Behavior data processing method, device, equipment and storage medium

Abstract

The present application discloses a behavior data processing method, device, equipment and storage medium, which relates to the field of data processing technology, especially to artificial intelligence and deep learning technology. The specific implementation scheme is: in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model; determining the business scenario corresponding to the behavior data processing request, and obtaining the reference cheating behavior parameters of the business scenario; obtaining a pool of users to be processed based on the real-time streaming data of cheating behavior, the reference cheating behavior parameters and the multi-threshold calculation model of the first user; determining the level disposal strategy corresponding to the users to be processed in the user pool to be processed, and based on the determined level disposal strategy, performing corresponding disposal on the corresponding users to be processed in the user pool to be processed. Different users can be processed accordingly according to different thresholds to reduce the probability of the behavior pattern of the anti-cheating recognition model being cracked.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, in particular to artificial intelligence and deep learning technology, and more particularly to a behavior data processing method, device, equipment and storage medium. Background Art

[0002] In the related art, the anti-cheating recognition model can detect the cheating probability of abnormal behavior based on relevant parameters, and deal with the abnormal behavior based on the cheating probability. However, the behavior pattern of the anti-cheating recognition model may be perceived, so that the anti-cheating recognition model can be bypassed through corresponding behavior, making the anti-cheating model invalid. For example, when a user uses a processed IP (Internet Protocol Address) address to access again, the cheating probability obtained by the anti-cheating recognition model for detecting the access behavior of the IP address will also increase, but the user can reduce the probability of being detected as cheating by the anti-cheating recognition model by changing the IP address. Summary of the invention

[0003] The present application provides a behavior data processing method, apparatus, device and storage medium.

[0004] According to one aspect of the present application, a behavior data processing method is provided, comprising: in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating identification model; determining a business scenario corresponding to the behavior data processing request, and obtaining reference cheating behavior parameters of the business scenario; obtaining a user pool to be processed based on the cheating behavior real-time streaming data, the reference cheating behavior parameters and a first user multi-threshold calculation model; wherein the first user multi-threshold calculation model has learned a mapping relationship between cheating behavior parameter samples and cheating probabilities; determining a level handling strategy corresponding to a user to be processed in the user pool to be processed, and based on the determined level handling strategy, performing corresponding handling on the corresponding user to be processed in the user pool to be processed.

[0005] In one implementation, the step of obtaining a user pool to be processed based on the cheating behavior real-time streaming data, the reference cheating behavior parameters, and the first user multi-threshold calculation model includes: extracting the cheating behavior parameters in the cheating behavior real-time streaming data; inputting the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the cheating behavior real-time streaming data; and obtaining the user pool to be processed based on the cheating probability of each user in each channel and the operation configuration information of the business scenario.

[0006] In an optional implementation, the obtaining of the user pool to be processed according to the cheating probability of each user in each channel and the operational configuration information of the business scenario includes: determining the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool corresponding to the business scenario according to the operational configuration information of the business scenario; placing the identification information of the user in the real-time streaming data of the cheating behavior into the corresponding high-precision recall pool and / or the high-recall recall pool according to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool; obtaining the user pool to be processed according to the identification information in the high-precision recall pool and / or the high-recall recall pool.

[0007] Optionally, obtaining the user pool to be processed based on the identification information in the high-precision recall pool and / or the high-recall recall pool includes: counting the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool; when the number of identical identification information reaches a processing threshold, putting the identification information that reaches the processing threshold into a user pool, and using the user pool as the user pool to be processed.

[0008] Optionally, determining the level handling strategy corresponding to the users to be handled in the pool of users to be handled includes: determining the source of the identification information in the pool of users to be handled; in response to the identification information in the pool of users to be handled originating from the high-precision recall pool, determining that the level handling strategy for users corresponding to the identification information originating from the high-precision recall pool is a first-level handling strategy; or, in response to the identification information in the pool of users to be handled originating from the high-precision recall pool, determining that the level handling strategy for users corresponding to the identification information originating from the high-precision recall pool is a second-level handling strategy.

[0009] In one implementation, based on the determined level handling strategy, corresponding handling is performed on the corresponding users to be handled in the user pool to be handled, including: based on the determined level handling strategy, combined with a random time factor and / or a random handling ratio factor, corresponding handling is performed on the corresponding users to be handled in the user pool to be handled.

[0010] In one implementation, the method further includes: based on the anti-cheating identification model, obtaining real-time streaming data of normal user behavior from the behavior data processing request; performing aggregation calculation on the real-time streaming data of cheating behavior to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; training a second user multi-threshold calculation model based on the real-time streaming data of normal user behavior, the real-time streaming data of cheating behavior and the composite-dimensional cheating behavior parameters; wherein the second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model.

[0011] In an optional implementation, the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior, the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameters includes: training the second user multi-threshold calculation model by a semi-supervised learning method based on the real-time streaming data of the user's normal behavior; wherein the second user multi-threshold calculation model learns the behavior parameters and their ranges of normal users during this training; and continuing to train the second user multi-threshold calculation model by the semi-supervised learning method based on the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameters after completing the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior; wherein the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability during this training.

