A method, device and storage medium for training an anomaly detection model

Abstract

The application discloses a training method and device of an anomaly detection model, an equipment and a storage medium. A training sample group containing historical behavior sequences corresponding to a plurality of sample accounts is determined, a label of the training sample group is determined according to a first correlation between abnormal processing strategies executed on each sample account corresponding to the training sample group in the past, then an anomaly detection result corresponding to each sample account in the training sample group is obtained through an anomaly detection model to be trained, and the anomaly detection model is trained according to the similarity between the anomaly detection results corresponding to each sample account and the label of the training sample group. It can be seen that the first correlation between the abnormal processing strategies executed on each sample account corresponding to the training sample group is used to guide the training of the anomaly detection model in the application. The anomaly detection model obtained through the training can accurately identify abnormal accounts, thereby ensuring the accuracy of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a training method, apparatus, device, and storage medium for an anomaly detection model. Background Technology

[0002] With the development of computer technology and people's increasing attention to their privacy, it has become a common business execution method to detect anomalies in the accounts used by users to perform business operations and execute business operations based on the detection results.

[0003] Generally, in the process of anomaly detection for user accounts, it is usually necessary to determine the historical behavior sequence corresponding to the account and input this historical behavior sequence into the anomaly detection model to obtain the anomaly detection result output by the model. This anomaly detection result is used to characterize whether the account exhibits any anomalies.

[0004] Based on this, this application provides a training method for an anomaly detection model. Summary of the Invention

[0005] This application provides a training method, apparatus, device, and storage medium for an anomaly detection model, in order to partially solve the aforementioned problems existing in the prior art.

[0006] The technical solution adopted in this application is as follows:

[0007] This application provides a method for training an anomaly detection model, the method comprising:

[0008] Obtain the historical behavior sequences corresponding to several sample accounts, and combine the historical behavior sequences to determine each training sample group;

[0009] For each training sample group, the label of the training sample group is determined based on the first correlation between the anomaly handling strategies performed on each sample account corresponding to the training sample group in history. The label is used to characterize the similarity between each sample account corresponding to the training sample group.

[0010] The training sample group is input into the anomaly detection model to be trained, and the anomaly detection results corresponding to each sample account of the training sample group are output by the anomaly detection model.

[0011] The anomaly detection model is trained based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group, and the annotation of the training sample group.

[0012] This application provides a training apparatus for an anomaly detection model, the apparatus comprising:

[0013] The acquisition module is used to acquire the historical behavior sequences corresponding to several sample accounts, and combine the historical behavior sequences to determine the training sample groups.

[0014] The first determining module is used to determine the label of each training sample group based on the first correlation between the anomaly handling strategies historically executed on each sample account corresponding to the training sample group, wherein the label is used to characterize the similarity between each sample account corresponding to the training sample group.

[0015] The second determining module is used to input the training sample group into the anomaly detection model to be trained, and to obtain the anomaly detection results corresponding to each sample account of the training sample group output by the anomaly detection model.

[0016] The training module is used to train the anomaly detection model based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group and the annotation of the training sample group.

[0017] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the training method for the above-described anomaly detection model.

[0018] This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the training method of the above-mentioned anomaly detection model.

[0019] The above-mentioned technical solution adopted in this application can achieve the following beneficial effects:

[0020] A training sample group is determined, which contains historical behavior sequences corresponding to multiple sample accounts. The annotation of the training sample group is determined based on the first correlation between the anomaly handling strategies executed on each sample account in the training sample group in history. Then, the anomaly detection results corresponding to each sample account in the training sample group are obtained through the anomaly detection model to be trained. The anomaly detection model is trained based on the similarity between the anomaly detection results corresponding to each sample account and the annotation of the training sample group.

