Abnormal user identification method and device, computer storage medium, and electronic device

Abstract

The present disclosure relates to the technical field of artificial intelligence, and provides an abnormal user identification method, an abnormal user identification device, a computer storage medium and an electronic device, wherein the abnormal user identification method comprises: determining historical service volume time series data corresponding to each user in a plurality of users according to a historical service volume index corresponding to the each user; predicting predicted service volume time series data of the each user in a future period according to the historical service volume time series data; generating fusion service volume time series data corresponding to the each user according to the historical service volume time series data and the predicted service volume time series data; and identifying an abnormal user from the plurality of users based on the fusion service volume time series data corresponding to the each user. The abnormal user identification method in the present disclosure can timely find abnormal users.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, and in particular, to an abnormal user identification method, an abnormal user identification device, a computer storage medium, and an electronic device. BACKGROUND

[0002] At present, the competition in the telecommunications industry in China is becoming increasingly fierce and complex. The service quality provided by similar enterprises of each other is not much different, and the competition focuses on the establishment and cultivation of customer loyalty and the establishment of customers. The service volume usage is an important indicator of customer loyalty. By characterizing the service volume usage of users, identifying abnormal users with service drops, and implementing activation, maintenance, and other measures, fine operation can be promoted, and user loss can be effectively prevented.

[0003] There are currently some schemes for identifying abnormal users using historical data. However, the above schemes have the problem of not timely discovering abnormal users, which affects the business.

[0004] Therefore, there is an urgent need in the art to develop a new abnormal user identification method and device.

[0005] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure. SUMMARY

[0006] The purpose of the present disclosure is to provide an abnormal user identification method, an abnormal user identification device, a computer storage medium, and an electronic device, thereby at least partially overcoming the technical problem of not timely discovering abnormal users due to the limitations of related technologies.

[0007] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0008] According to a first aspect of the present disclosure, an abnormal user identification method is provided, comprising: determining historical service volume time series data corresponding to each user in a plurality of users according to a historical service volume indicator corresponding to each user; predicting predicted service volume time series data of each user in a future period according to the historical service volume time series data; generating fusion service volume time series data corresponding to each user according to the historical service volume time series data and the predicted service volume time series data; and identifying an abnormal user from the plurality of users based on the fusion service volume time series data corresponding to each user.

[0009] In the example embodiment of the present disclosure, the predicted traffic time series data includes first predicted traffic time series data and second predicted traffic time series data; the predicting the predicted traffic time series data of the user in the future time period according to the historical traffic time series data includes: decomposing the historical traffic time series data into high-frequency sub-sequences and low-frequency sub-sequences based on wavelet transform; inputting the high-frequency sub-sequences into a trained Gaussian regression model to obtain the first predicted traffic time series data of the user in the future time period by the trained Gaussian regression model; inputting the low-frequency sub-sequences into a trained deep learning model to obtain the second predicted traffic time series data of the user in the future time period by the trained deep learning model; and performing inverse transformation on the first predicted traffic time series data and the second predicted traffic time series data to obtain the predicted traffic time series data of the user in the future time period.

[0010] In the example embodiment of the present disclosure, the future time period includes a plurality of continuous unit time periods, and the first predicted traffic time series data includes a predicted traffic indicator corresponding to each unit time period; the obtaining the first predicted traffic time series data of the user in the future time period by the trained Gaussian regression model includes: generating a joint probability distribution corresponding to the predicted traffic indicator by the Gaussian regression model; calculating a posterior distribution of the predicted traffic indicator according to the joint probability distribution and a prior distribution of the predicted traffic indicator; determining the predicted traffic indicator corresponding to each unit time period according to a mean value of the posterior distribution; and determining the first predicted traffic time series data according to the predicted traffic indicators corresponding to the plurality of continuous unit time periods respectively.

[0011] In the example embodiment of the present disclosure, the future time period includes a plurality of continuous unit time periods, and the first predicted traffic time series data includes a predicted traffic indicator corresponding to each unit time period; the obtaining the second predicted traffic time series data of the user in the future time period by the trained deep learning model includes: generating a likelihood function of each predicted traffic indicator by the deep learning model using the high-frequency sub-sequences; performing multiple samplings on the likelihood function to obtain a plurality of sampling values; determining an expected value corresponding to each sampling value as the predicted traffic indicator corresponding to each unit time period; and determining the second predicted traffic time series data according to the predicted traffic indicators corresponding to the plurality of continuous unit time periods respectively.

[0012] In an example embodiment of the present disclosure, after the fusion traffic time series data corresponding to each user is generated according to the historical traffic time series data and the predicted traffic time series data, the method further comprises: calculating, for the fusion traffic time series data corresponding to each user, an average value of a plurality of traffic indicators contained in the fusion traffic time series data; and if the average value meets a preset condition, removing the user from the plurality of users to update the plurality of users; wherein the preset condition comprises any one or more of the following: the average value is equal to a first preset threshold; an ordering result of the average value in a preset ordering sequence meets a preset requirement; and the preset ordering sequence is obtained by ordering the average values of the plurality of traffic indicators contained in the fusion traffic time series data corresponding to each user.

[0013] In an example embodiment of the present disclosure, after the plurality of users is updated, the method further comprises: performing smoothing processing on the fusion traffic time series data corresponding to each user after the update.

[0014] In an example embodiment of the present disclosure, the smoothing processing on the fusion traffic time series data corresponding to each user after the update comprises: for each traffic indicator in the fusion traffic time series data, obtaining N characteristic traffic indicators associated with the each traffic indicator; N is a positive integer; and updating the each traffic indicator by using an average value of the each traffic indicator and the N characteristic traffic indicators, to achieve the smoothing processing on the fusion traffic time series data.

[0015] In an example embodiment of the present disclosure, the identifying of the abnormal user from the plurality of users based on the fusion traffic time series data corresponding to each user comprises: for the fusion traffic time series data corresponding to each user, performing sliding data interception on the fusion traffic time series data by using a sliding window with a preset data interception width, to obtain a plurality of time series data segments; identifying, by using a quartile range algorithm, whether a target traffic indicator in each of the time series data segments is an abnormal value; determining a number of abnormal values in the plurality of time series data segments; and determining whether each user is the abnormal user according to the number of abnormal values and a distribution characteristic of the abnormal values, to identify the abnormal user from the plurality of users.

[0016] In the example embodiment of the present disclosure, the identifying whether the target traffic volume indicator in each of the time series data segments is an abnormal value by using the interquartile range algorithm comprises: sorting a plurality of traffic volume indicators contained in each of the time series data segments to obtain a sorting sequence; obtaining a lower quartile and an upper quartile of each of the sorting sequences, and determining an interquartile range of the sorting sequence according to the lower quartile and the upper quartile; determining a reference value by using the lower quartile and the interquartile range; determining that the target traffic volume indicator is the abnormal value if the target traffic volume indicator is less than the reference value; and determining that the target traffic volume indicator is not the abnormal value if the target traffic volume indicator is greater than or equal to the reference value.

[0017] In the example embodiment of the present disclosure, after the reference value is determined by using the lower quartile and the interquartile range, the method further comprises: obtaining an average value of M specified traffic volume indicators associated with the target traffic volume indicator; M is an integer greater than 1; determining that the target traffic volume indicator is the abnormal value if the target traffic volume indicator is less than the reference value and the average value of the M specified traffic volume indicators is greater than or equal to the reference value; and determining that the target traffic volume indicator is not the abnormal value if the target traffic volume indicator is greater than or equal to the reference value or the average value of the M specified traffic volume indicators is greater than or equal to the reference value.

