Anomaly determination method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of data processing, in particular to an abnormality determination method and device, electronic equipment and a storage medium. The method comprises the following steps: determining an operation description information set for a to-be-determined object, determining a first interaction text set under various types of businesses, obtaining various business processing objects associated with the to-be-determined object, and obtaining a second interaction text set according to second business processing data when each business processing object processes a corresponding type of business, and then obtaining an abnormality determination result of the to-be-determined object by means of a trained target abnormality determination model based on the obtained operation description information set, each first interaction text set and each second interaction text set. In this way, the to-be-determined object described by multiple dimensions of data can be comprehensively analyzed, the abnormality of the business object can be effectively determined, and the abnormality determination accuracy of the to-be-determined object is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to an exception determination method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the development of information technology, people are facilitated to complete business processing, but it also provides an opportunity for abnormal operation.

[0003] In the related art, when determining the abnormal situation of a business object, business data of the business object in different business scenarios is usually obtained, and according to the text content in different business data, the inclusion of various abnormal keywords is obtained to obtain abnormal determination results in different business scenarios, and according to the obtained various abnormal determination results, the abnormal situation of the business object is determined.

[0004] At present, when determining the abnormal situation of a business object, the data of the business object in different business scenarios is independently analyzed, so that only one-sided abnormal determination results in different business scenarios can be obtained, and the abnormal situation of the business object cannot be effectively determined, which reduces the accuracy of the abnormal determination of the business object. SUMMARY

[0005] Embodiments of the present application provide an exception determination method, device, electronic equipment and storage medium to solve the problem that the abnormal situation of a business object cannot be effectively determined in the prior art, and the accuracy of the abnormal determination of the business object is low.

[0006] In a first aspect, an exception determination method is provided, comprising:

[0007] Based on the first business processing data corresponding to each type of business in which the to-be-determined object participates in processing in a specified historical stage, an operation description information set and a first interaction text set corresponding to each type of business are obtained;

[0008] Each business processing object associated with each first business processing data except the to-be-determined object is obtained, and for each type of business, a second interaction text set is obtained according to the second business processing data in which each business processing object participates in processing in the specified historical stage;

[0009] A trained target exception determination model is used to perform feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set, to obtain a fusion conversion result of each type of feature;

[0010] The target exception determination model is used to obtain an abnormal determination result of the to-be-determined object based on the fusion conversion result.

[0011] In a second aspect, an exception determination device is provided, comprising:

[0012] An obtaining unit is configured to obtain a set of operation description information and a set of first interaction texts corresponding to each type of business based on first business processing data corresponding to each type of business in which the to-be-determined object participated in processing within a specified historical stage;

[0013] A obtaining unit is configured to obtain each business processing object associated with each first business processing data except for the to-be-determined object, and for each type of business, obtain a set of second interaction texts based on second business processing data in which each business processing object participated in processing within the specified historical stage;

[0014] An extraction unit is configured to use a trained target exception determination model to perform feature extraction operations on the set of operation description information, each set of first interaction texts, and each set of second interaction texts, to obtain a fusion conversion result of each type of feature;

[0015] A determination unit is configured to use the target exception determination model to obtain an exception determination result of the to-be-determined object based on the fusion conversion result.

[0016] Optionally, when the set of second interaction texts is obtained based on the second business processing data in which each business processing object participated in processing within the specified historical stage for each type of business, the obtaining unit is configured to:

[0017] For each type of business, the following operations are performed:

[0018] Obtain each second business processing data in which each business processing object directly participated in processing a type of business within the specified historical stage;

[0019] For the type of business, obtain a set of second interaction texts based on interaction texts in the second business processing data.

[0020] Optionally, after the set of second interaction texts is obtained, before the trained target exception determination model is used to perform feature extraction operations on the set of operation description information, each set of first interaction texts, and each set of second interaction texts, the extraction unit is further configured to:

[0021] For each set of first interaction texts, the following operations are performed: connect each interaction text in a set of first interaction texts into a first interaction text sequence through a first identifier;

[0022] For each second set of interactive texts, perform the following operations: use a second identifier to connect the interactive texts belonging to the same business processing object in each second set of interactive texts to obtain an interactive text subsequence, and use a third identifier to connect each interactive text subsequence to obtain a second interactive text sequence.

[0023] Optionally, the trained target anomaly determination model includes a first target feature fusion network, various target encoding networks, a second target feature fusion network, and a target anomaly classification network;

[0024] When the trained target anomaly detection model is used to perform feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set, the extraction unit is used for:

[0025] Using the target feature fusion network, operation information fusion features are obtained based on the operation description information set;

[0026] Using each of the first target encoding networks in the target anomaly determination model, text embedding encoding operation, position encoding operation, and attribution text encoding operation are performed on each of the first interactive text sequences to obtain the corresponding first text encoding features;

[0027] Using the second target encoding networks in the target anomaly determination model, text embedding encoding, position encoding, attribution object encoding, and attribution text encoding operations are performed on each second interactive text sequence to obtain the corresponding second text encoding features.

[0028] Thirdly, an electronic device is proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the exception determination method described in any one of the first aspects above.

[0029] Fourthly, a computer-readable storage medium is proposed, on which a computer program is stored, wherein the computer program, when executed by a processor, implements the exception determination method described in any one of the first aspects above.

[0030] Fifthly, a computer program product is proposed, comprising a computer program that, when executed by a processor, implements the exception determination method as described in any one of the first aspects above.

[0031] The beneficial effects of this application are as follows:

[0032] In the embodiment of the present application, an abnormality determination method, device, electronic equipment and storage medium are provided. Based on the first business processing data corresponding to each type of business in which the to-be-determined object participates in processing within a specified historical stage, the operation description information set corresponding to the to-be-determined object is comprehensively determined, and the first interaction text set of the to-be-determined object under each type of business is determined. Each business processing object associated with the to-be-determined object is obtained, and for each type of business, the second business processing data when each business processing object processes the corresponding type of business is obtained to obtain the second interaction text set. Then, by means of the trained target abnormality determination model, the operation description information set, each first interaction text set, and each second interaction text set are obtained to realize comprehensive determination of the to-be-determined object and obtain the abnormality determination result of the to-be-determined object.

[0033] In this way, when the to-be-determined object is analyzed for abnormality, not only the business processing data of the to-be-determined object in each type of business is combined, but also the business processing data of the business processing object associated with the to-be-determined object in each type of business is combined. In other words, when the abnormality of the to-be-determined object is determined, multiple dimensions of data related to the to-be-determined object are fused. Therefore, the to-be-determined object described by multiple dimensions of data can be comprehensively analyzed, the abnormality of the business object can be effectively determined, and the accuracy of the abnormality determination of the to-be-determined object is improved.

[0034] In addition, the trained target abnormality model can perform feature extraction operation on the operation description information set, each first interaction text set, and each second interaction text set, respectively. In other words, the data related to the to-be-determined object under each type of business can be extracted. Therefore, the feature extraction process can take into account the differences between different types of businesses, so that the fusion conversion result obtained can better reflect the performance of the to-be-determined object under different types of businesses, and also reflect the performance of each business processing object under different types of businesses, providing a basis for the abnormality determination of the to-be-determined object and assisting in improving the accuracy of the abnormality determination of the to-be-determined object. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 An application scenario in the embodiment of the present application is shown;

[0036] Figure 2a A flowchart for training the to-be-trained abnormality determination model in the embodiment of the present application is shown;

[0037] Figure 2b A structure diagram of the to-be-trained abnormality determination model in the embodiment of the present application is shown;

[0038] Figure 2cA structural schematic diagram of the first feature fusion network in the embodiment of the present application;

[0039] Figure 2d A structural schematic diagram of the first encoding network in the embodiment of the present application;

[0040] Figure 2e A schematic diagram of the first encoding network in the embodiment of the present application encoding the received first interactive text sequence;

[0041] Figure 2f A structural schematic diagram of the second encoding network in the embodiment of the present application;

[0042] Figure 2g A schematic diagram of the second encoding network in the embodiment of the present application encoding the received second interactive text sequence;

[0043] Figure 3 A flowchart of the anomaly determination in the embodiment of the present application;

[0044] Figure 4 A process schematic diagram of the anomaly determination on the to-be-determined object in the embodiment of the present application;

[0045] Figure 5 A logical structure schematic diagram of the anomaly determination device in the embodiment of the present application;

[0046] Figure 6 A hardware component structure schematic diagram of an electronic device in the embodiment of the present application;

[0047] Figure 7 A structural schematic diagram of a computing device in the embodiment of the present application. DETAILED DESCRIPTION

[0048] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments described in the present application document, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application technical scheme.

[0049] The terms “first”, “second”, and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0050] The following explains some terms in the embodiments of the present application to facilitate understanding by those skilled in the art.

[0051] Operation description information: refers to information for describing the operation of an object on various types of businesses, and can also be understood as information obtained according to the operation of an object on various types of businesses. In the embodiments of the present application, the operation description information specifically refers to information that is statistically generated when processing various types of businesses, and the operation description information includes different contents in different types of businesses. For example, in the scenario of virtual resource transfer, the operation description information can specifically be the transfer amount of virtual resources, and the number of hits between the text noted during resource transfer and abnormal keywords. In the social interaction scenario, the operation description information can specifically be the number of active days, the number of registration days, and the number of content publishing, etc.