[0012] According to a second aspect of the present application, a behavior data processing device is provided, comprising: a first acquisition module, for, in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model; a first processing module, for determining a business scenario corresponding to the behavior data processing request, and obtaining reference cheating behavior parameters of the business scenario; a second acquisition module, for obtaining a user pool to be processed based on the cheating behavior real-time streaming data, the reference cheating behavior parameters and a first user multi-threshold calculation model; wherein the first user multi-threshold calculation model has learned a mapping relationship between cheating behavior parameter samples and cheating probabilities; a second processing module, for determining a level handling strategy corresponding to a user to be processed in the user pool to be processed, and based on the determined level handling strategy, performing corresponding handling on the corresponding user to be processed in the user pool to be processed.

[0013] In one implementation, the second acquisition module is specifically used to: extract cheating behavior parameters from the cheating behavior real-time streaming data; input the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the cheating behavior real-time streaming data; and obtain the user pool to be processed based on the cheating probability of each user in each channel and the operation configuration information of the business scenario.

[0014] In an optional implementation, the second acquisition module is specifically used to: determine the cheating probability threshold of the high-precision recall pool and / or high-recall recall pool corresponding to the business scenario according to the operational configuration information of the business scenario; according to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or high-recall recall pool, put the identification information of the user in the real-time streaming data of the cheating behavior into the corresponding high-precision recall pool and / or high-recall recall pool; and obtain the user pool to be processed according to the identification information in the high-precision recall pool and / or high-recall recall pool.

[0015] Optionally, the second acquisition module is specifically used to: count the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool;

[0016] When the number of the identical identification information reaches a handling threshold, the identification information reaching the handling threshold is put into a user pool, and the user pool is used as the user pool to be handled.

[0017] Optionally, the second acquisition module is specifically used to: determine the source of the identification information in the user pool to be processed; in response to the identification information in the user pool to be processed originating from the high-precision recall pool, determine that the level handling policy of the user corresponding to the identification information originating from the high-precision recall pool is the first level handling policy; or, in response to the identification information in the user pool to be processed originating from the high-precision recall pool, determine that the level handling policy of the user corresponding to the identification information originating from the high-precision recall pool is the second level handling policy.

[0018] In one implementation, the second processing module is specifically used to: perform corresponding treatment on the corresponding users to be treated in the pool of users to be treated based on the determined level treatment strategy in combination with a random time factor and / or a random treatment ratio factor.

[0019] In one implementation, the device also includes: a third acquisition module, used to obtain user normal behavior real-time stream data from the behavior data processing request based on the anti-cheating identification model; a third processing module, used to perform aggregation calculations on the cheating behavior real-time stream data to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; a training module, used to train a second user multi-threshold calculation model based on the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite-dimensional cheating behavior parameters; wherein the second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model.

[0020] In an optional implementation, the training module is specifically used to: train the second user multi-threshold calculation model through a semi-supervised learning device based on the real-time streaming data of the user's normal behavior; wherein the second user multi-threshold calculation model learns the behavior parameters and their ranges of normal users during this training; and continue to train the second user multi-threshold calculation model through the semi-supervised learning device based on the cheating behavior real-time streaming data and the composite dimensional cheating behavior parameters on the basis of completing the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior; wherein the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability during this training.

[0021] According to the third aspect of the present application, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect.

[0022] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect.

[0023] According to a fifth aspect of the present application, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the method described in the first aspect when executed by a processor.

[0024] According to the technology of the present application, the real-time streaming data of cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters of the corresponding business scenario can be determined, so as to obtain the user pool to be processed according to the real-time streaming data of cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, so as to perform corresponding processing according to the level processing strategy corresponding to the user to be processed. Therefore, different users are processed accordingly according to different thresholds and level processing strategies, reducing the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0025] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present application.

[0027] Figure 1 is a schematic diagram according to the first embodiment of the present application;

[0028] Figure 2 It is an overall flow chart of a behavior data processing solution provided by an embodiment of the present application;

[0029] Figure 3 is a schematic diagram according to a second embodiment of the present application;

[0030] Figure 4 It is a schematic diagram of a process for generating a user pool to be processed provided by an embodiment of the present application;

[0031] Figure 5 This is a schematic diagram of a first user multi-threshold calculation model output data storage process provided by an embodiment of the present application;

[0032] Figure 6 It is a schematic diagram of a processing strategy scheduling process provided by an embodiment of the present application;

[0033] Figure 7 is a schematic diagram according to a third embodiment of the present application;

[0034] Figure 8 It is a schematic diagram of a model training process provided in an embodiment of the present application;

[0035] Fig. 9 is a schematic diagram of a behavior data processing device provided in an embodiment of the present application;

[0036] Fig.10 is a schematic diagram of another behavior data processing device provided in an embodiment of the present application;

[0037] Fig.11 It is a block diagram of an electronic device used to implement the behavior data processing method of an embodiment of the present application. DETAILED DESCRIPTION

[0038] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0039] See also Figure 1 , Figure 1 is a schematic diagram according to the first embodiment of the present application. Figure 1 As shown, the behavior data processing method provided by this embodiment may include but is not limited to the following steps.

[0040] Step S101: in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model.

[0041] In the embodiments of the present application, the behavior data may include but is not limited to the behavior data when the user visits a website or uses an application.

[0042] For example, in response to receiving a request to process behavior data, the behavior data corresponding to the behavior data processing request is identified based on a preset anti-cheating identification model to obtain real-time streaming data of cheating behavior.

[0043] Step S102: Determine the business scenario corresponding to the behavior data processing request, and obtain reference cheating behavior parameters of the business scenario.

