Abnormal behavior recognition method and device, electronic device, and storage medium

Abstract

The embodiment of the present disclosure relates to an abnormal behavior recognition method and device, an electronic device and a storage medium, and relates to the technical field of computers. The abnormal behavior recognition method comprises the following steps: determining user behavior features in multiple dimensions according to behavior data of a to-be-processed object; detecting the user behavior features by using behavior baselines corresponding to multiple behavior thresholds, to determine multiple detection results corresponding to the user behavior features; and combining the multiple detection results to determine a recognition result of the user behavior features. The technical solution of the present disclosure can improve the accuracy of abnormal behavior recognition.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to an abnormal behavior recognition method, an abnormal behavior recognition device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] During application use, it is necessary to accurately identify abnormal behavior in data such as advertisements in order to improve the security of users using the application.

[0003] In related technologies, JavaScript is primarily used to calculate different feature values ​​for each dimension from multiple dimensions, and various algorithms are combined for precise localization. In addition, API or SDK methods are also used to detect abnormal behavior.

[0004] The aforementioned methods all have certain limitations in detection, making it difficult to achieve comprehensive detection and limiting their application scope. Furthermore, the difficulty in collecting comprehensive samples affects the sensitivity and coverage of sample-based detection, resulting in lower accuracy, lower security, and poor reliability.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide an abnormal behavior identification method, device, electronic device, and storage medium, thereby overcoming, to at least a certain extent, the problem of poor accuracy in identifying abnormal behavior due to limitations and defects in related technologies.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0008] According to one aspect of this disclosure, an abnormal behavior identification method is provided, comprising: determining user behavior features of multiple dimensions based on behavior data of an object to be processed; detecting the user behavior features through behavior baselines corresponding to multiple behavior thresholds to determine multiple detection results corresponding to the user behavior features; and combining the multiple detection results to determine the identification result of the user behavior features.

[0009] According to one aspect of this disclosure, an abnormal behavior recognition device is provided, comprising: a feature acquisition module, configured to determine user behavior features in multiple dimensions based on behavior data of an object to be processed; a multi-dimensional detection module, configured to detect the user behavior features through behavior baselines corresponding to multiple behavior thresholds, and determine multiple detection results corresponding to the user behavior features; and a combination module, configured to combine the multiple detection results to determine the recognition result of the user behavior features.

[0010] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the abnormal behavior identification method described in any of the preceding claims by executing the executable instructions.

[0011] According to one aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the abnormal behavior recognition method described in any of the preceding claims.

[0012] The abnormal behavior recognition method, device, electronic device, and computer-readable storage medium provided in this disclosure detect user behavior features using behavioral baselines corresponding to multiple behavior thresholds, and combine the multiple detection results to determine the recognition result of the object to be processed. On the one hand, by identifying abnormal behavior through multi-dimensional behavioral baselines, new abnormal behaviors not covered by the cheating sample library can be discovered, avoiding the limitations of behavior recognition in related technologies. It can achieve comprehensive behavior detection from multiple dimensions through the mutual supplementation of multiple behavioral baselines, increasing the application scope. On the other hand, by using thresholds and behavioral baselines without coding, the sensitivity and coverage of detection due to reliance on samples in related technologies are avoided, improving detection accuracy and security, and improving detection reliability. It can effectively detect cloud-based cheating behaviors that are easy to bypass shallow anti-cheating monitoring systems, and also reduces operation steps and improves operation efficiency.

[0013] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0014] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0015] Figure 1A schematic diagram of a system architecture for an abnormal behavior recognition method or device that can be applied to embodiments of this disclosure is shown.

[0016] Figure 2 A schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure is shown.

[0017] Figure 3 The diagram illustrates an abnormal behavior identification method according to an embodiment of this disclosure.

[0018] Figure 4 The diagram illustrates the overall process of behavior recognition in an embodiment of this disclosure.

[0019] Figure 5 The schematic diagram illustrates a cloud detection module in an embodiment of this disclosure.

[0020] Figure 6 The schematic diagram illustrates a process for determining multiple detection results in an embodiment of this disclosure.

[0021] Figure 7 The schematic diagram illustrates the process of determining the third detection result in an embodiment of this disclosure.

[0022] Figure 8 A block diagram of an abnormal behavior recognition device according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0023] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0024] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0025] Currently, mobile anti-fraud services primarily offer three modes: JavaScript, API, and SDK. The JavaScript mode collects and analyzes user behavior by embedding JavaScript code in ad landing pages or media ad placements to determine traffic quality. The API mode transmits traffic parameters to a third-party ad traffic verification company via API at each of the ad's three stages: impression, click, and landing page entry. The verification company analyzes the traffic and feeds back its quality to the Ad Exchange (ADX), which then determines whether to continue exposure. The SDK mode uses an SDK to obtain user-authorized ad-related parameters to analyze for potentially invalid traffic or to detect ad visibility. Besides using existing third-party anti-fraud systems, some clients have built their own mobile ad anti-fraud systems, mostly used in performance-based advertising. For example, System A. System A is a mobile application intelligent data analysis platform developed based on massive amounts of big data, providing full-chain big data operation services including application analysis, ad performance monitoring, ad channel anti-fraud, DMP tags, and market indices.

