Abnormal User Identification Methods, Apparatus, Equipment, Storage Media, and Program Products

Abstract

This application relates to an abnormal user identification method, apparatus, device, storage medium, and program product. The method includes: acquiring a target abnormal user identification strategy for the data to be analyzed; reconstructing the data to be analyzed based on the data characteristics required by the target abnormal user identification strategy to obtain a data group of the data to be analyzed, wherein the amount of data in the data group is less than the amount of data to be analyzed; further, identifying and processing the data group using the target abnormal user identification strategy to obtain the abnormal user identification result of the data to be analyzed. This method can comprehensively consider the data characteristics required by the target abnormal user identification strategy, filter out unnecessary data and features from the data to be analyzed, and reduce the amount of data processed during abnormal user identification by reconstructing the data to be analyzed, thereby reducing resource consumption and resource redundancy waste.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an abnormal user identification method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the development of technology, various risk events affecting people's property security are emerging one after another. For example, telecommunications fraud.

[0003] Therefore, related technologies often require the identification of abnormal users in user data under various scenarios, and then take corresponding measures based on the identified abnormal users to prevent risk events from occurring.

[0004] However, when using related technologies to identify abnormal users, there is a problem of resource redundancy and waste. Summary of the Invention

[0005] Therefore, it is necessary to provide an abnormal user identification method, device, equipment, storage medium, and program product to address the above-mentioned technical problems, so as to reduce resource redundancy and waste when identifying abnormal users in different scenarios.

[0006] In a first aspect, embodiments of this application provide an abnormal user identification method, the method comprising:

[0007] Target abnormal user identification strategy for acquiring data to be analyzed;

[0008] Based on the data characteristics required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0009] The data group is processed by a target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0010] In one embodiment, the target abnormal user identification strategy for acquiring the data to be analyzed includes:

[0011] Based on the identification requirements of the data to be analyzed, a target abnormal user identification strategy is determined from at least one pre-aggregated abnormal user identification strategy; wherein, each pre-aggregated abnormal user identification strategy requires different data features.

[0012] In one embodiment, the process of constructing each abnormal user identification strategy includes:

[0013] Acquire multiple different single abnormal user identification strategies;

[0014] Based on the data characteristics required by each single abnormal user identification strategy, each single abnormal user identification strategy is classified to obtain multiple identification strategy classes; each identification strategy class includes at least two single abnormal user identification strategies.

[0015] Each identification strategy class is aggregated to obtain the identification strategy for each abnormal user.

[0016] In one embodiment, based on the data characteristics required by each individual abnormal user identification strategy, the individual abnormal user identification strategies are classified to obtain multiple identification strategy classes, including:

[0017] Based on the data characteristics required for each individual abnormal user identification strategy, the strategy similarity of each individual abnormal user identification strategy is determined.

[0018] Based on the strategy similarity of each individual abnormal user identification strategy, the individual abnormal user identification strategies are classified to obtain each identification strategy class.

[0019] In one embodiment, the strategy similarity of each individual anomalous user identification strategy is determined based on the data features required by each individual anomalous user identification strategy, including:

[0020] For any single abnormal user identification strategy, obtain the data features required by the single abnormal user identification strategy;

[0021] The number of features that are the same as those in the preset data features among the data features required for a single abnormal user identification strategy is determined as the first feature number, and the number of features in the preset data features is determined as the second feature number.

[0022] The strategy similarity of a single abnormal user identification strategy is determined based on the number of first features and the number of second features.

[0023] In one embodiment, the strategy similarity of each individual anomalous user identification strategy is determined based on the data features required by each individual anomalous user identification strategy, including:

[0024] The number of data features for all single abnormal user identification strategies is defined as the third feature number, and the number of data features for each single abnormal user identification strategy is defined as the fourth feature number.

[0025] For any single abnormal user identification strategy, the strategy similarity of the single abnormal user identification strategy is determined based on the number of third features and the number of fourth features of the single abnormal user identification strategy.

[0026] In one embodiment, the individual abnormal user identification strategies are classified according to their strategy similarity to obtain various identification strategy classes, including:

[0027] All single abnormal user identification strategies with a strategy similarity value greater than or equal to a preset similarity threshold are classified into the same category to obtain each identification strategy class.

[0028] In one embodiment, each identification strategy class is aggregated to obtain each abnormal user identification strategy, including:

[0029] For any identification strategy class, the feature similarity between each data feature and the user data feature is determined based on the data features required for each individual abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed.

[0030] Based on the similarity of each feature, determine the aggregation weight of each individual abnormal user identification strategy;

[0031] The weighted sum of each aggregation weight and each individual abnormal user identification strategy is used to obtain the abnormal user identification strategy corresponding to the identification strategy class.

[0032] In one embodiment, the method further includes:

[0033] Obtain the identification results of each individual abnormal user identification strategy;

[0034] Based on the identification results of each individual abnormal user identification strategy, a periodic analysis of the strategy is conducted to determine the stability index measurement value of each individual abnormal user identification strategy.

[0035] Based on the measured values ​​of each stability index, the strategies for identifying abnormal users are adjusted.

[0036] In one embodiment, the data to be analyzed includes user data; based on the data features required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data set of the data to be analyzed, including:

[0037] Obtain the feature values ​​of user data features in the data to be analyzed;

[0038] Based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features, target data features are filtered from the user data features;

[0039] Based on the target data characteristics and the corresponding user data, determine the data group to be analyzed.

[0040] Secondly, embodiments of this application provide an abnormal user identification device, the device comprising:

[0041] The strategy acquisition module is used to acquire the target abnormal user identification strategy from the user data to be analyzed.

[0042] The reconstruction module is used to reconstruct the data to be analyzed based on the data characteristics required by the target abnormal user identification strategy, resulting in a data set of the data to be analyzed; the amount of data in the data set is less than the amount of data to be analyzed.

[0043] The identification and processing module is used to identify and process the data group through the target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0044] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the method in any of the embodiments of the first aspect.

[0045] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method in any embodiment of the first aspect.

[0046] Fifthly, embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the method in any of the embodiments of the first aspect.

