Risk identification methods, methods for training risk identification models, and corresponding devices

Abstract

This specification provides a risk identification method, a method for training a risk identification model, and a corresponding apparatus. It includes: inputting behavioral data to be identified into a risk identification model, which includes a routing module, multiple feature extraction modules corresponding to different primary keys, and multiple integration modules corresponding to different primary key combinations. The routing module determines the primary key combination corresponding to the behavioral data to be identified, provides the behavioral data to be identified to each feature extraction module corresponding to the primary keys included in the primary key combination, and determines the integration module corresponding to the primary key combination. The feature extraction modules extract feature representations corresponding to the primary keys from the behavioral data to be identified. The integration module uses the feature representations extracted by each feature extraction module corresponding to the primary keys included in the primary key combination to perform risk prediction and obtain risk information. This specification uses a general, integrated risk identification model, reducing construction and maintenance costs and mitigating the impact on storage performance.

Description

Technical Field

[0001] This specification relates to the field of network security technology, and in particular to a risk identification method, a method for training a risk identification model, and a corresponding apparatus. Background Technology

[0002] With the rapid development of internet technology, users encounter various risks in their internet usage, making risk identification a core capability of security services. Because users exhibit diverse behavioral characteristics while using the internet, and because users can provide a wide range of behavioral characteristics to risk identification systems, traditional risk identification systems often establish separate risk identification models for each behavioral characteristic. However, this approach results in high model construction and maintenance costs, and places significant pressure on storage performance. Summary of the Invention

[0003] In view of this, one or more embodiments of this specification disclose a risk identification method, a method for training a risk identification model, and a corresponding apparatus, in order to reduce the cost required for risk identification and the pressure on storage performance.

[0004] According to the first aspect, embodiments of this specification provide a risk identification method, the method comprising:

[0005] Acquire the behavior data to be identified;

[0006] The behavior data to be identified is input into a risk identification model to obtain risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavior description item of the behavior data to be identified;

[0007] The routing module is used to determine the primary key combination corresponding to the behavior data to be identified, provide the behavior data to be identified to each feature extraction module corresponding to the primary key contained in the primary key combination, and determine the integration module corresponding to the primary key combination.

[0008] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to the primary key from the behavior data to be identified.

[0009] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain risk information output for the behavior data to be identified.

[0010] According to one of the embodiments of this specification, the primary key includes at least one of the following: the active party, the passive party, the transaction amount, and various environmental information.

[0011] According to one of the embodiments of this specification, the feature extraction module further utilizes the extracted feature representation to perform preliminary risk prediction and obtain preliminary risk information.

[0012] When performing the risk prediction, the integrated module corresponding to the primary key combination further utilizes the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

[0013] According to one of the embodiments of this specification, the feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule;

[0014] The preprocessing submodule is used to perform feature preprocessing on the behavior data to be identified, based on the primary key corresponding to the feature extraction module.

[0015] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key;

[0016] The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained by the encoding submodule, and to obtain preliminary risk information.

[0017] According to one of the embodiments of this specification, the integration module corresponding to the primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule;

[0018] The first integration submodule is used to perform a first integration process on the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination;

[0019] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination;

[0020] The third integration submodule is used to perform a third integration process on the results of the first integration process and the second integration process.

[0021] The second classification submodule is used to perform risk prediction using the results of the third integration process, and to obtain risk information output for the behavior data to be identified.

[0022] Secondly, a method for training a risk identification model is provided, the method comprising:

[0023] Acquire first training data including multiple first training samples, wherein the first training sample includes a first row data sample and risk labels labeled for the first row data sample;

[0024] A risk identification model is trained using the first training data; wherein the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavioral description item of the second behavioral data sample;

[0025] The routing module is used to determine the primary key combination corresponding to the first behavioral data sample, provide the first behavioral data sample to each feature extraction module corresponding to the primary key contained in the primary key combination, determine the integration module corresponding to the primary key combination, and determine the integration module corresponding to the primary key combination.

[0026] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to the primary key from the first row of data samples.

[0027] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and to obtain risk information output for the first behavioral data sample.

[0028] The training objective includes minimizing the difference between the risk information output by the risk identification model for the first behavioral data sample and the risk labels labeled for the first behavioral data sample in the first training sample.

[0029] According to one of the embodiments of this specification, the feature extraction module further utilizes the extracted feature representation to perform preliminary risk prediction and obtain preliminary risk information.

[0030] When performing the risk prediction, the integrated module corresponding to the primary key combination further utilizes the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

[0031] According to one of the embodiments of this specification, the feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule;

[0032] The preprocessing submodule is used to perform feature preprocessing on the first behavioral data sample based on the primary key corresponding to the feature extraction module.

[0033] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key;

[0034] The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained by the encoding submodule, and to obtain preliminary risk information.

[0035] According to one of the embodiments of this specification, the integration module corresponding to the primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule;

[0036] The first integration submodule is used to perform a first integration process on the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination;

[0037] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination;

[0038] The third integration submodule is used to perform a third integration process on the results of the first integration process and the second integration process.

[0039] The second classification submodule is used to perform risk prediction using the results of the third integration process, and to obtain the risk probability value output for the first behavioral data sample.

[0040] According to one of the embodiments of this specification, the method further includes pre-training each feature extraction module;

[0041] Training the risk identification model using the first training data is a further training process based on the parameters of the feature extraction module obtained from pre-training.

[0042] The pre-training includes: acquiring second training data comprising multiple second training samples, wherein the second training samples include second behavioral data samples and risk labels labeled for the second behavioral data samples;

[0043] The feature extraction module is pre-trained using the second training data, wherein the second behavioral data sample is used as input to the feature extraction module and a copy of the feature extraction module. Preliminary risk information obtained by the feature extraction module and the copy of the feature extraction module for the second behavioral data sample is obtained. The feature extraction module and the copy of the feature extraction module have the same structure but different initialization parameters. The objectives of the pre-training include: minimizing the difference between the preliminary risk information obtained by the feature extraction module and the risk label labeled for the second behavioral data sample; minimizing the difference between the preliminary risk information obtained by the copy of the feature extraction module and the risk label labeled for the second behavioral data sample; and minimizing the output distribution divergence between the feature extraction module and the copy of the feature extraction module. After pre-training, the copy of the feature extraction module is removed.

[0044] According to one of the embodiments of this specification, an auxiliary classification layer is set before the second classification sub-module in each integrated module, and the auxiliary classification layer includes multiple auxiliary classifiers.

[0045] Each auxiliary classifier uses the result of the third integration process to perform risk prediction and obtain risk information. The auxiliary classifier and the second classification submodule have the same structure, but use different initialization parameters.

