categorical judgment parameters and numerical judgment parameters as behavior detection conditions. This allows the constructed target behavior model to be used directly for behavior detection on object interaction data without the need for feature transformation of the object interaction data, thereby improving the applicability of the constructed target behavior model.

[0188] In one embodiment, such as Figure 6 As shown, a method for constructing a target behavior model is provided, which can be applied to...Figure 1 Taking a computer device (terminal or server) as an example, the following steps are included:

[0189] S602, Obtain object interaction data generated during the item interaction process.

[0190] S604, obtain the quantile corresponding to the numerical object interaction data.

[0191] S606, based on quantiles, performs feature transformation on numerical object interaction data to obtain numerical interaction features.

[0192] S608 uses numerical interaction features and categorical object interaction data as object interaction features.

[0193] S610 performs behavior detection on the interaction features of objects and determines the behavior object based on the detection results.

[0194] S612, using the object interaction characteristics of each behavioral object as behavioral characteristics, and combining them into a behavioral characteristic set.

[0195] S614, Select the target behavioral feature from the set of behavioral features.

[0196] S616, obtain the total number of sub-behavioral feature sets in the behavioral feature set, and the number of target sub-behavioral feature sets in the sub-behavioral feature set that contain the target behavioral feature.

[0197] S618, Based on the number and total amount of the target sub-behavioral feature set, determine the frequency of the target behavioral feature appearing in the behavioral feature set.

[0198] S620, when the frequency of the target behavioral feature in the behavioral feature set reaches a preset threshold, determine the set of behavioral objects with the same target behavioral feature.

[0199] S622, In the set of behavioral features, find at least one behavioral feature in the set of behavioral objects that is different from the target behavioral feature.

[0200] S624, combine the target behavioral feature with at least one behavioral feature to obtain a feature combination.

[0201] S626, when the frequency of the feature combination appearing in the behavioral feature set reaches a preset threshold, determine the frequency of the feature combination appearing in the behavioral feature set.

[0202] S628, delete the feature combinations whose frequencies do not reach the preset threshold, and obtain the feature combinations whose frequencies reach the preset threshold.

[0203] S630, determine the feature combination corresponding to the frequency reaching a preset threshold, the feature combination includes a first feature combination and a second feature combination containing the first feature combination.

[0204] S632, Based on the frequency of the first feature combination appearing in the behavioral feature set and the frequency of the second feature combination appearing in the behavioral feature set, determine the confidence level of the second feature combination.

[0205] S634, When the confidence level of the second feature combination reaches the confidence level condition, construct a target behavior model for behavior detection based on the second feature combination.

[0206] This application also provides an application scenario in which the above-described method for constructing the target behavior model is applied. Specifically, the application of the method for constructing the target behavior model in this application scenario is as follows:

[0207] like Figure 7 As shown, the computer device performs behavior detection on the object interaction data generated during the interaction process of objects, determines the behavior object, and obtains the behavior feature set of the target behavior based on the object interaction characteristics of the behavior object. Then, the Apriori algorithm is used to mine frequent items from the feature set, where frequent items are feature combinations with a frequency that reaches a preset threshold. Finally, a target behavior model for behavior detection is constructed based on the feature combinations that reach the preset threshold.

[0208] This application also provides another application scenario, which applies the above-described method for constructing the target behavior model. Specifically, the application of the method for constructing the target behavior model in this scenario is as follows:

[0209] Computer devices perform anomaly detection on user interaction data generated during the interaction process of objects. After obtaining an anomaly feature set, the FP-growth algorithm is used to construct the FP-Tree corresponding to the anomaly feature set. That is, the anomaly feature set is mapped onto the FP-Tree. Then, frequent items are directly found according to the FP-Tree. Frequent items are feature combinations whose frequency reaches a preset threshold. Then, an anomaly behavior model for anomaly behavior detection is constructed based on the feature combinations that reach the preset threshold.

[0210] This application also provides another application scenario, which applies the above-described method for constructing the target behavior model. Specifically, the application of the method for constructing the target behavior model in this scenario is as follows:

[0211] Computer equipment performs anomaly detection on user interaction data generated during the interaction process of objects, obtains anomaly feature sets, constructs anomaly feature vectors based on the anomaly features corresponding to each sub-anomaly feature set, and inputs the constructed anomaly feature vectors into a pre-trained frequent item mining model, thereby outputting frequent items through the frequent item mining model. Frequent items are feature combinations whose frequency reaches a preset threshold. Then, based on the feature combinations that reach the preset threshold, an anomaly behavior model for anomaly behavior detection is constructed. The frequent item mining model is a neural network model based on deep learning.