[0047] The abnormal user identification method, apparatus, device, storage medium, and program product provided in this application include: acquiring a target abnormal user identification strategy for the data to be analyzed; reconstructing the data to be analyzed according to the data features required by the target abnormal user identification strategy to obtain a data group of the data to be analyzed, wherein the amount of data in the data group is less than the amount of data to be analyzed; further identifying the data group through the target abnormal user identification strategy to obtain the abnormal user identification result of the data to be analyzed. When using the above method to achieve abnormal user identification through the target abnormal user identification strategy, it is not necessary to consider the data features required by each individual abnormal user identification strategy in the target abnormal user identification strategy separately. Instead, the data features required by the target abnormal user identification strategy are considered holistically. User data and user data features that are not needed during abnormal user identification are filtered out from the data to be analyzed. By reconstructing the data to be analyzed, a feature group with a data amount less than the original data amount of the data to be analyzed and conforming to the requirements of the target abnormal user identification strategy is obtained. Compared with each individual abnormal user identification strategy, the reconstructed feature group required by the target abnormal user identification strategy greatly reduces the amount of data processed during abnormal user identification, reduces resource consumption, and reduces resource redundancy and waste. This method reduces resource redundancy and waste without requiring deep learning algorithms, thus simplifying the abnormal user identification process compared to deep learning algorithms. Furthermore, it operates automatically through a computer program, eliminating the need for manual user intervention. This not only improves the accuracy of the identification results and reduces the error rate but also increases the identification speed. Moreover, the method employs a reconstruction approach to extract data sets from the data to be analyzed, replacing larger datasets with smaller ones. The target abnormal user identification strategy then processes these data sets, improving identification efficiency without affecting the functionality of individual abnormal user identification strategies within the target strategy. Attached Figure Description

[0048] Figure 1 This is an application environment diagram of an abnormal user identification method in one embodiment;

[0049] Figure 2 This is a flowchart illustrating an abnormal user identification method in one embodiment;

[0050] Figure 3 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0051] Figure 4 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0052] Figure 5 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0053] Figure 6 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0054] Figure 7 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0055] Figure 8 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0056] Figure 9 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0057] Figure 10 This is a flowchart illustrating an abnormal user identification method in another embodiment;

[0058] Figure 11 This is a structural block diagram of an abnormal user identification device in one embodiment;

[0059] Figure 12 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] In the field of internet technology, various risk events affecting people's financial losses or personal privacy leaks are constantly emerging, taking telecommunications fraud as an example. In practical applications, telecommunications fraud scenarios are diverse. Related technologies often require identifying fraudulent users based on user data already generated in various scenarios, and then taking corresponding measures to prevent subsequent fraudulent events based on the identified fraudulent users. However, when using related technologies to identify fraudulent users in different scenarios, the same data may be processed repeatedly in different scenarios, resulting in resource redundancy and waste. Based on this, embodiments of this application provide an abnormal user identification method that can reduce resource redundancy and waste when identifying abnormal users in different scenarios.

[0062] The abnormal user identification method provided in this application embodiment can be applied to, for example, Figure 1The abnormal user identification system shown includes a user terminal and a computer device. The user terminal and the computer device communicate with each other via methods such as Bluetooth, Wi-Fi, or mobile network connection. The computer device can be, but is not limited to, a standalone server, a distributed server, or an electronic device with data processing capabilities. The user terminal and electronic device can be, but are not limited to, various personal computers, laptops, smartphones, or tablets. Figure 1 This example illustrates an abnormal user identification system using a personal computer as the computer device and a smartphone as the user terminal. The following embodiments will specifically describe the process of the abnormal user identification method, using a computer device as the executing entity.

[0063] like Figure 2 The diagram shown is a flowchart illustrating an abnormal user identification method provided in an embodiment of this application. The method may include the following steps:

[0064] S100, Target abnormal user identification strategy for acquiring data to be analyzed.

[0065] The data to be analyzed may include user data and user data features. Optionally, the types of user data and user data features can be determined according to the type of telecommunications fraud.

[0066] For example, if the telecommunications fraud is telephone fraud, the user data can be the user's phone number, and the user data characteristics can be the number of incoming calls, the number of outgoing calls, the call duration, the call frequency, the call time, etc., for different user phone numbers; if the telecommunications fraud is online fraud, the user data can be the registered account of the corresponding website visited by the user, and the user data characteristics can be the website access frequency, access duration, blocked access frequency, blocked access duration, etc.; if the telecommunications fraud is SMS fraud, the user data can be the user's phone number, and the user data characteristics can be the SMS sending frequency, SMS receiving frequency, SMS sending time, SMS receiving time, etc., for different user phone numbers.

[0067] It should be noted that abnormal users can be fraudulent users; the above-mentioned target abnormal user identification strategy can be understood as a processing algorithm that can identify telecommunications fraud users; among them, according to type, the above-mentioned telecommunications fraud can be telephone fraud, online fraud, SMS fraud, etc.

[0068] In this embodiment, the target abnormal user identification strategy can be an identification strategy obtained by aggregating at least two single abnormal user identification strategies under different scenarios. Optionally, the above-mentioned single abnormal user identification strategy can be used to identify fraudulent users in a specific area, or to identify fraudulent users under specific conditions across the entire area.

[0069] Taking abnormal users as examples of telecom fraud users, the application scenarios of a single abnormal user identification strategy can be to identify fraud users among all users in areas A, B, or C, or to identify fraud users among all users in all areas who have received more than or equal to 20 incoming calls. Of course, it can also be to identify fraud users among all users in all areas whose phone call duration is less than or equal to 15 minutes, etc.

[0070] Specifically, the computer device can search for the corresponding anomalous user identification strategy from an anomalous user identification strategy library based on the identifier of the data to be analyzed, and determine the found anomalous user identification strategy as the target anomalous user identification strategy for the data to be analyzed. Optionally, the anomalous user identification strategy library may include a mapping relationship between identifiers of different analyzed data and different anomalous user identification strategies.

[0071] S200. Based on the data characteristics required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0072] In practical applications, the data features required by the target abnormal user identification strategy can be the user data features that the target abnormal user identification strategy needs to process when performing abnormal user identification.

[0073] The target abnormal user identification strategy can process all user data and all user data features in the data to be analyzed to identify abnormal users, or it can process all user data or only a portion of user data and only a portion of user data features in the data to be analyzed to identify abnormal users. Based on this, in the embodiments of this application, the computer device can reconstruct the data to be analyzed according to the data features required by the target abnormal user identification strategy, so as to minimize the amount of data processed by the target abnormal user identification strategy and reduce resource redundancy and waste.

[0074] In this embodiment, the method of identifying abnormal users by processing all or part of the user data and some user data features in the data to be analyzed is used as an example. Naturally, the amount of data in the reconstructed data set can be less than the amount of data to be analyzed. Optionally, the data set may include a portion of the data to be analyzed.

[0075] It should be noted that the user data and user data features in the data set are all necessary to process when the target abnormal user identification strategy performs abnormal user identification. In other words, the reconstruction can filter out the user data and user data features that the target abnormal user identification strategy does not need to process from the data to be analyzed, thereby reducing the amount of data processed when the target abnormal user identification strategy performs abnormal user identification, and reducing resource redundancy and waste.

[0076] In one embodiment, the method of reconstructing the data to be analyzed based on the data features required by the target abnormal user identification strategy may be to filter the data features required by the target abnormal user identification strategy from the data to be analyzed, and then determine the reconstructed data group by the filtered data features and the user data corresponding to these data features.