[0026] In performance-based advertising, advertisers possess a wealth of post-download tracking data, which is then used to create metrics that measure traffic quality, such as MTTI (Mean Time to Install), MTTD (Mean Time to Download), CTR (Click-Through Rate), Day7 Retention (7-Day Retention), and ARPU (Average Revenue Per User).

[0027] For example, an anti-fraud system mainly comprises three modules: a terminal identification module (SDK auditing module), a rule-based identification module, and a data mining-based identification module, i.e., a cloud module. These three modules, based on the aforementioned JavaScript model, primarily perform multi-dimensional and multi-business cross-validation based on hardware information, user activity, and user behavior. They calculate different feature values ​​for each dimension and combine various algorithms such as decision trees, logistic regression, and Bayesian networks for precise localization.

[0028] In related technologies, the JavaScript mode only starts collecting data for judgment when an ad is displayed, making it unsuitable for pre-ad detection. The API mode is used for cleaning up fraudulent ad traffic. The SDK mode is only suitable for ad detection and verification in mobile internet apps. Self-built anti-fraud systems, due to their lack of neutrality, are difficult to use directly as a basis for media settlement in practice. Furthermore, the cloud modules in self-built anti-fraud systems are mainly based on supervised learning algorithms, but in real-world applications, it is difficult to collect comprehensive cheating samples, directly affecting the detection sensitivity and coverage of sample-dependent supervised learning. In addition, cloud-based cheating methods in mobile applications make behavioral characteristics dynamically changing: more and more malicious applications, in order to bypass app store detection or maintain app survival, will download executable plugins from the cloud after running for a period of time, using dynamic loading technology to execute malicious ad pop-ups and other behaviors. These loaded plugins are completely controlled by the cloud, cannot be detected by static scanning, and the plugin execution process is without any prompts, posing a significant security risk.

[0029] To address the aforementioned technical issues, this disclosure provides an abnormal behavior identification method that can be applied to scenarios involving the detection and identification of advertising behavior in applications.

[0030] Figure 1 A schematic diagram of a system architecture for an abnormal behavior recognition method or device that can be applied to embodiments of this disclosure is shown.

[0031] This abnormal behavior identification method can be applied to scenarios involving the detection of fraudulent advertising behavior within applications. (Reference) Figure 1 As shown, this method can be specifically applied to identify abnormal behaviors such as fraudulent advertising in a specific object to be processed on a client. The object to be processed 102 can be an application to be processed. The client 101 can be various types of devices with computing capabilities, such as smartphones, tablets, desktop computers, in-vehicle devices, wearable devices, and other smart terminals capable of installing applications. The object to be processed 102 can be various types and functions of applications. The client 101 can send the user behavior characteristics of the object to be processed to the server 104 via network 103. The server 104 can utilize a cloud-based detection model, using behavioral baselines corresponding to multiple behavioral thresholds to detect user behavior characteristics, determine multiple detection results, and combine these results to identify whether the advertisements in the object to be processed 102 exhibit fraudulent or other abnormal behaviors.

[0032] It should be noted that the abnormal behavior identification method provided in this embodiment can be executed entirely by the client. Accordingly, the abnormal behavior identification device can be installed in the client. Alternatively, the abnormal behavior identification method provided in this embodiment can also be executed entirely by the server; this is not limited here.

[0033] Figure 2 A schematic diagram is shown that is suitable for implementing exemplary embodiments of the present disclosure. The terminal of the present disclosure can be configured as follows: Figure 2 The electronic device shown is in the form of [the device]; however, it should be noted that... Figure 2 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0034] The electronic device disclosed herein includes at least a processor and a memory, the memory being used to store one or more programs, which, when executed by the processor, enable the processor to implement the methods of exemplary embodiments of this disclosure.

[0035] Specifically, such as Figure 2 As shown, the electronic device 200 may include: a processor 210, internal memory 221, external memory interface 222, Universal Serial Bus (USB) interface 230, charging management module 240, power management module 241, battery 242, antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, audio module 270, speaker 271, receiver 272, microphone 273, headphone jack 274, sensor module 280, display screen 290, camera module 291, indicator 292, motor 293, buttons 294, and a Subscriber Identification Module (SIM) card interface 295, etc. The sensor module 280 may include depth sensors, pressure sensors, gyroscope sensors, barometric pressure sensors, magnetic sensors, accelerometers, distance sensors, proximity sensors, fingerprint sensors, temperature sensors, touch sensors, ambient light sensors, and bone conduction sensors, etc.