[0212] It should be understood that, although Figure 2 and Figure 6 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 and Figure 6 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0213] In one embodiment, such as Figure 8 As shown, a device for constructing a target behavior model is provided. This device can be a software module, a hardware module, or a combination of both integrated into a computer device. Specifically, the device includes: a feature set determination module 802, a frequency determination module 804, a feature combination lookup module 806, and a model construction module 808, wherein:

[0214] The feature set determination module 802 is used to perform behavior detection on the object interaction data generated during the item interaction process to obtain the behavior feature set of the target behavior.

[0215] The frequency determination module 804 is used to determine the frequency of the target behavioral feature in the behavioral feature set.

[0216] The feature combination search module 806 is used to search for feature combinations including the target behavioral feature and at least one other behavioral feature in the behavioral feature set when the frequency of the target behavioral feature in the behavioral feature set reaches a preset threshold.

[0217] The model building module 808 is used to build a target behavior model for behavior detection based on the feature combination when the frequency of the feature combination in the behavior feature set reaches a preset threshold.

[0218] In the above embodiments, after the computer device performs behavior detection on the object interaction data generated during the interaction process of the object and obtains a set of behavior features of the target behavior, it determines the frequency of the target behavior features in the set of behavior features. When the frequency of the target behavior features in the set of behavior features reaches a preset threshold, it searches for feature combinations including the target behavior features and at least one other behavior feature in the set of behavior features. When the frequency of the feature combination in the set of behavior features reaches the preset threshold, a target behavior model for behavior detection can be directly constructed based on the feature combination without the need for manual labor, thus improving the efficiency of constructing the target behavior model.

[0219] In one embodiment, the feature combination lookup module 806 is further configured to: determine a set of behavioral objects that have the same target behavioral feature; in the set of behavioral features, find at least one behavioral feature of the set of behavioral objects that is different from the target behavioral feature; and combine the target behavioral feature and at least one behavioral feature to obtain a feature combination.

[0220] In this embodiment, the computer device determines a set of behavioral objects with the same target behavioral characteristics, and searches for at least one behavioral characteristic in the set of behavioral objects that is different from the target behavioral characteristics. The target behavioral characteristics and at least one behavioral characteristic are combined to obtain a feature combination. This avoids searching for feature combinations that rarely appear in the set of behavioral characteristics, thereby improving the efficiency of feature combination determination.

[0221] In one embodiment, the feature combination lookup module 806 is further configured to: determine the frequency of feature combinations appearing in the behavioral feature set; delete feature combinations whose frequency does not reach a preset threshold to obtain feature combinations whose frequency reaches the preset threshold; and construct a target behavior model for behavior detection based on the feature combinations whose frequency reaches the preset threshold.

[0222] In the above embodiments, the computer device determines the frequency of feature combinations appearing in the behavioral feature set; deletes feature combinations whose frequency does not reach a preset threshold, and obtains feature combinations whose frequency reaches the preset threshold; based on the feature combinations whose frequency reaches the preset threshold, a target behavior model for behavior detection is constructed, thereby ensuring that the feature combinations corresponding to the constructed target behavior model are common abnormal behavior patterns of the behavior object, and thus improving the accuracy of behavior detection when performing behavior detection based on the constructed target behavior model.

[0223] In one embodiment, such as Figure 9As shown, the device also includes: a node tree construction module 810, wherein: the node tree construction module 810 is used to construct a node tree with each behavioral feature in the behavioral feature set as a node; the feature combination search module 806 is further used to: take the node corresponding to the target behavioral feature as the starting point, search for at least one node in the node tree that has a connection relationship with the starting point; and combine the behavioral feature corresponding to at least one node and the behavioral feature corresponding to the starting point to obtain a feature combination.

[0224] In the above embodiments, the computer device uses the node corresponding to the target behavior feature as the starting point, searches for at least one node in the node tree that has a connection relationship with the starting point, combines the behavior feature corresponding to at least one node with the behavior feature corresponding to the starting point to obtain a feature combination, and can then quickly determine the feature combination whose frequency reaches the preset threshold, and construct a target behavior model for behavior detection based on the feature combination, thereby improving the efficiency of constructing the target behavior model.