[0021] As can be seen, this application uses the first correlation between the anomaly handling strategies executed by each sample account corresponding to the training sample group to guide the training of the anomaly detection model. The trained anomaly detection model can accurately identify abnormal accounts, ensuring the accuracy of anomaly detection. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0023] Figure 1 This is a flowchart illustrating a training method for an anomaly detection model in this application;

[0024] Figure 2 This is a flowchart illustrating a training method for an anomaly detection model in this application;

[0025] Figure 3 A schematic diagram of a training device for an anomaly detection model provided in this application;

[0026] Figure 4 The corresponding to this application Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] Additionally, it should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and regulations of the locality and with authorization from the owner of the relevant device.

[0029] With the development of computer technology and people's increasing concern for their privacy, detecting anomalies in user accounts during business operations and executing business based on the detection results has become a common practice. This anomaly detection process typically involves determining the account's historical behavior sequence and inputting it into a pre-trained anomaly detection model to obtain the model's output anomaly detection result, which is then used to execute business operations.

[0030] Currently, when training anomaly detection models, training samples can only be determined based on the anomaly type corresponding to the account, and the model can be trained accordingly. For example, if a sample account is a gray account, it will be labeled as either a gray account or an anomaly account if used as a training sample. This means the trained anomaly detection model can only distinguish the anomaly type corresponding to the account. Furthermore, in general, whether it's a gray account or a black account, its corresponding historical behavior sequences are diverse. Often, several similar historical behavior sequences will correspond to gray accounts, black accounts, and normal accounts, which further reduces the accuracy of the trained anomaly detection model.

[0031] In this scenario, how to train a more accurate anomaly detection model has become one of the problems that need to be solved.

[0032] Based on this, this application provides a training method for an anomaly detection model. Instead of directly using the anomaly type corresponding to the sample account as the label for the training samples, it adopts the anomaly handling strategy corresponding to the sample account to guide the training of the anomaly detection model. This allows the trained anomaly detection model to learn the features corresponding to the sample account and the features corresponding to the anomaly handling strategy, thereby ensuring the accuracy of the trained anomaly detection model.

[0033] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0034] Figure 1 A flowchart illustrating the training method for an anomaly detection model provided in this application.

[0035] S100: Obtain the historical behavior sequences corresponding to several sample accounts, and combine each historical behavior sequence to determine each training sample group.

[0036] This application provides a method for training an anomaly detection model. The training process can be performed by an electronic device such as a server for performing anomaly detection services or a server for model training. For ease of description, the following detailed explanation focuses on the server as the execution entity.

[0037] In this embodiment, the training process of the anomaly detection model can be divided into three stages: sample determination, sample processing, and training. As mentioned earlier, this application can use anomaly handling strategies corresponding to sample accounts to guide the training of the anomaly detection model. However, because the anomaly handling strategies contain a wealth of information, with thousands of corresponding processing types, they are difficult to classify into simple types directly, and multiple anomaly handling strategies can correspond to similar semantics. Therefore, directly using anomaly handling strategies as annotations for training samples to train the anomaly detection model is not appropriate.

[0038] Based on this, this application adopts a method of determining a training sample group containing historical behavior sequences of multiple sample accounts, and using the similarity between the anomaly handling strategies of each sample account in the training sample group in history as the annotation of the training sample group, so as to determine the training sample group and its annotation. Then, the anomaly detection model can be trained based on the training sample group and its annotation.

[0039] Therefore, during the sample determination phase, the server can determine a training sample group containing the historical behavior sequences corresponding to multiple sample users.

[0040] Specifically, the server can determine a specified number of sample accounts' historical behavior sequences from pre-stored historical behavior sequences corresponding to each account, and combine them to form a training sample group. There is a one-to-one correspondence between sample accounts and historical behavior sequences; that is, for each sample account, there is its corresponding historical behavior sequence.