[0036] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 200. In other embodiments of this application, the electronic device 200 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0037] Processor 210 may include one or more processing units, such as application processors, modem processors, graphics processors, image signal processors, controllers, video codecs, digital signal processors, baseband processors, and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors. Additionally, processor 210 may include memory for storing instructions and data. The model training method in this exemplary embodiment can be executed by an application processor, graphics processor, or image signal processor; when the method involves neural network-related processing, it can be executed by the NPU.

[0038] Internal memory 221 can be used to store computer executable program code, which includes instructions. Internal memory 221 may include a program storage area and a data storage area. External memory interface 222 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of electronic device 200.

[0039] The communication function of mobile terminal 200 can be implemented through a mobile communication module, antenna 1, a wireless communication module, antenna 2, a modem processor, and a baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. The mobile communication module can provide 2G, 3G, 4G, and 5G mobile communication solutions for use on mobile terminal 200. The wireless communication module can provide wireless communication solutions such as wireless LAN, Bluetooth, and near-field communication for use on mobile terminal 200.

[0040] The display screen is used to implement display functions, such as displaying the user interface, images, and videos. The camera module is used to implement shooting functions, such as capturing images and videos. The audio module is used to implement audio functions, such as playing audio and capturing voice. The power module is used to implement power management functions, such as charging the battery, supplying power to the device, and monitoring battery status.

[0041] This application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device.

[0042] Computer-readable storage media can be, for example—but not limited to—electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0043] Computer-readable storage media can be sent, propagated, or transmitted for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on a computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0044] A computer-readable storage medium carries one or more programs that, when executed by an electronic device, cause the electronic device to perform the methods described in the following embodiments.

[0045] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0046] The units described in the embodiments of this disclosure can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the unit itself.

[0047] Next, refer to Figure 3 The abnormal behavior identification method in the embodiments of this disclosure will be described in detail.

[0048] In step S310, user behavior characteristics in multiple dimensions are determined based on the behavior data of the object to be processed.

[0049] In this embodiment, the object to be processed can be various types of applications, as long as they can be installed on a terminal. The object to be processed can be one or more applications, and can be an application corresponding to any operating system. For example, the object to be processed can be a shopping application, an instant messaging application, or an image processing application, etc. The behavioral data for the object to be processed can be behavioral data for a specific module within it. Furthermore, the behavioral data can be determined according to the type of behavior to be detected. It should be noted that different types of malicious apps exhibit different malicious behaviors, requiring the extraction of behavioral data related to different types of malicious apps to improve detection sensitivity.

[0050] During the installation or use of an application, various types of advertisements may be displayed, and these advertisements may exhibit abnormal behaviors such as fraud, viruses, or violations of user privacy. To ensure application security, it is necessary to accurately identify abnormal behaviors such as advertising fraud to determine whether the application engages in advertising fraud and whether it is suitable for user use. Therefore, the behavioral data for the object to be processed can be advertising-related behavioral data, including user interaction data with advertisements displayed in the application and advertisement attribute information. Specifically, user interaction data with advertisements can be data associated with fraudulent behavior, including but not limited to the number of clicks and the click time. Ad attribute information can include but not limited to ad exposure data, ad exposure duration, ad type, and whether the ad is downloadable. In this embodiment, multi-dimensional user behavior features can be constructed using data from the advertising SDK (Software Development Kit). The advertising SDK refers to an advertising framework that can return data from the advertising SDK. The data from the advertising SDK can be determined based on the behavioral data; that is, the behavioral data can be used as the data from the advertising SDK.

[0051] Figure 4 The overall flowchart is shown schematically in the figure. (See reference) Figure 4 As shown, the main steps include:

[0052] Step S401: APP is sent for testing.

[0053] Step S402: Perform static detection on the application through the anti-cheating rule detection module (static rule module).

[0054] In step S403, the application is uploaded to the app store via the app store detection module, making it available for users to download and install.

[0055] Step S404: Check if the user has installed it.

[0056] Step S405: Construct user behavior characteristics by using data from the advertising SDK.

[0057] Step S406: The user behavior features of different dimensions are detected by the cloud detection module to obtain the recognition results.

[0058] Step S407: Submit the application that triggers the behavior baseline of the cloud detection module to the audit module, collect evidence of cheating, and download the application.

[0059] Step S408: Extract the cheating APP code-level rules that trigger cloud-based detection anomalies and feed them back to the rules module.

[0060] In other words, to improve security, all applications can undergo static testing via a static rules module (anti-fraud rule detection module) before acquiring user behavior characteristics. Static testing refers to security testing, used to detect anomalies in applications, specifically whether the application includes malicious behaviors such as fraud, viruses, or violations of user privacy. If the application does not contain the above anomalies, it is then listed on the app store through the app store detection module for users to download and install. Furthermore, multi-dimensional user behavior characteristics can be constructed using data from advertising SDK tracking points, and these characteristics can be identified based on a cloud-based detection module.