[0018] In the example embodiment of the present disclosure, the distribution characteristics of the abnormal values include the number of continuously distributed abnormal values; and the determining whether each of the users is the abnormal user according to the number of abnormal values and the distribution characteristics of the abnormal values comprises: determining that the user is the abnormal user if the number of abnormal values is greater than or equal to a second preset threshold and the number of continuously distributed abnormal values is greater than or equal to a third preset threshold; and determining that the user is not the abnormal user if the number of abnormal values is less than the second preset threshold or the number of continuously distributed abnormal values is less than the third preset threshold.

[0019] According to a second aspect of the present disclosure, an abnormal user identification device is provided, which comprises: a data determination module configured to determine historical traffic volume time series data corresponding to each of a plurality of users according to historical traffic volume indicators corresponding to each of the users; a prediction module configured to predict predicted traffic volume time series data of the future period of each of the users according to the historical traffic volume time series data; a fusion module configured to generate fusion traffic volume time series data corresponding to each of the users according to the historical traffic volume time series data and the predicted traffic volume time series data; and an abnormal user identification module configured to identify abnormal users from the plurality of users based on the fusion traffic volume time series data corresponding to each of the users.

[0020] According to a third aspect of the present disclosure, a computer storage medium is provided, and the computer storage medium stores a computer program, and the computer program is executed by a processor to implement the abnormal user identification method in the first aspect.

[0021] According to a fourth aspect of the present disclosure, an electronic device is provided, and the electronic device comprises a processor and a memory for storing executable instructions of the processor, wherein the processor is configured to execute the abnormal user identification method in the first aspect by executing the executable instructions.

[0022] According to the above technical solutions, the abnormal user identification method, the abnormal user identification device, the computer storage medium and the electronic device provided in the example embodiments of the present disclosure have at least the following advantages and positive effects:

[0023] In the technical solutions provided in some embodiments of the present disclosure, on the one hand, according to the historical traffic volume indicators corresponding to each user in a plurality of users, historical traffic volume time series data corresponding to each user is determined, and predicted traffic volume time series data of each user in a future period is predicted according to the historical traffic volume time series data; fusion traffic volume time series data corresponding to each user is generated according to the historical traffic volume time series data and the predicted traffic volume time series data, and fusion traffic volume time series data in the form of “history”+“future” is constructed, so that the abnormal situation of traffic volume can be predicted in advance. On the other hand, based on the fusion traffic volume time series data corresponding to each user, an abnormal user is identified from the plurality of users, which can solve the problem that in the related art, only historical data is used to identify abnormal users, resulting in that the abnormal users are not found in time, thereby facilitating the timely discovery of abnormal users, the implementation of activation, maintenance and other measures in advance, the promotion of fine operation, the effective prevention of user loss and the improvement of user loyalty.

[0024] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0025] The drawings incorporated into the specification and forming a part of the specification, show embodiments consistent with the present disclosure, and together with the specification, serve to explain the principles of the present disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0026] Figure 1 A flowchart of an abnormal user identification method in an embodiment of the present disclosure is shown;

[0027] Figure 2A flowchart illustrating how to predict the predicted traffic time series data of each user in a future period according to historical traffic time series data in the embodiments of the present disclosure is shown;

[0028] Figure 3 A flowchart illustrating how to predict the first predicted traffic time series data of a user in a future period by using the trained Gaussian regression model in the embodiments of the present disclosure is shown;

[0029] Figure 4 A flowchart illustrating how to predict the second predicted traffic time series data of a user in a future period by using the trained deep learning model in the embodiments of the present disclosure is shown;

[0030] Figure 5 A flowchart illustrating how to predict the predicted traffic time series data of each user in a future period according to historical traffic time series data in the embodiments of the present disclosure is shown;

[0031] Figure 6 A flowchart illustrating how to identify abnormal users from a plurality of users based on the fused traffic time series data corresponding to each user in the embodiments of the present disclosure is shown;

[0032] Figure 7 A flowchart illustrating how to identify whether a target traffic indicator in each time series data segment is an abnormal value by using the interquartile range algorithm in the embodiments of the present disclosure is shown;

[0033] Figure 8 A flowchart illustrating another way of identifying whether a target traffic indicator in each time series data segment is an abnormal value in the embodiments of the present disclosure is shown;

[0034] Figure 9 A flowchart illustrating how to determine whether each user is an abnormal user according to the number of abnormal values and the distribution characteristics of abnormal values in the embodiments of the present disclosure is shown;

[0035] Figure 10 A diagram illustrating the number of users hit by the partial cumulative abnormal number and the partial continuous abnormal number, and the change trend of the off-network rate supervision factor corresponding thereto in the embodiments of the present disclosure is shown;

[0036] Figure 11 A flowchart illustrating how to identify abnormal users in the embodiments of the present disclosure is shown;

[0037] Figure 12 A structural diagram of an abnormal user identification device in the exemplary embodiments of the present disclosure is shown;

[0038] Figure 13 A structural diagram of an electronic device in the exemplary embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0039] Example implementations are now described with reference to the drawings. Example implementations can, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the example implementations to those skilled in the art. The features, structures, or characteristics described in connection with the examples can be combined in any suitable manner in one or more implementations. In the following description, numerous specific details are provided, in order to provide a thorough understanding of the example implementations. One skilled in the relevant art will recognize, however, that the implementations can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures have not been described in detail in order to avoid obscuring aspects of the implementations.

[0040] The terms "one", "a", "an", and "the" as used herein mean "at least one" or "one or more" unless expressly specified otherwise. The term "includes" means "includes but is not limited to" and the term "including" means "including, but not limited to". The term "based on" means "based, at least in part, on" unless expressly specified otherwise.

[0041] In addition, the drawings are merely schematic and are not necessarily drawn to scale. Like reference numerals designate like or similar parts throughout the drawings and the detailed description, and thus corresponding portions of the drawings and description are not repeatedly described in detail. Some of the block diagrams shown in the drawings are functional entities that do not necessarily correspond to physically or logically independent entities.

[0042] In the related art, taking traffic data as an example, there are generally the following schemes for detecting abnormal traffic data:

[0043] The first is a statistical-based anomaly detection method. Specifically, the network traffic data in a historical period is obtained; the upper and lower threshold values are calculated using the average method; the traffic data is compared with the upper and lower threshold values of the traffic, respectively; when the traffic data is higher than the upper threshold value of the traffic or the traffic data is lower than the lower threshold value of the traffic, it is determined that the traffic data is abnormal. However, this scheme has the following defects: in the case of few observations, the sample size is insufficient, which may change the original distribution of the variable, resulting in inaccurate analysis results, and it cannot adapt to the increasing complexity of network conditions and the rapid increase of traffic data.

[0044] The second is an anomaly detection method based on machine learning. Specifically, a standard Euclidean distance is introduced to measure the abnormality degree based on the traffic data in the historical period. The standard Euclidean distance is used to quantify the abnormality degree of the suspected abnormal value of the initial detection result of the isolation forest, and the X-mean algorithm and the K-means algorithm with a cluster number of 2 are used to classify the distance values. However, this scheme has the following defects: the isolation forest is only sensitive to global sparse points and is not good at processing local relative sparse points, and is not suitable for particularly high-dimensional data.

[0045] The third is also an anomaly detection algorithm based on machine learning. Specifically, network traffic data in the historical period is collected, and the network traffic data is preprocessed. The processed network traffic data is pre-extracted by using an LSTM (Long Short Term Memory) model. A decision tree improved support vector machine model is established. The optimal parameters are selected by using a cross-validation algorithm, and an optimal model is constructed. The improved vector machine model is trained to classify the extracted network traffic data features, and the classification effect is evaluated. However, this scheme has the following defects: this method is supervised learning, and it is difficult to obtain abnormal label data.

[0046] It can be seen that the above schemes are all based on historical data for data anomaly analysis, and have the defects of late abnormal traffic discovery and untimely discovery, and thus cannot timely discover related abnormal users.