[0052] First interaction text set: refers to a text set obtained by summarizing the interaction texts generated when a to-be-judged object participates in processing various types of businesses in a specified historical stage. In the embodiments of the present application, the first interaction text set not only includes the interaction texts sent by the to-be-judged object to other objects, but also includes the interaction texts sent by other objects to the to-be-judged object.

[0053] Second interaction text set: refers to a text set obtained by summarizing the interaction texts generated when each business processing object participates in processing a type of business in a specified historical stage. In the embodiments of the present application, the second interaction text set includes the interaction texts of each business processing object when processing the same type of business in the specified historical stage.

[0054] The design idea of the embodiments of the present application is briefly introduced as follows:

[0055] In the related art, when judging the abnormal situation of a to-be-judged object, the business data of the to-be-judged object in different business scenarios is usually obtained, and the abnormal judgment results of the to-be-judged object in different business scenarios are respectively determined according to the inclusion of the interaction texts in the business data with respect to various abnormal keywords, and then the abnormal situation of the to-be-judged object is determined based on the abnormal judgment results of the to-be-judged object in different business scenarios.

[0056] However, the current judgment method of independently obtaining the abnormal judgment results of the to-be-judged object in different business scenarios based on the data of the to-be-judged object in different business scenarios, and then comprehensively determining the abnormal situation of the to-be-judged object based on the abnormal judgment results, is equivalent to splitting the operation data of the to-be-judged object into different application scenarios, so that only part of the operation data of the to-be-judged object can be analyzed in different application scenarios, and the abnormal situation of the to-be-judged object cannot be grasped as a whole. Therefore, the abnormal situation of the business object cannot be effectively judged, and the accuracy of the abnormal judgment of the to-be-judged object is reduced.

[0057] Therefore, in the embodiments of the present application, an abnormality determination method and device, an electronic device, and a storage medium are provided. The method comprises: determining a set of operation description information corresponding to a to-be-determined object based on first business processing data corresponding to each type of business in which the to-be-determined object participates in a specified historical stage; determining a first interaction text set of the to-be-determined object in each type of business; obtaining each business processing object associated with the to-be-determined object; and obtaining a second interaction text set corresponding to each type of business by respectively processing second business processing data of each business processing object when processing the corresponding type of business. Then, by means of a trained target abnormality determination model, a comprehensive determination of the to-be-determined object is realized based on the obtained set of operation description information, each first interaction text set, and each second interaction text set, and an abnormality determination result of the to-be-determined object is obtained.

[0058] In this way, when performing abnormality analysis on the to-be-determined object, not only the business processing data of the to-be-determined object in each type of business is combined, but also the business processing data of the business processing object associated with the to-be-determined object in each type of business is combined. In other words, when determining the abnormality of the to-be-determined object, multiple dimensions of data related to the to-be-determined object are fused. Therefore, the to-be-determined object described by the multiple dimensions of data can be comprehensively analyzed, the abnormality of the business object can be effectively determined, and the accuracy of the abnormality determination of the to-be-determined object is improved.

[0059] In addition, the trained target abnormality model can perform feature extraction operations on the set of operation description information, each first interaction text set, and each second interaction text set, respectively. In other words, the data related to the to-be-determined object in each type of business can be extracted as features. Therefore, the feature extraction process can take into account the differences between different types of businesses, so that the fusion conversion result obtained can better reflect the performance of the to-be-determined object in different types of businesses, and also reflect the performance of each business processing object in different types of businesses, thereby providing a basis for the abnormality determination of the to-be-determined object and assisting in improving the accuracy of the abnormality determination of the to-be-determined object.

[0060] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application, and the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0061] Referring to Figure 1As shown, it is a possible application scenario in the embodiments of the present application. In the application scenario, terminal devices 110 (including terminal device 1101 of object 1, terminal device 1102 of object 2, …, and terminal device 110n of object n), service servers 120 (including service server 1201 corresponding to service 1, service server 1202 corresponding to service 2, …, and service server 120m corresponding to service m), and processing device 130 are included.

[0062] In the embodiments of the present application, terminal device 110 includes, but is not limited to, desktop computers, mobile phones, mobile computers, tablet computers, media players, smart wearable devices, smart televisions, vehicle-mounted devices, personal digital assistants (PDA), and other electronic devices.

[0063] Service server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and basic cloud computing services such as big data and artificial intelligence platforms.

[0064] Processing device 130 is a device for implementing abnormality determination in the embodiments of the present application. Processing device 130 can be a designated service server, or a separate server independent of the service server, or a separate electronic device independent of the service server. Processing device 130 can determine the abnormality of the object to be determined based on the obtained service processing data of various services. Processing device 130 can be a desktop computer, a mobile phone, a mobile computer, a tablet computer, or other electronic devices, or a standalone physical server, a cloud server, or other server devices.

[0065] In the embodiments of the present application, terminal device 110 and corresponding service server 120 are connected by wired or wireless connection, and a communication connection is established through a communication network. Processing device 130 and service server 120 are connected by wired or wireless connection, and a communication connection is established through a communication network.

[0066] In the possible technical solutions of the present application, an object on a terminal device 1101 accesses various service servers 120 corresponding to various services to implement service processing, and the service processing data of the object processing different services is saved in the corresponding service server 120. Processing device 130 accesses service server 120 to obtain the service processing data of different objects for various services, and then implements abnormality determination based on the obtained service processing data.

[0067] The technical solution provided in the application can obtain various associated objects including the to-be-judged object, and business processing data in various businesses, to implement abnormal judgment on the to-be-judged object in various application scenarios.

[0068] Scenario one: abnormal transfer of the to-be-judged object to electronic money.

[0069] Specifically, the processing device 130 can obtain business processing data of the to-be-judged object and various business processing objects in various businesses related to the transfer of electronic money, and implement judgment on whether the to-be-judged object abnormally transfers electronic money based on the obtained business processing data.

[0070] For example, when judging whether the to-be-judged object has a money laundering behavior, the business processing data of the to-be-judged object and various business processing objects in the transfer business and the red envelope business can be obtained, and targeted analysis can be performed.

[0071] Scenario two: abnormal use of electronic money by the to-be-judged object.

[0072] Specifically, the processing device 130 can obtain business processing data of the to-be-judged object and various business processing objects in various businesses related to the use of electronic money, and implement judgment on whether the to-be-judged object abnormally uses electronic money based on the obtained business processing data.

[0073] For example, when judging whether the to-be-judged object has a gambling behavior, the business processing data of the to-be-judged object and various business processing objects in the transfer business and the red envelope business can be obtained, and targeted analysis can be performed.

[0074] Scenario three: participation of the to-be-judged object in abnormal organizations.

[0075] For example, when judging whether the to-be-judged object has a behavior of joining an illegal organization, the processing device 130 can obtain business content published by the to-be-judged object and various business processing objects on a social platform, and travel data, and perform targeted analysis on the to-be-judged object according to the obtained data.

[0076] It should be noted that in some possible application scenarios of the application, when the target abnormal judgment model is used to perform abnormal judgment on the to-be-judged object, the target abnormal judgment model can be installed on the processing device 130, so that the processing device 130 can directly use the target abnormal judgment model for processing, wherein the target abnormal judgment model can be obtained by the processing device 130 itself, or the target abnormal judgment model can be obtained by other devices and provided to the processing device 130.

[0077] In some possible application scenarios of this application, when the target abnormality determination model is installed on another device, the processing device 130 can send the processed service processing data of each object to the other device on which the target abnormality determination model is installed, and directly obtain the abnormality determination result for the to-be-determined object from the other device.

[0078] In the following description of this application, the abnormality determination process in this application will be described by taking the target abnormal object as an example, which is trained by the processing device 130 and determined by the processing device 130 for the to-be-determined object.

[0079] First, the process of training the target abnormality determination model in the embodiment of this application will be described with reference to the accompanying drawings:

[0080] It should be noted that in the embodiment of this application, the processing device can periodically train the abnormality determination model according to actual processing needs, so that the latest target abnormality determination model can be used to determine the abnormality of the to-be-determined object when determining the abnormality of the to-be-determined object.

[0081] Referring to Figure 2a FIG. 2 is a flowchart of training the abnormality determination model to be trained in the embodiment of this application, which will be described below with reference to the accompanying drawings. Figure 2a The training process of the abnormality determination model will be described in detail:

[0082] Step 201: The processing device obtains a training sample set.

[0083] In the embodiment of this application, the processing device can generate a training sample set according to the service processing data of the sample object and the associated object in the set history period, wherein each training sample includes input information and an abnormality label determined for a sample object, and the input information includes a sample operation description information set and a sample first interaction text set and a sample second interaction text set corresponding to each type of business.