[0041] The sample account can be any account used by a user in the past when performing transactions. The historical behavior sequence corresponding to the sample account can be the user's actions monitored after the user initiated a specified transaction. This specified transaction can be the most recently executed transaction or a specified type of transaction such as a payment transaction. Monitored user actions can include: clicks, long presses, etc., the user's screen swipe trajectory, the user's screen tap position, etc. Of course, this historical behavior sequence can also be a vector or feature determined based on the user's actions. How this historical behavior sequence is determined and its specific form can be set as needed, and this application does not impose any restrictions on this.

[0042] S102: For each training sample group, determine the label of the training sample group based on the first correlation between the anomaly handling strategies executed on each sample account corresponding to the training sample group in history. The label is used to characterize the similarity between each sample account corresponding to the training sample group.

[0043] In one or more embodiments provided in this application, as described above, the training method for the anomaly detection model in this application employs a method of determining a training sample group containing historical behavior sequences of multiple sample accounts, and using the similarity between the anomaly handling strategies of each sample account in the training sample group historically as the labeling of the training sample group, to determine the training sample group and its labeling for training the anomaly detection model. Based on this, the server can determine the labeling of the training sample group.

[0044] Specifically, the server can determine the anomaly handling strategies historically executed for each sample account corresponding to each training sample group, as designated strategies.

[0045] Then, for each sample account, the server can determine the first correlation between the anomaly handling strategy corresponding to that sample account and the anomaly handling strategies of other sample accounts in the training sample group to which that sample account belongs. This first correlation can be determined by the similarity between the first strategy features obtained after feature extraction of the anomaly handling strategy corresponding to that sample account and the first strategy features obtained after feature extraction of the anomaly handling strategies of other sample accounts in the training sample group to which that sample account belongs. Alternatively, it can be determined directly based on common words and sentence structures between the anomaly handling strategies corresponding to that sample account and the anomaly handling strategies of other sample accounts in the training sample group to which that sample account belongs. The specific method for determining this first correlation can be set as needed, and this application does not impose any restrictions on it.

[0046] Finally, after determining the first relevance, the server can directly use the first relevance as the label for the training sample group.

[0047] Of course, since the training sample group contains multiple historical behavior sequences of sample accounts, there can be multiple first relevance values. Therefore, the server can directly use each first relevance value as the label of the training sample group, and can also determine the mean, median and other indicators of each first relevance value as the label of the training sample group.

[0048] The specific method for determining the labeling of the training sample group and the specific index type corresponding to the labeling of the training sample group based on the first relevance can be set as needed, and this application does not impose any restrictions on this.

[0049] S104: Input the training sample group into the anomaly detection model to be trained, and obtain the anomaly detection results corresponding to each sample account of the training sample group output by the anomaly detection model.

[0050] In one or more embodiments provided in this application, the training method for the anomaly detection model can process the training samples after the training samples are determined, and then train the anomaly detection model based on the processing results of the training samples.

[0051] Specifically, the server can take the historical behavior sequence corresponding to each sample account in the training sample group as input and input it into the anomaly detection model to be trained.

[0052] Therefore, the server can obtain the anomaly detection results for each sample account in the training sample group output by the anomaly detection model. These anomaly detection results can be either the anomaly type for each sample account or the anomaly handling strategy for each sample account.

[0053] S106: Train the anomaly detection model based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group and the annotation of the training sample group.

[0054] In one or more embodiments provided in this application, the server can train the anomaly detection model after processing the training samples.

[0055] Specifically, the server can determine the anomaly detection results for each sample account corresponding to each training sample group.

[0056] Then, the server can determine the similarity between the anomaly detection results of each sample account corresponding to the training sample group. Similar to the first correlation between the anomaly handling strategies implemented by each sample account, the server can also determine this similarity based on the anomaly features obtained after feature extraction from the anomaly detection results of each sample account, or directly based on whether the anomaly detection results of each sample account belong to the same anomaly type, or whether they contain the same keywords, etc. The specific method for determining the similarity between the anomaly detection results of each sample account can be set as needed, and this application does not impose any restrictions on this.