[0046] The training objectives also include at least one of the following:

[0047] The auxiliary classifier with the smallest corresponding loss function is selected as the teacher network, and the rest are selected as student networks. The goal is to minimize the difference between the risk information output by the student network and the risk information output by the teacher network.

[0048] The difference between the risk information predicted by integrating the risk probability values ​​output by each auxiliary classifier in the second classification submodule and the risk information output by the teacher network is minimized.

[0049] Maximize the difference between the risk probability values ​​output by each auxiliary classifier;

[0050] After training, the auxiliary classification layer is removed.

[0051] According to one of the embodiments of this specification, the integration module with the smallest corresponding loss function is used as the teacher network. The routing module inputs the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination into the teacher network. The teacher network uses the input feature representations to perform risk prediction and obtains the risk probability value output for the first behavioral data sample. The integration module corresponding to the primary key combination is used as the student network, and the output risk information includes the risk probability value.

[0052] The training objective also includes minimizing the difference between the risk probability values ​​output by the teacher network and the risk probability values ​​output by the student network.

[0053] Thirdly, a risk identification device is provided, the device comprising:

[0054] The data acquisition unit is configured to acquire data on the behavior to be identified.

[0055] A risk identification unit is configured to input the behavior data to be identified into a risk identification model and obtain risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is a behavior description item of the behavior data to be identified;

[0056] The routing module is used to determine the primary key combination corresponding to the behavior data to be identified, provide the behavior data to be identified to each feature extraction module corresponding to the primary key contained in the primary key combination, and determine the integration module corresponding to the primary key combination.

[0057] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to the primary key from the behavior data to be identified.

[0058] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain risk information output for the behavior data to be identified.

[0059] Fourthly, an apparatus for training a risk identification model is provided, the apparatus comprising:

[0060] The sample acquisition unit is configured to acquire first training data including a plurality of first training samples, wherein the first training samples include first row data samples and risk labels labeled for the first row data samples.

[0061] The model training unit is configured to train a risk identification model using the first training data; wherein the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavioral description item of the second behavioral data sample;

[0062] The routing module is used to determine the primary key combination corresponding to the first behavioral data sample, provide the first behavioral data sample to each feature extraction module corresponding to the primary key contained in the primary key combination, determine the integration module corresponding to the primary key combination, and determine the integration module corresponding to the primary key combination.

[0063] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to the primary key from the first row of data samples.

[0064] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and to obtain risk information output for the first behavioral data sample.

[0065] The training objective includes minimizing the difference between the risk information output by the risk identification model for the first behavioral data sample and the risk labels labeled for the first behavioral data sample in the first training sample.

[0066] According to a fifth aspect, embodiments of this specification provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described above.

[0067] According to a sixth aspect, embodiments of this specification provide a computing device including a memory and a processor, characterized in that the memory stores executable code, and when the processor executes the executable code, it implements the method described above.

[0068] As can be seen from the above technical solutions, the embodiments of this specification have the following advantages:

[0069] 1) This specification provides a general, integrated risk identification model. This model includes feature extraction modules for different primary keys and integration modules for different primary key combinations. A routing module determines the necessary feature extraction and integration modules based on the primary key combinations corresponding to the behavioral data to be identified, thereby achieving feature extraction and risk prediction for the behavioral data. This specification uses a general, integrated risk identification model, eliminating the need to pre-build different risk identification models for different behavioral characteristics, reducing construction and maintenance costs, and mitigating the impact on storage performance.

[0070] 2) In the embodiments of this specification, the feature extraction module can further utilize the extracted feature representation to perform preliminary risk prediction and obtain preliminary risk information; when performing risk prediction, the integration module corresponding to the primary key combination can further utilize the preliminary risk information obtained by each feature extraction module corresponding to the primary key contained in the primary key combination, thereby improving the prediction accuracy of the risk identification model.

[0071] 3) Before training the risk identification model, the embodiments in this specification can use mutual learning to improve the effect of feature representation, thereby accelerating the training efficiency and effect of the risk identification model.

[0072] 4) In the training part of the integrated module, the embodiments of this specification adopt knowledge distillation between integrated modules. The better-trained integrated module assists the poorer integrated module in learning, thereby improving the recognition effect of the poorer-trained module.

[0073] 5) The embodiments in this specification adopt a training method of mutual learning and negative correlation learning within the integration module. By constructing "different yet harmonious" auxiliary classifiers, they jointly help the second classification submodule learn better results.

[0074] Of course, implementing any product according to the embodiments of this specification does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 An exemplary system architecture diagram is shown that can be applied to the embodiments of this specification;

[0077] Figure 2 This is a flowchart illustrating the risk identification method provided in the embodiments of this specification.

[0078] Figure 3 This is a schematic diagram illustrating the principle structure of the risk identification model provided in the embodiments of this specification;

[0079] Figure 4 A schematic diagram illustrating the principle structure of the feature extraction module provided in the embodiments of this specification;

[0080] Figure 5 A schematic diagram of the principle structure of the integrated module provided in the embodiments of this specification;

[0081] Figure 6 This is a flowchart illustrating the method for training a risk identification model provided in the embodiments of this specification.

[0082] Figure 7 A schematic diagram illustrating the principle of the training feature extraction module provided in the embodiments of this specification;

[0083] Figures 8a-8c This is a schematic diagram illustrating the principle of mutual learning within an integrated module, provided for the embodiments of this specification.

[0084] Figure 9 A schematic diagram illustrating the principle of knowledge distillation between integrated modules provided in the embodiments of this specification;

[0085] Figure 10 This diagram shows a structural diagram of a risk identification device according to one embodiment of this specification;

[0086] Figure 11 This diagram illustrates a device structure for training a risk identification model according to one embodiment of this specification. Detailed Implementation

[0087] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0088] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0089] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0090] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0091] To reduce the pressure on storage performance and cost caused by building separate risk identification models for each behavioral characteristic, this specification provides a novel approach that uses a universal integrated model to achieve risk identification for various behavioral characteristics.

[0092] To facilitate understanding of the embodiments in this specification, the system architecture on which the embodiments are based is first described. Figure 1 An exemplary system architecture applicable to the embodiments of this specification is illustrated. The system mainly includes a model training device for building a risk identification model offline, and a risk identification device for performing risk identification on the behavioral data to be identified online.

[0093] After acquiring training data, the model training device can use the methods provided in the embodiments of this specification to train the model and obtain a risk identification model.

[0094] The risk identification device uses a trained risk identification model to identify risks in the behavioral data to be identified, thereby obtaining risk information about the behavioral data.

[0095] The model training device and risk identification device can be configured as independent servers, or they can be configured on the same server or server group, or they can be configured on a separate or the same cloud server. A cloud server, also known as a cloud computing server or cloud host, is a host product in the cloud computing service system, designed to address the shortcomings of traditional physical hosts and Virtual Private Servers (VPS) services, such as high management difficulty and weak service scalability. The model training device and risk identification device can also be configured on computer terminals with strong computing capabilities.