[0044] Among them, in the embodiments of the present application, the above-mentioned business scenarios may be scenarios in which users use different application products (for example, social applications, community applications, or live broadcast applications, etc.).

[0045] As an example, it is determined that the business scenario corresponding to the behavior data processing request is a social application scenario, and a reference cheating behavior parameter corresponding to a preset social application scenario is obtained.

[0046] Step S103: obtaining a user pool to be processed according to the real-time streaming data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model.

[0047] In the embodiment of the present application, the first user multi-threshold calculation model has learned the mapping relationship between the cheating behavior parameter samples and the cheating probability.

[0048] It can be understood that, in the embodiments of the present application, each different business scenario may correspond to a different first user multi-threshold calculation model.

[0049] For example, the real-time streaming data of cheating behavior and the reference cheating behavior parameters are input into the first user multi-threshold calculation model to obtain the actual cheating probability of each user, and the users whose actual cheating probability is greater than the preset probability threshold are placed in the user pool to be processed.

[0050] Step S104: determining the level handling strategy corresponding to the users to be handled in the pool of users to be handled, and taking corresponding measures on the users to be handled in the pool of users to be handled based on the determined level handling strategy.

[0051] For example, from multiple preset level handling strategies, determine the level handling strategy corresponding to each user to be handled in the user pool to be handled, and based on the level handling strategy corresponding to each user to be handled, perform corresponding handling on each user to be handled in the user pool to be handled.

[0052] By implementing the embodiments of the present application, it is possible to obtain cheating behavior real-time streaming data from the behavior data processing request based on the preset anti-cheating identification model, and determine the reference cheating behavior parameters corresponding to the business scenario, thereby obtaining a pool of users to be processed based on the cheating behavior real-time streaming data, the reference cheating behavior parameters and the first user multi-threshold calculation model, so as to perform corresponding processing according to the level processing strategy corresponding to the user to be processed. Thus, different users are processed accordingly according to different thresholds and level processing strategies, reducing the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0053] As an example, see Figure 2 , Figure 2 This is an overall flow chart of a behavior data processing solution provided by an embodiment of the present application. Figure 2 As shown, the behavioral data processing solution provided in the embodiment of the present application first processes the relevant data of the user's cheating behavior to obtain basic data, and obtains the user pool to be processed in combination with the preset data processing strategy, and then matches each user in the user pool to be processed with a corresponding processing strategy based on the preset processing strategy scheduling, so as to perform corresponding processing on the users in the user pool to be processed based on the above processing strategy.

[0054] In one implementation, the cheating behavior parameters can be obtained according to the real-time streaming data of the cheating behavior, so as to obtain the user pool to be processed based on the cheating behavior parameters. As an example, see Figure 3 , Figure 3 is a schematic diagram according to the second embodiment of the present application. Figure 3 As shown, the behavior data processing method provided by this embodiment may include but is not limited to the following steps.

[0055] Step S301: in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model.

[0056] In the embodiment of the present application, step S301 can be implemented in any way in the embodiments of the present application, and the embodiments of the present application do not limit this and will not be repeated.

[0057] Step S302: Determine the business scenario corresponding to the behavior data processing request, and obtain reference cheating behavior parameters of the business scenario.

[0058] In the embodiment of the present application, step S302 can be implemented in any way in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0059] Step S303: extracting cheating behavior parameters from the real-time cheating behavior streaming data.

[0060] For example, cheating behavior parameters in real-time streaming data of cheating behaviors are extracted by aggregation cheating behavior calculation.

[0061] Step S304: input the cheating behavior parameter and the reference cheating behavior parameter into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the real-time stream data of the cheating behavior.

[0062] For example, the cheating behavior parameter and the reference cheating behavior parameter are input as input data into the first user multi-threshold calculation model to obtain the cheating probability corresponding to each user in each channel in the real-time stream data of the cheating behavior.

[0063] Step S305: Obtain a user pool to be processed based on the cheating probability of each user in each channel and the operation configuration information of the business scenario.

[0064] For example, the cheating probability threshold corresponding to each business channel is obtained based on the operational configuration information of the business scenario, and the cheating probability of each user in each business channel is compared with the cheating probability threshold corresponding to each business channel. Users whose cheating probability in any business channel is greater than or equal to the cheating probability threshold corresponding to the business channel are obtained as users to be processed, thereby obtaining a pool of users to be processed.

[0065] In an optional implementation, the above-mentioned obtaining the user pool to be processed according to the cheating probability of each user in each channel and the operational configuration information of the business scenario may include: determining the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool corresponding to the business scenario according to the operational configuration information of the business scenario; placing the identification information of the user in the real-time streaming data of the cheating behavior into the corresponding high-precision recall pool and / or the high-recall recall pool according to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool; and obtaining the user pool to be processed according to the identification information in the high-precision recall pool and / or the high-recall recall pool.

[0066] As an example, a high-precision (i.e., high-accuracy) recall pool corresponding to the business scenario is determined based on the operational configuration information of the business scenario, and based on the cheating probability of each user in each channel, the identification information (for example, UID (User Identification)) of users whose cheating probability is greater than or equal to the cheating probability threshold corresponding to the high-precision recall pool is obtained from the real-time streaming data of the cheating behavior, and the above identification information is placed in the corresponding high-precision recall pool, so as to obtain the user pool to be processed based on the identification information in the high-precision recall pool.