[0077] In another embodiment, the method of reconstructing the data to be analyzed based on the data features required by the target abnormal user identification strategy can also be to pre-train an algorithm model, and then input both the data features required by the target abnormal user identification strategy and the data to be analyzed into the algorithm model, which outputs a data set.

[0078] S300. The data group is identified and processed using the target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0079] Specifically, based on the target abnormal user identification strategy and data group obtained in the previous steps, the data group can be identified and processed by the target abnormal user identification strategy to obtain the abnormal user identification result of the data group, that is, the abnormal user identification result of the data to be analyzed.

[0080] The technical solution in this application embodiment obtains a target abnormal user identification strategy for the data to be analyzed. Based on the data features required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed. The data volume in the data group is less than the data volume of the data to be analyzed. The data group is then further processed using the target abnormal user identification strategy to obtain the abnormal user identification result of the data to be analyzed. This method, when implementing abnormal user identification through the target abnormal user identification strategy, does not require processing all the data to be analyzed. It considers the data features required by the target abnormal user identification strategy as a whole, filtering out user data and user data features that are not needed for abnormal user identification from the data to be analyzed. By reconstructing the data to be analyzed, a feature group with a data volume less than the original data volume of the data to be analyzed and conforming to the requirements of the target abnormal user identification strategy is obtained. Compared to any single abnormal user identification strategy, the reconstructed data group yields a more complete set of features. The method significantly reduces the amount of data processed during abnormal user identification, thereby lowering resource consumption and reducing resource redundancy and waste. Furthermore, it achieves this reduction without relying on deep learning algorithms, thus simplifying the process. The method is automated by a computer program, eliminating the need for manual user intervention, which improves accuracy, reduces error rate, and increases speed. Moreover, it uses a reconstruction approach to extract data sets from the data to be analyzed, replacing larger sets with smaller ones. This allows for the identification of these smaller sets using the target abnormal user identification strategy, improving efficiency without compromising the functionality of individual abnormal user identification strategies.

[0081] The process of obtaining the target abnormal user identification strategy for the data to be analyzed is described below. In one embodiment, the steps in S100 above may include: determining the target abnormal user identification strategy from at least one pre-aggregated abnormal user identification strategy according to the identification requirements of the data to be analyzed; wherein, each pre-aggregated abnormal user identification strategy requires different data features.

[0082] The identification requirement of the data to be analyzed can be understood as the identification scenario of the data to be analyzed, and there can be one or more identification requirements. Optionally, the identification requirement of the data to be analyzed can be to identify fraudulent users among all users in a specific area, or it can be to identify fraudulent users under specific conditions in the entire area.

[0083] It should be noted that each aggregated abnormal user identification strategy can have at least two use cases, and the number of use cases can be equal to the number of individual abnormal user identification strategies aggregated within the abnormal user identification strategy. Correspondingly, the identification requirement of the data to be analyzed can be at least one use case of the same abnormal user identification strategy, or it can be multiple use cases of different abnormal user identification strategies.

[0084] In practical applications, different abnormal user identification strategies require processing different data characteristics when performing abnormal user identification.

[0085] In this embodiment, the computer device can obtain an identification requirement identifier based on the identification requirements of the data to be analyzed, then search for the identification requirement identifier in a mapping table, and obtain the identification strategy identifier corresponding to the identification requirement identifier in the mapping table. Then, the abnormal user identification strategy corresponding to the identification strategy identifier is determined as the target abnormal user identification strategy. Optionally, the mapping table may include the correspondence between different identification requirement identifiers and the identification strategy identifiers of different abnormal user identification strategies.

[0086] The technical solution in this application embodiment determines the target abnormal user identification strategy from at least one pre-aggregated abnormal user identification strategy according to the identification requirements of the data to be analyzed; the method can accurately find the target abnormal user identification strategy that meets the identification requirements of the data to be analyzed.

[0087] The construction process of each abnormal user identification strategy in the above steps is described below. In one embodiment, the construction process of each abnormal user identification strategy is as follows: Figure 3 As shown, this can be achieved in the following way:

[0088] S400: Obtain multiple different single abnormal user identification strategies.

[0089] Specifically, it is possible to obtain a single abnormal user identification strategy for multiple different usage scenarios.

[0090] S500. Based on the data characteristics required by each single abnormal user identification strategy, classify each single abnormal user identification strategy to obtain multiple identification strategy classes. Each identification strategy class includes at least two single abnormal user identification strategies.

[0091] Specifically, based on the acquired single abnormal user identification strategies for multiple different usage scenarios, the data features required by each single abnormal user identification strategy can be obtained. Then, according to the data features required by each single abnormal user identification strategy, all single abnormal user identification strategies are classified to obtain multiple identification strategy classes. Optionally, the data features required by different single abnormal user identification strategies can be the same or different; each identification strategy class can include at least two single abnormal user identification strategies.

[0092] In one implementation, a computer device can pre-train a classification network model, and then input the data features required for each individual abnormal user identification strategy and all individual abnormal user identification strategies into the classification network model, which outputs multiple identification strategy classes.

[0093] Optionally, the classification network model may be composed of at least one of the following: convolutional neural network model, fully connected neural network model, recurrent recurrent neural network model, deep belief network model, deep autoencoder and generative adversarial network model. This embodiment of the application does not limit the specific composition of the model.

[0094] In another implementation, the computer device can classify single abnormal user identification strategies with the same data characteristics into the same category based on the data characteristics required by each single abnormal user identification strategy, thus obtaining multiple identification strategy categories.

[0095] S600: Aggregate each identification strategy class to obtain each abnormal user identification strategy.

[0096] Among them, based on the identification strategy classes obtained in the above steps, for any identification strategy class, all single abnormal user identification strategies in the identification strategy class can be aggregated to obtain the abnormal user identification strategy corresponding to the identification strategy class.

[0097] Optionally, the way to aggregate all the single abnormal user identification strategies in the identification strategy class is to pre-train an algorithm model, and then input all the single abnormal user identification strategies in the identification strategy class into the algorithm model, which outputs the abnormal user identification strategy corresponding to the identification strategy class.

[0098] Alternatively, all single abnormal user identification strategies in the identification strategy class can be aggregated by merging the same processing steps in all single abnormal user identification strategies, and then determining the abnormal user identification strategy based on the merged processing steps and the unmerged processing steps.