[0096] It should be noted that, in addition to online risk identification, the aforementioned risk identification device can also perform risk identification offline, such as identifying risks separately for batches of behavioral data to be identified.

[0097] It should be understood that Figure 1 The number of model training devices, risk identification devices, and risk identification models shown in the diagram is merely illustrative. Depending on implementation needs, any number of model training devices, risk identification devices, and risk identification models can be included.

[0098] Figure 2 This is a flowchart illustrating the risk identification method provided in the embodiments of this specification. It can be understood that this method can... Figure 1 The risk identification device in the system shown is used to perform this action. See also Figure 2 The method mainly includes the following steps:

[0099] Step 201: Obtain the behavior data to be identified.

[0100] Step 203: Input the behavior data to be identified into the risk identification model and obtain the risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different primary key combinations, where the primary key is the behavior description item of the behavior data to be identified; the routing module is used to determine the primary key combination corresponding to the behavior data to be identified, provide the behavior data to be identified to each feature extraction module corresponding to the primary key contained in the primary key combination, and determine the integration module corresponding to the primary key combination; each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to that primary key from the behavior data to be identified; the integration module corresponding to the primary key combination is used to perform risk prediction using the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and obtain the risk information output for the behavior data to be identified.

[0101] As can be seen from the technical content provided in the above embodiments, the embodiments of this specification provide a general integrated risk identification model. This risk identification model is configured with feature extraction modules corresponding to different primary keys and integration modules corresponding to different primary key combinations. The routing module determines the required feature extraction modules and integration modules based on the primary key combinations corresponding to the behavioral data to be identified, thereby realizing feature extraction and risk prediction for the behavioral data to be identified. The embodiments of this specification adopt a general integrated risk identification model, eliminating the need to pre-build different risk identification models for different behavioral characteristics, reducing construction and maintenance costs, and mitigating the impact on storage performance.

[0102] The following is about Figure 2 The steps shown are explained below. The behavioral data to be identified obtained in step 201 above can be actual behavioral data that occurs in the network, which can be obtained from the server or in real time.

[0103] In addition, the behavioral data to be identified obtained in step 201 above can also be behavioral data provided by the user. For example, in a risk consultation scenario, if a user wants to seek risk consultation on behavioral data that is about to occur or has already occurred, they can provide part or all of the behavioral data as behavioral data to be identified to the risk identification device provided in the embodiments of this specification.

[0104] Other applications are also possible, but they will not be listed here.

[0105] Users generate various behavioral data during their online activities, reflecting their intentions. Some of these behaviors are risky, while most are trustworthy. Behavioral data varies depending on the scenario. For example, in online transactions, users could be accounts, bank cards, or red envelope IDs. Online behaviors could include financial transactions such as payment, deposits and withdrawals, contract signing, sending and receiving red envelopes, and receiving payments. In online dating, users could be social media platform accounts, and online behaviors could include logging in, sending and receiving friend requests, chatting, and sending links.

[0106] The behavioral data to be identified obtained in this step can be parsed to obtain various behavioral description items, such as at least one of the following: the initiator of the behavior, the passive party, the transaction amount, and various environmental information. In the embodiments of this specification, these behavioral description items are referred to as primary keys. The aforementioned initiator and passive party can be, for example, an account, bank card, user ID, identification number, social network account, instant messaging account, financial account, host address, client identifier, etc. The aforementioned environmental information can include, for example, geographical location information, platform information, and time information.

[0107] Based on the completeness level of the available primary key information, it can be divided into different levels from high to low, for example:

[0108] Level 1: The party who initiates the action or the party who is passive in the action;

[0109] Level 2: Active and Passive Parties;

[0110] Level 3: Active party, passive party, and transaction amount;

[0111] Level 4: Active party, passive party, transaction amount, and environmental information.

[0112] The following describes in detail step 203, namely, "inputting the behavior data to be identified into the risk identification model and obtaining the risk information output by the risk identification model for the behavior data to be identified," with reference to the embodiments.

[0113] The risk identification model provided in the embodiments of this specification is as follows: Figure 3 As shown, it mainly includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys.

[0114] Each primary key corresponds to its own features. Feature calculation essentially originates from primary key lookups; therefore, feature calculation is influenced by the primary key of the behavioral data to be identified. One feasible approach is to create different feature extraction modules for each primary key. However, a more preferred approach is to organize the primary keys required for all features and divide each feature into different feature domains. One primary key may correspond to multiple different feature domains, and different feature extraction modules can be created for each feature domain. For example, as shown in Table 1:

[0115] Table 1

[0116]

[0117]

[0118] After the risk identification model receives the behavioral data to be identified, the routing module determines the primary key combination corresponding to the behavioral data and provides the behavioral data to the feature extraction modules corresponding to the primary keys contained in the primary key combination. If a more granular division is made, one primary key may correspond to multiple feature domains; in this case, the routing module actually provides the behavioral data to be identified to the feature extraction modules corresponding to the feature domains contained in the primary key combination. Taking Table 1 as an example... Figure 3 As shown, each feature domain corresponds to its own feature extraction module.

[0119] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to that primary key from the behavior data to be identified. More granularly, each feature extraction module can correspond to one of the feature domains and be used to extract the feature representation corresponding to that feature domain from the behavior data to be identified.

[0120] In the embodiments of this specification, the size of the feature extraction module can be configured by configuring feature domains of different granularities, forming a series of feature extraction modules with varying complexity, which is convenient for dealing with hardware requirements under different resources.

[0121] Furthermore, the routing module is also used to determine the integration module corresponding to the primary key combination. The primary key combinations involved in the embodiments of this specification may include one primary key or multiple primary keys. If the primary key is divided into finer-grained feature fields, then correspondingly, the primary key combination may be a finer-grained combination of feature fields. For example, as shown in Table 2 below:

[0122] Table 2

[0123] Integrated module Feature domain combination E1 F1 E2 F2, F3, F5 E3 F2, F3, F4, F5 E4 F1, F2, F3, F5 E5 F1, F2, F3, F4, F5, F6 E6 F1, F2, F3, F5, F6 E7 F1, F2, F3, F4, F5, F6, F7 … …

[0124] The integration module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by each feature extraction module corresponding to the primary key combination (or, if more granular, feature domain combination) to obtain risk information output for the behavior data to be identified.