[0067] As another example, a high-recall (i.e., high recall rate) recall pool corresponding to the business scenario is determined based on the operational configuration information of the business scenario, and based on the cheating probability of each user in each channel, identification information of users whose cheating probability is greater than or equal to the cheating probability threshold corresponding to the high-recall recall pool is obtained from the real-time streaming data of the cheating behavior, and the above identification information is placed in the corresponding high-recall recall pool, thereby obtaining a user pool to be processed based on the identification information in the high-recall recall pool.

[0068] As another example, a high-precision recall pool and a high-call recall pool corresponding to the business scenario are determined according to the operational configuration information of the business scenario, and according to the cheating probability of each user in each channel, the identification information of users whose cheating probability is greater than or equal to the cheating probability threshold corresponding to the above-mentioned high-precision recall pool and greater than or equal to the cheating probability threshold corresponding to the above-mentioned high-call recall pool is obtained from the real-time streaming data of the cheating behavior, and the above-mentioned identification information is put into the corresponding high-precision recall pool and high-call recall pool, so as to obtain the user pool to be processed according to the identification information in the high-precision recall pool and the high-call recall pool.

[0069] It can be understood that the above method can take into account both the business requirements of high-precision recall and the business requirements of high-recall rate recall, thereby meeting the needs of different business scenarios that are highly sensitive to false recalls and / or highly sensitive to contamination.

[0070] See also Figure 4 , Figure 4 Schematic diagram of a process for generating a user pool to be processed provided by an embodiment of the present application. Figure 4 As shown, the process for generating a user pool to be processed provided in an embodiment of the present application can perform real-time processing on the real-time streaming data and basic data of the user's cheating behavior based on a real-time computing cluster, thereby obtaining data with a cheating probability greater than or equal to a cheating probability threshold corresponding to a high-precision recall pool from the above-mentioned real-time streaming data to generate a high-precision recall pool, and can obtain data with a cheating probability greater than or equal to a cheating probability threshold corresponding to a high-recall recall pool from the above-mentioned real-time streaming data to generate a high-recall recall pool.

[0071] Optionally, the above-mentioned obtaining the user pool to be processed based on the identification information in the high-precision recall pool and / or the high-recall recall pool may include: counting the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool; when the number of identical identification information reaches a processing threshold, placing the identification information that reaches the processing threshold into the user pool, and using the user pool as the user pool to be processed.

[0072] As an example, the number of identical identification information in the high-precision recall pool is counted. When the number of identical identification information is greater than or equal to a preset handling threshold, the identification information reaching the handling threshold is placed in the user pool, and the user pool is used as the user pool to be handled.

[0073] As another example, the number of identical identification information in the high-call recall pool is counted. When the number of identical identification information is greater than or equal to a preset handling threshold, the identification information reaching the handling threshold is placed in the user pool, and the user pool is used as the user pool to be handled.

[0074] As another example, the number of identical identification information in the high-precision recall pool and the high-recall recall pool is counted; when the number of identical identification information is greater than or equal to a preset disposal threshold, the identification information that reaches the disposal threshold is placed in the user pool, and the user pool is used as the user pool to be disposed.

[0075] See also Figure 5 , Figure 5 1 is a schematic diagram of a first user multi-threshold calculation model output data storage process provided by an embodiment of the present application. Figure 5 As shown, in an embodiment of the present application, the first user multi-threshold calculation model can calculate the cheating probability of each user based on the behavior data of the user, and compare the cheating probability with the disposal threshold under the high-precision model and the disposal threshold under the high-recall model, respectively, and store the result of the cheating probability being greater than the disposal threshold under the high-precision model, the relevant mapping data (such as real-time UID, disposal threshold and channel data) and the global information of the corresponding user (including but not limited to user information and user behavior information, etc.), and the result of the cheating probability being greater than the disposal threshold under the high-recall model, the relevant mapping data and the global information of the corresponding user.

[0076] Step S306: determining the level handling strategy corresponding to the users to be handled in the pool of users to be handled, and taking corresponding measures on the users to be handled in the pool of users to be handled based on the determined level handling strategy.

[0077] In the embodiment of the present application, step S306 can be implemented in any way in the embodiments of the present application. The embodiments of the present application do not limit this and will not be repeated.

[0078] Optionally, the above-mentioned determination of the level handling strategy corresponding to the user to be processed in the pool of users to be processed may include: determining the source of the identification information in the pool of users to be processed; in response to the identification information in the pool of users to be processed originating from the high-precision recall pool, determining that the level handling strategy for the user corresponding to the identification information originating from the high-precision recall pool is the first level handling strategy; or, in response to the identification information in the pool of users to be processed originating from the high-precision recall pool, determining that the level handling strategy for the user corresponding to the identification information originating from the high-precision recall pool is the second level handling strategy.

[0079] As an example, it is determined that the identification information in the to-be-processed user pool originates from the high-precision recall pool, and it is determined that the level processing strategy of the user corresponding to the identification information originating from the high-precision recall pool is the preset first-level processing strategy.

[0080] In the embodiment of the present application, the first-level handling strategy may be a UV (Unique Visitor) handling strategy.

[0081] As another example, it is determined that the identification information in the to-be-processed user pool originates from the high-recall pool, and it is determined that the level processing policy of the user corresponding to the identification information originating from the high-recall pool is the preset second-level processing policy.

[0082] In the embodiment of the present application, the second-level handling strategy may be a PV (Page View) level handling strategy.