[0099] The technical solution in this application embodiment obtains multiple different single abnormal user identification strategies, classifies each single abnormal user identification strategy according to the data characteristics required by each single abnormal user identification strategy, obtains multiple identification strategy classes, and aggregates each identification strategy class to obtain each abnormal user identification strategy. This method can classify all single abnormal user identification strategies, and then aggregate single abnormal user identification strategies of the same identification strategy class. In the application process, the aggregated abnormal user identification strategies corresponding to the same identification strategy class can be used to identify abnormal users in different usage scenarios within that identification strategy class, which can avoid the process of repeatedly analyzing and processing the same data, thereby reducing the redundancy and waste of data resources. At the same time, by using the aggregated abnormal user identification strategies to identify abnormal users in different usage scenarios, it can also reduce the amount of data processing, thereby reducing the data space occupied.

[0100] The following describes the process of classifying each individual abnormal user identification strategy according to the data characteristics required by each strategy, resulting in multiple identification strategy classes. In one embodiment, as... Figure 4 As shown, the steps in S500 above can be implemented in the following ways:

[0101] S510. Based on the data characteristics required by each individual abnormal user identification strategy, determine the strategy similarity of each individual abnormal user identification strategy.

[0102] Specifically, the computer device can acquire preset data features, and then, for any single abnormal user identification strategy, based on the data features required by the single abnormal user identification strategy and the preset data features, use a similarity calculation method to obtain the strategy similarity of the single abnormal user identification strategy.

[0103] Optionally, the preset data features can be the data features required by any one or more single abnormal user identification strategies. Optionally, the similarity calculation method can be the mean squared error evaluation method, the goodness-of-fit evaluation method, the correlation coefficient method, the string similarity method, etc.

[0104] S520. Based on the strategy similarity of each individual abnormal user identification strategy, classify each individual abnormal user identification strategy to obtain each identification strategy class.

[0105] Among them, based on the strategy similarity value of each single abnormal user identification strategy, all single abnormal user identification strategies with the same strategy similarity value can be classified into the same category, thus obtaining each identification strategy class.

[0106] In one embodiment, the step of classifying each single abnormal user identification strategy according to the strategy similarity of each single abnormal user identification strategy in S520 to obtain each identification strategy class may include: classifying all single abnormal user identification strategies whose strategy similarity value is greater than or equal to a preset similarity threshold into the same class to obtain each identification strategy class.

[0107] Optionally, single anomalous user identification strategies with a strategy similarity value greater than or equal to a preset similarity threshold can be grouped into one category, while single anomalous user identification strategies with a strategy similarity value less than the preset similarity threshold can be grouped into another category, thus obtaining various identification strategy classes. Optionally, the preset similarity threshold can be user-defined or determined based on historical experience values.

[0108] Alternatively, single abnormal user identification strategies with a strategy similarity value greater than or equal to a preset similarity threshold can be classified into the same category. Single abnormal user identification strategies with a strategy similarity value less than another similarity threshold can be classified into the same category. Single abnormal user identification strategies with a strategy similarity value between the preset similarity threshold and another similarity threshold can be classified into the same category, thus obtaining each identification strategy class.

[0109] The technical solution in this application embodiment determines the strategy similarity of each single abnormal user identification strategy based on the data features required by each single abnormal user identification strategy, and classifies each single abnormal user identification strategy according to the strategy similarity to obtain each identification strategy class. This method can determine the strategy similarity of each single abnormal user identification strategy based on the data features required by each single abnormal user identification strategy, so that the obtained single abnormal user identification strategy has a higher strategy similarity. Furthermore, based on obtaining a more accurate strategy similarity, all single abnormal user identification strategies can be accurately classified, thereby improving the accuracy of the obtained identification strategy classes.

[0110] The process of determining the strategy similarity of each individual anomalous user identification strategy based on the data features required for each individual anomalous user identification strategy is described below. In one embodiment, as... Figure 5 As shown, the steps in S510 above can be implemented in the following ways:

[0111] S511. For any single abnormal user identification strategy, obtain the data features required by the single abnormal user identification strategy.

[0112] In practical applications, for any single abnormal user identification strategy, the strategy can be analyzed to obtain the data features required for its identification. Additionally, the data features required for the single abnormal user identification strategy can be obtained based on its application scenario.

[0113] S512. The number of features that are the same as those in the preset data features among the data features required for the single abnormal user identification strategy is determined as the first feature number, and the number of features in the preset data features is determined as the second feature number.

[0114] For example, if the data features required by a single abnormal user identification strategy A are A1, A2, and A3, and the data features required by a single abnormal user identification strategy B are B1, B2, and B3, and the preset data features are A1, A2, B1, B2, B3, and B4, then two of the data features required by the single abnormal user identification strategy A are the same as those in the preset data features, namely A1 and A2, corresponding to a first feature count of 2; three of the data features required by the single abnormal user identification strategy B are the same as those in the preset data features, namely B1, B2, and B3, corresponding to a first feature count of 3. Meanwhile, the number of features in the preset data features can be 6.

[0115] S513. Determine the strategy similarity of a single abnormal user identification strategy based on the number of the first feature and the number of the second feature.

[0116] Specifically, the computer device can perform arithmetic operations on the number of first features and the number of second features to obtain the strategy similarity of a single abnormal user identification strategy. Optionally, the arithmetic operations may include at least one of addition, subtraction, multiplication, division, exponentiation, and logarithm.

[0117] In this embodiment of the application, the computer device can obtain the strategy similarity of a single abnormal user identification strategy by dividing the number of first features by the number of second features.

[0118] The technical solution in this application embodiment, for any single abnormal user identification strategy, obtains the data features required by the single abnormal user identification strategy, determines the number of features in the data features required by the single abnormal user identification strategy that are the same as those in the preset data features as the first feature number, and determines the number of features in the preset data features as the second feature number. Based on the first feature number and the second feature number, the strategy similarity of the single abnormal user identification strategy is determined. This method can determine the strategy similarity of the single abnormal user identification strategy without processing through deep learning algorithms, thereby reducing the complexity of the strategy similarity calculation process, reducing the amount of data in the strategy similarity calculation process, and further improving the calculation speed of strategy similarity.

[0119] In some scenarios, the policy similarity of a single abnormal user identification strategy can also be calculated using methods other than those described in the above embodiments. The process of calculating the policy similarity of a single abnormal user identification strategy using another method is described below. In one embodiment, as... Figure 6 As shown, the step in S510 above, which determines the strategy similarity of each individual abnormal user identification strategy based on the data features required by each individual abnormal user identification strategy, can be implemented in the following way:

[0120] S514. The number of data features of all single abnormal user identification strategies is determined as the third feature number, and the number of data features of each single abnormal user identification strategy is determined as the fourth feature number.