[0125] by Figure 3 Taking the example, if the feature domain combination is F1, then after the feature extraction module corresponding to F1 extracts features, the integration module E1 uses the feature representation extracted by the feature extraction module corresponding to F1 to perform risk prediction. If the feature domain combination is F2, F3, F5, then after the feature extraction modules corresponding to F2, F3, F5 extract features, the integration module E2 uses the feature representation extracted by the feature extraction modules corresponding to F2, F3, F5 to perform risk prediction. If the feature domain combination is F2, F3, F4, F5, then after the feature extraction modules corresponding to F2, F3, F4, F5 extract features, the integration module E3 uses the feature representation extracted by the feature extraction modules corresponding to F2, F3, F4, F5 to perform risk prediction. This process continues according to the correspondence shown in Table 2.

[0126] The feature extraction module provided in the embodiments of this specification can adopt a commonly used feature extraction module based on the Transformer architecture. For example, it includes a preprocessing submodule and an encoding submodule.

[0127] The preprocessing submodule is used to preprocess the primary key features corresponding to the feature extraction module on the behavior data to be identified. Preprocessing can include features such as discretization, Min-Max (dispersion normalization), dynamic embedding, and processing with DNN (Deep Neural Networks), etc. Figure 4 As shown in the image.

[0128] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key. The encoding submodule can be composed of a DNN and a Transformer.

[0129] As another, more preferred implementation, the feature extraction module may further include a first classification submodule, such as... Figure 4 As shown in the diagram, the first classification submodule is used to perform preliminary risk prediction using the feature representation obtained from the encoding submodule, thus obtaining preliminary risk information. This preliminary risk information can be information such as whether a risk exists, or risk level information.

[0130] In this implementation, the feature extraction module actually uses the extracted feature representation to perform preliminary risk prediction and obtain preliminary risk information. This allows the integrated module corresponding to the primary key combination to further utilize the preliminary risk information obtained by each feature extraction module corresponding to the primary key in the primary key combination when performing risk prediction, thereby improving the accuracy of risk prediction.

[0131] The integration module may include a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule.

[0132] The first integration submodule is used to perform a first integration process on the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination. For example... Figure 5 As shown, the first integration submodule can perform splicing and DNN processing.

[0133] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination. For example... Figure 5 As shown, the second integration submodule can perform splicing and DNN processing.

[0134] The third integration submodule is used to perform a third integration process on the results of the first and second integration processes, such as... Figure 5 As shown, splicing can be performed.

[0135] The second classification submodule utilizes the results of the third integration process to perform risk prediction, obtaining risk information output for the behavioral data to be identified. This risk information can be either whether a risk exists or its level. It can first obtain a risk probability value, and then determine whether a risk exists or its level based on that probability value.

[0136] The risk level information is actually divided into two categories: risky and risk-free. The second classification sub-module uses a binary classifier. The risk level information is actually divided into multiple categories, such as high risk, medium risk, low risk, and no risk. The second classification sub-model uses a multi-class classifier.

[0137] Through the methods provided in the above embodiments, the risk identification model can automatically route the input primary key to the corresponding feature extraction module and integration module to achieve risk identification. When users conduct risk consultation or risk identification, although the primary keys contained in the behavioral data they provide may differ, risk identification can still be performed using a universal risk identification model. This significantly reduces construction and maintenance costs, as well as the pressure on storage performance.

[0138] The training process of the risk identification model used in the above method embodiments is described in detail below. Figure 6 This is a flowchart illustrating a method for training a risk identification model provided in the embodiments of this specification. This method can be... Figure 1 The model training device in the system shown is executed. For example... Figure 6 As shown, the method may include the following steps:

[0139] Step 601: Obtain first training data including multiple first training samples. The first training samples include first row data samples and risk labels labeled for the first row data samples.

[0140] During user network usage, servers record a large amount of behavioral data, typically stored in a data warehouse. This data reflects the user's behavioral intentions. Some of these behaviors are risky, while most are trustworthy. In the embodiments of this specification, some behavioral data with explicit risk information can be labeled with risk information tags as first behavioral data samples. These risk information tags can be labels indicating whether a behavior is risky or risk levels, etc.

[0141] When training a risk identification model, behavioral data of various risk types can be acquired to construct the initial training data. For example, data exhibiting one or any combination of risks such as theft, fraud, money laundering, and gambling, as well as data without any risk, can be used to construct the initial training data. If the risk information is a risk level, behavioral data with various risk levels can be acquired to construct the initial training data.

[0142] Step 603: Train a risk identification model using the first training data; the risk identification model includes a routing module, feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different primary key combinations, where the primary key is the behavioral description item of the second row of data samples. The routing module is used to determine the primary key combination corresponding to the first row of data samples, provide the first row of data samples to each feature extraction module corresponding to the primary key contained in the primary key combination, and determine the integration module corresponding to the primary key combination; each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to that primary key from the first row of data samples; the integration module corresponding to the primary key combination is used to perform risk prediction using the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and obtain the risk information output for the first row of data samples; the training objective includes: minimizing the difference between the risk information output by the risk identification model for the first row of data samples and the risk labels labeled for the first row of data samples in the first training samples.

[0143] In one preferred embodiment, the feature extraction module can further utilize the extracted feature representations to perform preliminary risk prediction and obtain preliminary risk information. Correspondingly, the integration module corresponding to the primary key combination further utilizes the preliminary risk information obtained by each feature extraction module corresponding to the primary key contained in the primary key combination when performing risk prediction.

[0144] In this implementation, the structure of the feature extraction module can be as follows: Figure 4 As shown, it includes: a preprocessing submodule, an encoding submodule, and a first classification submodule.

[0145] The preprocessing submodule is used to perform feature preprocessing on the first row of data samples, corresponding to the primary key of the feature extraction module. Preprocessing can include features such as discretization, Min-Max optimization, dynamic embedding, or DNN processing.

[0146] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key. The encoding submodule can be composed of a DNN and a Transformer.

[0147] The first classification submodule is used to perform preliminary risk prediction using the feature representations obtained from the encoding submodule, thus obtaining preliminary risk information. This preliminary risk information can include, for example, whether a risk exists or its risk level.

[0148] The structure of the integrated module corresponding to the primary key combination can be as follows: Figure 5 As shown, it includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule.

[0149] The first integration submodule is used to perform the first integration processing on the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination. For example... Figure 5 As shown, the first integration submodule can perform splicing and DNN processing.

[0150] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination. For example... Figure 5 As shown, the second integration submodule can perform splicing and DNN processing.

[0151] The third integration submodule is used to perform a third integration process on the results of the first and second integration processes, such as... Figure 5 As shown, splicing can be performed.

[0152] The second classification submodule is used to perform risk prediction using the results of the third integration process, and obtains the risk probability value output for the data sample of the first row.

[0153] The correspondence between the primary key and the feature extraction module, the correspondence between the primary key combination and the integration module, and the principle and structure of the risk identification model can be found in the relevant descriptions in the risk identification method embodiments, and will not be elaborated here.