[0084] It should be noted that in some possible embodiments, the set history period described above corresponds to the same duration as the specified history period for obtaining service processing data when determining the abnormality of the to-be-determined object; in some other possible embodiments, the set history period can be a history period set according to actual processing needs, and the duration of the set history period can be different in different training periods of the abnormality determination model.

[0085] In the embodiment of this application, when generating the training sample, the way of selecting the sample object can be any one or a combination of the following:

[0086] A、the processing device determines an object previously determined as abnormal by the target abnormality determination model as a sample object.

[0087] B、the processing device determines an object previously recorded as abnormal as a sample object.

[0088] Specifically, the object previously recorded as abnormal can be an object determined as abnormal by manual detection or other detection methods before the technical solution proposed in the present application is adopted.

[0089] C、the processing device determines an object with a frequency of operation on a specified type of business higher than a first set value in a set historical stage as a sample object.

[0090] Specifically, in order to ensure that the business processing data of the sample object can be obtained, the number of times of processing the specified type of business in the set historical stage can be used to determine the sample object that can participate in generating the training sample, so that only the object with the number of times of processing the specified type of business exceeding the first set value can be selected as the sample object. The first set value can be set according to actual processing needs, which is not limited herein.

[0091] D、the processing device determines an object with a total frequency of operation on each type of business higher than a second set value in a set historical stage as a sample object.

[0092] Specifically, in order to ensure that the business processing data of the sample object can be obtained, the number of times of processing each type of business in the set historical stage can be used to determine the sample object that can participate in generating the training sample, so that only the object with the number of times of processing each type of business exceeding the second set value can be selected as the sample object. The second set value can be set according to actual processing needs, which is not limited herein.

[0093] Further, the processing device determines each sample object, and performs the following operations for each sample object: based on the sample first business processing data of each type of business corresponding to the sample object in the set historical stage, obtaining a sample operation description information set and a sample first interaction text set corresponding to each type of business; obtaining each associated object associated with each sample first business processing data except the sample object, and according to the sample second business processing data of each associated object in the set historical stage, obtaining a sample second interaction text set corresponding to each type of business.

[0094] After determining the first service processing data of each sample and the second service processing data of each sample, the processing device respectively obtains a corresponding first interaction text set of each sample according to the interaction text included in the first service processing data of each sample, and respectively obtains a corresponding second interaction text set of each sample according to the interaction text included in the second service processing data of each sample, wherein the interaction text refers to the text content directly sent between the sample object and the associated object.

[0095] For example, in the scenario of determining the abnormal transfer of the object to the electronic money, or in the scenario of determining the abnormal use of the object to the electronic money, the interaction text specifically refers to the note text when the electronic money is transferred, such as transfer note or red envelope message.

[0096] For another example, in the scenario of determining the participation of the object to the abnormally organized, the interaction text specifically refers to the content published by the object, the text content forwarded by the object, the appendix content when the object forwards the data published by other objects, and the like.

[0097] It should be noted that in the implementation of the present application, each associated object of each sample first service processing data in addition to the sample object specifically refers to the object directly interacting with the sample object recorded in each sample first service processing data, wherein the object directly interacting with the sample object includes: the object to which the sample object initiates business interaction, and the object initiating business interaction to the sample object.

[0098] For example, assuming that the set historical stage is from January 1st to March 31st, the processing device obtains the business processing data of the sample object 1 when performing various business processing in the set historical stage as the first service processing data of each sample, and determines the objects to which the sample object 1 initiates business interaction in each first service processing data of each sample, and determines the objects initiating business interaction to the sample object 1, and takes each determined object as an associated object. Further, the business processing data of each associated object respectively in the business processing from January 1st to March 31st is obtained as the second service processing data of each sample. Further, the interaction text set is generated by extracting the interaction text from the sample business processing data.

[0099] The processing device takes the sample operation description information set obtained for one sample object, the first interaction text set of each sample, and the second interaction text set of each sample as input information in one training sample, and labels the abnormal label for the sample object, and takes the input information and the labeled abnormal label obtained by processing as a generated training sample, and similarly constructs a training sample set based on each generated training sample.

[0100] It should be noted that the abnormal label labeled for the sample object corresponds to the possible abnormal determination result, in other words, the labeled abnormal label is the abnormal determination result corresponding to the sample object.

[0101] For example, in the scenario of determining the abnormal transfer of electronic money, the labeled abnormal label may be specifically: there is money laundering behavior, or there is no money laundering behavior.

[0102] For example, in the scenario of determining the abnormal use of electronic money, the labeled abnormal label may be: there is gambling behavior, or there is no gambling behavior according to actual processing needs.

[0103] For example, in the scenario of determining the abnormal use of electronic money, the labeled abnormal label may be: there is gambling behavior, and there is behavior of buying various prohibited goods, etc.

[0104] For example, in the scenario of determining the participation of abnormal organizations, the labeled abnormal label may be: there is behavior of participating in cult organizations, there is behavior of participating in other illegal organizations, etc.

[0105] In this way, in the constructed training sample, not only the business processing data of the sample object in various businesses is combined, but also the text content of each associated object directly interacted with the sample object in various businesses is combined, so that the constructed training sample can integrate more dimensional data features, and thus can represent the abnormal situation of the sample object from multiple dimensions, providing more dimensional learnable content for the training of the abnormal determination model, and helping to improve the determination accuracy of the trained target abnormal determination model.

[0106] Step 202: The processing device adopts the training sample in the training sample set to perform multiple rounds of iterative training on the abnormal determination model, and outputs the target abnormal determination model when the preset convergence condition is met.

[0107] After the processing device obtains the training sample set, the processing device performs multiple rounds of iterative training on the abnormal determination model to be trained based on the training sample in the training sample set, until the preset convergence condition is met. The abnormal determination model obtained by the last training is used as the target abnormal determination model.

[0108] Next, taking one iteration training process as an example, the training process is described:

[0109] In the embodiment of the application, when performing one round of iterative training, the processing device can simultaneously use one or more training samples to perform training in parallel according to actual training needs, and the application does not make specific limitations.

[0110] In the embodiment of the present application, the anomaly determination model at least includes a first feature fusion network, various type encoding networks, a second feature encoding network, and an anomaly classification network.

[0111] The processing device obtains a training sample, inputs input information in the training sample into the anomaly determination model, and obtains a predicted anomaly determination result output by the anomaly determination model, wherein one training sample includes input information and an anomaly label, and the input information includes a sample operation description information set and a sample first interaction text set and a sample second interaction text set corresponding to each type of business.

[0112] Referring to Figure 2b As shown in the figure, it is a structure schematic diagram of the anomaly determination model to be trained in the embodiment of the present application. The following will be combined with the attached Figure 2b The structure of the anomaly determination model is described as follows:

[0113] (1) The first feature fusion network is used to extract information fusion features from the operation description information set.

[0114] Specifically, the first feature fusion network in the embodiment of the present application can be a multi-layer dense network, which is used to perform feature conversion and feature fusion on the dense information in the operation description information.

[0115] It should be noted that a bias and an activation function layer are added in the multi-layer dense network in the present application, wherein the added activation function layer is used to capture the nonlinear relationship between variables, and the adopted activation function can be a rectified linear unit (RELU).

[0116] Referring to Figure 2c As shown in the figure, it is a structure schematic diagram of the first feature fusion network in the embodiment of the present application,

[0117] The present application uses a multi-layer dense (bias added) network to model the dense features (statistical variables), in order to capture the nonlinear relationship between variables, a RELU activation layer is added, as Figure 2c As shown, when training the anomaly determination model, the processing device arranges each sample operation description information in the sample operation description information set into a p-dimensional vector form according to a specified order, such as Figure 2c X1, X2, X3…Xp in the formula, and then the multi-layer dense network performs feature fusion and extraction operations on the input vector to obtain h-dimensional information fusion features, such as Y1, Y2, Y3…Yh, wherein the values of p and h are set according to actual processing needs, and the present application does not make specific limitations.

[0118] Figure 2cThe full connection layer (FC) shown in the figure is used to represent the dense structure in the present application. In the present application, a plurality of dense layers are used to implement functions, wherein the number of dense layers is set according to actual use requirements. Figure 2c The two layers shown in the figure are only illustrative examples. M in the single dense network represents the dimension of the full connection layer, that is, M is the total number of neurons, wherein M is a positive integer and can be 4096.

[0119] (2) Various types of encoding networks: networks for extracting text encoding features from different sets of interactive texts, specifically including a first encoding network for extracting text encoding features from the first set of interactive texts of each sample, and a second encoding network for extracting text encoding features from the second set of interactive texts of each sample, wherein the model structures of the first and second encoding networks are different.

[0120] It should be noted that in the embodiments of the present application, the first and second encoding networks adopt the structure of the Bert base operator transformer-encoder (Transformer-Encoder) network. The reason for using Transformer-Encoder is that, on the one hand, it can take into account the presence of more short texts in the interactive texts of various types of businesses in the present application, and on the other hand, it can take into account the generation of the second set of interactive text samples by splicing the interactive texts of different objects and inputting them into the second encoding network when different objects participate in business processing based on the same type of business. Therefore, it is necessary to consider the short text sequence of short texts and the complex correlation between the context short texts.