[0121] For example, if all single abnormal user identification strategies are single abnormal user identification strategy A, single abnormal user identification strategy B, single abnormal user identification strategy C, and single abnormal user identification strategy D, and the data features required for single abnormal user identification strategy A are A1 and A2, the data features required for single abnormal user identification strategy B are B1, B2, and B3, the data features required for single abnormal user identification strategy C are C1 and C2, and the data features required for single abnormal user identification strategy D are D1 and D2, then the number of data features (i.e., the number of fourth features) for single abnormal user identification strategy A is 2, the number of data features (i.e., the number of fourth features) for single abnormal user identification strategy B is 3, the number of data features (i.e., the number of fourth features) for single abnormal user identification strategy C is 2, and the number of data features (i.e., the number of fourth features) for single abnormal user identification strategy D is 2.

[0122] Correspondingly, the number of data features (i.e. the number of third features) of all single abnormal user identification strategies can be equal to the sum of the number of data features of single abnormal user identification strategy A (2), the number of data features of single abnormal user identification strategy B (3), the number of data features of single abnormal user identification strategy C (2), and the number of data features of single abnormal user identification strategy D (2), that is, 2+3+2+2 equals 9.

[0123] S515. For any single abnormal user identification strategy, determine the strategy similarity of the single abnormal user identification strategy based on the number of third features and the number of fourth features of the single abnormal user identification strategy.

[0124] For any single abnormal user identification strategy, the strategy similarity can be obtained by performing an arithmetic operation on the number of third features and the number of fourth features of the single abnormal user identification strategy.

[0125] In this embodiment of the application, the computer device can obtain the strategy similarity of a single abnormal user identification strategy by dividing the number of fourth features by the number of third features.

[0126] The technical solution in this application embodiment determines the number of data features of all single abnormal user identification strategies as the third feature number and the number of data features of each single abnormal user identification strategy as the fourth feature number. For any single abnormal user identification strategy, the strategy similarity of the single abnormal user identification strategy is determined based on the third feature number and the fourth feature number of the single abnormal user identification strategy. This method can determine the strategy similarity of single abnormal user identification strategies without processing through deep learning algorithms, thereby reducing the complexity of the strategy similarity calculation process, reducing the amount of data in the strategy similarity calculation process, and further improving the calculation speed of strategy similarity.

[0127] The following describes the process of aggregating each identification strategy class to obtain the respective abnormal user identification strategies. In one embodiment, as shown... Figure 7 As shown, the steps in S600 above can be implemented in the following ways:

[0128] S610. For any identification strategy class, determine the feature similarity between each data feature and the user data feature based on the data features required for each single abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed.

[0129] Specifically, for any single abnormal user identification strategy in any identification strategy class, the computer device can use a similarity calculation method to perform similarity calculation processing on the data features required by the single abnormal user identification strategy in the identification strategy class and all user data features in the data to be analyzed, so as to obtain the feature similarity between the data features of the single abnormal user identification strategy and the user data features.

[0130] In addition, for any single abnormal user identification strategy in any identification strategy class, the computer device can also obtain the number of single features corresponding to the data features required by the single abnormal user identification strategy in the identification strategy class and the total number of features of all user data features in the data to be analyzed. Then, by dividing the number of single features by the total number of features, the feature similarity between the data features of the single abnormal user identification strategy and the user data features is obtained.

[0131] S620. Determine the aggregation weight of each individual abnormal user identification strategy based on the similarity of each feature.

[0132] The computer device can look up the feature similarity value between the data features of the single abnormal user identification strategy and the user data features in the mapping relationship table, then obtain the weight corresponding to the found feature similarity value from the mapping relationship table, and determine the weight corresponding to the found feature similarity value as the aggregate weight of the single abnormal user identification strategy.

[0133] In addition, the computer device can also assign corresponding aggregation weights to a single abnormal user identification strategy according to a preset aggregation weight allocation rule, based on the feature similarity value between the data features of the single abnormal user identification strategy and the user data features. Optionally, the above aggregation weight allocation rule can be calculated by taking the feature similarity value corresponding to each single abnormal user identification strategy in the same identification strategy class and the sum of the feature similarity values ​​corresponding to all single abnormal user identification strategies, calculating the ratio between the two, and then determining the aggregation weight of each single abnormal user identification strategy based on the ratio corresponding to each single abnormal user identification strategy.

[0134] Optionally, within the same identification strategy class, the sum of the aggregate weights corresponding to all single abnormal user identification strategies can be equal to 1.

[0135] It should be noted that the sum of the ratios corresponding to all single abnormal user identification strategies in the same identification strategy class corresponds to the sum of the aggregate weights of all single abnormal user identification strategies. Specifically, the way to determine the aggregate weight of each single abnormal user identification strategy based on the ratio corresponding to each single abnormal user identification strategy can be based on the proportion of the ratio corresponding to each single abnormal user identification strategy in the sum of all ratios.

[0136] S630. The aggregate weights and individual abnormal user identification strategies are weighted and summed to obtain the abnormal user identification strategy corresponding to the identification strategy class.

[0137] For any identification strategy class, the abnormal user identification strategy corresponding to that identification strategy class can be obtained by weighted summation of each individual abnormal user identification strategy in the identification strategy class and its corresponding aggregate weight.

[0138] The technical solution in this application embodiment, for any identification strategy class, determines the feature similarity between each data feature and the user data feature based on the data features required by each individual abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed. Based on the feature similarity, the aggregation weight of each individual abnormal user identification strategy is determined. The aggregation weight and each individual abnormal user identification strategy are weighted and summed to obtain the abnormal user identification strategy corresponding to the identification strategy class. When aggregating each individual abnormal user identification strategy in the identification strategy class, this method can achieve the aggregation of each individual abnormal user identification strategy in the identification strategy class by weighting and summing the aggregation weight of each individual abnormal user identification strategy with the corresponding individual abnormal user identification strategy. The aggregation process does not need to change the internal logic of each individual abnormal user identification strategy. It is implemented on the basis of the original individual abnormal user identification strategy. On this basis, it can save the time of changing the internal logic, reduce the consumption of space resources, and reduce the complexity of the aggregation process, thereby further improving the aggregation speed. Among them, the design of each individual abnormal user identification strategy is relatively simple, while the design of the abnormal user identification strategy is more complex and has stronger functionality compared to the individual abnormal user identification strategies. At the same time, the abnormal user identification strategy aggregates multiple individual abnormal user identification strategies, which can improve the applicability of scenarios compared to the individual abnormal user identification strategies, make the aggregated strategies more diversified, improve the identification stability and accuracy of the identification strategy, and also reduce the identification error rate. In addition, the aggregated abnormal user identification strategy only needs to process the reconstructed data group to achieve abnormal user identification, which can also reduce the operating load of the identification strategy.

[0139] In some scenarios, as individual abnormal user identification strategies are used over time, their stability decreases. This leads to a decrease in the accuracy of the aggregated abnormal user identification strategy and an increase in the error rate. Therefore, the stability of each individual abnormal user identification strategy can be periodically analyzed, and those with poor stability can be removed from the list of abnormal user identification strategies to address the problems of low accuracy and increased error rate. In one embodiment, after performing the steps in S300 above, as... Figure 8 As shown, the above method may further include the following steps:

[0140] S700: Obtain the identification results of each individual abnormal user identification strategy.