[0061] The technical solution in this disclosure combines a static rules module, a cloud detection module, and an audit module to form an advertising fraud proactive detection system, which monitors alliance apps and improves application security and user experience by identifying fraudulent apps.

[0062] In step S320, the user behavior features are detected using behavior baselines corresponding to multiple behavior thresholds, and multiple detection results corresponding to the user behavior features are determined.

[0063] In this embodiment of the disclosure, reference continues to be made to Figure 4As shown, a cloud-based detection module can detect user behavior features across multiple dimensions. The cloud-based detection module first determines behavioral baselines corresponding to multiple behavioral thresholds, and then detects user behavior features based on these baselines. Behavioral thresholds can include static thresholds and multiple dynamic thresholds. Static thresholds can be fixed. Dynamic thresholds can be learned from daily user behavior features, so the dynamic thresholds may differ daily. Based on this, a behavioral baseline can be constructed using the dynamically changing dynamic thresholds. On this basis, the static thresholds and the behavioral baselines corresponding to the multiple dynamic thresholds can be combined to detect user behavior features, resulting in multiple detection results.

[0064] Figure 5 The diagram illustrates the structure of the cloud detection module 500. (Refer to...) Figure 5 As shown, it mainly includes a behavior rule submodule 501, a supervised learning submodule 502, a dynamic behavior baseline submodule 503, and a policy integration submodule 504. Since user behavior characteristics differ across regions, provinces, and even device models, all submodules can detect user behavior characteristics in parallel, obtaining the detection results corresponding to each submodule as multiple detection results.

[0065] Specifically, Figure 6 The flowchart illustrating the process of obtaining multiple detection results is shown in the image. Figure 6 As shown, the main steps include:

[0066] In step S610, the user behavior features are detected using a static threshold to obtain a first detection result.

[0067] In this step, the static threshold can be a hard threshold for the feature, i.e., a fixed threshold that does not change over time. The static threshold can be used to perform preliminary detection of user behavior features, filtering out obviously fraudulent behaviors as the first detection result. Specifically, the static threshold can be determined based on the first type of data in the user behavior features. The first type of data can be data with high importance, where importance indicates the impact on the accuracy of the detection result. The first type of data can be, for example, intuitive data such as download conversion rate and click conversion rate. When the probability of a user behavior feature being an abnormal behavior is greater than the static threshold, it is considered an abnormal behavior, and the application is considered an application with obvious fraudulent behavior. For example, if the probability of user behavior feature 1 of application 1 is greater than the static threshold of 0.5, then the first detection result is determined to be that the user behavior feature of application 1 is an abnormal behavior, and application 1 is an application with obvious fraudulent behavior.

[0068] In step S620, supervised learning is performed on the user behavior features to obtain a second detection result.

[0069] In this step, the supervised learning model can include a machine learning model or a deep learning model. Specifically, supervised learning can be performed on the second type of data to determine the probability that the user behavior feature belongs to abnormal behavior, and the second detection result is determined based on this probability. The second type of data refers to data with low importance, such as, but not limited to, collected AdCheat (ad fraud app type) virus samples, non-AdCheat virus samples, behavioral data of white samples, comment data, survival geographical location, developer profiles, and other user behavior features. The second detection result can be the probability that the user behavior feature belongs to abnormal behavior. When the probability value is high, the user behavior feature can be considered to be abnormal behavior.

[0070] In step S630, multiple behavioral baselines represented by dynamic thresholds are obtained, and the user behavior features are detected by combining each of the behavioral baselines to obtain a third detection result.

[0071] In this step, multiple dynamic threshold-represented behavioral baselines can be constructed using a dynamic learning submodule. First, by extracting white sample user behavior features, a behavioral sequence of the application is constructed. This behavioral sequence can include both daily average discrete behavioral features and continuous behavioral feature sequences. Further, a multi-dimensional behavioral baseline can be constructed based on the white sample user behavior features and the application's behavioral sequence to obtain a third detection result. The white sample user behavior features can include daily discrete behavioral features and continuous daily behavioral sequences. Specifically, this can include, but is not limited to, affiliate user conversion link data such as exposure, downloads, arousal, launches, uninstalls, launch duration, click-through rate, and download conversion rate. (Reference) Figure 5 As shown, the multidimensional behavioral baseline is constructed by the dynamic behavioral baseline submodule 503, and the multidimensional behavioral baseline includes, but is not limited to, the white sample discrete behavioral baseline, the white sample temporal behavioral baseline, the APP single-feature temporal behavioral baseline, and the APP full-feature temporal behavioral baseline. Each behavioral baseline can be determined according to the corresponding dynamic threshold, and the types of multiple dynamic thresholds can vary according to actual needs, such as including discrete dynamic thresholds, temporal dynamic thresholds, single-feature dynamic thresholds, and full-feature dynamic thresholds.