[0154] In the embodiments of this specification, in order to improve the training effect and efficiency of the model, a two-stage training method can be adopted. In the first stage, the feature extraction modules are pre-trained using the second training data. In the second stage, the risk identification model is further trained using the first training data based on the pre-trained feature extraction modules.

[0155] The first stage of the pre-training process for each feature extraction module mainly includes steps S11 to S12:

[0156] Step S11: Obtain second training data including multiple second training samples. The second training samples include second behavioral data samples and risk labels labeled for the second behavioral data samples.

[0157] In the embodiments of this specification, some behavioral data with clear risk information can be labeled with risk information tags and used as second behavioral data samples. These risk information tags can be labels indicating whether a risk exists, or risk level labels, etc.

[0158] Step S12: Pre-train the feature extraction module using the second training data.

[0159] In the embodiments of this specification, each feature extraction module is trained independently, which facilitates the pluggability of the feature extraction modules. No matter how many feature extraction modules are added, removed, or fine-tuned, it will not affect other feature extraction modules.

[0160] This specification provides a preferred training method in its embodiments, which incorporates mutual learning distillation during the training of the feature extraction module. The description uses one feature extraction module as an example; the training methods for other feature extraction modules are the same. Figure 7 As shown, a copy of the feature extraction module can be pre-built for this feature extraction module, with both using the same structure but different initialization parameters.

[0161] The second row of data samples is used as input to the feature extraction module and its copy to obtain preliminary risk information obtained by the feature extraction module and its copy for the second row of data samples.

[0162] The objectives of pre-training include: minimizing the difference between the initial risk information obtained by the feature extraction module and the risk label labeled for the second row of data samples, minimizing the difference between the initial risk information obtained by the feature extraction module copy and the risk label labeled for the second row of data samples, and minimizing the output distribution divergence between the feature extraction module and the feature extraction module copy.

[0163] A loss function can be constructed based on the above training objectives. In each iteration, the model parameters are updated using the value of the loss function, employing methods such as gradient descent, until a preset training termination condition is met. This termination condition may include, for example, the value of the loss function being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold.

[0164] In the embodiments described in this specification, the loss function L can be constructed as follows:

[0165] L = L1 + L2

[0166] L1 = L C1 +D KL(p2||p1)

[0167] L2 = L C2 +D KL(p1||p2)

[0168] Among them, L C1 This reflects the difference between the preliminary risk information obtained by the feature extraction module and the risk labels annotated for the second row of data samples. KL(p2||p1) This reflects the output distribution divergence between the feature extraction module and its replica. For example:

[0169]

[0170]

[0171]

[0172] Among them, X i Let be the i-th data sample in the second row of the input, and N be the number of second-row data samples in a batch of training samples. m represents the category of the risk label, with a total of M risk labels. p1 m (X i X is the output of the feature extraction module. i The probability of belonging to m is obtained based on the feature representation z1 extracted by the feature extraction module. y1 i The feature extraction module is for X i Preliminary risk information obtained from the forecast.

[0173] L C2 This reflects the difference between the preliminary risk information obtained by the feature extraction module and the risk labels annotated for the second row of data samples. KL(p1||p2) This reflects the output distribution divergence between the feature extraction module and its replica. For example:

[0174]

[0175]

[0176]

[0177] Among them, p2 m (X i X is the output of the feature extraction module copy. i The probability of belonging to m is obtained based on the feature representation z2 extracted from the copy of the feature extraction module. y2 i It is a copy of the feature extraction module for X i Preliminary risk information obtained from the forecast.

[0178] After pre-training, the copy of the feature extraction module is removed, and only the feature extraction module is retained. Each feature extraction module is trained in a similar manner, with the training method being the same, the only difference being that each feature extraction module targets a different primary key (or a finer-grained feature domain).

[0179] It should be noted that, in addition to the preferred pre-training methods described above, other pre-training methods can also be used. For example, the second row of data samples can be used as input to the feature extraction module to obtain preliminary risk information obtained by the feature extraction module for the second row of data samples. The goal of pre-training includes minimizing the difference between the preliminary risk information obtained by the feature extraction module and the risk labels annotated for the second row of data samples. Other methods can also be used, which will not be listed here.

[0180] In the second stage of training the risk identification model, the ensemble modules can employ a "mutual learning, negative correlation learning" approach within each module and a knowledge distillation approach between modules. Either the "mutual learning, negative correlation learning" approach within the ensemble modules or the knowledge distillation approach between modules can be chosen, or both can be used. These are described in detail below.

[0181] When using a "mutual learning, negative correlation learning" approach within the integration module, an auxiliary classification layer can be set before the second classification sub-module within the integration module. This auxiliary classification layer includes multiple auxiliary classifiers. Figures 8a-8c Taking three auxiliary classifiers as an example, each auxiliary classifier uses the result of the third ensemble processing to predict risk, obtaining a risk probability value (i.e., regression processing), and then obtaining risk information (i.e., classification processing). The second classification submodule uses the same structure as each auxiliary classifier, but uses different initialization parameters. The training objective, in addition to minimizing the difference between the risk information output by the ensemble module for the first row of data samples and the risk labels labeled for the first row of data samples in the first training samples, may further include at least one of the following:

[0182] The auxiliary classifier with the smallest corresponding loss function is used as the teacher network, and the rest are used as student networks. The difference between the risk information output by the student network and the risk information output by the teacher network is minimized.

[0183] Minimize the difference between the risk information predicted by the second classification submodule after integrating the risk probability values ​​output by each auxiliary classifier and the risk information output by the teacher network;

[0184] Maximize the difference between the risk probability values ​​output by each auxiliary classifier.

[0185] A loss function can be constructed based on the aforementioned training objectives. In each iteration, the model parameters are updated using the value of the loss function, employing methods such as gradient descent, until a preset training termination condition is met. This termination condition may include, for example, the loss function value being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold. When updating the model parameters, only the parameters of each ensemble module can be updated, or the parameters of each feature extraction module and each ensemble module can be updated.

[0186] Taking all the above training objectives as an example, the loss function Loss can be expressed as:

[0187] Loss=Loss1+Loss2+Loss3+Loss4

[0188] Loss1 reflects the difference between the risk information output by the second classification submodule for the first row of data samples and the risk label labeled for the first row of data samples in the first training samples. It can be expressed using a loss function such as cross-entropy, which will not be detailed here.

[0189] Loss2 reflects the difference between the risk information output by the student network and the risk information output by the teacher network. In the embodiments of this specification, the auxiliary classifier with the smallest corresponding loss function (i.e., the smallest difference between the output risk information and the risk label) is designated as the teacher network, and the rest are designated as student networks. Figure 8a As shown, knowledge distillation occurs from the teacher network to the student network. For example, Loss2 could employ:

[0190]

[0191] Where CE() is the cross-entropy loss function, Best label For the risk information (i.e., classification results) output by the teacher network, y sub_predi This represents the risk information output by the i-th auxiliary classifier, where n is the number of student networks.