[0083] As an example, see Figure 6 , Figure 6 Schematic diagram of a processing strategy scheduling process provided by an embodiment of the present application. Figure 6 As shown, in an embodiment of the present application, after obtaining the user pool to be processed based on the high-recall recall pool and / or the high-precision recall pool, the processing scheduler can determine, based on the identification information in the user pool to be processed, that the user to be processed originates from the high-precision recall pool or the high-recall recall pool; in response to determining that the user to be processed originates from the high-precision recall pool, the user to be processed is divided into a UV level strategy group, so as to perform corresponding processing on the user to be processed based on the UV level strategy; or, in response to determining that the user to be processed originates from the high-recall recall pool, the user to be processed is divided into a PV level strategy group, so as to perform corresponding processing on the user to be processed based on the PV level strategy.

[0084] By implementing the embodiments of the present application, cheating behavior parameters can be obtained based on the obtained real-time streaming data of cheating behavior, and reference cheating behavior parameters corresponding to the business scenario can be determined, so as to obtain the cheating probability of each user in each channel based on the first user multi-threshold calculation model, obtain the user pool to be processed in combination with the operation configuration information of the business scenario, and perform corresponding processing according to the level processing strategy corresponding to the user to be processed. Thus, different users can be processed accordingly according to different business scenarios, reducing the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0085] In one implementation, the random time factor and / or the random handling ratio factor may be combined to perform corresponding handling on the corresponding users in the handling user pool. Figure 7 , Figure 7 is a schematic diagram according to the third embodiment of the present application. Figure 7 As shown, the behavior data processing method provided by this embodiment may include but is not limited to the following steps.

[0086] Step S701: in response to receiving a behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model.

[0087] In the embodiment of the present application, step S701 can be implemented in any way in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0088] Step S702: Determine the business scenario corresponding to the behavior data processing request, and obtain reference cheating behavior parameters of the business scenario.

[0089] In the embodiment of the present application, step S702 can be implemented in any way in the embodiments of the present application. The embodiments of the present application do not limit this and will not be repeated.

[0090] Step S703: obtaining a user pool to be processed according to the real-time streaming data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model.

[0091] In the embodiment of the present application, step S703 can be implemented in any way in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0092] Step S704: determine the level handling strategy corresponding to the users in the user pool, and perform corresponding handling on the corresponding users in the user pool based on the determined level handling strategy combined with the random time factor and / or the random handling ratio factor.

[0093] As an example, determine the level handling strategy corresponding to the users to be handled in the user pool to be handled, determine the corresponding delay time in combination with the random time factor, and after the above delay time, take corresponding measures for the corresponding users to be handled in the user pool to be handled based on the determined level handling strategy.

[0094] As another example, determine the level handling strategy corresponding to the users to be handled in the user pool, determine the handling percentage in combination with the random handling ratio factor, randomly select the target users to be handled from all the users to be handled in the user pool based on the handling percentage, and perform corresponding processing on the above target users to be handled based on the determined level handling strategy.

[0095] As another example, determine the level handling strategy corresponding to the users to be handled in the user pool, determine the corresponding delay time in combination with the random time factor, and determine the handling percentage in combination with the random handling ratio factor; based on the handling percentage, randomly select the target user to be handled from all the users to be handled in the user pool; after the above-mentioned delay time, perform corresponding processing on the above-mentioned target user to be handled based on the determined level handling strategy.

[0096] By implementing the embodiments of the present application, it is possible to obtain cheating behavior real-time streaming data from the behavior data processing request based on the preset anti-cheating identification model, and determine the reference cheating behavior parameters corresponding to the business scenario, thereby obtaining the user pool to be processed based on the cheating behavior real-time streaming data, the reference cheating behavior parameters and the first user multi-threshold calculation model, and combining the random time factor and / or the random processing ratio factor, and performing corresponding processing according to the level processing strategy corresponding to the user to be processed. This reduces the probability of the processing behavior being perceived, so as to reduce the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0097] In some embodiments of the present application, the above-mentioned behavior data processing method may also include: based on the anti-cheating identification model, obtaining the user's normal behavior real-time streaming data from the behavior data processing request; performing aggregation calculation on the cheating behavior real-time streaming data to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; training a second user multi-threshold calculation model based on the user's normal behavior real-time streaming data, the cheating behavior real-time streaming data and the composite-dimensional cheating behavior parameters.

[0098] In an embodiment of the present application, the second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model.

[0099] For example, based on the anti-cheating identification model, the real-time streaming data of behavior corresponding to the behavior data processing request is identified to obtain the real-time streaming data of the user's normal behavior; and the real-time streaming data of the cheating behavior is aggregated and calculated to obtain the composite-dimensional cheating behavior parameters with business scenario characteristics; thereby, the second user multi-threshold calculation model is trained based on the real-time streaming data of the user's normal behavior, the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameters.

[0100] Optionally, the training of the second user multi-threshold calculation model according to the real-time streaming data of normal user behavior, the real-time streaming data of cheating behavior and the composite-dimensional cheating behavior parameters may include the following steps.

[0101] Step a1: Based on the real-time streaming data of the user's normal behavior, the second user multi-threshold calculation model is trained by a semi-supervised learning method.

[0102] In the embodiment of the present application, the second user multi-threshold calculation model learns the behavior parameters and ranges of normal users in this training.

[0103] For example, the real-time streaming data of normal user behavior is used as training data, and the cross entropy is used as the loss function. The second user multi-threshold calculation model is trained through a semi-supervised learning method, so that the second user multi-threshold calculation model learns the behavior parameters and ranges of normal users during this training.