[0057] Finally, the server can determine the loss based on the determined similarity and the gap between the annotations of the training sample group, and train the anomaly detection model with the goal of minimizing the loss.

[0058] Therefore, the trained anomaly detection model can accurately detect anomalies in an account based on its historical behavior sequence.

[0059] like Figure 1The training method for the anomaly detection model described herein involves determining a training sample group comprising historical behavior sequences corresponding to multiple sample accounts. The annotation of the training sample group is determined based on the first correlation between the anomaly handling strategies historically executed on each sample account within that training sample group. Then, the anomaly detection model to be trained obtains the anomaly detection results for each sample account within the training sample group. Finally, the anomaly detection model is trained based on the similarity between the anomaly detection results for each sample account and the annotation of the training sample group. It is evident that this application uses the first correlation between the anomaly handling strategies executed on each sample account within the training sample group to guide the training of the anomaly detection model. The trained anomaly detection model can accurately identify anomalous accounts, ensuring the accuracy of anomaly detection.

[0060] Furthermore, generally speaking, the similarity between anomaly handling strategies determined directly based on keywords contained in the anomaly handling strategies is more accurate than the similarity between features obtained by feature extraction based on the anomaly handling strategies executed by the sample accounts. Therefore, in step S102, the server can also directly determine the similarity based on keywords contained in the anomaly handling strategies.

[0061] Specifically, the server can determine the anomaly handling strategies historically executed on each sample account corresponding to the training sample group, and use these strategies as the designated strategies.

[0062] Then, the server can perform word segmentation on the specified strategy and determine the word segmentation results corresponding to the specified strategy. From the word segmentation results, the keywords for the specified strategy can be determined. These keywords can be determined based on at least one attribute of each word in the word segmentation results, such as part-of-speech tagging and word frequency.

[0063] Finally, the server can determine the labeling of the training sample group based on the similarity between keywords of each specified strategy.

[0064] Taking the keyword "fine" for the specified policy corresponding to account A and "account cancellation" for the specified policy corresponding to account B as an example, the similarity between the keywords of the specified policies corresponding to accounts A and B can be the similarity between "fine" and "account cancellation". This similarity can be determined by extracting features from "fine" and "account cancellation" separately, identifying the similarity between the abnormal features corresponding to "fine" and "account cancellation". Alternatively, it can be determined by judging whether "fine" and "account cancellation" are synonyms or near-synonyms based on a pre-defined dictionary.

[0065] Furthermore, the server can also use a deterministic intersection-union ratio (DIU) method to determine the labels for training sample groups.

[0066] Specifically, for each specified policy, the server can create a specified set corresponding to that specified policy and add the keywords of that specified policy to the specified set corresponding to that specified policy.

[0067] Then, the server can determine the similarity between the keywords of the specified strategy and the keywords of other specified strategies based on the intersection-union ratio of the specified set corresponding to the specified strategy and the specified set corresponding to other specified strategies.

[0068] Finally, the server can determine the label of the training sample group based on the similarity scores.

[0069] Taking the keywords "fine" and "5000 yuan" for the specified strategy corresponding to account A, and "fine" and "4500 yuan" for the specified strategy corresponding to account B as an example, the server can add the keywords of account A to the specified set corresponding to account A, and add the keywords of account B to the specified set corresponding to account B. Thus, the server can determine the intersection-union ratio (IU) of the specified sets for account A and account B, which serves as the annotation for the training sample group containing the historical behavior sequences of account A and account B. The IU of the specified sets can be determined based on whether the two specified sets contain synonyms or near-synonyms, and the proportion of the number of synonyms or near-synonyms in the total number of words in the specified sets.

[0070] Furthermore, in this application, the server can not only determine the type of anomaly of the account, but also determine the anomaly handling strategy for the account, as a result of the detection.

[0071] Specifically, the server can take the historical behavior sequence of each sample account corresponding to the training sample group as input and input it into the feature extraction layer of the anomaly detection model to obtain the sample features corresponding to the sample account output by the feature extraction layer.