[0225] In one embodiment, the frequency determination module 804 is further configured to: obtain the root node or leaf node in the node tree; take the behavioral feature corresponding to the root node or leaf node as the target behavioral feature, and determine the frequency of the target behavioral feature in the behavioral feature set.

[0226] In the above embodiments, the computer device obtains the root node or leaf node in the node tree; takes the behavioral features corresponding to the root node or leaf node as the target behavioral features, determines the frequency of the target behavioral features in the behavioral feature set, and then finds the feature combination that meets the preset threshold based on the target behavioral features that meet the preset threshold, thereby improving the search efficiency of feature combination.

[0227] In one embodiment, the frequency determination module 804 is further configured to: determine the number of times a leaf node appears in the behavioral feature set; when the number of occurrences reaches a threshold, execute the step of taking the behavioral feature corresponding to the root node or leaf node as the target behavioral feature; when the number of occurrences does not reach the threshold, search for the child node of the root node in the node tree, or search for the parent node of the leaf node in the node tree; take the behavioral feature corresponding to the child node or parent node as the target behavioral feature; and determine the frequency of the target behavioral feature appearing in the behavioral feature set.

[0228] In the above embodiments, the computer device searches for the child nodes of the root node in the node tree, or searches for the parent nodes of the leaf nodes in the node tree; the behavioral features corresponding to the child nodes or parent nodes are used as target behavioral features, the frequency of the target behavioral features appearing in the behavioral feature set is determined, and then feature combinations that meet the preset threshold can be found based on the target behavioral features that meet the preset threshold, thereby improving the search efficiency of feature combinations.

[0229] In one embodiment, the node tree construction module 810 is further configured to: construct a node chain using the behavioral features corresponding to each behavioral object in the behavioral feature set as nodes; and connect the node chains corresponding to each behavioral object using nodes corresponding to the same behavioral feature as connection points to obtain a node tree.

[0230] In the above embodiments, the computer device constructs a node tree using each behavioral feature in the behavioral feature set as a node, thereby quickly finding feature combinations whose frequency reaches the preset threshold based on the constructed node tree, and then constructing a target behavior model for behavior detection based on the feature combinations, thus improving the efficiency of constructing the target behavior model.

[0231] In one embodiment, the feature set determination module 802 is further configured to: acquire object interaction data generated during the object interaction process; perform feature conversion on the object interaction data to obtain object interaction features; perform behavior detection on the object interaction features and determine the behavior object based on the detection results; and combine the object interaction features of each behavior object into a behavior feature set.

[0232] In this embodiment, the computer device performs feature transformation on the object interaction data generated during the interaction process of the object to obtain object interaction features. This allows for the detection of behavioral objects based on the object interaction features, improving the accuracy of behavioral object detection. Furthermore, when determining the behavioral feature set based on the object interaction features of the behavioral objects, it ensures that the behavioral features in the behavioral feature set are accurate.

[0233] In one embodiment, the types of object interaction data include numerical and categorical types. The feature set determination module 802 is further configured to: obtain the quantiles corresponding to the numerical object interaction data; perform feature transformation on the numerical object interaction data based on the quantiles to obtain numerical interaction features; and use the numerical interaction features and the categorical object interaction data as object interaction features.

[0234] In the above embodiments, the computer device obtains the quantiles corresponding to the numerical object interaction data; performs feature transformation on the numerical object interaction data based on the quantiles to obtain numerical interaction features; and uses the numerical interaction features and the categorical object interaction data as object interaction features, thereby enabling direct detection of behavioral objects based on the object interaction features, which improves the efficiency of behavior detection.

[0235] In one embodiment, the feature combination includes a first feature combination and a second feature combination that includes the first feature combination; the frequency determination module 804 is further configured to determine the frequencies of the first feature combination and the second feature combination in the behavioral feature set, respectively; such as Figure 9As shown, the device further includes: a confidence determination module 812, used to determine the confidence of the second feature combination based on the frequency of the first feature combination appearing in the behavioral feature set and the frequency of the second feature combination appearing in the behavioral feature set; and a model building module 808, used to: build a target behavior model for behavior detection based on the second feature combination when the confidence of the second feature combination reaches the confidence condition.