[0047] In an embodiment of the present disclosure, an abnormal user identification method is first provided, which at least partially overcomes the defect of untimely abnormal user discovery in the related art.

[0048] Figure 1 A flowchart of the abnormal user identification method in the embodiment of the present disclosure is shown. The execution subject of the abnormal user identification method can be a server for identifying abnormal users.

[0049] Reference Figure 1 The abnormal user identification method according to one embodiment of the present disclosure includes the following steps:

[0050] Step S110, determining historical traffic time series data corresponding to each user according to historical traffic indicators corresponding to each user in a plurality of users;

[0051] Step S120, predicting predicted traffic time series data of each user in a future period according to the historical traffic time series data;

[0052] Step S130, generating fusion traffic time series data corresponding to each user according to the historical traffic time series data and the predicted traffic time series data;

[0053] Step S140, identifying an abnormal user from the plurality of users based on the fusion traffic time series data corresponding to each user.

[0054] In Figure 1 In the technical solution provided by the embodiment shown, on the one hand, according to the historical traffic indicators corresponding to each user in the plurality of users, historical traffic time series data corresponding to the each user is determined, and prediction traffic time series data of the each user in a future period is predicted according to the historical traffic time series data; the fusion traffic time series data corresponding to the each user is generated according to the historical traffic time series data and the prediction traffic time series data, the fusion traffic time series data in the form of "history" + "future" is constructed, and the advance prediction of the traffic abnormal situation is realized. On the other hand, based on the fusion traffic time series data corresponding to the each user, an abnormal user is identified from the plurality of users, which can solve the problem that in the related art, only historical data is used to identify abnormal users, resulting in that the abnormal users are not found in time, thereby being beneficial to finding the abnormal users in time, taking measures such as activation and maintenance in advance, promoting fine operation, effectively preventing user loss, and improving user loyalty.

[0055] The specific implementation process of each step in Figure 1 is described in detail as follows:

[0056] The abnormal user in the present disclosure refers to a traffic sudden drop user, i.e., a user with rapid and large reduction in traffic, wherein the traffic indicator can be traffic, traffic volume, SMS volume, MMS volume, etc., which can be set by the user according to the actual situation, and the present disclosure does not make special limitation thereon, and the following embodiment is described by taking traffic as an example.

[0057] In step S110, according to the historical traffic indicators corresponding to each user in the plurality of users, historical traffic time series data corresponding to the each user is determined.

[0058] In this step, the plurality of users can be all users of an operator except for traffic suppression users among all users online. The traffic suppression user refers to a user who is pre-given some free traffic quota, for example, a user is given a 10 GB (gigabyte, 1 GB = 1024 MB) traffic package in December. On December 25, the 10 GB traffic remains 0.5 GB. At this time, the user's traffic suppression behavior may be triggered (for example, the user will try not to use or use less traffic in the remaining 6 days of December), so that the user's traffic use will be greatly reduced compared to before December 25. Such a user is considered a traffic suppression user. In order to avoid identifying such a user as an abnormal user with a traffic surge in the future, the traffic suppression user can be pre-identified, and then the traffic suppression user is excluded, that is, the user of the operator except the traffic suppression user is determined as the plurality of users.

[0059] The historical traffic indicator can be the traffic used every day within 45 days before the current time. The specific time length can be set by the actual situation, and the present disclosure does not make special limitations thereon.

[0060] For example, after obtaining the historical traffic indicator corresponding to each user in the plurality of users, the historical traffic indicators can be spliced in chronological order to obtain the historical traffic time series data x(t) corresponding to each user, t = 1, 2, …, T.

[0061] After obtaining the historical traffic time series data corresponding to each user, the method can proceed to step S120, and the historical traffic time series data is used to predict the predicted traffic time series data of each user in a future period.

[0062] For example, the future period can be 7 days, 14 days, etc. after the current date, which can be set by the actual situation, and the present disclosure does not make special limitations thereon. In the following embodiment, 14 days are taken as an example for illustration. When the future period is 14 days, each day in the 14 days is referred to as a unit period.

[0063] Reference can be made to Figure 2 , Figure 2 A flowchart showing how to predict the predicted traffic time series data of each user in a future period according to the historical traffic time series data in the embodiment of the present disclosure is shown, which includes steps S201-S204:

[0064] In step S201, the historical traffic time series data is decomposed into a high-frequency subsequence and a low-frequency subsequence based on wavelet transform.

[0065] In this step, the wavelet transform is to discretize the scale and translation of the basic wavelet. The wavelet transform can not only know the frequency components in the time series, but also know the specific location of these frequencies in the time domain, that is, the time-frequency spectrum can be obtained.

[0066] The formula of the wavelet transform can be expressed as: DWT(x(t)) = [h(t), l(t)], the principle of which is that the above historical traffic time series data is respectively input into the low-pass filter and the high-pass filter, the data output by the high-pass filter is down-sampled to obtain the above high-frequency subsequence h(t), and the data output by the low-pass filter is down-sampled to obtain the above low-frequency subsequence l(t).

[0067] Among them, the high-frequency subsequence h(t) reflects the suddenness and irregularity of the time series, and the low-frequency subsequence l(t) reflects the periodicity and long-term dependence of the time series.

[0068] In step S202, the high-frequency subsequence is input into the trained Gaussian regression model to obtain the first predicted traffic time series data of the user in the future period by the trained Gaussian regression model.

[0069] In this step, the Gaussian process model is a kernel-based non-parametric probability model that uses Gaussian process (GP) prior to perform regression analysis on data.

[0070] After training the above Gaussian regression model, the following can be referred to Figure 3 , Figure 3 A flowchart showing how to predict the first predicted traffic time series data of the user in the future period by the trained Gaussian regression model in the embodiment of the present disclosure is shown, which includes steps S301-S304:

[0071] In step S301, the joint probability distribution corresponding to the predicted traffic index is generated by the Gaussian regression model.

[0072] In this step, it is assumed that m i is the high-frequency subsequence of the user i, m i = [m1 i , m2 i , …, m n i ], n is the sequence length, and then the sample set D: (x, y) can be generated using m i , let f(x i ) = y i , so that the vector f = [f(x1), f(x2), …, f(x n )] can be obtained, and f obeys the joint probability distribution N(0, K), and K is the covariance matrix.

[0073] Further, the covariance matrix can be calculated using an RBF kernel function, which can be expressed as: where a is a hyperparameter and l is a parameter to be determined by learning. Specifically, the optimal hyperparameter can be obtained by maximum likelihood probability method to calculate the covariance matrix, so as to determine the joint probability distribution.

[0074] In step S302, the posterior distribution of the predicted traffic index is calculated according to the joint probability distribution and the prior distribution of the predicted traffic index.

[0075] In this step, the Gaussian regression model can calculate the posterior distribution of the traffic index to be predicted p(f|f) according to the joint probability distribution p(f,f) and the prior distribution p(f) of the predicted traffic index by Bayes formula. * * The Bayes formula is shown in the following formula 1:

[0076]

[0077] In step S303, the predicted traffic index corresponding to each unit period is determined according to the mean of the posterior distribution.

[0078] In this step, the Gaussian regression model can take the mean of the posterior distribution, and determine the mean as the predicted traffic index of each unit period.

[0079] In step S304, the first predicted traffic time series data is determined according to the predicted traffic index corresponding to each of the plurality of consecutive unit periods.

[0080] In this step, the predicted traffic index corresponding to each of the plurality of consecutive unit periods can be spliced in time sequence to obtain the first predicted traffic time series data h'.

[0081] Next, referring to Figure 2 In step S203, the low-frequency subsequence is input into the trained deep learning model to predict the second predicted traffic time series data of the user in the future period by the trained deep learning model.