[0121] The structure and processing mode of the first and second encoding networks will be described below in conjunction with the accompanying drawings:

[0122] Referring to Figure 2d , which is a structural diagram of the first encoding network in the embodiments of the present application, according to Figure 2d , the content shown, "Nx" can be understood as "N times", representing that there are N network structures framed by the dashed box in the first encoding network, and N usually takes the value of 1. Figure 2d The first encoding network shown in the figure can implement text embedding encoding operations, position encoding operations, and belonging text encoding operations, wherein Figure 2d The network structure framed by the dashed box in the figure is the original network part in the Transformer-Encoder, so the present application will not be described.

[0123] In conjunction with Figure 2dIn the network structure shown, when obtaining text encoding features by using the first encoding network, the processing device uses the first identifier to connect each interactive text of the sample object under the same type of service to obtain each first interactive text sequence corresponding thereto, and then uses each first interactive text sequence obtained for each type of service as input data of the corresponding first encoding network. In the scheme disclosed in the present application, one first interactive text sequence of the sample object under one type of service is encoded by one corresponding first encoding network to extract encoding features.

[0124] It should be noted that, in order to ensure the consistency of the operation, the processing device can generate input data forms including the same number of interactive texts for the interactive texts of the sample object under each type of service, for example, the total number of interactive texts included in the first interactive text sequence is set to i, and the interactive texts less than i are padded with empty texts. For a type of service with a total number of interactive texts greater than i, i interactive texts can be selectively extracted from the sample first interactive text set to generate a first interactive text sequence, where i is a positive integer.

[0125] For example, assuming that the special character "#" is used to separate each interactive text of the sample object under service 1, the input data form of the sample object's interactive text 1#sample object's interactive text 2...#sample object's interactive text i can be obtained.

[0126] Based on Figure 2d In the network structure shown, when the first interactive text sequence is received, text encoding can be obtained as Figure 2e As shown in Figure 2e It is a schematic diagram of the first encoding network in the embodiment of the present application for encoding the received first interactive text sequence.

[0127] According to Figure 2e When the processing device inputs the content in the first encoding network, specifically, "transfer payment#self 500#...#", the first encoding network performs three encoding operations on the received first interactive text sequence, namely, text embedding encoding operation (Token embeddings), position encoding operation (Position embeddings), and segment text encoding operation (Segment embeddings).

[0128] It should be noted that the implementation of the segment text encoding operation is realized by recognizing the first identifier. In the case of connecting each sample first interactive text according to the first identifier, it can be determined that the two different sample first interactive texts connected by the first identifier.

[0129] Referring to Figure 2fAs shown, it is a structural schematic diagram of the second encoding network in the embodiment of the present application, according to Figure 2f As shown, "Nx" can be understood as "N times", representing that there are N network structures framed by the dashed box in the second encoding network, and usually N takes the value of 1. Figure 2f As shown, the second encoding network can realize text embedding encoding operation, position encoding operation, belonging object encoding operation, and belonging text encoding operation, wherein, Figure 2f The network structure framed by the dashed box in the transformer-encoder is the original network part in the transformer-encoder, so the present application will not be described.

[0130] In the embodiment of the present application, Figure 2f As shown, in the second encoding network, the belonging object number is added in the network structure shown in the first encoding network to improve the aggregation of the associated objects and weaken the partial order of the associated objects, and in Figure 2f In the embodiment of the present application, E1 and E2 represent different associated objects respectively.

[0131] In combination with Figure 2f As shown, when obtaining the text encoding features by using the second encoding network, the processing device uses the second identifier to connect the interactive texts belonging to the same associated object in a sample second interactive text set to obtain an interactive text subsequence, and uses the third identifier to connect each interactive text subsequence to obtain a second interactive text sequence.

[0132] It should be noted that in order to ensure the consistency of the operation, the processing device can generate the second interactive text sequence corresponding to each associated object with the same number of interactive texts according to the interactive texts of each associated object participating in the same type of business, that is, the input data form of the second encoding network, for example, the total number of interactive texts of an associated object in the second interactive text sequence is set to j, and the empty text is filled up for less than j, and for a certain type of business with a total number of interactive texts greater than j, j interactive texts can be selectively extracted to generate a second interactive text sequence, wherein j is a positive integer.

[0133] For example, assuming that the second identifier is "#" and the third identifier is "##", then the obtained second interactive text sequence is as follows: interactive text 1 of associated object 1 # interactive text 2 of associated object 1... # interactive text j of associated object 1 ## interactive text 1 of associated object 2 # interactive text 2 of associated object 2 #... # interactive text j of associated object 2 ##... ## interactive text 1 of associated object z # interactive text 2 of associated object z... # interactive text j of associated object z.

[0134] Based on Figure 2fThe network structure shown can obtain, when text encoding is performed on the received second interactive text sequence, as Figure 2g The encoding process shown, see Figure 2g The encoding process shown, see

[0135] According to Figure 2g As shown, the processing device inputs the content in the second encoding network, specifically, "tuition # gas fee ## property fee # card #... ##", when the second encoding network encodes the received second interactive text sequence in four aspects, namely, text embedding encoding operation, position encoding operation, related object encoding operation (RelatedObjEmbeddings), and attribution text encoding operation, to obtain the text encoding features obtained by the second encoding network.

[0136] It should be noted that the implementation of the attribution text encoding operation is realized by recognizing the second identifier, and in the case of connecting the sample second interactive text of the same associated object according to the second identifier, it can be determined that the second identifier connects two different sample second interactive texts, and the attribution object encoding operation is realized by recognizing the third identifier. Since the third identifier connects the interactive text of different associated objects, the associated object to which the interactive text belongs can be determined by recognizing the third identifier.

[0137] (3) Second target feature fusion network: used for converting and fusing the obtained information fusion features and each text encoding feature to obtain the fusion conversion result of each type of feature.

[0138] It should be noted that the second target feature fusion network in the present application can be a single-layer dense network, that is, the structure of the single-layer dense network in Figure 2c The present application will not be described again.

[0139] (4) Abnormal classification network: used for obtaining the abnormal judgment result of the object to be judged based on the obtained fusion conversion result of each type of feature.

[0140] The abnormal classification network in the embodiments of the present application can be a normalization (softmax) network or a S-type (signoid) algorithm network, which is used to realize abnormal classification.

[0141] After the model structure of the abnormal judgment model is determined, the operations performed in a round of iterative training process are described as follows:

[0142] The processing device adopts an anomaly determination model, obtains a predicted anomaly determination result based on input information in the training sample, and adjusts parameters of the anomaly determination model based on a cross-entropy loss value between the predicted anomaly determination result and a corresponding anomaly label.

[0143] Specifically, in the case where the anomaly determination model to be trained includes a first feature fusion network, various type encoding networks, a second feature fusion network, and an anomaly classification network, when obtaining the predicted anomaly determination result, the processing device inputs a sample operation description information set in the training sample into the first feature fusion network to obtain information fusion features, inputs each sample first interaction text set and each sample second interaction text set into the various type encoding networks respectively to obtain corresponding various text encoding features, inputs the information fusion features and the spliced various text encoding features into the second feature fusion network to obtain fusion conversion results of the various types of features, and inputs the obtained fusion conversion results into the anomaly classification network to obtain the predicted anomaly determination result.

[0144] Further, after obtaining the anomaly determination result, the parameters of the anomaly determination model are adjusted based on the difference between the predicted anomaly determination result and the corresponding anomaly label by using a cross-entropy loss function.

[0145] In this way, the anomaly determination model constructed by the multiple networks can realize anomaly determination of multiple dimensions of the sample object based on the input information in the training sample, and finally obtain the predicted anomaly determination result.

[0146] Similarly, the processing device performs multiple rounds of iterative training by using the above test method until a preset convergence condition is met, wherein the preset convergence condition at least includes any one of the following:

[0147] Condition one, the number of rounds of iterative training reaches a preset first threshold value.

[0148] It should be noted that the value of the first threshold value is set according to actual processing needs, and the present application does not make specific limits here.

[0149] Condition two, the number of times that the loss value calculated based on the predicted anomaly determination result output by the anomaly determination model and the corresponding anomaly label is lower than a second threshold value reaches a set threshold value.

[0150] It should be noted that the values of the second threshold value and the set threshold value are set according to actual processing needs, and the present application does not make specific limits here.

[0151] Thus, through the multi-round iterative training of the abnormality determination model, the trained target abnormality determination model can be finally obtained, and since the abnormality determination model learns to determine the abnormality based on the multi-dimensional data of the sample object during the training process, more factors can be considered when the abnormality determination model determines the abnormality, and the determination accuracy of the abnormality determination model is improved.

[0152] Referring to Figure 3 As shown in the flowchart of the abnormality determination in the embodiments of the present application, the following will be described in combination with the accompanying Figure 3 The process of the abnormality determination based on the trained target abnormality determination model in the embodiments of the present application will be described as follows:

[0153] Step 301: The processing device obtains the operation description information set and the first interaction text set corresponding to each type of business based on the first business processing data corresponding to each type of business in which the to-be-determined object participates in the specified historical stage.