[0141] Specifically, computer equipment can identify and process the data to be analyzed using each individual abnormal user identification strategy, and the identification results of each individual abnormal user identification strategy are as follows.

[0142] It should be noted that the data to be analyzed may be equal or unequal at different times.

[0143] S800. Based on the identification results of each individual abnormal user identification strategy, perform periodic analysis of the strategy to determine the stability index measurement value of each individual abnormal user identification strategy.

[0144] The computer equipment can pre-train an analysis network model, and then input the identification results of each individual abnormal user identification strategy into the analysis network model, so as to perform strategy analysis on the identification results of each individual abnormal user identification strategy through the analysis network model, and obtain the stability index measurement value of each individual abnormal user identification strategy.

[0145] Optionally, the analysis network model can be composed of at least one of the following: convolutional neural network model, fully connected neural network model, recurrent recurrent neural network model, and deep belief network model. This application does not limit the specific network model.

[0146] In practical applications, each individual anomalous user identification strategy can be analyzed periodically. However, the data obtained for analysis may be equal or unequal each time a strategy is analyzed. Naturally, the identification results of the same individual anomalous user identification strategy may be equal or unequal each time a strategy is analyzed.

[0147] In this embodiment of the application, the data to be analyzed can be acquired in real time each time the strategy is analyzed, and then the identification results can be obtained by implementing the acquired data to be analyzed.

[0148] S900: Adjust the abnormal user identification strategy based on the measured values ​​of each stability index.

[0149] Furthermore, based on the stability index measurements of each individual abnormal user identification strategy obtained during each strategy analysis, adjustments can be made to each abnormal user identification strategy.

[0150] In one implementation, for each strategy adjustment, if the stability index measurement value of a single abnormal user identification strategy is less than a preset index threshold, the single abnormal user identification strategy can be removed from the list of abnormal user identification strategies. The aggregate weights of other single abnormal user identification strategies in the list of abnormal user identification strategies are then recalculated. Finally, the aggregate weights of the other single abnormal user identification strategies and the other single abnormal user identification strategies are weighted and summed to obtain the adjusted abnormal user identification strategy.

[0151] Optionally, the preset indicator threshold can be user-defined or determined based on historical experience values.

[0152] It should be noted that when performing strategy analysis in two or more consecutive sessions, the same abnormal user identification strategy can be left unchanged or all of the same abnormal user identification strategies can be adjusted.

[0153] The technical solution in this application embodiment obtains the identification results of each individual abnormal user identification strategy, performs periodic strategy analysis based on the identification results, determines the stability index measurement value of each individual abnormal user identification strategy, and adjusts each abnormal user identification strategy based on the stability index measurement value. This method can obtain the stability index measurement value of each individual abnormal user identification strategy, then adjust each abnormal user identification strategy based on the stability index measurement value, removing individual abnormal user identification strategies with poor stability from the corresponding abnormal user identification strategies, thereby improving the identification accuracy of the adjusted abnormal user identification strategy and reducing the identification error rate. Furthermore, by periodically adjusting each abnormal user identification strategy through the stability index measurement value, the continuous optimization of the abnormal user identification strategy can be ensured, allowing the adjusted abnormal user identification strategy to continuously adapt to new fraud scenarios and identify telecommunications fraud users corresponding to new fraud methods.

[0154] In one embodiment, the data to be analyzed includes user data; such as Figure 9 As shown, the step in S200 above, which reconstructs the data to be analyzed based on the data features required by the target abnormal user identification strategy to obtain the data set of the data to be analyzed, can be implemented in the following way:

[0155] S210. Obtain the feature values ​​of user data features in the data to be analyzed.

[0156] S220. Based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features, filter the target data features from the user data features.

[0157] Optionally, the computer device can use an inverted index method to reconstruct the data to be analyzed based on the data characteristics required by the target abnormal user identification strategy, thereby obtaining a data set of the data to be analyzed.

[0158] Specifically, the computer device can analyze the target abnormal user identification strategy to obtain the data features required by the target abnormal user identification strategy, and then filter the target data features from the user data features based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features.

[0159] S230. Based on the target data characteristics and the user data corresponding to the target data characteristics, determine the data group of the data to be analyzed.

[0160] Furthermore, user data corresponding to the target data features can be obtained from the data to be analyzed, and the target data features and the corresponding user data can be defined as a data group of the data to be analyzed. Optionally, the target data features can be referred to as a feature group.

[0161] The technical solution in this application embodiment obtains the feature values ​​of user data features in the data to be analyzed. Based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features, target data features are filtered from the user data features. Based on the target data features and the user data corresponding to the target data features, a data group of the data to be analyzed is determined. This method can reconstruct the data to be analyzed based on the data features required by the target abnormal user identification strategy to obtain the data group required by the target abnormal user identification strategy to achieve abnormal user identification. This allows for further identification processing of the smaller data group through the target abnormal user identification strategy, reducing the amount of data to be processed, saving processing time, reducing space resource occupation, and reducing resource redundancy and waste. In addition, this method only needs to access the data to be analyzed once to obtain all the data, i.e., the data group, required by each individual abnormal user identification strategy in the target abnormal user identification strategy to achieve abnormal user identification. Compared with the need for multiple accesses to the data to be analyzed when each individual abnormal user identification strategy achieves abnormal user identification, this method can reduce the number of data accesses, reduce the load pressure on the access subject, and further improve the efficiency of abnormal user identification. Furthermore, this method relies on the data features required by the target abnormal user identification strategy during data reconstruction. This allows the reconstructed data set to change flexibly when the target abnormal user identification strategy is adjusted, making the final reconstructed data set applicable to the target abnormal user identification strategy and thus improving the identification success rate of the target abnormal user identification strategy.

[0162] In one embodiment, this application also provides a method for identifying abnormal users, such as... Figure 10 As shown, the method includes the following procedures:

[0163] S10. Based on the identification requirements of the data to be analyzed, determine the target abnormal user identification strategy from at least one pre-aggregated abnormal user identification strategy; wherein, each pre-aggregated abnormal user identification strategy requires different data features.

[0164] The construction process of each abnormal user identification strategy includes:

[0165] S11. Obtain multiple different single abnormal user identification strategies;

[0166] S12. Determine the strategy similarity of each individual abnormal user identification strategy based on the data characteristics required by each individual abnormal user identification strategy.

[0167] Step S12 above can be implemented in two ways:

[0168] The first method includes:

[0169] S121. For any single abnormal user identification strategy, obtain the data features required by the single abnormal user identification strategy.