[0082] In this step, the deep learning model can be trained in the following way:

[0083] Suppose z i is the low-frequency subsequence of user i, and z i = [z1 i , z2 i , …, z n i ​[], where n is the sequence length. During training, at each time step t, the model's input includes the covariate x. i,t The value z of the previous time step i,t-1 And the state h of the previous time step. i,t-1 Using the above input parameters, first calculate the current hidden state h(h). i,t-1 ,z i,t-1 ,x i,t ,∈), and then calculate the parameter θh of the likelihood function l(z|θ). i,t =θ(h) i,t Finally, by maximizing the log-likelihood: l = ∑ i ∑ t logl(z i,t |θ(h i,t The parameters of the model are determined.

[0084] The likelihood function can be formed by a Gaussian distribution and can be expressed as: The Gaussian distribution can be parameterized using the expected value μ and the standard deviation σ. The expected value μ is given by the affine transformation function of the neural network output, while σ is obtained by the affine transformation following the softplus activation function.

[0085] After training the above deep learning model, you can refer to... Figure 4 , Figure 4 This illustration shows a flowchart of how a trained deep learning model predicts the second predicted business volume time series data of a user in a future period, including steps S401-S404:

[0086] In step S401, a likelihood function for each predicted business volume indicator is generated using a deep learning model with high-frequency subsequences.

[0087] In this step, the deep learning model can convert high-frequency subsequences into hidden state vectors, and then use the hidden state vectors to predict the likelihood function of the predicted business volume index.

[0088] In step S402, the likelihood function is sampled multiple times to obtain multiple sample values.

[0089] In this step, the likelihood function can be sampled multiple times to obtain multiple sample values.

[0090] In step S403, the expected values ​​corresponding to multiple sampled values ​​are determined as the predicted business volume index for each unit time period.

[0091] In this step, the expected value corresponding to the above multiple sample values ​​can be calculated, and the expected value can be determined as the predicted business volume indicator for each unit time period.

[0092] Wherein, the mathematical expectation (or mean, also simply referred to as expectation) is the sum of the probability of each possible result in the test multiplied by its result, which reflects the average value of the random variable.

[0093] In step S404, the second predicted traffic time series data is determined according to the predicted traffic indicators corresponding to the plurality of consecutive unit time periods respectively.

[0094] In this step, the predicted traffic indicators corresponding to the plurality of consecutive unit time periods respectively can be spliced to obtain the second predicted traffic time series data l'.

[0095] The present disclosure can solve the prediction error problem caused by the fact that the traditional traffic prediction only uses a certain type of prediction method without considering the stability and continuity of the traffic time series data by matching different prediction models for different types of time series data, specifically, using a deep learning model for low-frequency regularity data and using a Gaussian regression model for high-frequency regularity weak data. The prediction result is a probability distribution, which is better than the traditional direct prediction using the same model and has higher accuracy.

[0096] Next, referring to Figure 2 In step S204, the first predicted traffic time series data and the second traffic time series data are inversely transformed to obtain the predicted traffic time series data of the user in the future period.

[0097] In this step, the first predicted traffic time series data h' and the second traffic time series data l' can be inversely transformed by discrete wavelet to obtain the predicted traffic time series data of the user in the future period.

[0098] Wherein, the formula of the inverse discrete wavelet transform can be expressed as the following formula 2:

[0099] IDWT(h',l')=[x(T+1),x(T+2),x(T+3),…,x(T+14)] Formula 2

[0100] Referring to Figure 5 , Figure 5 The overall flowchart of how to predict the predicted traffic time series data of each user in the future period according to the historical traffic time series data in the embodiment of the present disclosure is shown, which includes steps S501-S509:

[0101] In step S501, the historical traffic time series data of the user is obtained;

[0102] In step S502, the historical traffic time series data is inversely transformed by discrete wavelet;

[0103] In step S503, it is judged whether the sequence obtained by the discrete wavelet transform is a low-frequency sub-sequence.

[0104] If it is a low-frequency sub-sequence, it is entered into step S504, the prediction traffic time series data of the future period is predicted by using a deep learning model (DeepAR model), it is entered into step S505, and the second prediction traffic time series data is outputted.

[0105] If it is not a low-frequency sub-sequence, it is entered into step S506, the prediction traffic time series data of the future period is predicted by using a Gaussian regression model (GPR model), it is entered into step S507, and the first prediction traffic time series data is outputted.

[0106] In step S508, the discrete wavelet inverse transform is performed.

[0107] In step S509, the prediction traffic time series data of the future period of each user is obtained.

[0108] The present disclosure converts the historical traffic time series data into a high-frequency sub-sequence and a low-frequency sub-sequence by using the discrete wavelet transform, respectively predicts the high-frequency and low-frequency sub-sequences by using a Gaussian review model and a deep autoregressive learning model, and finally uses the discrete wavelet inverse transform and reconstruction to predict the future user traffic, thereby improving the prediction accuracy.

[0109] Next, reference is made to Figure 1 In step S130, the fusion traffic time series data corresponding to each user is generated according to the historical traffic time series data and the prediction traffic time series data.

[0110] In this step, the historical traffic time series data and the prediction traffic time series data are spliced to obtain the fusion traffic time series data corresponding to each user.

[0111] The present disclosure predicts the future traffic of the user, fuses the prediction traffic with the historical traffic, and obtains the traffic time series data with predictability, thereby solving the problem of delayed identification and identification with hysteresis caused by only using the historical traffic to identify the abnormal traffic and the abnormal user in the related art, so as to timely find the abnormal user and avoid the adverse effects on the business.

[0112] After step S130, the fusion traffic time series data can be used to update the plurality of users.

[0113] In an alternative embodiment, the number of days in which the traffic index is 0 in the half month before the current time can be determined. If the number of days in which the traffic index is 0 is greater than 7 days, it can be determined that the user is a silent user rather than an abnormal user with a sudden drop in traffic, and the user is excluded from the plurality of users.

[0114] In another alternative embodiment, for the fusion traffic time series data corresponding to each user, the average value of the plurality of traffic indexes included in the fusion traffic data can be calculated first, and then it is determined whether the average value is equal to the first preset threshold. When the average value is equal to the first preset threshold, the user is excluded from the plurality of users, and the related data of the user does not need to be processed, and whether the user is an abnormal user does not need to be identified.

[0115] For example, the first preset threshold can be 0, so that after calculating the average value of all traffic indexes included in the fusion traffic data sequence, if the average value is 0, it can be determined that the current user is a silent user rather than an abnormal user with a sudden drop in traffic, and then the user can be excluded from the plurality of users.

[0116] In still another alternative embodiment, the average value of the traffic indexes included in the fusion traffic time series data corresponding to each user can be calculated, and then the plurality of average values corresponding to the plurality of users are sorted. After sorting, the users whose sorting results are in the top 20% can be excluded from the plurality of users.

[0117] Thus, related silent users can be excluded from the plurality of users, which excludes the condition that does not necessarily meet the sudden drop in traffic, thereby reducing the amount of data to be processed and improving the speed of subsequent identification of abnormal users.

[0118] After updating the plurality of users, the fusion traffic time series data corresponding to each updated user can also be smoothed. Specifically, for each traffic index in the fusion traffic time series data corresponding to each user, N characteristic traffic indexes associated with each traffic index can be obtained, and each traffic index and the average value of the N characteristic traffic indexes are used to update each traffic index to achieve smoothing of the fusion traffic time series data.

[0119] For example, taking N as 2, the N characteristic traffic indexes associated with each traffic index are taken as an example, and the traffic indexes of the two days before the date corresponding to the traffic index are taken as an example. For any traffic index F n It can be updated by using the following formula 3:

[0120]

[0121] G n F n , F n-1 F n F n-2 F n F F n-2 F n-1 F n F

[0122] Thus, each traffic volume indicator in the fused traffic volume time series data can be updated by using the above formula, so as to realize the smoothing processing of the fused traffic volume data, thereby reducing the abruptness of the fused traffic volume data.