[0072] Secondly, the server can input the sample features into the matching layer to obtain the first policy features predicted by the matching layer based on the sample features. Specifically, the matching layer is used to predict the policy features corresponding to the exception handling policy to be executed for the account corresponding to the behavior sequence based on the behavioral features corresponding to the behavior sequence.

[0073] Then, the server can input the sample features into the detection layer of the anomaly detection model to obtain the initial detection result output by the detection layer. This initial detection result may contain only the anomaly type corresponding to the sample account, and may also include at least a portion of the anomaly handling strategy corresponding to the sample account.

[0074] Finally, the server can determine the detection result of the sample account based on the initial detection result and the first strategy feature. The detection result includes the anomaly type of the sample account and the estimated anomaly handling strategy that should be implemented for the sample account. In other words, the server can predict the anomaly handling strategy that should be implemented for the sample account based on the first strategy feature, and combine this anomaly handling strategy with the initial detection result of the sample account, using the combined result as the anomaly handling strategy for the sample account.

[0075] Furthermore, in this application, the server can determine not only the anomaly type of the account but also the anomaly handling strategy of the account, as a detection result. Therefore, when determining the loss of the anomaly detection model, the server can also determine the loss for each sample account by using the difference between the anomaly detection result of the sample account and the anomaly handling strategy corresponding to the sample account, as well as the difference between the similarity of the anomaly detection results of each sample account in the training sample group and the labeling of the training sample group. However, since the anomaly handling strategies of each sample account are difficult to directly use as labels for training samples, the server can train the model by determining the similarity between the behavioral features corresponding to the historical behavioral sequences of the sample account and the strategy features corresponding to the anomaly handling strategy of the sample account.

[0076] Specifically, for each sample account corresponding to the training sample group, the server can input the anomaly handling strategy historically executed on that sample account into the feature extraction layer of the anomaly detection model to obtain the second strategy feature output by the feature extraction layer.

[0077] Secondly, the server can determine the first gap based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group, as well as the annotation of the training sample group.

[0078] Then, the server can determine the second gap based on the gap between the first strategy feature and the second strategy feature corresponding to each sample account.

[0079] Finally, the server can determine the loss based on the first gap and the second gap, and train the anomaly detection model with the goal of minimizing the loss.

[0080] Furthermore, when the matching layer determines the first strategy feature based on the sample features, it can use methods such as convolution and feature extraction on the sample features, or it can use a transformation matrix with adjustable parameters. Taking the method of setting an adjustable transformation matrix as an example, the server can input the sample features into the matching layer, and determine the first strategy feature corresponding to the sample features through the pre-set transformation matrix in the matching layer. Then, when training the anomaly detection model, the server can adjust the parameters of the transformation matrix in the matching layer of the anomaly detection model to train the anomaly detection model.

[0081] Furthermore, the trained anomaly detection model can be used to detect anomalies in target accounts.

[0082] Specifically, the server can receive anomaly detection requests, which can be sent by the server executing the business or by the user's client when it detects that a business needs to be executed.

[0083] The server can determine the target account corresponding to the anomaly detection request based on the anomaly detection request.

[0084] Next, the server can determine the target behavior sequence of the target account based on the account identifier of the target account, and input the target behavior sequence into the feature extraction layer of the trained anomaly detection model to obtain the target behavior features output by the feature extraction layer.

[0085] Then, the server can input the target behavior features into the matching layer and the detection layer respectively to obtain the target policy features output by the matching layer and the initial detection results output by the detection layer. Similar to the initial detection results of the sample account mentioned above, the initial detection result corresponding to this target account can be the anomaly type corresponding to the target account, or it can be the anomaly type corresponding to the target account and at least part of the anomaly handling strategy corresponding to the target account.