[0154] Specifically, when the processing device determines the abnormality of the to-be-determined object, the data related to the to-be-determined object needs to be obtained first. Therefore, the processing device obtains the first business processing data corresponding to each type of business in which the to-be-determined object participates in the specified historical stage, and obtains the operation description information set and the first interaction text set corresponding to each type of business based on each first business processing data.

[0155] In the embodiments of the present application, the processing device takes the business processing data when the to-be-determined object initiatively initiates business interaction with other objects and when other objects initiate business interaction with the to-be-determined object in each type of business in the specified historical stage as the first business processing data in which the to-be-determined object participates in the specified historical stage. The specific business types of each type of business are determined according to actual processing needs, which are not limited in the present application.

[0156] For example, assuming that the current time is December 2, and the data of the to-be-determined object in the past 6 months is obtained for abnormality determination when the abnormality of the to-be-determined object is analyzed, the specified historical stage is from June 2 to December 1, and the processing device obtains the first business processing data in which the to-be-determined object directly participates in each type of business during the period from June 2 to December 1.

[0157] For example, assuming that the currently determined types of business are transfer business and red packet business, then for the transfer business, a first business processing data of the to-be-judged object is generated based on the transfer information of the to-be-judged object to other objects and the transfer information of other objects to the to-be-judged object within the specified historical stage; similarly, for the red packet business, a first business processing data of the to-be-judged object is generated based on the red packet information of the to-be-judged object sent to other objects and the red packet information of other objects sent to the to-be-judged object within the specified historical stage.

[0158] In the embodiments of the present application, when the operation description information set is obtained, the processing device respectively determines the interaction text in each first business processing data, and respectively generates a corresponding first interaction text set corresponding to the interaction text in each first business processing data. Then, the operation frequency information of the to-be-judged object when processing each type of business is determined, and the operation description information set is generated according to the determined operation frequency information and the hit situation of each type of preset abnormal keyword in each first interaction text set.

[0159] It should be noted that the processing device can preset each type of abnormal keyword for various possible abnormal situations. For example, for gambling behavior, the preset abnormal keywords can be: Hu card, mahjong, Douzhuang, etc.

[0160] For example, in the case where each type of business is transfer business and red packet business, the processing device generates a first interaction text set by obtaining the transfer text received by the to-be-processed object as a transfer receiver and the transfer text sent by the to-be-processed object as a transfer initiator. Similarly, the processing device generates a first interaction text set by obtaining the red packet text received by the to-be-processed object as a red packet receiver and the red packet text sent by the to-be-processed object as a red packet sender.

[0161] For example, when determining the hit situation of the abnormal keyword in each first interaction text set, the total number of occurrences of each type of abnormal keyword in each first interaction text set can be determined, or the number of matched keywords corresponding to each type of abnormal keyword in each first interaction text set can be determined, and the hit situation of the abnormal keyword in each first interaction text set can be determined according to the determined total number of occurrences of each type of abnormal keyword or the number of matched keywords.

[0162] For example, assume that a type of abnormal keyword is {zichu, hu card, mahjong, domineer…}, and another type of abnormal keyword is {XX drug, knife…}. Assume that in the transfer scenario, the first interactive text set includes {transfer payment; zichu 500 yuan; XX drug payment; property fee}, and in the red envelope interaction scenario, the first interactive text set includes {happy new year; happy Valentine's Day; good luck, play mahjong next time; domineer debt}. In the first interactive text set in the transfer scenario, the number of abnormal keywords appearing is 2, which are “zichu” and “XX drug”, and the abnormal keyword hit number is 2. In the first interactive text set in the red envelope interaction scenario, the number of abnormal keywords appearing is 2, which are “mahjong” and “domineer”, and the abnormal keyword hit number is 2.

[0163] It should be noted that in the embodiments of the present application, the information in the operation description information set can be obtained by statistics according to the operation of the to-be-judged object on each type of business. The data obtained by the to-be-judged object in the real business scenario in each first business processing data generated by the to-be-judged object in processing each type of business includes not only dense information, i.e. some statistical information and dictionary hit number information determined to increase the interpretability of the model, but also pure text. Since pure text and statistical information belong to different modalities of information, different networks in the target anomaly judgment model are used in the present application to process pure text and dense information, and finally to comprehensively realize the anomaly judgment of the to-be-judged object.

[0164] For statistical information, there are different definitions in different types of businesses. Possible statistical information includes active days, registration days, post numbers, payment amounts, etc. Such information exists in the form of natural numbers and decimals. For dictionary hit number information, it can also be understood as keyword hit number, which is used to represent the hit situation of abnormal keywords in the interactive text set. This information is to meet the demand for model interpretability in actual business scenarios. Building dictionary hit number information is to ensure the coverage judgment of normal objects and to quickly process abnormal objects. The dictionary hit number information also exists in the form of natural numbers. For pure text, unlike various statistical information, pure text can be understood as a discrete variable and has context relevance.

[0165] For example, the operation frequency of the to-be-judged object on each type of business can be the number of transfers of the to-be-judged object in a specified historical stage, the number of received transfers of the to-be-judged object in a specified historical stage, the number of red envelope sending of the to-be-judged object in a specified historical stage, and the number of red envelope receiving of the to-be-judged object in a specified historical stage.

[0166] In this way, the operation of the to-be-judgment object in each type of business can be aggregated from the perspective of the to-be-judgment object, so that the business processing of the to-be-judgment object can be effectively represented, which helps to effectively sort the business data processed by the to-be-judgment object and improves the judgment accuracy of the to-be-judgment object.

[0167] In step 302, the processing device obtains each business processing object associated with each first business processing data of the to-be-judgment object, and respectively obtains a second interaction text set according to second business processing data processed by each business processing object in a specified historical stage corresponding to each type of business.

[0168] After the processing device determines each first business processing data of the to-be-judgment object, the processing device obtains each business processing object associated with each first business processing data.

[0169] In an embodiment of the present application, the processing device can selectively select each object directly interacting with the to-be-judgment object in each first business processing data as a business processing object.

[0170] Alternatively, in order to reduce the data processing amount, the processing device can screen each object directly interacting with the to-be-judgment object in the first business processing data, and then screen each business processing object.

[0171] Specifically, when each business processing object is screened, the processing device determines each candidate object directly interacting with the to-be-judgment object in each type of business according to each first business processing data, then determines the business interaction frequency between each candidate object and the to-be-judgment object, and screens each candidate object satisfying a preset condition as each corresponding business processing object according to the business interaction frequency.

[0172] It should be noted that in the embodiment of the present application, the business interaction frequency between the candidate object and the to-be-judgment object can refer to the total interaction frequency of the candidate object and the to-be-judgment object in each type of business in a specified historical stage, and each candidate object is screened based on the total interaction frequency. The preset condition for screening each business processing object can be that the business interaction frequency is higher than a third set value, or the preset condition can be that Z candidate objects with the highest business interaction frequency, wherein the value of the third set value is set according to actual processing needs, and the value of Z is a positive integer, and the present application does not limit the value of the third set value and Z.

[0173] In addition, the interaction frequency between the candidate object and the object to be determined corresponds to the business processing procedure when any one of the candidate object or the object to be determined initiates a business interaction, for example, the candidate object initiates a transfer to the object to be determined, and a corresponding interaction between the candidate object and the object to be determined is generated, and the object to be determined initiates a transfer to the candidate object, and a corresponding interaction is generated, wherein the interaction frequency refers to the number of interactions generated in the specified historical stage.

[0174] For example, assuming that in the specified historical stage, for business 1, the objects interacting with the object to be determined include: object 1, interaction frequency 10 times; object 2, interaction frequency 5 times; object 3, interaction frequency 7 times; for business 2, the objects interacting with the object to be determined include: object 1, interaction frequency 6 times; object 4, interaction frequency 5 times; object 5, interaction frequency 3 times. Then, the interaction frequency of each candidate object and the object to be determined can be sorted as: object 1, interaction frequency 10+6=16 times; object 2, interaction frequency 5 times; object 3, interaction frequency 7 times; object 4, interaction frequency 5 times; object 5, interaction frequency 3 times, assuming that the value of the third set value is 5, then objects 1, 2, 3, and 4 can be screened as business processing objects.

[0175] In this way, by screening the business processing objects based on the interaction frequency of the objects and the object to be determined, on the one hand, the data calculation amount can be reduced, and on the other hand, the business processing objects that interact relatively closely with the object to be determined can be screened out, so that the screened business processing objects have more analysis value and can better represent the abnormal situation of the object to be determined.

[0176] Further, the processing device determines the associated business processing objects, and for each type of business, obtains a second interaction text set according to the second business processing data of each business processing object participating in processing in the specified historical stage.

[0177] Specifically, the processing device performs the following operations for each type of business: obtaining each second business processing data of each business processing object directly participating in processing of the type of business in the specified historical stage; and obtaining a second interaction text set based on the interaction text in each second business processing data corresponding to the type of business, wherein the business processing data of the business processing object directly participating in processing of the business is referred to as second business processing data in the present application.