[0123] After removing part of the users and smoothing the fused traffic volume time series data corresponding to the remaining users, the step S140 can be entered, in which, based on the fused traffic volume time series data corresponding to each user, an abnormal user is identified from the plurality of users.

[0124] In this step, the following formula can be used to identify the abnormal user from the plurality of users: Figure 6 Figure 6 The following shows a flow diagram illustrating how to identify the abnormal user from the plurality of users based on the fused traffic volume time series data corresponding to each user in the embodiments of the present disclosure, which includes steps S601-S604:

[0125] In step S601, for the fused traffic volume time series data corresponding to each user, a sliding window with a preset data interception width is used to slide and intercept the data of the fused traffic volume time series data, so as to obtain a plurality of time series data segments.

[0126] In this step, the fused traffic volume time series data is taken as an example, which includes the historical traffic volume time series data of the past 45 days + the predicted traffic volume time series data of the future 14 days (i.e. the first day to the 14th day). For example, the first day in the future is represented as T, the dates corresponding to the historical traffic volume time series data can be represented as (T-45, T-44, T-43, …, T-1), the dates corresponding to the predicted traffic volume time series data can be represented as (T, T+1, T+2, T+3, …, T+13), and thus, the dates corresponding to the fused traffic volume time series data can be represented as (T-45, T-44, T-43, …, T-1, T, T+1, T+2, T+3, …, T+13).

[0127] ​Taking the sliding window length of the preset data width of 37 (containing 30 days of historical traffic indicators + 7 days of predicted traffic indicators) as an example, first, the first time series segment corresponding to the date (T-30, T-29, T-28, …, T-1, T, T+1, …, T+6) can be cut from the fused traffic time series data; then the second time series segment corresponding to the date (T-29, T-28, …, T-1, T, T+1, …, T+7) can be cut from the fused traffic time series data; then the third time series segment corresponding to the date (T-28, T-28, …, T-1, T, T+1, …, T+8) can be cut from the fused traffic time series data; …; similarly, until the eighth time series segment corresponding to (T-24, T-28, …, T-1, T, T+1, …, T+13) is cut from the fused traffic time series data.

[0128] The present disclosure considers the non-fixedness of data and the regular change of data by constructing a sliding window with a fixed window size and sliding the window according to the date, greatly reduces the influence of data noise on the data processing result, and improves the accuracy of the subsequent data processing result.

[0129] In step S602, whether the target traffic indicator in each time series data segment is an abnormal value is identified by using the interquartile range algorithm.

[0130] In this step, after obtaining the plurality of time series data segments, whether the target traffic indicator in each time series data segment is an abnormal value can be identified by using the interquartile range algorithm.

[0131] Specifically, whether the target traffic indicator corresponding to the date T in the first time series data segment is an abnormal value can be identified by using the interquartile range algorithm, whether the target traffic indicator corresponding to the date T+1 in the second time series data segment is an abnormal value can be identified, whether the target traffic indicator corresponding to the date T+2 in the third time series data segment is an abnormal value can be identified, whether the target traffic indicator corresponding to the date T+3 in the fourth time series data segment is an abnormal value can be identified, …, and whether the target traffic indicator corresponding to the date T+7 in the eighth time series data segment is an abnormal value can be identified.

[0132] Reference Figure 7 , Figure 7 A flowchart showing how to identify whether the target traffic indicator in each time series data segment is an abnormal value by using the interquartile range algorithm in the embodiment of the present disclosure is shown, which includes steps S701-S705:

[0133] In step S701, the plurality of traffic indicators contained in each time series data segment are sorted to obtain a sorted sequence.

[0134] In this step, taking the first time series data segment as an example, the plurality of traffic indicators contained in the first time series data segment can be sorted in ascending order to obtain a sorted sequence.

[0135] In step S702, the lower quartile and the upper quartile of the sorted sequence are obtained, and the interquartile range of the sorted sequence is determined according to the lower quartile and the upper quartile.

[0136] In this step, after obtaining the sorted sequence, the lower quartile Q1 and the upper quartile Q3 of the sorted sequence can be obtained. The lower quartile refers to the value at the 25% position in the sorted sequence, and the upper quartile refers to the value at the 75% position in the sorted sequence.

[0137] After calculating the upper quartile and the lower quartile, the difference between the upper quartile and the lower quartile can be used to determine the interquartile range, that is, the interquartile range IQR = Q3-Q1.

[0138] In step S703, a reference value is determined using the lower quartile and the interquartile range.

[0139] In this step, the reference value Wd can be determined based on the following formula 4:

[0140] Wd = Q1-1.5*IQR Formula 4

[0141] In step S704, if the target traffic indicator is less than the reference value, the target traffic indicator is determined to be an outlier.

[0142] In this step, the target traffic indicator corresponding to date T in the first time series data segment can be compared with the reference value Wd. If it is less than Wd, it can be determined that the target traffic indicator corresponding to date T in the first time series data segment is an outlier.

[0143] In step S705, if the target traffic indicator is greater than or equal to the reference value, the target traffic indicator is determined to be not an outlier.

[0144] In this step, if the target traffic indicator corresponding to date T in the first time series data segment is greater than or equal to Wd, it can be determined that the target traffic indicator corresponding to date T in the first time series data segment is not an outlier.

[0145] It should be noted that after step S703, in order to improve the accuracy of outlier detection, the following formula 5 can also be referred to: Figure 8 , Figure 8A flowchart for identifying whether the target traffic volume indicator in each time series data segment is an abnormal value is shown, comprising steps S801-S803:

[0146] In step S801, the average value of the M specified traffic volume indicators associated with the target traffic volume indicator is obtained.

[0147] In this step, taking M as 7 as an example, the M specified traffic volume indicators can be the traffic volume indicators of each day after the date T corresponding to the target traffic volume indicator, so that the average value of the M specified traffic volume indicators can be obtained based on the following formula 5:

[0148]

[0149] Wherein, V p represents the average value of the traffic volume indicators of each day after the date T, F1, F2, F3, F4, F5, F6, and F7 represent the traffic volume indicators of each day after the date T corresponding to the target traffic volume indicator.

[0150] In step S802, if the target traffic volume indicator is less than the reference value, and the average value of the M specified traffic volume indicators is greater than or equal to the reference value, it is determined that the target traffic volume indicator is an abnormal value.

[0151] In this step, if the target traffic volume indicator corresponding to the date T in the first time series data segment is less than Wd, and V p is less than Wd, it can be determined that the target traffic volume indicator corresponding to the date T in the first time series data segment is an abnormal value.

[0152] In step S803, if the target traffic volume indicator is greater than or equal to the reference value, or the average value of the M specified traffic volume indicators is greater than or equal to the reference value, it is determined that the target traffic volume indicator is not an abnormal value.

[0153] In this step, if the target traffic volume indicator corresponding to the date T in the first time series data segment is greater than or equal to Wd, and V p is greater than or equal to Wd, it can be determined that the target traffic volume indicator corresponding to the date T in the first time series data segment is not an abnormal value.

[0154] Similarly, whether the target traffic volume indicator in each time series data segment is an abnormal value can be determined.

[0155] In this disclosure, by introducing the off-grid rate supervision factor, the abnormal value identification scheme is innovated, the accurate identification of abnormal values is realized, the traditional abnormal detection is only data level abnormal detection, which is easily affected by data volatility, and there are disadvantages such as unreasonable and inaccurate abnormal detection, and the accuracy of the abnormal value identification result is improved.

[0156] Next, refer to Figure 6 In step S603, the number of abnormal values in the plurality of time series data segments is determined.