[0072] Figure 7 The diagram illustrates a flowchart for determining a third detection result based on a behavioral baseline. (See reference) Figure 7 As shown, the main steps include:

[0073] In step S710, the discrete behavioral features of the white sample are extracted daily, and the discrete behavioral features are classified to construct the discrete behavioral baseline of the white sample to obtain discrete results.

[0074] In this step, a baseline for discrete behavior of white samples can be constructed. Specifically, the discrete behavioral features of white samples are extracted daily within a first duration. These discrete behavioral features can be represented as 1*f-dimensional data, where f is the number of features. The first duration can be 30 days. Further, an anomaly detection model can be used to classify the daily discrete behavioral features of white samples to obtain the probability that each daily discrete behavioral feature belongs to an anomalous behavior. White samples refer to samples that do not belong to anomalous behavior. Anomaly detection models can include, but are not limited to, One-Class-SVM based on linear models, Isolation Forest based on tree models, and AutoEncoder based on deep representations. Based on this, the input to the anomaly detection model is the user data of all user groups of a certain application each day, and the user data of this application can be compared with user data of other applications for detection through different application sides. If the probability output of a certain user behavior feature does not belong to the spatial distribution, then the user behavior feature is considered an anomaly. Since the user behavior features are different each day, the probability output of the user behavior features each day can be dynamically obtained, and then a discrete dynamic threshold can be determined based on the output probability to construct a discrete behavior baseline.

[0075] After constructing a white sample discrete behavior baseline, the input user behavior features can be classified according to the anomaly detection model and compared with the white sample discrete behavior baseline to obtain discrete results. If the white sample offline behavior baseline is not met, the discrete result is considered that the user behavior feature belongs to an anomalous behavior. For example, the anomaly detection model can be an autoencoder. An autoencoder is a neural network designed to copy its input to its output. It works by compressing the input into a latent space representation and then reconstructing this representation from the output. Such a network consists of an encoder and a decoder. The encoder compresses the input into a latent space representation, and the decoder aims to reconstruct the input from the latent space representation.

[0076] In step S720, the behavioral sequence features of the white sample are obtained for each consecutive day, and the behavioral sequence features are deeply characterized to obtain the temporal behavioral baseline of the white sample, so as to obtain the temporal results.

[0077] In this step, the daily behavioral sequences of white samples within a second duration can be extracted. The second duration can be 7 days, 15 days, 30 days, 60 days, etc. The daily behavioral sequences of white samples can be n*f dimensional feature data, where n is the selected time period and f is the number of features. Based on this, the temporal behavioral baseline of white samples is obtained by performing deep representation of the white sample behavioral sequences using convolutional autoencoders, variational autoencoders, etc. Specifically, convolutional operations are performed on the white sample behavioral sequences using models such as convolutional autoencoders and variational autoencoders to learn a representation of the entire feature space corresponding to the white sample behavioral sequences. A temporal dynamic threshold is obtained through this representation, and this temporal dynamic threshold is used to indicate whether the white sample behavioral sequence belongs to this feature space. If it does not belong to this feature space, the white sample behavioral sequence is considered an outlier. Furthermore, since the temporal dynamic threshold is determined based on the daily behavioral data, the temporal behavioral baseline of white samples can be extracted based on the temporal dynamic threshold obtained from the representation. In this process, while learning the representation of the entire feature space, the reconstruction error of the entire feature space can also be obtained. A temporal dynamic threshold can then be set based on the sum of the mean and standard deviation of the reconstruction error. If the features belong to the same distribution, the reconstruction error is lower than the temporal dynamic threshold.

[0078] After constructing the white sample temporal behavior baseline, the input user behavior features can be deeply represented using a convolutional autoencoder or variational autoencoder to obtain the corresponding probabilities. These probabilities are then compared with the white sample temporal behavior baseline to obtain the temporal result. If the white sample offline temporal behavior baseline is not met, the temporal result is considered to indicate that the user behavior feature belongs to abnormal behavior.

[0079] In step S730, the target application's daily behavior sequence is obtained to generate a first behavior sequence feature, and a single-feature time-series behavior baseline is constructed based on the first behavior sequence feature to determine abnormal results for the day.