[0192] Loss3 reflects the difference between the risk information predicted by the second classification submodule after integrating the risk probability values ​​output by each auxiliary classifier and the risk information output by the teacher network. As shown in 8b, Loss3 can be implemented as follows:

[0193] Loss3=CE(y cls_pred Best label )

[0194] Where CE() is the cross-entropy loss function, Best label For the risk information (i.e., classification results) output by the teacher network, y cls_predThis refers to the risk information predicted by the second classification submodule after integrating the risk probability values ​​output by each auxiliary classifier. Specifically, the second classification submodule can first integrate the risk probability values ​​obtained by each auxiliary classifier, and then use the integrated risk probability values ​​and the feature representation output by the third integration submodule to predict the risk information.

[0195] Loss4 reflects the differences in risk probability values ​​output by each auxiliary classifier; it's a penalty term used for negative correlation learning. The purpose is to prevent overfitting by the auxiliary classifiers, i.e., to avoid mutual learning failure caused by excessive convergence among them. Figure 8c As shown, Loss4 can be represented by: logit3

[0196]

[0197] or,

[0198] Where, logit represents the risk probability value output by the i-th auxiliary classifier. k Let h be the risk probability value output by the k-th auxiliary classifier, and h be the total number of auxiliary classifiers. mean Let be the mean risk probability value output by each auxiliary classifier. MSE() is the mean squared error loss function.

[0199] Through the aforementioned mutual learning and negative correlation learning processes, a large number of diverse auxiliary classifiers can be constructed to assist the "second classification submodule," thereby improving the performance of the ensemble module. After training, the auxiliary classification layers are removed.

[0200] When using knowledge distillation between integration modules, the training method is similar to that between feature extraction modules. The integration module with the smallest corresponding loss function (minimizing the difference between the output risk information and the corresponding risk label) can be used as the teacher network. The routing module further inputs the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination into this teacher network. The teacher network uses the input feature representations to perform risk prediction, obtaining the risk probability value output for the first row of data samples. The integration module corresponding to this primary key combination serves as the student network. The training objective further includes minimizing the difference between the risk probability value output by the teacher network and the risk probability value output by the student network.

[0201] like Figure 9As shown, the first row represents the features corresponding to the data samples, corresponding to the input teacher network and student network. The teacher network is the ensemble module with the smallest corresponding loss function (i.e., the smallest difference between the output risk information and the corresponding risk label). This ensemble module usually contains the most information and has better performance. Therefore, distilling the knowledge of this teacher network into the student network can effectively improve the overall prediction performance of the ensemble module.

[0202] Through the introduction of this knowledge distillation, such as Figure 9 As shown, this is equivalent to striving to achieve the expected output of the student network itself, with the student loss corresponding to this expected output. This student loss can be obtained from the aforementioned Loss, or from Loss1 if mutual learning within the ensemble module is not used. The difference in risk probability values ​​(soft objectives) between the teacher and student networks corresponds to distillation loss. The overall loss for training the risk identification model can be determined jointly by the aforementioned student loss and distillation loss, for example, by weighted summing of the student and teacher losses. Figure 9 λ in the equation corresponds to the weighting coefficient of the student loss.

[0203] The above is a detailed description of the methods provided in the embodiments of this specification. The following is a detailed description of the apparatus provided in the embodiments of this specification.

[0204] Figure 10 This diagram illustrates a structural diagram of a risk identification device according to one embodiment of this specification, such as... Figure 10 As shown, the device 1000 may include a data acquisition unit 1001 and a risk identification unit 1002. The main functions of each component are as follows:

[0205] The data acquisition unit 1001 is configured to acquire the behavior data to be identified.

[0206] The risk identification unit 1002 is configured to input the behavior data to be identified into the risk identification model and obtain the risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavior description item of the behavior data to be identified.

[0207] The routing module is used to determine the primary key combination corresponding to the behavior data to be identified, provide the behavior data to be identified to each feature extraction module corresponding to the primary key contained in the primary key combination, and determine the integration module corresponding to the primary key combination.

[0208] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to that primary key from the behavioral data to be identified.

[0209] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain risk information output for the behavioral data to be identified.

[0210] The primary key may include the active party of the action, the passive party of the action, the transaction amount, and at least one of various environmental information.

[0211] Furthermore, the aforementioned feature extraction module can further utilize the extracted feature representations to perform preliminary risk prediction and obtain preliminary risk information.

[0212] When performing risk prediction, the integrated module corresponding to the primary key combination can further utilize the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

[0213] As one possible implementation method, the feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule.

[0214] The preprocessing submodule is used to perform feature preprocessing on the primary key corresponding to the feature extraction module of the behavior data to be identified.

[0215] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key.

[0216] The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained from the encoding submodule, and to obtain preliminary risk information.

[0217] As one possible implementation method, the integration module corresponding to the above primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule.

[0218] The first integration submodule is used to perform the first integration processing on the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination.

[0219] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination.

[0220] The third integration submodule is used to perform a third integration process on the results of the first and second integration processes.

[0221] The second classification submodule is used to perform risk prediction using the results of the third integration process, and to obtain risk information output for the behavioral data to be identified.

[0222] Figure 11 This diagram illustrates a device structure for training a risk identification model according to one embodiment of this specification. Figure 11 As shown, the device 1100 may include a sample acquisition unit 1101 and a model training unit 1102, and may further include a pre-training unit 1103. The main functions of each component are as follows:

[0223] The sample acquisition unit 1101 is configured to acquire first training data including multiple first training samples, wherein the first training samples include first row data samples and risk labels labeled for the first row data samples.

[0224] The model training unit 1102 is configured to train a risk identification model using the first training data; wherein the risk identification model includes a routing module, a feature extraction module corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, and the primary key is the behavioral description item of the second row data sample.

[0225] The routing module is used to determine the primary key combination corresponding to the first row of data samples, provide the first row of data samples to each feature extraction module corresponding to the primary key contained in the primary key combination, determine the integration module corresponding to the primary key combination, and determine the integration module corresponding to the primary key combination.

[0226] Each feature extraction module corresponds to one of the primary keys and is used to extract the feature representation corresponding to the primary key from the first row of data samples.

[0227] The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain the risk information output for the first row of data samples.

[0228] The training objectives include minimizing the difference between the risk information output by the risk identification model for the first row of data samples and the risk labels annotated for the first row of data samples in the first training samples.

[0229] As one possible approach, the feature extraction module can further utilize the extracted feature representations to perform preliminary risk prediction and obtain preliminary risk information.