[0086] Finally, the server can determine the target detection result for the target account based on the initial detection result and the target policy characteristics. Similarly, the server can predict the anomaly handling policy that the target account should execute based on the determined target policy characteristics, and combine the anomaly handling policy with the initial detection result of the target account, using the combined result as the anomaly handling policy for the target account.

[0087] Based on the same idea, this application provides a flowchart illustrating a training method for an anomaly detection model, as shown below. Figure 2 As shown.

[0088] Figure 2This is a flowchart illustrating the training method for the anomaly detection model provided in this application. The anomaly detection model includes a feature extraction layer, a matching layer, and a detection layer. Taking an anomaly detection model containing historical behavior sequences corresponding to two sample accounts as an example, the server can input the historical behavior sequences of sample account 1 and sample account 2 into the feature extraction layer respectively, obtaining sample feature 1 and sample feature 2 output by the feature extraction layer.

[0089] Then, the server can use sample feature 1 and sample feature 2 as inputs to the matching layer to obtain the first strategy feature 1 and the first strategy feature 2 output by the matching layer, and input the obtained first strategy feature 1 and the first strategy feature 2 into the detection layer to obtain the initial detection result 1 and the initial detection result 2 output by the detection layer.

[0090] Next, the server can determine the abnormal detection result 1 of sample account 1 based on the first strategy feature 1 and the initial detection result 1, and determine the abnormal detection result 2 of sample account 2 based on the first strategy feature 2 and the initial detection result 2.

[0091] Meanwhile, the server can take the anomaly handling strategy executed by sample account 1 and the anomaly handling strategy executed by sample account 2 as inputs and input them into the pre-trained feature extraction layer to obtain the second strategy feature 1 and the second strategy feature 2.

[0092] Finally, the server determines a first similarity based on the similarity between anomaly detection result 1 and anomaly detection result 2, and determines a first gap based on the difference between the first similarity and the annotation of the training sample group. It also determines a second gap 1 based on first policy feature 1 and second policy feature 1, and a second gap 2 based on first policy feature 2 and second policy feature 2. Therefore, the server can determine the loss based on the determined first gap and each of the second gaps, and train the anomaly detection model with the loss minimization as the optimization objective. The annotation of the training sample group is determined based on the similarity between the anomaly handling policy applied to sample account 1 and the anomaly handling policy applied to sample account 2.

[0093] Figure 3 A schematic diagram of a training device for an anomaly detection model provided in this application, wherein:

[0094] The acquisition module 200 is used to acquire the historical behavior sequences corresponding to several sample accounts, and combine the historical behavior sequences to determine each training sample group.

[0095] The first determining module 202 is used to determine the label of each training sample group based on the first correlation between the anomaly handling strategies historically executed on each sample account corresponding to the training sample group. The label is used to characterize the similarity between each sample account corresponding to the training sample group.

[0096] The second determining module 204 is used to input the training sample group into the anomaly detection model to be trained, and obtain the anomaly detection results corresponding to each sample account of the training sample group output by the anomaly detection model.

[0097] The training module 206 is used to train the anomaly detection model based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group and the annotation of the training sample group.

[0098] Optionally, the first determining module 202 is used to determine the anomaly handling strategies that were historically executed on each sample account corresponding to the training sample group, as each designated strategy, to perform word segmentation on each designated strategy, and to determine the keywords corresponding to each designated strategy from the word segmentation results, and to determine the labeling of the training sample group based on the similarity between the keywords of each designated strategy.

[0099] Optionally, the first determining module 202 is configured to, for each specified strategy, add the keywords of the specified strategy to the specified set corresponding to the specified strategy, determine the similarity between the keywords of the specified strategy and the keywords of other specified strategies based on the intersection-union ratio of the specified set corresponding to the specified strategy and the specified set corresponding to other specified strategies, and determine the label of the training sample group based on each similarity.