[0104] Step a2: On the basis of completing the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior, continue to train the second user multi-threshold calculation model through a semi-supervised learning method based on the real-time streaming data of the cheating behavior and the composite dimensional cheating behavior parameters.

[0105] In the embodiment of the present application, the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability in this training.

[0106] For example, the real-time streaming data of cheating behavior and the cheating behavior parameters of composite dimensions are used as training data, and the cross entropy is used as the loss function. Through the semi-supervised learning method, the second user multi-threshold calculation model trained based on the real-time streaming data of the user's normal behavior is continued to be trained.

[0107] As an example, see Figure 8 , Figure 8 Schematic diagram of a model training process provided by an embodiment of the present application. Figure 8As shown, in an embodiment of the present application, the user's behavior data is first identified and processed based on an anti-cheating identification model to obtain the behavior data and cheating behavior data of all users, and the cheating behavior data is input into an aggregation calculation model to obtain composite dimensional cheating parameters with business characteristics as a bypass data stream; then, the cheating probability of each user in each channel is calculated based on the PaddlePaddle framework; and thus, based on the above-mentioned cheating probability, the second user multi-threshold calculation model is trained in combination with the real-time stream data A corresponding to the behavior data of all users and the real-time stream data B corresponding to the cheating behavior data.

[0108] See also Fig. 9 , Fig. 9 Schematic diagram of a behavior data processing device provided in an embodiment of the present application. Fig. 9 As shown, the device 900 includes: a first acquisition module 901, which is used to obtain cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model in response to receiving a behavior data processing request; a first processing module 902, which is used to determine the business scenario corresponding to the behavior data processing request and obtain reference cheating behavior parameters of the business scenario; a second acquisition module 903, which obtains a user pool to be processed according to the cheating behavior real-time streaming data, the reference cheating behavior parameters and the first user multi-threshold calculation model; wherein the first user multi-threshold calculation model has learned the mapping relationship between the cheating behavior parameter samples and the cheating probability; a second processing module 904, which is used to determine the level disposal strategy corresponding to the user to be processed in the user pool to be processed, and based on the determined level disposal strategy, perform corresponding disposal on the corresponding user to be processed in the user pool to be processed.

[0109] In one implementation, the second acquisition module 903 is specifically used to: extract cheating behavior parameters from the real-time cheating behavior streaming data; input the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the real-time cheating behavior streaming data; obtain the user pool to be processed according to the cheating probability of each user in each channel and the operational configuration information of the business scenario.

[0110] In an optional implementation, the second acquisition module 903 is specifically used to: determine the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool corresponding to the business scenario based on the operational configuration information of the business scenario; according to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool, put the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and / or the high-recall recall pool; and obtain the user pool to be processed based on the identification information in the high-precision recall pool and / or the high-recall recall pool.

[0111] Optionally, the second acquisition module 903 is specifically used to: count the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool; when the number of identical identification information reaches a disposal threshold, the identification information that reaches the disposal threshold is placed into the user pool, and the user pool is used as a user pool to be disposed.

[0112] Optionally, the second acquisition module 903 is specifically used to: determine the source of the identification information in the user pool to be processed; in response to the identification information in the user pool to be processed originating from the high-precision recall pool, determine that the level handling policy of the user corresponding to the identification information originating from the high-precision recall pool is the first-level handling policy; or, in response to the identification information in the user pool to be processed originating from the high-precision recall pool, determine that the level handling policy of the user corresponding to the identification information originating from the high-precision recall pool is the second-level handling policy.

[0113] In one implementation, the second processing module 904 is specifically used to: perform corresponding treatment on the corresponding to-be-treated users in the to-be-treated user pool based on the determined level treatment strategy in combination with the random time factor and / or the random treatment ratio factor.

[0114] In one implementation, the above device further includes: a third acquisition module, a third processing module and a training module. As an example, see Fig.10 , Fig.10 Schematic diagram of another behavior data processing device provided in an embodiment of the present application. Fig.10 As shown. The device 1000 includes a third acquisition module 1005, which is used to obtain the user's normal behavior real-time streaming data from the behavior data processing request based on the anti-cheating identification model; a third processing module 1006, which is used to perform aggregation calculations on the cheating behavior real-time streaming data to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; a training module 1007, which is used to train the second user multi-threshold calculation model according to the user's normal behavior real-time streaming data, the cheating behavior real-time streaming data and the composite-dimensional cheating behavior parameters; wherein the second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model. wherein, Fig.10 1001-1004 and Fig. 9 901-904 have the same function and structure.

[0115] In an optional implementation, the training module 1007 is specifically used to: train a second user multi-threshold calculation model through a semi-supervised learning device based on real-time streaming data of normal user behavior; wherein the second user multi-threshold calculation model learns the behavior parameters and their ranges of normal users during this training; on the basis of completing the training of the second user multi-threshold calculation model based on the real-time streaming data of normal user behavior, continue to train the second user multi-threshold calculation model through a semi-supervised learning device based on the real-time streaming data of cheating behavior and the cheating behavior parameters of the composite dimension; wherein the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability during this training.