[0080] In this step, the daily behavior sequence of the target application within a third duration can be obtained as the first behavior sequence. The third duration can be 7 days or 15 days. The first behavior sequence can be 1*f dimensional feature data, where f is the number of features shifted upwards. For example, shifting behavior data from 7 days ago to the current day is used as the behavior feature for that day. That is, the first behavior sequence features are obtained by shifting the historical behavior data of the corresponding third duration for that day. Further, the target behavior features in the first behavior sequence are predicted using a time series model to obtain predicted values, and the sum of the mean and standard deviation of the predicted value and the actual value is set as a single-feature dynamic threshold. This single-feature dynamic threshold is used to detect daily anomalies in the target application. The target behavior feature can be click conversion rate or any other type of feature, which is not limited here. Since the single-feature dynamic threshold changes with different behavior features each day, a single-feature time series behavior baseline can be determined based on the dynamically learned single-feature dynamic threshold, and then the abnormal results for the day can be determined based on the single-feature time series behavior baseline. The time series model can be LSTM (Long Short-Term Memory), etc. Based on this, a convolutional operation is performed on a user behavior feature using a time-series model to predict whether the user behavior feature is abnormal. If the predicted value deviates from the actual value, the user behavior feature is considered abnormal. For example, if the predicted value of user behavior feature 1 is 0.3, but the actual value is 0, then user behavior feature 1 is considered abnormal.

[0081] In step S740, the behavior sequence of the target application for each consecutive day is obtained to generate a second behavior sequence feature, and the second behavior sequence feature is predicted to construct a full feature time-series behavior baseline to determine abnormal time periods.

[0082] In this step, since the single-feature time-series behavior baseline only detects abnormal time points, it is assumed that the previous day is normal behavior. However, in general, abnormal behavior has been going on for some time. Therefore, the dimension is expanded by checking abnormal time periods to detect from multiple dimensions, thereby making up for the limitations of the single-feature time-series behavior baseline.

[0083] Specifically, the behavior sequences of the target application (APP) are extracted daily within a fourth duration (e.g., 7 days, 15 days, 30 days, 60 days) to construct the second behavior sequence features. The second behavior sequence features can be n*f dimensional feature data, where n is the selected time period and f is the number of features. Further, the long-sequence dependency capability of the Transformer model is used to perform convolution operations on all features represented by the second behavior sequence features for the current day and previous periods to predict the probability of them belonging to abnormal behavior. The sum of the mean and standard deviation of the predicted and actual values ​​is set as the full-feature dynamic threshold. The full-feature temporal behavior baseline is determined using the full-feature temporal behavior baseline, and abnormal behavior of the target application APP for a certain time period is detected using this baseline to obtain the time period results. It should be noted that the time period results describe the probability of abnormal behavior within that time period.

[0084] For example, the input is the behavioral characteristics of the target application over 30 days, specifically represented as (day-30, day-29, ..., day-1). The output is a reconstruction of the behavioral characteristics of the target application over the most recent 7 days (or a longer period) (pre-day-7, pre-day-6, ..., pre-day-1). The reconstruction error is calculated between the output behavioral reconstruction and the actual behavioral characteristics over the 7 days (day-7, day-6, ..., day-1) to detect abnormal time periods.

[0085] In step S750, the discrete results, time-series results, daily anomaly results, and time-period results are integrated to obtain the third detection result.

[0086] In this step, after obtaining the corresponding results for each dynamic behavior baseline, the discrete results, time-series results, daily anomaly results, and time-period results can be combined and integrated to obtain the third detection result, thus integrating multiple different results into a single dynamic result. Specifically, different results can be integrated according to the integration method. The integration method can include, but is not limited to, sequential integration, uniform integration, linear integration, and model stacking. Any integration method can be chosen to combine the results corresponding to multiple behavior baselines; no special limitation is made here. For example, when the integration method is linear integration, the weights corresponding to the discrete results, time-series results, daily anomaly results, and time-period results can be obtained separately, and then logical operations can be performed based on the weights and the corresponding results to obtain the third detection result.

[0087] It should be noted that since the behavioral baseline is learned based on dynamic thresholds, the thresholds will change dynamically as different behaviors change every day. Therefore, the behavioral baseline can be used to dynamically predict the application's behavior and improve accuracy.

[0088] Continue to refer to Figure 3 As shown, in step S330, the multiple detection results are combined to determine the identification result of the user behavior feature.

[0089] In this embodiment of the disclosure, multiple detection results can be combined to obtain the final identification result. (Continue to refer to...) Figure 5 As shown, multiple detection results can be combined through the strategy integration submodule in the cloud detection module to obtain the recognition result of the user behavior features corresponding to the object to be processed.

[0090] Specifically, the multiple detection results can be integrated according to a target integration method to determine the recognition result. The target integration method includes at least one of sequential integration, uniform integration, linear integration, and model stacking. Uniform integration can be a voting method. Taking linear integration as an example, all detection results can be defined as a feature vector. Linear integration is used to learn the weight of each detection result, and then multiple detection results are combined according to their weights to obtain the recognition result. Based on the recognition result, it is determined whether the user behavior characteristics are abnormal, and whether the object to be processed corresponding to the user behavior characteristics is a malicious cheating application.