[0236] In the above embodiments, the computer device determines the confidence level of the feature combination, and when the confidence level of the feature combination reaches the confidence level condition, constructs a target behavior model for behavior detection based on the feature combination, thereby ensuring that the constructed target behavior model can perform behavior detection more accurately and improving the reliability of the constructed target behavior model.

[0237] In one embodiment, the feature combination includes numerical behavioral features and categorical behavioral features; the model building module 808 is further configured to: use categorical behavioral features as categorical judgment parameters; use numerical behavioral features as numerical judgment parameters; and use the categorical judgment parameters and numerical judgment parameters as behavior detection conditions to construct a target behavior model for behavior detection.

[0238] In the above embodiments, the computer device constructs a target behavior model for behavior detection by using categorical behavior features that meet a preset threshold as categorical judgment parameters and numerical behavior features as numerical judgment parameters, and using the categorical judgment parameters and numerical judgment parameters as behavior detection conditions. This allows the constructed target behavior model to be used directly for behavior detection on object interaction data without the need for feature transformation of the object interaction data, thereby improving the applicability of the constructed target behavior model.

[0239] In one embodiment, the behavior feature set includes a sub-behavior feature set corresponding to each behavior object. The frequency determination module 804 is further configured to: select a target behavior feature from the behavior feature set; obtain the total number of sub-behavior feature sets in the behavior feature set, and the number of target sub-behavior feature sets in the sub-behavior feature set where the target behavior feature appears; and determine the frequency of the target behavior feature in the behavior feature set based on the number and total number of target sub-behavior feature sets.

[0240] In this embodiment, the computer device selects target behavior features from the behavior feature set, obtains the total number of sub-behavior feature sets in the behavior feature set, and the number of target sub-behavior feature sets in the sub-behavior feature set where the target behavior feature appears. Based on the number and total number of target sub-behavior feature sets, the frequency of the target behavior feature appearing in the behavior feature set is determined. Then, based on the target behavior features with a frequency greater than a threshold, other feature combinations that frequently appear in the behavior feature set can be mined to construct a target behavior model for behavior detection, thereby improving the efficiency of constructing the target behavior model.

[0241] Specific limitations regarding the apparatus for constructing the target behavior model can be found in the limitations on the construction method of the target behavior model above, and will not be repeated here. Each module in the aforementioned apparatus for constructing the target behavior model can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0242] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores object interaction data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for constructing a target behavior model.

[0243] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 11As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for constructing a target behavior model. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0244] Those skilled in the art will understand that Figure 10 The structure shown in Figure 11 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0245] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0246] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0247] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0248] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0249] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0250] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for constructing a target behavior model, characterized in that, The method includes: Behavior detection is performed on the object interaction data generated during the item interaction process to obtain a set of behavioral features of the target behavior; the object interaction data is the data generated by the interaction between the object and the item, including the attribute data of the object itself and the transaction data generated when the object trades the item; the attribute data of the object itself includes the object's gender, age, province and device used, and the transaction data includes the number of transactions, transaction amount, transaction time interval and the number of transactions generated in special periods within the preset time period; Construct a node tree using each behavioral feature in the set of behavioral features as nodes; Obtain the root node or leaf node from the node tree; The behavioral features corresponding to the root node or the leaf node are used as target behavioral features, and the frequency of the target behavioral features in the behavioral feature set is determined. When the frequency of the target behavior feature in the set of behavior features reaches a preset threshold, take the node corresponding to the target behavior feature as the starting point and search for at least one node in the node tree that has a connection relationship with the starting point. The behavioral features corresponding to the at least one node and the behavioral features corresponding to the starting point are combined to obtain a feature combination; When the frequency of the feature combination appearing in the behavioral feature set reaches the preset threshold, a target behavior model for behavior detection is constructed based on the feature combination.

2. The method according to claim 1, characterized in that, The method further includes: Determine the set of behavioral objects that possess the same target behavioral characteristics; In the set of behavioral features, find at least one behavioral feature of the set of behavioral objects that is different from the target behavioral feature; The target behavioral feature and the at least one behavioral feature are combined to obtain a feature combination.

3. The method according to claim 2, characterized in that, When the frequency of the feature combination appearing in the behavioral feature set reaches the preset threshold, constructing a target behavior model for behavior detection based on the feature combination includes: Determine the frequency of the occurrence of the feature combination in the set of behavioral features; The feature combinations whose frequencies do not reach the preset threshold are deleted to obtain the feature combinations whose frequencies reach the preset threshold. Based on the feature combinations corresponding to the frequency reaching the preset threshold, a target behavior model for behavior detection is constructed.