[0170] S122. The number of features that are the same as those in the preset data features among the data features required for the single abnormal user identification strategy is determined as the first feature number, and the number of features in the preset data features is determined as the second feature number.

[0171] S123. Determine the strategy similarity of a single abnormal user identification strategy based on the number of first features and the number of second features.

[0172] The second method includes:

[0173] S124. The number of data features of all single abnormal user identification strategies is determined as the third feature number, and the number of data features of each single abnormal user identification strategy is determined as the fourth feature number.

[0174] S125. For any single abnormal user identification strategy, determine the strategy similarity of the single abnormal user identification strategy based on the number of third features and the number of fourth features of the single abnormal user identification strategy.

[0175] S13. Classify all single abnormal user identification strategies whose strategy similarity values ​​are greater than or equal to a preset similarity threshold into the same category to obtain each identification strategy class; each identification strategy class includes at least two single abnormal user identification strategies.

[0176] S14. For any identification strategy class, determine the feature similarity between each data feature and the user data feature based on the data features required for each single abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed.

[0177] S15. Determine the aggregation weight of each individual abnormal user identification strategy based on the similarity of each feature.

[0178] S16. The aggregate weights and individual abnormal user identification strategies are weighted and summed to obtain the abnormal user identification strategy corresponding to the identification strategy class.

[0179] S17. Obtain the identification results of each individual abnormal user identification strategy.

[0180] S18. Based on the identification results of each individual abnormal user identification strategy, conduct periodic analysis of the strategy to determine the stability index measurement value of each individual abnormal user identification strategy.

[0181] S19. Adjust the abnormal user identification strategy based on the measured values ​​of each stability index.

[0182] S20. Obtain the feature values ​​of user data features in the data to be analyzed.

[0183] S30. Based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features, filter the target data features from the user data features.

[0184] S40. Based on the target data characteristics and the corresponding user data, determine the data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0185] S50. The data group is identified and processed using the target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0186] The execution process of S10 to S50 can be found in the description of the above embodiments. The implementation principle and technical effect are similar, and will not be repeated here.

[0187] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0188] Based on the same inventive concept, this application also provides an abnormal user identification device for implementing the abnormal user identification method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more abnormal user identification device embodiments provided below can be found in the limitations of the abnormal user identification method described above, and will not be repeated here.

[0189] In one embodiment, Figure 11 This is a schematic diagram of the structure of an abnormal user identification device in one embodiment of this application. The abnormal user identification device provided in this embodiment can be applied to computer devices. Figure 11As shown, the abnormal user identification device in this application embodiment may include: a policy acquisition module 11, a reconstruction module 12, and an identification processing module 13, wherein:

[0190] Strategy acquisition module 11 is used to acquire the target abnormal user identification strategy of the user data to be analyzed;

[0191] Reconstruction module 12 is used to reconstruct the data to be analyzed based on the data characteristics required by the target abnormal user identification strategy, so as to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0192] The identification and processing module 13 is used to identify and process the data group through the target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0193] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0194] In one embodiment, the policy acquisition module 11 is specifically used for:

[0195] Based on the identification requirements of the data to be analyzed, a target abnormal user identification strategy is determined from at least one pre-aggregated abnormal user identification strategy; wherein, each pre-aggregated abnormal user identification strategy requires different data features.

[0196] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0197] In one embodiment, the abnormal user identification device further includes: a single policy acquisition module, a policy classification module, and an aggregation processing module, wherein:

[0198] The single strategy acquisition module is used to acquire multiple different single abnormal user identification strategies;

[0199] The strategy classification module is used to classify each single abnormal user identification strategy according to the data characteristics required by each single abnormal user identification strategy, resulting in multiple identification strategy classes; each identification strategy class includes at least two single abnormal user identification strategies.

[0200] The aggregation processing module is used to aggregate each identification strategy class to obtain the identification strategy for each abnormal user.

[0201] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0202] In one embodiment, the strategy classification module includes: a determination unit and a classification unit, wherein:

[0203] The determining unit is used to determine the strategy similarity of each individual abnormal user identification strategy based on the data features required by each individual abnormal user identification strategy.

[0204] The classification unit is used to classify each individual abnormal user identification strategy according to the strategy similarity of each strategy, and obtain each identification strategy class.

[0205] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0206] In one embodiment, the determining unit includes: a feature acquisition subunit, a first quantity acquisition subunit, and a first determining subunit, wherein:

[0207] The feature acquisition subunit is used to acquire the data features required for any single abnormal user identification strategy.

[0208] The first quantity acquisition subunit is used to determine the number of features that are the same as those in the preset data features among the data features required for the single abnormal user identification strategy as the first feature quantity, and to determine the number of features in the preset data features as the second feature quantity.

[0209] The first determining subunit is used to determine the strategy similarity of a single abnormal user identification strategy based on the number of first features and the number of second features.

[0210] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0211] In one embodiment, the determining unit includes: a second quantity acquisition subunit and a second determining subunit, wherein:

[0212] The second quantity acquisition subunit is used to determine the number of data features of all single abnormal user identification strategies as the third feature quantity, and to determine the number of data features of each single abnormal user identification strategy as the fourth feature quantity.

[0213] The second determining subunit is used to determine the strategy similarity of a single abnormal user identification strategy based on the number of third features and the number of fourth features of the single abnormal user identification strategy for any single abnormal user identification strategy.

[0214] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0215] In one embodiment, the classification unit is specifically used for:

[0216] All single abnormal user identification strategies with a strategy similarity value greater than or equal to a preset similarity threshold are classified into the same category to obtain each identification strategy class.

[0217] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0218] In one embodiment, the aggregation processing module is specifically used for:

[0219] For any identification strategy class, the feature similarity between each data feature and the user data feature is determined based on the data features required for each individual abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed.

[0220] Based on the similarity of each feature, determine the aggregation weight of each individual abnormal user identification strategy;

[0221] The weighted sum of each aggregation weight and each individual abnormal user identification strategy is used to obtain the abnormal user identification strategy corresponding to the identification strategy class.

[0222] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0223] In one embodiment, the abnormal user identification device further includes: a policy adjustment module, which is specifically used for:

[0224] Obtain the identification results of each individual abnormal user identification strategy;

[0225] Based on the identification results of each individual abnormal user identification strategy, a periodic analysis of the strategy is conducted to determine the stability index measurement value of each individual abnormal user identification strategy.

[0226] Based on the measured values ​​of each stability index, the strategies for identifying abnormal users are adjusted.

[0227] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0228] In one embodiment, the reconstruction module 12 is specifically used for:

[0229] Obtain the feature values ​​of user data features in the data to be analyzed;

[0230] Based on the data features required by the target abnormal user identification strategy and the feature values ​​of the user data features, target data features are filtered from the user data features;

[0231] Based on the target data characteristics and the corresponding user data, determine the data group to be analyzed.