[0116] Through the device of the embodiment of the present application, the real-time streaming data of cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters corresponding to the business scenario can be determined, so as to obtain the user pool to be processed according to the real-time streaming data of cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, so as to perform corresponding treatment according to the level treatment strategy corresponding to the user to be processed. Therefore, different users are processed accordingly according to different thresholds, reducing the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0117] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0118] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0119] like Fig.11 , is a block diagram of an electronic device according to a method for behavioral data processing according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0120] like Fig.11As shown, the electronic device includes: one or more processors 1101, a memory 1102, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are interconnected using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.11 A processor 1101 is taken as an example.

[0121] The memory 1102 is a non-transitory computer-readable storage medium provided in the present application. The memory stores instructions executable by at least one processor to enable the at least one processor to perform the method for processing behavioral data provided in the present application. The non-transitory computer-readable storage medium of the present application stores computer instructions, which are used to enable a computer to perform the method for processing behavioral data provided in the present application.

[0122] The memory 1102 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the behavior data processing method in the embodiment of the present application (for example, the attached Fig. 9 The first acquisition module 901, the first processing module 902, the second acquisition module 903 and the second processing module 904, and the attached Fig.10 The processor 1101 executes various functional applications and data processing of the server by running the non-transient software programs, instructions and modules stored in the memory 1102, that is, the method for processing behavioral data in the above method embodiment is implemented.

[0123] The memory 1102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device for behavioral data processing, etc. In addition, the memory 1102 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1102 may optionally include a memory remotely arranged relative to the processor 1101, and these remote memories may be connected to the electronic device for behavioral data processing via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The electronic device of the method for processing behavior data may further include: an input device 1103 and an output device 1104. The processor 1101, the memory 1102, the input device 1103 and the output device 1104 may be connected via a bus or other means. Fig.11 The example of connecting through bus is taken in the following.

[0125] The input device 1103 can receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device for behavior data processing, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator rod, one or more mouse buttons, a trackball, a joystick and other input devices. The output device 1104 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The display device may include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display and a plasma display. In some embodiments, the display device may be a touch screen.

[0126] Various implementations of the systems and techniques described herein can be realized in digital electronic circuit systems, integrated circuit systems, dedicated ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0127] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for programmable processors and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or means (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0129] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0130] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0131] According to the technical solution of the embodiment of the present application, the real-time streaming data of cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters corresponding to the business scenario can be determined, so as to obtain the user pool to be processed according to the real-time streaming data of cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, so as to perform corresponding treatment according to the level treatment strategy corresponding to the user to be processed. Therefore, different users are processed accordingly according to different thresholds, reducing the probability of the behavior pattern of the anti-cheating identification model being cracked.

[0132] It should be understood that various forms of processes shown above can be used, and reordering, adding or executing can also be performed in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0133] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A behavior data processing method, comprising: In response to receiving the behavior data processing request, obtaining cheating behavior real-time streaming data from the behavior data processing request based on a preset anti-cheating recognition model; Determine a business scenario corresponding to the behavior data processing request, and obtain a reference cheating behavior parameter of the business scenario; Obtaining a user pool to be processed according to the real-time cheating behavior stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model; wherein the first user multi-threshold calculation model has learned a mapping relationship between a cheating behavior parameter sample and a cheating probability; Determining the level handling strategy corresponding to the user to be handled in the user pool to be handled, and taking corresponding measures on the corresponding user to be handled in the user pool to be handled based on the determined level handling strategy, including: Based on the determined level handling strategy, a corresponding delay time is determined in combination with a random time factor, and after the delay time, corresponding handling is performed on the corresponding user to be handled in the user pool to be handled based on the determined level handling strategy; and / or, Based on the determined level handling strategy, the handling percentage is determined in combination with the random handling ratio factor, and based on the handling percentage, a target user to be handled is randomly selected from all users to be handled in the user pool to be handled, and the target user to be handled is handled accordingly based on the determined level handling strategy.

2. The method of claim 1, wherein: The step of obtaining a user pool to be processed according to the real-time cheating behavior stream data, the reference cheating behavior parameter and the first user multi-threshold calculation model includes: Extracting cheating behavior parameters from the cheating behavior real-time streaming data; Inputting the cheating behavior parameter and the reference cheating behavior parameter into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the real-time stream data of the cheating behavior; The user pool to be processed is obtained according to the cheating probability of each user in each channel and the operation configuration information of the business scenario.

3. The method of claim 2, wherein: The obtaining the user pool to be processed according to the cheating probability of each user in each channel and the operation configuration information of the business scenario includes: Determine, according to the operational configuration information of the business scenario, a cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool corresponding to the business scenario; According to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or the high-call recall pool, the identification information of the user in the real-time stream data of the cheating behavior is placed into the corresponding high-precision recall pool and / or the high-call recall pool; The user pool to be processed is obtained according to the identification information in the high-precision recall pool and / or the high-recall recall pool.

4. The method of claim 3, wherein: The acquiring the to-be-processed user pool according to the identification information in the high-precision recall pool and / or the high-recall recall pool includes: Counting the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool; When the number of the identical identification information reaches a handling threshold, the identification information reaching the handling threshold is put into a user pool, and the user pool is used as the user pool to be handled.

5. The method according to claim 3 or 4, wherein: The step of determining the level handling strategy corresponding to the user to be handled in the user pool to be handled includes: Determining the source of identification information in the user pool to be processed; In response to the identification information in the to-be-processed user pool originating from the high-precision recall pool, determining that the level processing strategy for the user corresponding to the identification information originating from the high-precision recall pool is a first-level processing strategy; Alternatively, in response to the identification information in the to-be-processed user pool originating from the high-call recall pool, it is determined that the level processing strategy for the user corresponding to the identification information originating from the high-call recall pool is the second level processing strategy.