[0178] It should be noted that the processing device generates each second interaction text set corresponding to each type of business, and one second interaction text set corresponds to one type of business, and meanwhile, each second interaction text set includes the interaction texts of each business processing object when processing the same type of business. In other words, when obtaining the second interaction text set, the application generates the second interaction text set based on the second business processing data generated by each business processing object when directly participating in the processing of the same type of business in the specified historical stage. That is, the second business processing data is based on the business processing object, and after obtaining the second business processing data directly participating in the processing, the second business processing data is generated based on the interaction text in the second business processing data.

[0179] In this way, by obtaining the second business processing data of each business processing object, the business processing situation of the business processing object can be analyzed from the perspective of the business processing object, which is equivalent to providing the to-be-judged object with an abnormal judgment basis in an auxiliary manner, so as to realize the abnormal analysis of the to-be-judged object by respectively analyzing the processing situation of each business processing object in the same type of business.

[0180] Step 303: The processing device adopts the trained target abnormal judgment model to perform feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set, respectively, to obtain fusion conversion results of various features.

[0181] After the processing device constructs the operation description information set, each first interaction text set, and each second interaction text set for the to-be-judged object, the processing device adopts the latest trained target abnormal judgment model to perform feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set, respectively, to obtain fusion conversion results of various features.

[0182] In specific implementation, before the processing device inputs each first interaction text set and each second interaction text set into the target abnormal judgment model, the processing device first needs to arrange the text content in each first interaction text set and each second interaction text set, and arrange the text content into a form that can be processed by the target abnormal judgment model.

[0183] The processing device performs the following operations on each first interaction text set: connecting each interaction text in one first interaction text set into a first interaction text sequence through a first identifier; and performing the following operations on each second interaction text set: connecting the interaction texts belonging to the same business processing object in one second interaction text set into an interaction text sub-sequence through a second identifier, and connecting each interaction text sub-sequence into a second interaction text sequence through a third identifier.

[0184] The first identifier, the second identifier, and the third identifier are set according to actual processing needs and remain consistent during the training and application of the target anomaly judgment model, and the third identifier can identify different business processing objects to which the interactive text belongs.

[0185] It should be noted that the application Figure 3 The process of anomaly judgment based on the trained target anomaly judgment model is complementary to the training process of the anomaly judgment model. Figures 2a-2g The processing process shown in the Figures 2a-2g The processing process in the flow shown in the Figure 3 The processes of arranging the first interactive text set to generate the first interactive text sequence and arranging the second interactive text set to generate the second interactive text sequence have been described in detail in the foregoing training process, and will not be repeated here.

[0186] In addition, in the embodiments of the application, considering that there is a sequence of different business processing objects in each first interactive text sequence and each second interactive text sequence, but in actual business scenarios, the business sequence of the business processing objects has no effect on the abnormal situation of the object to be judged, and the judgment of the abnormal situation should be affected by the feature aggregation effect, therefore, in order to avoid introducing the partial order between the business processing objects in the first interactive text sequence and the second interactive text sequence, a third identifier is used to distinguish different business processing objects.

[0187] In this way, with the help of the third identifier, the interactive text of different business processing objects under the same type of business can be distinguished, and the aggregation of the business processing objects is improved while the partial order of the business processing objects is weakened.

[0188] Further, when the trained target anomaly judgment model includes the first target feature fusion network, various target encoding networks, the second target feature fusion network, and the target anomaly classification network, the processing device, when using the target feature fusion network to obtain the operation information fusion feature based on the operation description information set, performs the following operations:

[0189] The processing device uses each first target encoding network in the target anomaly judgment model to perform text embedding encoding operation, position encoding operation, and belonging text encoding operation on each first interactive text sequence respectively to obtain corresponding each first text encoding feature, and then uses each second target encoding network in the target anomaly judgment model to perform text embedding encoding operation, position encoding operation, belonging object encoding operation, and belonging text encoding operation on each second interactive text sequence respectively to obtain corresponding each second text encoding feature.

[0190] It should be noted that in the embodiments of the present application, each first target encoding network and each second target encoding network are built based on the Transformer-Encoder structure.

[0191] Specifically, since the structure of the target anomaly determination model is the same as the model structure in the above training process, the encoding operations for each first interaction text sequence and each second interaction text sequence are the same as the above training process, and the present application will not be described in detail.

[0192] After the processing device obtains each first text encoding feature corresponding to each first interaction text sequence, obtains each second text encoding feature corresponding to each second interaction text sequence, and obtains the information fusion feature obtained by processing the operation description information set via the first target feature fusion network, the second target feature fusion network is used to obtain the fusion conversion result of each type of feature based on the obtained information fusion feature and the spliced each first text encoding feature and each second text encoding feature.

[0193] In this way, with the aid of each type of target encoding network of the Transformer-Encoder structure, the processing of the interaction text sequence can be realized, and the interaction text of the to-be-determined object in different businesses can be respectively modeled by different Transformer-Encoders, and the interaction text of each business processing object in different types of business can be respectively modeled by Transformer-Encoders, and the interaction text of different business processing objects can be embedded into the corresponding Transformer-encoder for processing by using different attribution object encodings.

[0194] Step 304: The processing device uses the target anomaly determination model to obtain the anomaly determination result of the to-be-determined object based on the fusion conversion result.

[0195] Specifically, when the trained target anomaly determination model includes the first target feature fusion network, each type of target encoding network, the second target feature fusion network, and the target anomaly classification network, after the processing device obtains the fusion conversion result of each type of feature obtained by the second target feature fusion network, the obtained fusion conversion result is input into the target anomaly classification network to obtain the anomaly determination result of the to-be-determined object.

[0196] In this way, when the to-be-judgment object is subjected to abnormality analysis, not only the operation data of the to-be-judgment object in various businesses is combined, but also the operation data of the business processing object associated with the to-be-judgment object in various businesses is combined. In other words, when the abnormality of the to-be-judgment object is judged, the data of multiple dimensions related to the to-be-judgment object is fused. Therefore, the to-be-judgment object described by the data of multiple dimensions can be comprehensively analyzed, the abnormality of the business object can be effectively judged, and the accuracy of the abnormality judgment of the to-be-judgment object is improved.

[0197] The abnormality judgment method in the embodiment of the present application is described below in a specific application scenario.

[0198] Referring to FIG. 1, Figure 4 FIG. 1 is a process schematic diagram of the abnormality judgment of the to-be-judgment object in the embodiment of the present application. The specific application process is described below in combination with the accompanying drawings. Figure 4 The specific application process is described below.

[0199] The abnormality judgment process of the processing device for the object X is as follows, taking the determination of whether the object X has gambling behavior in the transfer business and the red packet business as an example, and setting the duration of the specified historical stage to 6 months.

[0200] Firstly, the processing device obtains the red packet business and the transfer business handled by the object X within 6 months before the current time, and obtains the objects transferring money to the object X, the objects to which the object X initiates the transfer, the objects sending red packets to the object X, and the objects to which the object X initiates the red packet, as the various business processing objects associated with the object X. In addition, the interactive text sent or received by the object X in the transfer business within the stage is generated as a first interactive text set, and the interactive text sent or received by the object X in the red packet business within the stage is generated as another interactive text set. Furthermore, the statistical information is obtained according to at least the execution of the object X in the red packet business and the transfer business, and the operation description information set is generated according to the statistical information. The operation description information set may include the number of times of handling the red packet business, the number of times of handling the transfer business, the total amount of received transfer, the total amount of transferred transfer, the total amount of received red packet, the total amount of transferred red packet, the number of hits of the interactive text of the red packet business on the keywords corresponding to the gambling behavior in the dictionary, and the number of hits of the interactive text of the transfer business on the keywords corresponding to the gambling behavior in the dictionary.

[0201] Similarly, for each business processing object, the processing device determines a second set of interactive texts based on the red envelope business and the transfer business that each business processing object participated in processing within the same historical period. Under the red envelope business, it consists of a set of interactive texts composed of the interactive texts of each business processing object in the red envelope business, and under the transfer business, it consists of a set of interactive texts composed of the interactive texts of each business processing object in the transfer business. The interactive texts in the interactive text sets are short texts.

[0202] Furthermore, according to Figure 4 As shown, the processing device organizes the various operation description information in the operation description information set into vector form and inputs it into a multi-layer dense (first target feature fusion network) to obtain information fusion features. Then, it concatenates the various interactive texts in the first interactive text set under the red envelope business into a first interactive text sequence and inputs it into Transformer-Encoder1 (a first target feature fusion network). After Transformer-Encoder1 performs text embedding encoding, position encoding, and attribution text encoding operations, a corresponding first text encoding feature is obtained. Similarly, Transformer-Encoder2 processes the first interactive text set under the transfer business to obtain a first text encoding feature. Meanwhile, the processing device concatenates the various interactive texts in the second interactive text set under the red envelope business into a second interactive text sequence, and then inputs it into Transformer-Encoder3 (a second target feature fusion network). After Transformer-Encoder3 performs text embedding encoding, position encoding, attribution object encoding, and attribution text encoding operations, a corresponding second text encoding feature is obtained. Similarly, Transformer-Encoder4 processes the second interactive text set under the transfer business to obtain a second text encoding feature.