[0091] It should be added that after determining the identification results of user behavior features, the abnormal behavior sequences corresponding to the identification results are returned to the supervised learning model, and the model parameters of the supervised learning model are updated according to the abnormal behavior sequences. That is, the confirmed cheating APP behavior sequences are added to the supervised learning sample set, and the model is iterated periodically. Since the dynamic behavior baseline is a rule learning process, returning abnormal behaviors to the supervised learning model to update its sample set can enrich the sample set, and then adjust the model parameters of the supervised learning model according to the updated sample set, thereby obtaining an accurate supervised learning model, and thus obtaining a more accurate second detection result, improving the accuracy of the identification results.

[0092] In addition, the rule learning algorithm can be used to extract the abnormal cheating APP behavior rules detected by the dynamic behavior baseline submodule and feed them back to the rule module to update the behavior rules in the behavior rule submodule, obtain more accurate behavior rules, and thus improve the accuracy of the first detection result and the accuracy of the recognition result.

[0093] The technical solution in this disclosure identifies abnormal behavior through multi-dimensional behavioral baselines, enabling the discovery of new abnormal behaviors not covered by the cheating sample database. This avoids the limitations of behavior recognition in related technologies and achieves comprehensive behavior detection from multiple dimensions through the mutual complementation of multiple behavioral baselines, thus expanding the application scope. Detection using thresholds and behavioral baselines without coding avoids the sensitivity and coverage limitations of sample-based detection in related technologies, improving detection accuracy, security, and reliability. By constructing a multi-dimensional dynamic behavioral baseline submodule, it deeply mines discrete and continuous behavioral features, effectively detecting cloud-based cheating behaviors that easily bypass shallow anti-cheating monitoring systems, improving the executability and versatility of the detection.

[0094] This disclosure provides an abnormal behavior identification device, referring to... Figure 8 As shown, the abnormal behavior recognition device 800 may include:

[0095] The feature acquisition module 801 is used to determine user behavior features in multiple dimensions based on the behavioral data in the object to be processed.

[0096] The multidimensional detection module 802 is used to detect the user behavior features through multiple behavior baselines corresponding to multiple behavior thresholds, and determine multiple detection results corresponding to the user behavior features;

[0097] The combination module 803 is used to combine the multiple detection results to determine the recognition result of the user behavior feature.

[0098] In one exemplary embodiment of this disclosure, the multidimensional detection module includes: a first detection module, configured to detect the user behavior features using a static threshold to obtain a first detection result; a second detection module, configured to perform supervised learning on the user behavior features to obtain a second detection result; and a third detection module, configured to acquire multiple behavior baselines represented by dynamic thresholds, and combine each of the behavior baselines to detect the user behavior features to obtain a third detection result.

[0099] In one exemplary embodiment of this disclosure, the third detection module includes: a behavior baseline construction module, configured to construct a behavior baseline based on the behavior characteristics of the white sample or the behavior sequence of the application, and obtain the third detection result through the behavior baseline.

[0100] In an exemplary embodiment of this disclosure, the behavior baseline construction module includes: a first construction module, configured to extract discrete behavior features of the white sample each day, classify the discrete behavior features to construct a discrete behavior baseline for the white sample, and obtain discrete results; a second construction module, configured to obtain continuous daily behavior sequence features of the white sample, and perform deep characterization on the behavior sequence features to obtain a temporal behavior baseline for the white sample, and obtain a temporal result; a third construction module, configured to obtain continuous daily behavior sequences of the target application to generate first behavior sequence features, and construct a single-feature temporal behavior baseline based on the first behavior sequence features, to determine abnormal results for the day; a fourth construction module, configured to obtain continuous daily behavior sequences of the target application to generate second behavior sequence features, and predict the second behavior sequence features to construct a full-feature temporal behavior baseline, to determine time period results; and an integration module, configured to integrate the discrete results, temporal results, abnormal results for the day, and time period results to obtain the third detection result.

[0101] In an exemplary embodiment of this disclosure, the third construction module includes: a prediction module, configured to predict the target behavior feature in the first behavior sequence feature to obtain a predicted value; the first behavior sequence feature is obtained by shifting based on historical behavior data; and a construction control module, configured to determine a single feature dynamic threshold based on the predicted value and the actual value, and construct the single feature time-series behavior baseline based on the single feature dynamic threshold to perform anomaly detection on the user behavior feature, so as to obtain the abnormal result of the day.

[0102] In one exemplary embodiment of this disclosure, the combining module includes an integration module, configured to integrate the plurality of detection results according to a target integration method to determine the identification result.

[0103] In one exemplary embodiment of this disclosure, the apparatus further includes: an update module, configured to return the user behavior features corresponding to the recognition result to the supervised learning model, and update the model parameters of the supervised learning model according to the user behavior features.

[0104] It should be noted that the specific details of each module in the above-mentioned abnormal behavior recognition device have been described in detail in the corresponding abnormal behavior recognition method, so they will not be repeated here.