[0232] The abnormal user identification device provided in this application embodiment can be used to execute the technical solutions in the above-described abnormal user identification method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0233] Specific limitations regarding the abnormal user identification device can be found in the limitations of the abnormal user identification method described above, and will not be repeated here. Each module in the aforementioned abnormal user identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0234] In one embodiment, a computer device is provided, the internal structure of which can be as follows: Figure 12 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides processing power. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores data to be analyzed and individual abnormal user identification strategies. The network interface communicates with external endpoints via a network connection. When executed by the processor, the computer program implements an abnormal user identification method.

[0235] Those skilled in the art will understand that Figure 12The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0236] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0237] Target abnormal user identification strategy for acquiring data to be analyzed;

[0238] Based on the data characteristics required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0239] The data group is processed by a target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0240] In one embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, the computer program performing the following steps when executed by a processor:

[0241] Target abnormal user identification strategy for acquiring data to be analyzed;

[0242] Based on the data characteristics required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0243] The data group is processed by a target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0244] In one embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, performs the following steps:

[0245] Target abnormal user identification strategy for acquiring data to be analyzed;

[0246] Based on the data characteristics required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the amount of data in the data group is less than the amount of data to be analyzed.

[0247] The data group is processed by a target abnormal user identification strategy to obtain the abnormal user identification results of the data to be analyzed.

[0248] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) or data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information or data authorized by the user or fully authorized by all parties.

[0249] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0250] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0251] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An abnormal user identification method characterized by comprising: The method comprises: According to the identification requirement of the data to be analyzed, a target abnormal user identification strategy is determined from at least one pre-aggregated abnormal user identification strategy; wherein the data features required by each pre-aggregated abnormal user identification strategy are different; According to the data features required by the target abnormal user identification strategy, the data to be analyzed is reconstructed to obtain a data group of the data to be analyzed; the data amount in the data group is less than the data amount of the data to be analyzed; The data group is processed by the target abnormal user identification strategy to obtain an abnormal user identification result of the data to be analyzed; The construction process of each abnormal user identification strategy comprises: A plurality of different single abnormal user identification strategies are obtained; According to the data features required by each single abnormal user identification strategy, each single abnormal user identification strategy is classified to obtain a plurality of identification strategy classes; each identification strategy class includes at least two single abnormal user identification strategies; For any identification strategy class, according to the data features required by each single abnormal user identification strategy in the identification strategy class and the user data features in the data to be analyzed, the feature similarity between each data feature and the user data feature is determined; according to each feature similarity, the aggregation weight of each single abnormal user identification strategy is determined; each aggregation weight and each single abnormal user identification strategy are weighted and summed to obtain an abnormal user identification strategy corresponding to the identification strategy class.

2. The method of claim 1, wherein, According to the data features required by each single abnormal user identification strategy, each single abnormal user identification strategy is classified to obtain a plurality of identification strategy classes, which comprises: According to the data features required by each single abnormal user identification strategy, the strategy similarity of each single abnormal user identification strategy is determined; According to the strategy similarity of each single abnormal user identification strategy, each single abnormal user identification strategy is classified to obtain each identification strategy class.

3. The method of claim 2, wherein, According to the data features required by each single abnormal user identification strategy, the strategy similarity of each single abnormal user identification strategy is determined, which comprises: For any single abnormal user identification strategy, the data features required by the single abnormal user identification strategy are obtained; The number of the same features in the data features required by the single abnormal user identification strategy and the preset data features is determined as a first feature number, and the number of features in the preset data features is determined as a second feature number; According to the first feature number and the second feature number, the strategy similarity of the single abnormal user identification strategy is determined.

4. The method of claim 2, wherein, According to the data features required by each single abnormal user identification strategy, the strategy similarity of each single abnormal user identification strategy is determined, which comprises: The number of data features of all single abnormal user identification strategies is determined as a third feature number, and the number of data features of each single abnormal user identification strategy is determined as a fourth feature number; For any single abnormal user identification strategy, a strategy similarity of the single abnormal user identification strategy is determined according to the third feature quantity and a fourth feature quantity of the single abnormal user identification strategy.

5. The method according to any one of claims 2-4, characterized in that, The classification of each single abnormal user identification strategy according to the strategy similarity of each single abnormal user identification strategy comprises: The single abnormal user identification strategies with a strategy similarity value greater than or equal to a preset similarity threshold value are classified into the same class, and each identification strategy class is obtained.

6. The method of claim 1, wherein, The method further comprises: An identification result of each single abnormal user identification strategy is obtained. A stability index measurement value of each single abnormal user identification strategy is determined through periodic analysis of the identification result of each single abnormal user identification strategy. Each abnormal user identification strategy is adjusted according to the stability index measurement value.

7. The method according to any one of claims 1-4, characterized in that, The data to be analyzed includes user data, and the data group of the data to be analyzed is obtained by reconstructing the data to be analyzed according to the data features required by the target abnormal user identification strategy, comprising: A feature value of a user data feature in the data to be analyzed is obtained. A target data feature is selected from the user data feature according to the data features required by the target abnormal user identification strategy and the feature value of the user data feature. The data group of the data to be analyzed is determined according to the target data feature and the user data corresponding to the target data feature.

8. An abnormal user identifying apparatus characterized by comprising: The device comprises: A strategy acquisition module is configured to determine a target abnormal user identification strategy from at least one pre-aggregated abnormal user identification strategy according to the identification requirement of the data to be analyzed, wherein the data features required by each pre-aggregated abnormal user identification strategy are different. A reconstruction module is configured to reconstruct the data to be analyzed according to the data features required by the target abnormal user identification strategy, and obtain a data group of the data to be analyzed, wherein the data amount in the data group is less than the data amount of the data to be analyzed. An identification processing module is configured to perform identification processing on the data group by the target abnormal user identification strategy, and obtain an abnormal user identification result of the data to be analyzed. The strategy acquisition module is further configured to obtain a plurality of different single abnormal user identification strategies, classify each single abnormal user identification strategy according to the data features required by each single abnormal user identification strategy, and obtain a plurality of identification strategy classes, wherein each identification strategy class includes at least two single abnormal user identification strategies, for any identification strategy class, determine a feature similarity between each data feature and a user data feature in the identification strategy class according to the data features required by each single abnormal user identification strategy in the identification strategy class and the user data feature in the data to be analyzed, determine an aggregation weight of each single abnormal user identification strategy according to each feature similarity, and obtain an abnormal user identification strategy corresponding to the identification strategy class by weighted summation of each aggregation weight and each single abnormal user identification strategy. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8. The computer program is executed by the processor to implement the steps of the method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-7.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-7.

Images