[0157] In this step, the number of abnormal values in the plurality of time series data segments can be determined, that is, the total number of abnormal target traffic indicators in the above-mentioned eight data time series data segments, which can be referred to as the cumulative number of abnormalities.

[0158] Referring to the related explanation of step S602, if the abnormal target traffic indicators in the above-mentioned eight data time series data segments are identified as: the target traffic indicator corresponding to date T+1, the target traffic indicator corresponding to date T+4, the target traffic indicator corresponding to date T+5, the target traffic indicator corresponding to date T+6, and the target traffic indicator corresponding to date T+7, it can be determined that the cumulative number of abnormalities is 5.

[0159] In step S604, according to the number of abnormal values and the distribution characteristics of abnormal values, it is determined whether each user is an abnormal user to identify abnormal users from a plurality of users.

[0160] In this step, the distribution characteristics of abnormal values can be the number of consecutive abnormal values (which can be referred to as the number of consecutive abnormalities), for example, referring to the related explanation of step S603, the number of consecutive abnormal values is 4 (i.e., the target traffic indicator corresponding to date T+4, the target traffic indicator corresponding to date T+5, the target traffic indicator corresponding to date T+6, and the target traffic indicator corresponding to date T+7).

[0161] Referring to Figure 9 , Figure 9 A flowchart showing how to determine whether each user is an abnormal user according to the number of abnormal values and the distribution characteristics of abnormal values in the embodiments of the present disclosure is shown, including steps S901-S902:

[0162] In step S901, if the number of abnormal values is greater than or equal to a second preset threshold, and the number of consecutively distributed abnormal values is greater than or equal to a third preset threshold, it is determined that the current user is an abnormal user.

[0163] In this step, first, the specific implementation of how to determine the above-mentioned second preset threshold and the above-mentioned fourth threshold is described:

[0164] The cumulative number of abnormalities and the number of consecutive abnormalities corresponding to each user in the above-mentioned updated plurality of users can be counted, and the numerical range of the cumulative number of abnormalities, for example: 3-8, and the numerical range of the number of consecutive abnormalities, for example: 3-8, can be counted.

[0165] Further, the off-network rate supervision factor corresponding to different cumulative abnormal number and different continuous abnormal number can be calculated based on the following formula 6:

[0166]

[0167] The off-network rate refers to the proportion of off-network users (e.g., users who log out of the SIM card) in the users hit by different cumulative abnormal number and different continuous abnormal number within a preset number of days (e.g., 20 days). For example, assuming that 100 users are hit by cumulative abnormal number 3 and continuous abnormal number 3, and there are 20 off-network users among the 100 users, the off-network rate corresponding to cumulative abnormal number 3 and continuous abnormal number 3 is 20 / 100 = 20%.

[0168] The coverage rate refers to the proportion of off-network users in all users of the operator. For example, assuming that there are 10,000 users under the operator, the coverage rate can be 20 / 10,000 = 0.2%.

[0169] Referring to Table 1, Table 1 shows the off-network rate supervision factor corresponding to different cumulative abnormal number and different continuous abnormal number:

[0170] Table 1

[0171]

[0172]

[0173] In addition, referring to Figure 10 , Figure 10 shows the schematic diagram of the change trend of the number of users hit by part of the cumulative abnormal number and part of the continuous abnormal number, and the off-network rate supervision factor corresponding thereto in the embodiment of the present disclosure, by Figure 10 It can be seen that the continuous abnormal number 4 days and the cumulative abnormal number 6 days hit a total of 245 users, and the corresponding off-network rate supervision factor is 5.5%; the continuous abnormal number 5 days and the cumulative abnormal number 6 days hit a total of 185 users, and the corresponding off-network rate supervision factor is 5.9%; the continuous abnormal number 5 days and the cumulative abnormal number 7 days hit a total of 155 users, and the corresponding off-network rate supervision factor is 5.1%; the continuous abnormal number 5 days and the cumulative abnormal number 8 days hit a total of 135 users, and the corresponding off-network rate supervision factor is 4.7%. Therefore, the value of the off-network rate supervision factor corresponding to the continuous abnormal number 5 days and the cumulative abnormal number 6 days is the largest.

[0174] Further, the disclosure obtains the following through monitoring and analyzing the off-network rate and coverage corresponding to different continuous abnormal numbers, different cumulative abnormal numbers: the coverage of off-network users corresponding to the continuous abnormal number of 4 days and the cumulative abnormal number of 6 days is the largest, and the off-network rate is the lowest; the coverage of off-network users corresponding to the continuous abnormal number of 5 days and the cumulative abnormal number of 6 days decreases, and the off-network rate increases; the coverage of off-network users corresponding to the continuous abnormal number of 5 days and the cumulative abnormal number of 7 days continuously decreases, and the off-network rate continuously increases; the coverage of off-network users corresponding to the continuous abnormal number of 5 days and the cumulative abnormal number of 8 days is the highest, and the off-network rate is the highest.

[0175] Therefore, based on the above analysis, Table 1, Figure 10 The cumulative abnormal number (6) corresponding to the largest off-network rate supervision factor can be determined as the second preset threshold, and the continuous abnormal number (5) corresponding to the largest off-network rate supervision factor can be determined as the third preset threshold.

[0176] Further, if the number of abnormal values corresponding to the user is greater than or equal to the second preset threshold, and the number of continuously distributed abnormal values is greater than or equal to the third preset threshold, the user can be determined as an abnormal user of traffic sudden drop.

[0177] In step S902, if the number of abnormal values is less than the second preset threshold, or the number of continuously distributed abnormal values is less than the third preset threshold, it is determined that the user is not the abnormal user.

[0178] In this step, if the number of abnormal values corresponding to a certain user is less than the second preset threshold, or the number of continuously distributed abnormal values is less than the third preset threshold, it can be determined that the user is not an abnormal user.

[0179] Reference Figure 11 , Figure 11 An overall flowchart showing how to identify abnormal users in the embodiment of the disclosure is shown, including steps S1101-S1105:

[0180] In step S1101, fusion traffic time series data (history + future) is constructed.

[0181] In step S1102, preprocessing is performed.

[0182] In step S1103, abnormal value identification based on a sliding window is performed.

[0183] In step S1104, abnormal user identification based on an off-network rate supervision factor is performed.

[0184] In step S1105, an abnormal user identification result is output.

[0185] Based on the above technical solutions, the disclosure has at least the following technical effects:

[0186] First, by constructing the "history" + "future" fusion traffic time series data, the abnormal value of traffic is predicted in advance, so as to realize the early prediction of abnormal user of traffic;

[0187] Second, based on discrete wavelet combined with Gaussian regression model and deep autoregressive model, the accurate prediction of future traffic is realized;

[0188] Third, by introducing the off-grid rate supervision factor when identifying abnormal users, a new method for determining abnormal users is provided, and the identification accuracy of abnormal users of traffic is improved.

[0189] The present disclosure also provides an abnormal user identification device, Figure 12 The structure schematic diagram of the abnormal user identification device in the exemplary embodiment of the present disclosure is shown. As shown in the figure, Figure 12 The abnormal user identification device 1200 can include a data determination module 1210, a prediction module 1220, a fusion module 1230 and an abnormal user identification module 1240. Among them:

[0190] The data determination module 1210 is configured to determine the historical traffic time series data corresponding to each user in the plurality of users according to the historical traffic index corresponding to each user;

[0191] The prediction module 1220 is configured to predict the predicted traffic time series data of each user in the future period according to the historical traffic time series data;

[0192] The fusion module 1230 is configured to generate the fusion traffic time series data corresponding to each user according to the historical traffic time series data and the predicted traffic time series data;

[0193] The abnormal user identification module 1240 is configured to identify the abnormal user from the plurality of users based on the fusion traffic time series data corresponding to each user.