[0203] After concatenating the first and second text encoding features, they are input into a single-layer dense network (second target feature fusion network) along with the information fusion features to obtain the fusion transformation results of various features. Then, the softmax network obtains the judgment result of whether the object to be judged has engaged in gambling behavior based on the obtained fusion transformation results of various features.

[0204] In this way, the technical scheme provided in the present application can perform aggregation processing on interactive texts under various services, and at the same time, a short text splicing manner and an encoding manner based on a Transformer-Encoder are provided, so that the short text sequence and the complex correlation between context short texts can be taken into account, and in addition, object coding of service processing objects is used to realize embedding of object boundaries, which is equivalent to providing an unordered service processing object text feature splicing manner, and the influence of the partial order of service processing objects can be reduced.

[0205] It can be understood that in the above various embodiments of the present application, the object-related service processing data and other related data are involved, and when the above embodiments of the present application are applied to specific products or technologies, the permission or consent of the related object needs to be obtained, and the collection, use and processing of the related service processing data need to comply with the relevant laws, regulations and standards of the country and region.

[0206] Based on the same inventive concept, refer to Figure 5 As shown in FIG. 5, it is a schematic diagram of the logical structure of the abnormality determination device in the embodiments of the present application, the abnormality determination device 500 includes an obtaining unit 501, an acquiring unit 502, an extracting unit 503, and a determination unit 504, wherein,

[0207] The obtaining unit 501 is configured to obtain an operation description information set and a first interactive text set corresponding to each type of service based on the first service processing data corresponding to each type of service in which the to-be-determined object participates in processing within a specified historical stage.

[0208] The acquiring unit 502 is configured to acquire each service processing object associated with each first service processing data except the to-be-determined object, and obtain a second interactive text set according to the second service processing data in which each service processing object participates in processing within a specified historical stage corresponding to each type of service.

[0209] The extracting unit 503 is configured to use a trained target abnormality determination model to perform feature extraction operations on the operation description information set, each first interactive text set, and each second interactive text set, and obtain a fusion conversion result of each type of feature.

[0210] The determination unit 504 is configured to use the target abnormality determination model to obtain an abnormality determination result of the to-be-determined object based on the fusion conversion result.

[0211] Optionally, when training the abnormality determination model, the device further includes a training unit, and the training unit 505 is specifically configured to:

[0212] obtain a training sample set, wherein each training sample includes input information and an abnormality label determined according to a sample object, and the input information includes a sample operation description information set, and a sample first interaction text set and a sample second interaction text set corresponding to each type of business;

[0213] perform multi-round iterative training on the abnormality determination model using the training samples in the training sample set, and output a target abnormality determination model when a preset convergence condition is met;

[0214] During one round of iterative training, the following operations are performed:

[0215] using the abnormality determination model, obtaining a predicted abnormality determination result based on the input information in the training sample, and adjusting the parameters of the abnormality determination model based on the cross-entropy loss value between the predicted abnormality determination result and the corresponding abnormality label.

[0216] Optionally, the abnormality determination model to be trained includes a first feature fusion network, a plurality of type encoding networks, a second feature fusion network, and an abnormality classification network.

[0217] When the abnormality determination model is used to obtain a predicted abnormality determination result based on the input information in the training sample, the training unit 505 is configured to:

[0218] input the sample operation description information set in the training sample into the first feature fusion network to obtain information fusion features, and input each sample first interaction text set and each sample second interaction text set into the plurality of type encoding networks respectively to obtain corresponding text encoding features.

[0219] input the information fusion features and the concatenated text encoding features into the second feature fusion network to obtain fusion conversion results of the features of each type, and input the fusion conversion results into the abnormality classification network to obtain the predicted abnormality determination result.

[0220] Optionally, when the operation description information set and the first interaction text set corresponding to each type of business are obtained, the obtaining unit 501 is configured to:

[0221] determine the interaction text in each first business processing data respectively, and generate a corresponding first interaction text set according to the interaction text in each first business processing data respectively.

[0222] determine the operation frequency information when each to-be-determined object processes each type of business, and generate an operation description information set according to the determined operation frequency information and the hit situation of each type of preset abnormality keyword in each first interaction text set.

[0223] Optionally, when obtaining each service processing object associated with each first service processing data except the to-be-judged object, the obtaining unit 502 is configured to:

[0224] According to each first service processing data, determine each candidate object that directly interacts with the to-be-judged object in each type of service;

[0225] Determine the service interaction frequency between each candidate object and the to-be-judged object respectively, and filter out each candidate object that meets the preset condition as the corresponding each service processing object according to the service interaction frequency.

[0226] Optionally, for each type of service, the obtaining unit 502 is configured to:

[0227] For each type of service, the following operations are performed respectively:

[0228] Obtain each second service processing data of each service processing object directly participating in processing a type of service in a specified historical stage;

[0229] For a type of service, obtain a second interaction text set based on the interaction text in each second service processing data.

[0230] Optionally, after obtaining the second interaction text set, before the extracting unit 503 performs feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set using the trained target abnormal judgment model, the extracting unit 503 is further configured to:

[0231] For each first interaction text set, the following operations are performed respectively: connect each interaction text in a first interaction text set into a first interaction text sequence through a first identifier;

[0232] For each second interaction text set, the following operations are performed respectively: use a second identifier to connect the interaction texts belonging to the same service processing object in a second interaction text set to obtain an interaction text sub-sequence, and use a third identifier to connect each interaction text sub-sequence to obtain a second interaction text sequence.

[0233] Optionally, the trained target abnormal judgment model includes a first target feature fusion network, each type of target encoding network, a second target feature fusion network, and a target abnormal classification network.

[0234] Then, when the extracting unit 503 performs feature extraction operations on the operation description information set, each first interaction text set, and each second interaction text set using the trained target abnormal judgment model, the extracting unit 503 is configured to:

[0235] The target feature fusion network is adopted to obtain operation information fusion features based on a set of operation description information.

[0236] Each first target encoding network in the target anomaly judgment model is adopted to perform text embedding encoding operation, position encoding operation, and belonging text encoding operation on each first interactive text sequence respectively, to obtain corresponding first text encoding features.

[0237] Each second target encoding network in the target anomaly judgment model is adopted to perform text embedding encoding operation, position encoding operation, belonging object encoding operation, and belonging text encoding operation on each second interactive text sequence respectively, to obtain corresponding second text encoding features.

[0238] After introducing the anomaly judgment method and device of the example embodiment of the present application, next, the electronic device according to another example embodiment of the present application is introduced.

[0239] Those skilled in the art can understand that each aspect of the present application can be implemented as a system, a method or a program product. Therefore, each aspect of the present application can be specifically implemented as follows: a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0240] Based on the same inventive concept as the above method embodiments, an electronic device is also provided in the present embodiment. Referring to Figure 6 , which is a hardware component structure schematic diagram of an electronic device applying the present embodiment. The electronic device 600 can at least include a processor 601 and a memory 602. The memory 602 stores program code, and when the program code is executed by the processor 601, the processor 601 performs the steps of any one of the above anomaly judgment methods.

[0241] In some possible embodiments, the computing device according to the present application can at least include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor performs the steps of the anomaly judgment method according to various example embodiments of the present application described above in the present specification. For example, the processor can perform the steps as shown in Figure 3 .

[0242] The computing device 700 according to this embodiment of the present application will be described below with reference to Figure 7 . As shown in Figure 7As shown, the computing device 700 is in the form of a general-purpose computing device. The components of computing device 700 can include, but are not limited to, the aforementioned at least one processing unit 701, the aforementioned at least one memory unit 702, a bus 703 that connects the various system components, including the memory unit 702 and the processing unit 701.

[0243] The bus 703 represents one or more of any of several bus structures, including a memory bus or memory controller, a peripheral bus, a processor or local bus, using any of a variety of bus architectures.

[0244] The memory unit 702 can include read-only memory (ROM) 7023 in the form of flash memory or other suitable technology, and can also include random access memory (RAM) 7021 in the form of synchronous dynamic random access memory (SDRAM) or other suitable technology, as well as a cache memory unit 7022.

[0245] The memory unit 702 can also include a program / utility 7025 having a set (at least one) of program modules 7024, including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or a combination thereof can include implementation of a network environment.

[0246] The computing device 700 can also communicate with one or more external devices 704 such as a keyboard or a pointing device, as well as other devices that enable a user to interact with the computing device 700. Additionally, the computing device 700 can communicate with one or more devices that enable a user to interact with the computing device 700 through an input / output (I / O) interface 705. The computing device 700 can also include a communication interface 706 that can be used to communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), and / or the Internet, through a network adapter 706. As depicted, the network adapter 706 communicates with the other components of the computing device 700 via the bus 703. It should be appreciated that although the network adapter 706 is depicted as a single component, the network adapter 706 can comprise a plurality of communication interfaces to communicate with the plurality of types of networks and devices that enable a computing device to communicate with one or more other computing devices.