4. The method according to claim 1, characterized in that, The method further includes: Determine the number of times the leaf node appears in the set of behavioral features; When the number of times reaches the threshold, the step of taking the behavioral feature corresponding to the root node or the leaf node as the target behavioral feature is executed. When the number of occurrences does not reach the threshold, search for the child node of the root node in the node tree, or search for the parent node of the leaf node in the node tree; take the behavioral feature corresponding to the child node or the parent node as the target behavioral feature; determine the frequency of the target behavioral feature in the behavioral feature set.

5. The method according to claim 1, characterized in that, The step of constructing a node tree using each behavioral feature in the behavioral feature set as a node includes: A node chain is constructed using the behavioral features corresponding to each behavioral object in the behavioral feature set as nodes; Using nodes corresponding to the same behavioral characteristics as connection points, connect the node chains corresponding to each behavioral object to obtain a node tree.

6. The method according to any one of claims 1 to 5, characterized in that, The behavior detection of object interaction data generated during the item interaction process to obtain the set of behavioral features of the target behavior includes: Acquire object interaction data generated during the item interaction process; The object interaction data is transformed to obtain object interaction features; The interaction features of the objects are subjected to behavior detection, and the behavior objects are determined based on the detection results; The object interaction characteristics of each of the aforementioned behavioral objects are used as behavioral characteristics to form a set of behavioral characteristics.

7. The method according to claim 6, characterized in that, The types of object interaction data include numerical and categorical types. The step of performing feature transformation on the object interaction data to obtain object interaction features includes: Obtain the quantile corresponding to the numerical object interaction data; Based on the quantiles, feature transformation is performed on the numerical object interaction data to obtain numerical interaction features; The numerical interaction features and the categorical object interaction data are used as object interaction features.

8. The method according to any one of claims 1 to 5, characterized in that, The feature combination includes a first feature combination and a second feature combination that includes the first feature combination; the method further includes: Determine the frequencies of the first feature combination and the second feature combination in the behavioral feature set, respectively; The confidence level of the second feature combination is determined based on the frequency of the first feature combination appearing in the behavioral feature set and the frequency of the second feature combination appearing in the behavioral feature set. The construction of the target behavior model for behavior detection based on the feature combination includes: When the confidence level of the second feature combination reaches the confidence level condition, a target behavior model for behavior detection is constructed based on the second feature combination.

9. The method according to any one of claims 1 to 5, characterized in that, The feature combination includes numerical behavioral features and categorical behavioral features; The construction of the target behavior model for behavior detection based on the feature combination includes: The behavioral characteristics of the category type are used as category type judgment parameters; The numerical behavioral characteristics are used as numerical judgment parameters; Using the categorical judgment parameters and the numerical judgment parameters as behavior detection conditions, a target behavior model for behavior detection is constructed.

10. The method according to any one of claims 1 to 5, characterized in that, The behavioral feature set includes a sub-behavioral feature set corresponding to each behavioral object, and determining the frequency of the target behavioral feature appearing in the behavioral feature set includes: Select the target behavioral feature from the set of behavioral features; Obtain the total number of sub-behavioral feature sets in the behavioral feature set, and the number of target sub-behavioral feature sets in the sub-behavioral feature set that contain the target behavioral feature; Based on the number of the target sub-behavioral feature sets and the total number, the frequency of the target behavioral feature appearing in the behavioral feature sets is determined.

11. A device for constructing a target behavior model, characterized in that, The device includes: The feature set determination module is used to perform behavior detection on the object interaction data generated during the item interaction process to obtain the behavior feature set of the target behavior; the object interaction data is the data generated by the interaction between the object and the item, including the attribute data of the object itself and the transaction data generated when the object trades with the item; the attribute data of the object itself includes the object's gender, age, province, and device used, and the transaction data includes the number of transactions, transaction amount, transaction time interval, and number of transactions generated during special periods within the preset time period; A node tree construction module is used to construct a node tree using each behavioral feature in the behavioral feature set as a node; A frequency determination module is used to obtain a root node or a leaf node in the node tree; take the behavioral features corresponding to the root node or the leaf node as target behavioral features, and determine the frequency of the target behavioral features in the behavioral feature set; The feature combination search module is used to, when the frequency of the target behavior feature in the set of behavior features reaches a preset threshold, take the node corresponding to the target behavior feature as the starting point, search for at least one node in the node tree that has a connection relationship with the starting point; and combine the behavior feature corresponding to the at least one node with the behavior feature corresponding to the starting point to obtain a feature combination. The model building module is used to build a target behavior model for behavior detection based on the feature combination when the frequency of the feature combination appearing in the behavior feature set reaches the preset threshold.