[0194] In an example embodiment of the present disclosure, the predicted traffic time series data includes first predicted traffic time series data and second predicted traffic time series data; the prediction module 1220 predicts the predicted traffic time series data of the user in the future period according to the historical traffic time series data, including: decomposing the historical traffic time series data into high-frequency subsequences and low-frequency subsequences based on wavelet transform; inputting the high-frequency subsequences into the trained Gaussian regression model to obtain the first predicted traffic time series data of the user in the future period by the trained Gaussian regression model; inputting the low-frequency subsequences into the trained deep learning model to obtain the second predicted traffic time series data of the user in the future period by the trained deep learning model; and performing inverse transformation on the first predicted traffic time series data and the second traffic time series data to obtain the predicted traffic time series data of the user in the future period.

[0195] In an example embodiment of the present disclosure, the future period includes a plurality of continuous unit periods, and the first predicted traffic time series data includes a predicted traffic indicator corresponding to each unit period; the prediction module 1220 predicts the first predicted traffic time series data of the user in the future period by the trained Gaussian regression model, including: generating a joint probability distribution corresponding to the predicted traffic indicator by the Gaussian regression model; calculating a posterior distribution of the predicted traffic indicator according to the joint probability distribution and a prior distribution of the predicted traffic indicator; determining the predicted traffic indicator corresponding to each unit period according to a mean value of the posterior distribution; and determining the first predicted traffic time series data according to the predicted traffic indicators corresponding to the plurality of continuous unit periods respectively.

[0196] In an example embodiment of the present disclosure, the future period includes a plurality of continuous unit periods, and the first predicted traffic time series data includes a predicted traffic indicator corresponding to each unit period; the prediction module 1220 predicts the second predicted traffic time series data of the user in the future period by the trained deep learning model, including: generating a likelihood function of each predicted traffic indicator by the deep learning model using the high-frequency subsequences; sampling the likelihood function multiple times to obtain a plurality of sampling values; determining an expected value corresponding to the plurality of sampling values as the predicted traffic indicator corresponding to each unit period; and determining the second predicted traffic time series data according to the predicted traffic indicators corresponding to the plurality of continuous unit periods respectively.

[0197] In an example embodiment of the present disclosure, after generating the fusion traffic time series data corresponding to each user according to the historical traffic time series data and the predicted traffic time series data, the fusion module 1230 is configured to:

[0198] For the fusion traffic time series data corresponding to each user, an average value of a plurality of traffic indicators contained in the fusion traffic time series data is calculated; if the average value meets a preset condition, the user is excluded from the plurality of users to update the plurality of users; wherein the preset condition includes any one or more of the following: the average value is equal to a first preset threshold; an ordering result of the average value in a preset ordering sequence meets a preset requirement; the preset ordering sequence is obtained by ordering the average values of the plurality of traffic indicators contained in the fusion traffic time series data corresponding to each user.

[0199] In an exemplary embodiment of the present disclosure, after updating the plurality of users, the fusion module 1230 is configured to:

[0200] Smooth the fusion traffic time series data corresponding to each updated user.

[0201] In an exemplary embodiment of the present disclosure, the fusion module 1230 smooths the fusion traffic time series data corresponding to each updated user, including: for each traffic indicator in the fusion traffic time series data, obtaining N characteristic traffic indicators associated with the each traffic indicator; N is a positive integer; updating the each traffic indicator by using the average value of the each traffic indicator and the N characteristic traffic indicators, to achieve smoothing of the fusion traffic time series data.

[0202] In an exemplary embodiment of the present disclosure, the abnormal user identification module 1240 identifies an abnormal user from the plurality of users based on the fusion traffic time series data corresponding to each user, including: for the fusion traffic time series data corresponding to each user, slidingly intercepting data of the fusion traffic time series data with a sliding window of a preset data interception width to obtain a plurality of time series data segments; identifying whether a target traffic indicator in each of the time series data segments is an abnormal value by using a quartile range algorithm; determining the number of abnormal values in the plurality of time series data segments; determining whether the each user is the abnormal user according to the number of abnormal values and the distribution characteristics of the abnormal values, to identify the abnormal user from the plurality of users.

[0203] In an example embodiment of the present disclosure, the abnormal user identification module 1240 identifies whether a target traffic volume indicator in each of the time series data segments is an abnormal value using a interquartile range algorithm, including: sorting a plurality of traffic volume indicators contained in each of the time series data segments to obtain a sorted sequence; obtaining a lower quartile and an upper quartile of each of the sorted sequences, and determining an interquartile range of the sorted sequence according to the lower quartile and the upper quartile; determining a reference value using the lower quartile and the interquartile range; determining that the target traffic volume indicator is the abnormal value if the target traffic volume indicator is less than the reference value; and determining that the target traffic volume indicator is not the abnormal value if the target traffic volume indicator is greater than or equal to the reference value.

[0204] In an example embodiment of the present disclosure, after determining a reference value using the lower quartile and the interquartile range, the abnormal user identification module 1240 is configured to:

[0205] obtain an average value of M specified traffic volume indicators associated with the target traffic volume indicator; M is an integer greater than 1; determine that the target traffic volume indicator is the abnormal value if the target traffic volume indicator is less than the reference value and the average value of the M specified traffic volume indicators is greater than or equal to the reference value; and determine that the target traffic volume indicator is not the abnormal value if the target traffic volume indicator is greater than or equal to the reference value or the average value of the M specified traffic volume indicators is greater than or equal to the reference value.

[0206] In an example embodiment of the present disclosure, the distribution characteristics of the abnormal values include a number of continuously distributed abnormal values; and the abnormal user identification module 1240 determines whether each of the users is the abnormal user according to the number of abnormal values and the distribution characteristics of the abnormal values, including: determining that the user is the abnormal user if the number of abnormal values is greater than or equal to a second preset threshold and the number of continuously distributed abnormal values is greater than or equal to a third preset threshold; and determining that the user is not the abnormal user if the number of abnormal values is less than the second preset threshold or the number of continuously distributed abnormal values is less than the third preset threshold.

[0207] The specific details of the modules in the above abnormal user identification device have been described in detail in the corresponding abnormal user identification method, and therefore will not be described here again.

[0208] It should be noted that although several modules or units of the devices for action execution are mentioned in the above detailed description, such division is not mandatory. Indeed, features and functionalities of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functionalities of one module or unit described above can be further divided into multiple modules or units for embodiment.

[0209] Further, although the various steps of the methods in the present disclosure are described in a particular order in the drawings, this is not required or implied as to the order of the steps or that all of the steps shown must be performed to achieve a desirable result. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, one step can be broken into multiple steps, etc.

[0210] From the above description of the embodiments, those skilled in the art will readily appreciate that the example embodiments described herein can be implemented by software and / or by hardware. Embodiments according to the present disclosure can therefore be realized in a software selective product stored in a non-transitory storage medium such as a CD-ROM, a USB key, a mobile hard disk, etc. or present on a network, comprising a plurality of instructions to make a computer device (personal computer, server, mobile terminal, network device, etc.) carry out the methods according to the embodiments of the present disclosure.

[0211] The present application also provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device.

[0212] The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device.

[0213] The computer readable storage medium can also be distributed among computer systems connected through a network and executed on a distributed manner. Also, functional programs, codes, and code segments for accomplishing the various purposes of some embodiments of the present disclosure can be easily derived by programmers skilled in the art to which the present disclosure pertains.

[0214] The computer readable storage medium can also be distributed among computer systems connected through a network and executed on a distributed manner. Also, functional programs, codes, and code segments for accomplishing the various purposes of some embodiments of the present disclosure can be easily derived by programmers skilled in the art to which the present disclosure pertains.

[0215] In addition, an electronic device capable of implementing the above method is provided in the embodiments of the present disclosure.