[0247] Based on the same inventive concept as the method embodiments described above, each aspect of the anomaly identification provided in the present application can also be implemented in the form of a program product, which includes program code for causing an electronic device to perform the steps of the anomaly determination method described above according to various exemplary embodiments of the present application when the program product is run on the electronic device, for example, the electronic device can execute the anomaly determination method according to various exemplary embodiments of the present application as described above. Figure 3The steps shown in the middle.

[0248] The program product can employ any combination of one or more computer readable media. The computer readable media can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0249] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the preferred embodiments by those of skill in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, the appended claims are intended to encompass within their scope all such variations and modifications as are within the scope of the application.

[0250] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. An abnormality determination method characterized by comprising: The method comprises the following steps: obtaining operation description information sets and first interaction text sets corresponding to each type of business based on first business processing data corresponding to each type of business in which the to-be-judged object participates in processing within a specified historical stage; the first interaction text set refers to a text set obtained by summarizing interaction texts generated when the to-be-judged object participates in processing of each type of business within the specified historical stage; obtaining each business processing object associated with each first business processing data except the to-be-judged object, and obtaining second interaction text sets based on second business processing data of each business processing object participating in processing within the specified historical stage corresponding to each type of business; obtaining operation information fusion features based on the operation description information sets by using a first target feature fusion network in a trained target abnormal judgment model; performing text embedding encoding operation, position encoding operation, and belonging text encoding operation on each first interaction text sequence by using each first target encoding network in the target abnormal judgment model to obtain first text encoding features corresponding to each first interaction text sequence; performing text embedding encoding operation, position encoding operation, belonging object encoding operation, and belonging text encoding operation on each second interaction text sequence by using each second target encoding network in the target abnormal judgment model to obtain second text encoding features corresponding to each second interaction text sequence; and obtaining fusion conversion results of each type of feature based on the first text encoding features, the second text encoding features, and the operation information fusion features by using a second target feature fusion network in the target abnormal judgment model; one first interaction text sequence is obtained by connecting each interaction text in one first interaction text set; and one second interaction text sequence is obtained by connecting each interaction text in one second interaction text set. obtaining an abnormal judgment result of the to-be-judged object based on the fusion conversion results by using an abnormal classification network in the target abnormal judgment model.

2. The method of claim 1, wherein, The target abnormal judgment model is obtained by the following method: obtaining a training sample set, wherein one training sample comprises input information and an abnormal label determined for a sample object, and the input information comprises sample operation description information sets, sample first interaction text sets, and sample second interaction text sets corresponding to each type of business; performing multi-round iterative training on a to-be-trained abnormal judgment model by using training samples in the training sample set, and outputting a target abnormal judgment model when a preset convergence condition is met; in one round of iterative training, the following operations are performed: obtaining a predicted abnormal judgment result based on input information in a training sample by using the abnormal judgment model, and adjusting parameters of the abnormal judgment model based on a cross-entropy loss value between the predicted abnormal judgment result and a corresponding abnormal label.

3. The method of claim 2, wherein, The to-be-trained abnormal judgment model comprises a first feature fusion network, each type of encoding network, a second feature fusion network, and an abnormal classification network. The adopting the abnormality judgment model, based on input information in the training sample, obtains a predicted abnormality judgment result, comprising: Input the sample operation description information set in the training sample into the first feature fusion network to obtain information fusion features, and input each sample first interaction text set and each sample second interaction text set into each type of encoding network to obtain corresponding each text encoding feature; Input the information fusion features and the spliced each text encoding feature into the second feature fusion network to obtain a fusion conversion result of each type of feature, and input the fusion conversion result into the abnormality classification network to obtain a predicted abnormality judgment result.

4. The method of claim 1, wherein, The operation description information set and each type of business corresponding first interaction text set are obtained, comprising: Determine the interaction text in each first business processing data respectively, and generate the corresponding first interaction text set according to the interaction text in each first business processing data respectively; Determine the operation frequency information when the to-be-judged object processes each type of business, and generate the operation description information set according to the determined each operation frequency information and the hit situation of each first interaction text set of each type of preset abnormality keyword.

5. The method of claim 1, wherein, The each business processing object associated with each first business processing data except the to-be-judged object, comprising: According to each first business processing data, determine each candidate object that directly interacts with the to-be-judged object in the each type of business; Determine the business interaction frequency between each candidate object and the to-be-judged object respectively, and select each candidate object that meets the preset condition as the corresponding each business processing object according to the business interaction frequency.

6. The method of claim 1, wherein, According to the second business processing data of the each business processing object participating in processing in the specified historical stage, obtain a second interaction text set for each type of business, comprising: For each type of business, the following operations are performed: Obtain each second business processing data of the each business processing object directly participating in processing a type of business in the specified historical stage; According to the interaction text in the each second business processing data, obtain a second interaction text set for the type of business.

7. The method according to any one of claims 1 to 6, wherein After obtaining the second interaction text set, before the feature extraction operation is performed on the operation description information set, each first interaction text set and each second interaction text set by using the trained target abnormality judgment model, further comprising: For each first interaction text set, the following operations are performed: connect each interaction text in a first interaction text set into a first interaction text sequence through a first identifier; For each second interaction text set, the following operations are performed: connect the interaction texts belonging to the same business processing object in a second interaction text set into an interaction text sub-sequence through a second identifier, and connect each interaction text sub-sequence into a second interaction text sequence through a third identifier.

8. An abnormality determination device characterized by comprising: Comprising: The obtaining unit is configured to obtain an operation description information set and a first interaction text set corresponding to each type of business based on first business processing data corresponding to each type of business in which the to-be-judged object participates in processing within a specified historical stage; the first interaction text set refers to a text set obtained by summarizing interaction texts generated when the to-be-judged object participates in processing of the types of business within the specified historical stage; The obtaining unit is configured to obtain each business processing object associated with each first business processing data except the to-be-judged object, and obtain a second interaction text set based on second business processing data of each business processing object participating in processing within the specified historical stage corresponding to each type of business. The extracting unit is configured to obtain operation information fusion features based on the operation description information set by using a first target feature fusion network in a trained target abnormality judgment model; perform text embedding encoding operation, position encoding operation, and belonging text encoding operation on each first interaction text sequence by using each first target encoding network in the target abnormality judgment model to obtain first text encoding features corresponding to each first interaction text sequence; perform text embedding encoding operation, position encoding operation, belonging object encoding operation, and belonging text encoding operation on each second interaction text sequence by using each second target encoding network in the target abnormality judgment model to obtain second text encoding features corresponding to each second interaction text sequence; and obtain fusion conversion results of each type of feature based on the first text encoding features, the second text encoding features, and the operation information fusion features by using a second target feature fusion network in the target abnormality judgment model; one first interaction text sequence is obtained by connecting each interaction text in one first interaction text set; and one second interaction text sequence is obtained by connecting each interaction text in one second interaction text set. The judgment unit is configured to obtain an abnormality judgment result of the to-be-judged object based on the fusion conversion results by using an abnormality classification network in the target abnormality judgment model.

9. The apparatus of claim 8, wherein, The target abnormality judgment model is obtained by a training unit in the device by using the following method: A training sample set is obtained, wherein one training sample includes input information and an abnormality label determined for one sample object, and the input information includes a sample operation description information set, a sample first interaction text set, and a sample second interaction text set corresponding to each type of business; The trained abnormality judgment model is trained by using training samples in the training sample set for multiple rounds of iteration, and a target abnormality judgment model is output when a preset convergence condition is met; In one round of iteration training, the following operations are performed: The abnormality judgment model is used to obtain a predicted abnormality judgment result based on input information in a training sample, and parameters of the abnormality judgment model are adjusted based on a cross-entropy loss value between the predicted abnormality judgment result and a corresponding abnormality label.

10. The apparatus of claim 9, wherein, The abnormality determination model to be trained comprises a first feature fusion network, various type encoding networks, a second feature fusion network, and an abnormality classification network. When the abnormality determination model is used to obtain a predicted abnormality determination result based on input information in a training sample, the training unit is configured to: input sample operation description information sets in the training sample into the first feature fusion network to obtain information fusion features, and input each sample first interactive text set and each sample second interactive text set into the various type encoding networks respectively to obtain corresponding text encoding features; input the information fusion features and the spliced text encoding features into the second feature fusion network to obtain fusion conversion results of various types of features, and input the fusion conversion results into the abnormality classification network to obtain a predicted abnormality determination result.

11. The apparatus of claim 8, wherein, When the operation description information sets and the first interactive text sets corresponding to various types of businesses are obtained, the obtaining unit is configured to: determine interactive texts in each first business processing data respectively, and generate corresponding first interactive text sets respectively corresponding to the interactive texts in the first business processing data; determine operation frequency information when the to-be-determined object processes the various types of businesses, and generate the operation description information sets according to the determined operation frequency information and hit conditions of various preset abnormality keywords in each first interactive text set.

12. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the abnormality determination method of any one of claims 1-7.

13. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the abnormality determination method of any one of claims 1-7.

14. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the abnormality determination method of any one of claims 1-7.

Images