[0100] Optionally, the second determining module 204 is configured to, for each sample account corresponding to the training sample group, input the historical behavior sequence of the sample account into the feature extraction layer of the anomaly detection model to obtain the sample features output by the feature extraction layer, input the sample features into the matching layer of the anomaly detection model to obtain the first strategy features estimated by the matching layer based on the sample features, input the sample features into the detection layer of the anomaly detection model to obtain the initial detection result output by the detection layer, and determine the anomaly detection result of the sample account based on the initial detection result and the first strategy features.

[0101] Optionally, the second determining module 204 is configured to, for each sample account corresponding to the training sample group, input the anomaly handling strategy historically executed on that sample account into the feature extraction layer of the anomaly detection model to obtain the second strategy feature output by the feature extraction layer, determine the similarity between the anomaly detection results of each sample account corresponding to the training sample group as a first similarity, determine the difference between the first similarity and the label of the training sample group as a first gap, determine a second gap based on the difference between the first strategy feature and the second strategy feature corresponding to each sample account, determine the loss based on the first gap and the second gap, and train the anomaly detection model with the minimization of the loss as the optimization objective.

[0102] Optionally, the second determining module 204 is used to input the sample features into the matching layer and determine the first strategy features corresponding to the sample features through a pre-set transformation matrix in the matching layer. The training module 206 is used to adjust at least the parameters of the transformation matrix in the matching layer of the anomaly detection model in order to train the anomaly detection model.

[0103] Optionally, the second determining module 204 is configured to, in response to an anomaly detection request, determine the target account carried in the anomaly detection request, determine the target behavior sequence corresponding to the target account, input the target behavior sequence into the feature extraction layer of the trained anomaly detection model to obtain the target behavior features output by the feature extraction layer, input the target behavior features into the matching layer to obtain the target policy features output by the matching layer, input the target behavior features into the detection layer to obtain the initial detection result output by the detection layer, and determine the target detection result of the target account based on the initial detection result and the target policy features.

[0104] This application also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The training method for the anomaly detection model is shown.

[0105] This application also provides Figure 4 The diagram shows a schematic structural representation of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1The training method for the anomaly detection model is shown. Of course, in addition to software implementation, this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0106] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0107] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0108] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0109] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0110] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0112] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0113] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0114] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0115] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0116] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0117] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0118] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0120] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0121] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A training method for an anomaly detection model, the method comprising: Obtain the historical behavior sequences corresponding to several sample accounts, and combine the historical behavior sequences to determine each training sample group; For each training sample group, the annotation of the training sample group is determined based on the first correlation between the anomaly handling strategies historically executed on each sample account corresponding to that training sample group, including: For each training sample group, determine the anomaly handling strategies historically executed for each sample account corresponding to that training sample group, and use them as designated strategies. Each specified strategy is segmented into words, and the keywords corresponding to each specified strategy are determined from the segmentation results. For each sample account, determine the similarity between the keywords of the specified strategy corresponding to that sample account and the keywords of the specified strategies of other sample accounts in the training sample group to which that sample account belongs; For each training sample group, the label of the training sample group is determined based on the similarity corresponding to each sample account in each training sample group; The annotation is used to characterize the similarity between the sample accounts corresponding to the training sample group. The annotation is each first relevance corresponding to the training sample group or the mean or median index calculated from each first relevance. The training sample group is input into the anomaly detection model to be trained, and the anomaly detection results corresponding to each sample account of the training sample group are obtained by the anomaly detection model. The anomaly detection result corresponding to each sample account is generated by the anomaly detection model by processing the historical behavior sequence corresponding to the sample account. The anomaly detection model is trained based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group, and the annotation of the training sample group.

2. The method as described in claim 1, wherein the labeling of the training sample group is determined based on the similarity corresponding to each sample account in each training sample group, specifically including: For each specified strategy, add the keyword of that specified strategy to the specified set corresponding to that specified strategy; Based on the intersection-union ratio (IUU) of the specified set corresponding to the specified strategy and the specified set corresponding to other specified strategies, the similarity between the keywords of the specified strategy and the keywords of other specified strategies is determined, and the annotation of the training sample group is determined based on each similarity.