[0105] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0106] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0107] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0108] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0109] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for identifying abnormal behavior, characterized in that, include: Determine multiple dimensions of user behavior characteristics based on behavioral data of the objects to be processed; The user behavior features are detected by using behavior baselines corresponding to multiple behavior thresholds, and multiple detection results corresponding to the user behavior features are determined. The multiple test results include a first test result, a second test result, and a third test result; The process of determining the third detection result includes: constructing a behavioral baseline based on the behavioral characteristics of the white sample or the behavioral sequence of the application, and obtaining the third detection result through the behavioral baseline; The multiple detection results are combined to determine the identification result of the user behavior feature; The step of constructing a behavioral baseline based on the behavioral characteristics of white samples or the behavioral sequence of the application, and obtaining the third detection result through the behavioral baseline, includes: Extract the discrete behavioral features of the white sample every day, classify the discrete behavioral features to construct the discrete behavioral baseline of the white sample, and obtain discrete results; The behavioral sequence features of the white sample are obtained for each consecutive day, and the behavioral sequence features are deeply characterized to obtain the temporal behavioral baseline of the white sample, so as to obtain the time series results; The first behavior sequence feature is generated by obtaining the daily behavior sequence of the target application, and a single-feature time-series behavior baseline is constructed based on the first behavior sequence feature to determine the abnormal results of the day. Obtain the daily behavior sequences of the target application to generate second behavior sequence features, and predict the second behavior sequence features to construct a full-feature time-series behavior baseline to determine the results for the time period; The discrete results, time-series results, daily anomaly results, and time-period results are integrated to obtain the third detection result.

2. The abnormal behavior identification method according to claim 1, characterized in that, The step of detecting user behavior features using behavior baselines corresponding to multiple behavior thresholds and determining multiple detection results corresponding to the user behavior features includes: The user behavior features are detected using static thresholds to obtain a first detection result; Supervised learning is performed on the user behavior features to obtain a second detection result; Multiple dynamic threshold-represented behavioral baselines are obtained, and the user behavior features are detected by combining each of the behavioral baselines to obtain a third detection result.

3. The abnormal behavior identification method according to claim 1, characterized in that, The step of constructing a single-feature time-series behavioral baseline based on the first behavioral sequence features to determine abnormal results for the day includes: The target behavior feature in the first behavior sequence feature is predicted to obtain a predicted value; the first behavior sequence feature is obtained by shifting historical behavior data. Based on the predicted value and the actual value, a single feature dynamic threshold is determined, and based on the single feature dynamic threshold, a single feature time-series behavior baseline is constructed to perform anomaly detection on the user behavior feature, so as to obtain the abnormal results of the day.

4. The abnormal behavior identification method according to claim 1, characterized in that, The step of combining the multiple detection results to determine the identification result of the object to be processed includes: The multiple detection results are integrated according to the target integration method to determine the recognition result.

5. The abnormal behavior identification method according to claim 1, characterized in that, The method further includes: The user behavior features corresponding to the recognition results are returned to the supervised learning model, and the model parameters of the supervised learning model are updated according to the user behavior features.

6. An abnormal behavior recognition device, characterized in that, include: The feature acquisition module is used to determine multi-dimensional user behavior features based on behavioral data of the object to be processed. The multidimensional detection module is used to detect the user behavior features through multiple behavior baselines corresponding to multiple behavior thresholds, and determine multiple detection results corresponding to the user behavior features; The multiple test results include a first test result, a second test result, and a third test result; The process of determining the third detection result includes: constructing a behavioral baseline based on the behavioral characteristics of the white sample or the behavioral sequence of the application, and obtaining the third detection result through the behavioral baseline; The combination module is used to combine the multiple detection results to determine the recognition result of the user behavior feature; The step of constructing a behavioral baseline based on the behavioral characteristics of white samples or the behavioral sequence of the application, and obtaining the third detection result through the behavioral baseline, includes: Extract the discrete behavioral features of the white sample every day, classify the discrete behavioral features to construct the discrete behavioral baseline of the white sample, and obtain discrete results; The behavioral sequence features of the white sample are obtained for each consecutive day, and the behavioral sequence features are deeply characterized to obtain the temporal behavioral baseline of the white sample, so as to obtain the time series results; The first behavior sequence feature is generated by obtaining the daily behavior sequence of the target application, and a single-feature time-series behavior baseline is constructed based on the first behavior sequence feature to determine the abnormal results of the day. Obtain the daily behavior sequences of the target application to generate second behavior sequence features, and predict the second behavior sequence features to construct a full-feature time-series behavior baseline to determine the results for the time period; The discrete results, time-series results, daily anomaly results, and time-period results are integrated to obtain the third detection result.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the abnormal behavior recognition method according to any one of claims 1-5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the abnormal behavior recognition method according to any one of claims 1-5.

Images