6. The method of claim 1, further comprising: Based on the anti-cheating identification model, obtaining real-time streaming data of normal user behavior from the behavior data processing request; Aggregate and calculate the real-time streaming data of the cheating behavior to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; Training a second user multi-threshold calculation model according to the real-time streaming data of the user's normal behavior, the real-time streaming data of the cheating behavior, and the composite-dimensional cheating behavior parameter; The second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model.

7. The method of claim 6, wherein: The training of the second user multi-threshold calculation model according to the real-time streaming data of the user's normal behavior, the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameter includes: Based on the real-time streaming data of the normal behavior of the user, the second user multi-threshold calculation model is trained by a semi-supervised learning method; wherein the second user multi-threshold calculation model learns the behavior parameters and ranges of normal users in this training; On the basis of completing the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior, the second user multi-threshold calculation model is continued to be trained through the semi-supervised learning method based on the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameters; wherein the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability during this training.

8. A behavior data processing device, comprising: A first acquisition module, configured to, in response to receiving a behavior data processing request, acquire cheating behavior real-time stream data from the behavior data processing request based on a preset anti-cheating recognition model; A first processing module, configured to determine a business scenario corresponding to the behavior data processing request, and obtain a reference cheating behavior parameter of the business scenario; A second acquisition module acquires a user pool to be processed according to the real-time stream data of cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model; wherein the first user multi-threshold calculation model has learned a mapping relationship between a cheating behavior parameter sample and a cheating probability; A second processing module is used to determine the level handling strategy corresponding to the user to be handled in the user pool to be handled, and based on the determined level handling strategy, perform corresponding handling on the corresponding user to be handled in the user pool to be handled; The second processing module is specifically used for: Based on the determined level handling strategy, a corresponding delay time is determined in combination with a random time factor, and after the delay time, corresponding handling is performed on the corresponding user to be handled in the user pool to be handled based on the determined level handling strategy; and / or, Based on the determined level handling strategy, the handling percentage is determined in combination with the random handling ratio factor, and based on the handling percentage, a target user to be handled is randomly selected from all users to be handled in the user pool to be handled, and the target user to be handled is handled accordingly based on the determined level handling strategy.

9. The device of claim 8, wherein: The second acquisition module is specifically used for: Extracting cheating behavior parameters from the cheating behavior real-time streaming data; Inputting the cheating behavior parameter and the reference cheating behavior parameter into the first user multi-threshold calculation model to obtain the cheating probability of each user in each channel in the real-time stream data of the cheating behavior; The user pool to be processed is obtained according to the cheating probability of each user in each channel and the operation configuration information of the business scenario.

10. The device of claim 9, wherein: The second acquisition module is specifically used for: Determine, according to the operational configuration information of the business scenario, a cheating probability threshold of the high-precision recall pool and / or the high-recall recall pool corresponding to the business scenario; According to the cheating probability of each user in each channel and the cheating probability threshold of the high-precision recall pool and / or the high-call recall pool, the identification information of the user in the real-time stream data of the cheating behavior is placed into the corresponding high-precision recall pool and / or the high-call recall pool; The user pool to be processed is obtained according to the identification information in the high-precision recall pool and / or the high-recall recall pool.

11. The device of claim 10, wherein: The second acquisition module is specifically used for: Counting the number of identical identification information in the high-precision recall pool and / or the high-recall recall pool; When the number of the identical identification information reaches a handling threshold, the identification information reaching the handling threshold is put into a user pool, and the user pool is used as the user pool to be handled.

12. The device according to claim 10 or 11, wherein: The second acquisition module is specifically used for: Determining the source of identification information in the user pool to be processed; In response to the identification information in the to-be-processed user pool originating from the high-precision recall pool, determining that the level processing strategy for the user corresponding to the identification information originating from the high-precision recall pool is a first-level processing strategy; Alternatively, in response to the identification information in the to-be-processed user pool originating from the high-call recall pool, it is determined that the level processing strategy for the user corresponding to the identification information originating from the high-call recall pool is the second level processing strategy.

13. The apparatus of claim 8, further comprising: A third acquisition module is used to acquire the real-time stream data of the user's normal behavior from the behavior data processing request based on the anti-cheating identification model; The third processing module is used to perform aggregation calculation on the real-time stream data of cheating behavior to obtain composite-dimensional cheating behavior parameters with business scenario characteristics; A training module, used for training a second user multi-threshold calculation model according to the real-time streaming data of the user's normal behavior, the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameter; The second user multi-threshold calculation model is a first version model of the user multi-threshold calculation model, and the first user multi-threshold calculation model is a second version model of the user multi-threshold calculation model.

14. The device of claim 13, wherein: The training module is specifically used for: Based on the real-time streaming data of the normal behavior of the user, the second user multi-threshold calculation model is trained by a semi-supervised learning device; wherein the second user multi-threshold calculation model learns the behavior parameters and ranges of normal users in this training; On the basis of completing the training of the second user multi-threshold calculation model based on the real-time streaming data of the user's normal behavior, the second user multi-threshold calculation model is continued to be trained through the semi-supervised learning device based on the real-time streaming data of the cheating behavior and the composite-dimensional cheating behavior parameters; wherein the second user multi-threshold calculation model learns the mapping relationship between the cheating behavior parameters and the cheating probability during this training.

15. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

16. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

17. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images