3. The method as described in claim 1, wherein the training sample group is input into the anomaly detection model to be trained, and the anomaly detection results corresponding to each sample account of the training sample group are output by the anomaly detection model, specifically including: For each sample account corresponding to the training sample group, the historical behavior sequence of the sample account is input into the feature extraction layer of the anomaly detection model to obtain the sample features output by the feature extraction layer; The sample features are input into the matching layer of the anomaly detection model to obtain the first strategy features predicted by the matching layer based on the sample features; The sample features are input into the detection layer of the anomaly detection model to obtain the initial detection result output by the detection layer; Based on the initial detection results and the first strategy features, the anomaly detection result of the sample account is determined.

4. The method as described in claim 3, wherein the anomaly detection model is trained based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group and the annotation of the training sample group, specifically including: For each sample account corresponding to the training sample group, the anomaly handling strategy historically executed on the sample account is input into the feature extraction layer of the anomaly detection model to obtain the second strategy feature output by the feature extraction layer; Determine the similarity between the anomaly detection results of each sample account corresponding to the training sample group as the first similarity, and determine the difference between the first similarity and the annotation of the training sample group as the first difference; The second gap is determined based on the gap between the first and second strategy features corresponding to each sample account. Based on the first gap and the second gap, the loss is determined, and the anomaly detection model is trained with the goal of minimizing the loss.

5. The method as described in claim 3, wherein the sample features are input into the matching layer of the anomaly detection model to obtain the first strategy features predicted by the matching layer based on the sample features, specifically includes: The sample features are input into the matching layer, and the first strategy features corresponding to the sample features are determined by a pre-set transformation matrix in the matching layer. Training the anomaly detection model specifically includes: At least the parameters of the transformation matrix in the matching layer of the anomaly detection model are adjusted to train the anomaly detection model.

6. The method of claim 3, further comprising: In response to an anomaly detection request, determine the target account carried in the anomaly detection request; Determine the target behavior sequence corresponding to the target account, and input the target behavior sequence into the feature extraction layer of the trained anomaly detection model to obtain the target behavior features output by the feature extraction layer; The target behavior features are input into the matching layer to obtain the target policy features output by the matching layer; The target behavior features are input into the detection layer to obtain the initial detection result output by the detection layer; Based on the initial detection results and the target strategy features, the target detection result of the target account is determined.

7. A training apparatus for an anomaly detection model, the apparatus comprising: The acquisition module is used to acquire the historical behavior sequences corresponding to several sample accounts, and combine the historical behavior sequences to determine the training sample groups. The first determining module is used to determine the label of each training sample group based on a first correlation between the anomaly handling strategies historically executed on each sample account corresponding to that training sample group; the first determining module is specifically used for: For each training sample group, determine the anomaly handling strategies historically executed for each sample account corresponding to that training sample group, and use them as designated strategies. Each specified strategy is segmented into words, and the keywords corresponding to each specified strategy are determined from the segmentation results. For each sample account, determine the similarity between the keywords of the specified strategy corresponding to that sample account and the specified strategies of other sample accounts in the training sample group to which that sample account belongs; For each training sample group, the label of the training sample group is determined based on the similarity corresponding to each sample account in each training sample group; The annotation is used to characterize the similarity between the sample accounts corresponding to the training sample group. The annotation is each first relevance corresponding to the training sample group or the mean or median index calculated from each first relevance. The second determining module is used to input the training sample group into the anomaly detection model to be trained, and to obtain the anomaly detection results corresponding to each sample account of the training sample group output by the anomaly detection model. The anomaly detection result for each sample account is generated by the anomaly detection model processing the historical behavior sequence corresponding to that sample account. The training module is used to train the anomaly detection model based on the similarity between the anomaly detection results of each sample account corresponding to the training sample group and the annotation of the training sample group.

8. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images