[0230] When performing risk prediction, the integrated module corresponding to the aforementioned primary key combination can further utilize the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

[0231] As one possible implementation method, the feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule.

[0232] The preprocessing submodule is used to perform feature preprocessing on the first row of data samples for the primary key corresponding to the feature extraction module.

[0233] The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key.

[0234] The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained from the encoding submodule, and to obtain preliminary risk information.

[0235] As one possible implementation method, the integration module corresponding to the primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule.

[0236] The first integration submodule is used to perform the first integration processing on the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination.

[0237] The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination.

[0238] The third integration submodule is used to perform a third integration process on the results of the first and second integration processes.

[0239] The second classification submodule is used to perform risk prediction using the results of the third integration process, and obtains the risk probability value output for the data sample of the first row.

[0240] As one possible implementation, the sample acquisition unit 1101 is further configured to acquire second training data including multiple second training samples, wherein the second training samples include second behavioral data samples and risk labels labeled for the second behavioral data samples.

[0241] The pre-training unit 1103 is configured to pre-train a feature extraction module using the second training data. The second row of data samples is used as input to the feature extraction module and a copy of the feature extraction module. Preliminary risk information obtained by the feature extraction module and its copy based on the second row of data samples is acquired. The feature extraction module and its copy use the same structure but different initialization parameters. The pre-training objectives include: minimizing the difference between the preliminary risk information obtained by the feature extraction module and the risk labels labeled for the second row of data samples; minimizing the difference between the preliminary risk information obtained by the copy of the feature extraction module and the risk labels labeled for the second row of data samples; and minimizing the output distribution divergence between the feature extraction module and its copy. The copy of the feature extraction module is removed after pre-training.

[0242] The model training unit 1102 trains the risk identification model using the first training data, which is a further training based on the parameters of the feature extraction module obtained from pre-training.

[0243] As one possible approach, the model training unit 1102 may set an auxiliary classification layer before the second classification sub-module in each integration module, the auxiliary classification layer including multiple auxiliary classifiers;

[0244] Each auxiliary classifier uses the result of the third integration process to predict risk and obtain risk information. The auxiliary classifiers and the second classification submodule have the same structure, but use different initialization parameters.

[0245] The training objectives also include at least one of the following:

[0246] The auxiliary classifier with the smallest corresponding loss function is designated as the teacher network, and the rest are designated as student networks. The goal is to minimize the difference between the risk information output by the student networks and the risk information output by the teacher networks.

[0247] The difference between the risk information predicted by integrating the risk probability values ​​output by each auxiliary classifier in the second classification submodule and the risk information output by the teacher network is minimized.

[0248] Maximize the difference between the risk probability values ​​output by each auxiliary classifier;

[0249] After training, the auxiliary classification layer is removed.

[0250] As one possible approach, the model training unit 1102 can use the ensemble module with the smallest corresponding loss function as the teacher network. The routing module inputs the feature representations extracted by each feature extraction module corresponding to the primary key in the primary key combination into the teacher network. The teacher network uses the input feature representations to perform risk prediction and obtains the risk probability value output for the first row of data samples. The ensemble module corresponding to the primary key combination serves as the student network, and its output risk information includes the risk probability value. In this case, the training objective also includes minimizing the difference between the risk probability value output by the teacher network and the risk probability value output by the student network.

[0251] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0252] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0253] This specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the foregoing method embodiments.

[0254] And an electronic device, comprising:

[0255] One or more processors; and

[0256] A memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method described in any of the foregoing method embodiments.

[0257] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the methods described in the foregoing method embodiments.

[0258] The memory can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc.

[0259] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that the embodiments of this specification can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of the embodiments of this specification, or the parts that contribute to the prior art, can be embodied in the form of a computer program product. This computer program product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this specification.

[0260] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A risk identification method, characterized in that, The method includes: Acquire the behavior data to be identified; The behavior data to be identified is input into a risk identification model to obtain the risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, multiple feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavior description item of the behavior data to be identified; wherein, each feature extraction module in the risk identification model is trained independently to achieve the pluggability of the feature extraction modules; The routing module is used to determine the primary key combination corresponding to the behavior data to be identified; the primary key combination is formed by obtaining each primary key from the behavior data to be identified and combining all the primary keys obtained from the behavior data to be identified. Select the feature extraction modules corresponding to each primary key included in the primary key combination from all feature extraction modules; The behavior data to be identified is provided to each feature extraction module selected from all feature extraction modules; Determine the integrated module corresponding to the primary key combination; Each feature extraction module corresponds to one of the primary keys, and each selected feature extraction module is used to extract the feature representation corresponding to the primary key from the behavior data to be identified; The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain risk information output for the behavior data to be identified.

2. The method according to claim 1, characterized in that, The primary key includes at least one of the following: the active party, the passive party, the transaction amount, and various environmental information.

3. The method according to claim 1, characterized in that, The feature extraction module further utilizes the extracted feature representations to perform preliminary risk prediction and obtain preliminary risk information. When performing the risk prediction, the integrated module corresponding to the primary key combination further utilizes the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

4. The method according to claim 3, characterized in that, The feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule; The preprocessing submodule is used to perform feature preprocessing on the behavior data to be identified, based on the primary key corresponding to the feature extraction module. The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key; The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained by the encoding submodule, and to obtain preliminary risk information.

5. The method according to claim 3, characterized in that, The integration module corresponding to the primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule; The first integration submodule is used to perform a first integration process on the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination; The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination; The third integration submodule is used to perform a third integration process on the results of the first integration process and the second integration process. The second classification submodule is used to perform risk prediction using the results of the third integration process, and to obtain risk information output for the behavior data to be identified.

6. A method for training a risk identification model, characterized in that, The method includes: Acquire first training data including multiple first training samples, wherein the first training sample includes a first row data sample and risk labels labeled for the first row data sample; A risk identification model is trained using the first training data; wherein the risk identification model includes a routing module, multiple feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is the behavioral description item of the first behavioral data sample; wherein each feature extraction module in the risk identification model is trained independently to achieve the pluggability of the feature extraction modules; The routing module is used to determine the primary key combination corresponding to the first row data sample; the primary key combination is formed by obtaining each primary key from the first row data sample and combining all the primary keys obtained from the first row data sample. Select the feature extraction modules corresponding to each primary key included in the primary key combination from all feature extraction modules; The first behavioral data sample is provided to each feature extraction module selected from all feature extraction modules; Determine the integrated module corresponding to the primary key combination; Each feature extraction module corresponds to one of the primary keys, and each selected feature extraction module is used to extract the feature representation corresponding to the primary key from the first row of data samples; The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and to obtain risk information output for the first behavioral data sample. The training objective includes minimizing the difference between the risk information output by the risk identification model for the first behavioral data sample and the risk labels labeled for the first behavioral data sample in the first training sample.