12. The apparatus for constructing a target behavior model according to claim 11, characterized in that, The feature combination search module is further configured to determine a set of behavioral objects that have the same target behavioral feature; and in the set of behavioral features, to search for at least one behavioral feature of the set of behavioral objects that is different from the target behavioral feature. The target behavioral feature and the at least one behavioral feature are combined to obtain a feature combination.

13. The apparatus for constructing a target behavior model according to claim 12, characterized in that, The model building module is further configured to determine the frequency of the feature combination appearing in the behavioral feature set; delete the feature combinations whose frequency does not reach the preset threshold to obtain the feature combinations whose frequency reaches the preset threshold; and construct a target behavior model for behavior detection based on the feature combinations whose frequency reaches the preset threshold.

14. The apparatus for constructing a target behavior model according to claim 11, characterized in that, The frequency determination module is further configured to determine the number of times the leaf node appears in the set of behavioral features; when the number of occurrences reaches a threshold, the step of using the behavioral feature corresponding to the root node or the leaf node as the target behavioral feature is executed; when the number of occurrences does not reach the threshold, the child node of the root node is searched in the node tree, or the parent node of the leaf node is searched in the node tree; the behavioral feature corresponding to the child node or the parent node is used as the target behavioral feature. Determine the frequency of the target behavioral feature in the set of behavioral features.

15. The apparatus for constructing a target behavior model according to claim 11, characterized in that, The node tree construction module is further configured to construct a node chain using the behavioral features corresponding to each behavioral object in the behavioral feature set as nodes; and to connect the node chains corresponding to each behavioral object using nodes corresponding to the same behavioral feature as connection points to obtain a node tree.

16. The apparatus for constructing a target behavior model according to any one of claims 11 to 15, characterized in that, The feature set determination module is also used to acquire object interaction data generated during the item interaction process; perform feature conversion on the object interaction data to obtain object interaction features; perform behavior detection on the object interaction features and determine the behavior object based on the detection results; and combine the object interaction features of each behavior object into a behavior feature set.

17. The apparatus for constructing a target behavior model according to claim 16, characterized in that, The types of object interaction data include numerical and categorical types; the feature set determination module is further used to obtain the quantiles corresponding to the numerical object interaction data; perform feature transformation on the numerical object interaction data based on the quantiles to obtain numerical interaction features; and use the numerical interaction features and the categorical object interaction data as object interaction features.

18. The apparatus for constructing a target behavior model according to any one of claims 11 to 15, characterized in that, The feature combination includes a first feature combination and a second feature combination that includes the first feature combination; the frequency determination module is further configured to determine the frequencies of the first feature combination and the second feature combination in the behavioral feature set, respectively; the device further includes a confidence determination module, configured to determine the confidence level of the second feature combination based on the frequencies of the first feature combination and the second feature combination in the behavioral feature set; the model building module is further configured to build a target behavior model for behavior detection based on the second feature combination when the confidence level of the second feature combination reaches a confidence level condition.

19. The apparatus for constructing a target behavior model according to any one of claims 11 to 15, characterized in that, The feature combination includes numerical behavioral features and categorical behavioral features; the model building module is also used to use the categorical behavioral features as categorical judgment parameters; use the numerical behavioral features as numerical judgment parameters; and use the categorical judgment parameters and the numerical judgment parameters as behavior detection conditions to construct a target behavior model for behavior detection.

20. The apparatus for constructing a target behavior model according to any one of claims 11 to 15, characterized in that, The frequency determination module is further configured to select a target behavior feature from the behavior feature set; obtain the total number of sub-behavior feature sets in the behavior feature set, and the number of target sub-behavior feature sets in the sub-behavior feature set where the target behavior feature appears; and determine the frequency of the target behavior feature appearing in the behavior feature set based on the number of target sub-behavior feature sets and the total number.

21. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 10.

22. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.

23. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method of any one of claims 1 to 10.

Images