[0216] Those skilled in the art can understand that each aspect of the present disclosure can be implemented as a system, a method or a program product. Therefore, each aspect of the present disclosure can be embodied as a whole hardware embodiment, a whole software embodiment (including firmware, microcode, etc.), or an embodiment of combination of hardware and software, which can be collectively referred to as "circuitry", "module" or "system".

[0217] The electronic device 1300 according to this embodiment of the present disclosure will be described below with reference to Figure 13 Figure 13 The displayed electronic device 1300 is merely an example and should not impose any limitation on the function and use range of the embodiments of the present disclosure.

[0218] As shown in Figure 13 The components of the electronic device 1300 can include, but are not limited to, the above-mentioned at least one processing unit 1310, the above-mentioned at least one storage unit 1320, a bus 1330 connecting different system components (including the storage unit 1320 and the processing unit 1310), and a display unit 1340.

[0219] The storage unit stores program codes which can be executed by the processing unit 1310, so that the processing unit 1310 performs the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification. For example, the processing unit 1310 can perform the steps according to the exemplary embodiments of the present disclosure as shown in Figure 1 ​As shown: Step S110, determine the historical business volume time series data corresponding to each user based on the historical business volume indicators corresponding to each user among multiple users; Step S120, predict the predicted business volume time series data of each user in the future period based on the historical business volume time series data; Step S130, generate the fused business volume time series data corresponding to each user based on the historical business volume time series data and the predicted business volume time series data; Step S140, identify abnormal users from the multiple users based on the fused business volume time series data corresponding to each user.

[0220] Storage unit 1320 may include readable media in the form of volatile storage units, such as random access memory (RAM) 13201 and / or cache memory 13202, and may further include read-only memory (ROM) 13203.

[0221] Storage unit 1320 may also include a program / utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0222] Bus 1330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0223] Electronic device 1300 can also communicate with one or more external devices 1400 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1300, and / or any device that enables electronic device 1300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1350. Furthermore, electronic device 1300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1360. As shown, network adapter 1360 communicates with other modules of electronic device 1300 via bus 1330. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0224] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. A method of identifying an abnormal user, characterized by, The method comprises: determining historical traffic volume time series data corresponding to each user in a plurality of users according to historical traffic volume indicators corresponding to each user; predicting predicted traffic volume time series data of each user in a future period according to the historical traffic volume time series data; the predicted traffic volume time series data comprises first predicted traffic volume time series data and second predicted traffic volume time series data; the predicted traffic volume time series data of the user in the future period is predicted according to the historical traffic volume time series data, comprising: decomposing the historical traffic volume time series data into high-frequency subsequences and low-frequency subsequences based on wavelet transform; predicting the first predicted traffic volume time series data of the user in the future period according to the high-frequency subsequences; predicting the second predicted traffic volume time series data of the user in the future period according to the low-frequency subsequences; and inversely transforming the first predicted traffic volume time series data and the second predicted traffic volume time series data to obtain the predicted traffic volume time series data of the user in the future period; generating fusion traffic volume time series data corresponding to each user according to the historical traffic volume time series data and the predicted traffic volume time series data; identifying an abnormal user from the plurality of users based on the fusion traffic volume time series data corresponding to each user.

2. The method of claim 1, wherein, The method further comprises: inputting the high-frequency subsequences into a trained Gaussian regression model to predict the first predicted traffic volume time series data of the user in the future period through the trained Gaussian regression model; inputting the low-frequency subsequences into a trained deep learning model to predict the second predicted traffic volume time series data of the user in the future period through the trained deep learning model.

3. The method of claim 2, wherein, The future period comprises a plurality of continuous unit periods, and the first predicted traffic volume time series data comprises a predicted traffic volume indicator corresponding to each unit period. The first predicted traffic volume time series data of the user in the future period is predicted through the trained Gaussian regression model, comprising: generating a joint probability distribution corresponding to the predicted traffic volume indicator through the Gaussian regression model; calculating a posterior distribution of the predicted traffic volume indicator according to the joint probability distribution and a prior distribution of the predicted traffic volume indicator; determining a predicted traffic volume indicator corresponding to each unit period according to a mean value of the posterior distribution; determining the first predicted traffic volume time series data according to the predicted traffic volume indicators corresponding to the plurality of continuous unit periods respectively.

4. The method of claim 2, wherein, The future period comprises a plurality of continuous unit periods, and the first predicted traffic volume time series data comprises a predicted traffic volume indicator corresponding to each unit period. The second predicted traffic volume time series data of the user in the future period is predicted through the trained deep learning model, comprising: generating a likelihood function of each predicted traffic volume indicator through the deep learning model using the low-frequency subsequences; sampling the likelihood function multiple times to obtain a plurality of sampling values; determining an expected value corresponding to the plurality of sampling values as the predicted traffic volume indicator corresponding to each unit period; and According to the predicted traffic volume indicators corresponding to the plurality of continuous unit time periods respectively, the second predicted traffic volume time series data is determined.

5. The method of claim 1, wherein, After the fusion traffic volume time series data corresponding to each user is generated according to the historical traffic volume time series data and the predicted traffic volume time series data, the method further comprises: An average value of a plurality of traffic volume indicators contained in the fusion traffic volume time series data is calculated for the fusion traffic volume time series data corresponding to each user. If the average value meets a preset condition, the user is excluded from the plurality of users to update the plurality of users. The preset condition comprises any one or more of the following: the average value is equal to a first preset threshold value; an ordering result of the average value in a preset ordering sequence meets a preset requirement; and the preset ordering sequence is obtained by ordering the average values of the plurality of traffic volume indicators contained in the fusion traffic volume time series data corresponding to each user. After the plurality of users is updated, the method further comprises:

6. The method of claim 5, wherein, The fusion traffic volume time series data corresponding to each user after the update is smoothed. The smoothing of the fusion traffic volume time series data corresponding to each user after the update comprises:

7. The method of claim 6, wherein, For each traffic volume indicator in the fusion traffic volume time series data, N characteristic traffic volume indicators associated with the each traffic volume indicator are obtained; N is a positive integer. The each traffic volume indicator is updated by using the average values of the each traffic volume indicator and the N characteristic traffic volume indicators, so as to realize the smoothing of the fusion traffic volume time series data. Comprise:

8. An abnormal user identifying apparatus characterized by comprising: A data determination module is configured to determine historical traffic volume time series data corresponding to each user in a plurality of users according to historical traffic volume indicators corresponding to each user. A prediction module is configured to predict predicted traffic volume time series data of each user in a future time period according to the historical traffic volume time series data. The predicted traffic volume time series data comprises first predicted traffic volume time series data and second predicted traffic volume time series data. The prediction module is configured to decompose the historical traffic volume time series data into a high-frequency subsequence and a low-frequency subsequence based on wavelet transform, predict first predicted traffic volume time series data of the user in the future time period according to the high-frequency subsequence, and predict second predicted traffic volume time series data of the user in the future time period according to the low-frequency subsequence. Inverse transform is performed on the first predicted traffic volume time series data and the second predicted traffic volume time series data to obtain predicted traffic volume time series data of the user in the future time period. A fusion module is configured to generate fusion traffic volume time series data corresponding to each user according to the historical traffic volume time series data and the predicted traffic volume time series data. An abnormal user identification module is configured to identify an abnormal user from the plurality of users based on the fusion traffic volume time series data corresponding to each user. The computer program is executed by the processor to implement the abnormal user identification method of any one of claims 1-7.

9. A computer storage medium having stored thereon a computer program, characterized in that Comprise:

10. An electronic device, comprising: A processor; And A memory configured to store executable instructions of the processor. ​ The processor is configured to execute the executable instructions to perform the method for identifying an abnormal user according to any one of claims 1-7.

Images