7. The method according to claim 6, characterized in that, The feature extraction module further utilizes the extracted feature representations to perform preliminary risk prediction and obtain preliminary risk information. When performing the risk prediction, the integrated module corresponding to the primary key combination further utilizes the preliminary risk information obtained by the feature extraction modules corresponding to the primary keys contained in the primary key combination.

8. The method according to claim 7, characterized in that, The feature extraction module includes: a preprocessing submodule, an encoding submodule, and a first classification submodule; The preprocessing submodule is used to perform feature preprocessing on the first behavioral data sample based on the primary key corresponding to the feature extraction module. The encoding submodule is used to encode the preprocessed feature data to obtain the feature representation corresponding to the primary key; The first classification submodule is used to perform preliminary risk prediction using the feature representation obtained by the encoding submodule, and to obtain preliminary risk information.

9. The method according to claim 7, characterized in that, The integration module corresponding to the primary key combination includes: a first integration submodule, a second integration submodule, a third integration submodule, and a second classification submodule; The first integration submodule is used to perform a first integration process on the feature representations extracted by each feature extraction module corresponding to the primary key included in the primary key combination; The second integration submodule is used to perform a second integration process on the preliminary risk information output by each feature extraction module corresponding to the primary key contained in the primary key combination; The third integration submodule is used to perform a third integration process on the results of the first integration process and the second integration process. The second classification submodule is used to perform risk prediction using the results of the third integration process, and to obtain the risk probability value output for the first behavioral data sample.

10. The method according to claim 7 or 8, characterized in that, The method also includes pre-training each feature extraction module; Training the risk identification model using the first training data is a further training process based on the parameters of the feature extraction module obtained from pre-training. The pre-training includes: acquiring second training data comprising multiple second training samples, wherein the second training samples include second behavioral data samples and risk labels labeled for the second behavioral data samples; The feature extraction module is pre-trained using the second training data, wherein the second behavioral data sample is used as input to the feature extraction module and a copy of the feature extraction module. Preliminary risk information obtained by the feature extraction module and the copy of the feature extraction module for the second behavioral data sample is obtained. The feature extraction module and the copy of the feature extraction module have the same structure but different initialization parameters. The objectives of the pre-training include: minimizing the difference between the preliminary risk information obtained by the feature extraction module and the risk label labeled for the second behavioral data sample; minimizing the difference between the preliminary risk information obtained by the copy of the feature extraction module and the risk label labeled for the second behavioral data sample; and minimizing the output distribution divergence between the feature extraction module and the copy of the feature extraction module. After pre-training, the copy of the feature extraction module is removed.

11. The method according to claim 9, characterized in that, An auxiliary classification layer is set before the second classification submodule in each integration module, and the auxiliary classification layer includes multiple auxiliary classifiers; Each auxiliary classifier uses the result of the third integration process to perform risk prediction and obtain risk information. The auxiliary classifier and the second classification submodule have the same structure, but use different initialization parameters. The training objectives also include at least one of the following: The auxiliary classifier with the smallest corresponding loss function is selected as the teacher network, and the rest are selected as student networks. The goal is to minimize the difference between the risk information output by the student network and the risk information output by the teacher network. The difference between the risk information predicted by integrating the risk probability values ​​output by each auxiliary classifier in the second classification submodule and the risk information output by the teacher network is minimized. Maximize the difference between the risk probability values ​​output by each auxiliary classifier; After training, the auxiliary classification layer is removed.

12. The method according to any one of claims 6 to 9, characterized in that, The integration module with the smallest corresponding loss function is used as the teacher network. The routing module inputs the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination into the teacher network. The teacher network uses the input feature representations to perform risk prediction and obtains the risk probability value output for the first behavioral data sample. The integrated module corresponding to the primary key combination serves as the student network, and the output risk information includes risk probability values. The training objective also includes minimizing the difference between the risk probability values ​​output by the teacher network and the risk probability values ​​output by the student network.

13. A risk identification device, characterized in that, The device includes: The data acquisition unit is configured to acquire data on the behavior to be identified. A risk identification unit is configured to input the behavior data to be identified into a risk identification model and obtain risk information output by the risk identification model for the behavior data to be identified; wherein, the risk identification model includes a routing module, multiple feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is a behavior description item of the behavior data to be identified; wherein, each feature extraction module in the risk identification model is trained independently to achieve the pluggability of the feature extraction modules; The routing module is used to determine the primary key combination corresponding to the behavior data to be identified; the primary key combination is formed by obtaining each primary key from the behavior data to be identified and combining all the primary keys obtained from the behavior data to be identified; the module selects each feature extraction module corresponding to each primary key included in the primary key combination from all feature extraction modules, provides the behavior data to be identified to each feature extraction module selected from all feature extraction modules, and determines the integration module corresponding to the primary key combination; Each feature extraction module corresponds to one of the primary keys, and each selected feature extraction module is used to extract the feature representation corresponding to the primary key from the behavior data to be identified; The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by the feature extraction modules corresponding to the primary keys contained in the primary key combination, and to obtain risk information output for the behavior data to be identified.

14. An apparatus for training a risk identification model, characterized in that, The device includes: The sample acquisition unit is configured to acquire first training data including a plurality of first training samples, wherein the first training samples include first row data samples and risk labels labeled for the first row data samples. The model training unit is configured to train a risk identification model using the first training data; wherein the risk identification model includes a routing module, multiple feature extraction modules corresponding to multiple different primary keys, and an integration module corresponding to multiple different combinations of primary keys, wherein the primary key is a behavioral description item of the first behavioral data sample; wherein each feature extraction module in the risk identification model is trained independently to achieve the pluggability of the feature extraction modules. The routing module is used to determine the primary key combination corresponding to the first row data sample; the primary key combination is formed by obtaining each primary key from the first row data sample and combining all the primary keys obtained from the first row data sample; the module selects each feature extraction module corresponding to each primary key included in the primary key combination from all feature extraction modules, provides the first row data sample to each feature extraction module selected from all feature extraction modules, and determines the integration module corresponding to the primary key combination; Each feature extraction module corresponds to one of the primary keys, and each selected feature extraction module is used to extract the feature representation corresponding to the primary key from the first row of data samples; The integrated module corresponding to the primary key combination is used to perform risk prediction by utilizing the feature representations extracted by each feature extraction module corresponding to the primary key contained in the primary key combination, and to obtain risk information output for the first behavioral data sample. The training objective includes minimizing the difference between the risk information output by the risk identification model for the first behavioral data sample and the risk labels labeled for the first behavioral data sample in the first training sample.

15. A computing device, comprising a memory and a processor, characterized in that, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1 to 12.

Images