Data processing method and device, equipment, storage medium and computer program product

Abstract

The application discloses a data processing method, device and equipment, a storage medium and a computer program product, and can be applied to abnormal operation identification in the fields or scenes of artificial intelligence, cloud technology, block chain, wisdom platform, application software and the like. The method comprises the following steps: acquiring basic portrait features and business features of a to-be-identified object, wherein the to-be-identified object is associated with a target application, and the business features are determined based on interaction data of the to-be-identified object for the target application; performing fusion processing on the basic portrait features and the business features to obtain fusion features; inputting the fusion features into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the to-be-identified object on the target application; and wherein the target abnormal operation identification model is obtained by training in combination with a pseudo-label technology. By using the application, the identification accuracy of abnormal operation can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a data processing method, a data processing device, a data processing equipment, a computer readable storage medium and a computer program product. BACKGROUND

[0002] With the development of computer, electronic, communication and other technologies, intelligent terminals (such as mobile phones, computers, etc.) have been widely used in people's daily life. In order to meet the needs of people for the functional diversity of intelligent terminals, various applications (Application, APP) have emerged. Various applications have brought convenience to people and enriched people's experience. However, some users may use applications to perform abnormal operations, such as malicious requests, single brushing and the like. Abnormal operations may increase the load of the application server, which is not conducive to the operation of the application server; and may also produce false operation data, which is not conducive to the analysis of the business involved in the application. Therefore, it is necessary to identify whether there is an abnormal operation. SUMMARY

[0003] The present application provides a data processing method, device, equipment, storage medium and computer program product, which can improve the identification accuracy of abnormal operations.

[0004] In one aspect, the present application provides a data processing method, comprising:

[0005] obtaining a basic portrait feature and a business feature of a to-be-identified object, the to-be-identified object being associated with a target application, the business feature being determined based on interaction data of the to-be-identified object for the target application;

[0006] fusing the basic portrait feature and the business feature to obtain a fused feature;

[0007] inputting the fused feature into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the to-be-identified object for the target application;

[0008] The target abnormal operation recognition model is trained based on a first training sample set and a second training sample set. The first training sample set includes first sample data with labeled labels and second sample data without labeled labels. The second training sample set is constructed based on the first sample data and the second sample data with determined pseudo labels. The pseudo labels are prediction labels obtained by processing the second sample data by using an initially trained abnormal operation recognition model. The initially trained abnormal operation recognition model is obtained by training an initial abnormal operation recognition model by using the first sample data. The target abnormal operation recognition model is obtained by training the initially trained abnormal operation recognition model by using the second training sample set. The sample data includes feature data of an associated object of the target application, and the label of the sample data is used to indicate whether the associated object has an abnormal operation.

[0009] In one aspect, the present application provides a data processing apparatus, comprising:

[0010] An acquisition unit is configured to acquire a basic portrait feature and a business feature of a to-be-identified object. The to-be-identified object is associated with a target application. The business feature is determined based on interaction data generated by the to-be-identified object for the target application.

[0011] A processing unit is configured to perform fusion processing on the basic portrait feature and the business feature to obtain a fusion feature.

[0012] The processing unit is further configured to input the fusion feature into a target abnormal operation recognition model for processing to obtain an abnormal operation recognition result of the to-be-identified object for the target application.

[0013] The target abnormal operation recognition model is trained based on a first training sample set and a second training sample set. The first training sample set includes first sample data with labeled labels and second sample data without labeled labels. The second training sample set is constructed based on the first sample data and the second sample data with determined pseudo labels. The pseudo labels are prediction labels obtained by processing the second sample data by using an initially trained abnormal operation recognition model. The initially trained abnormal operation recognition model is obtained by training an initial abnormal operation recognition model by using the first sample data. The target abnormal operation recognition model is obtained by training the initially trained abnormal operation recognition model by using the second training sample set. The sample data includes feature data of an associated object of the target application, and the label of the sample data is used to indicate whether the associated object has an abnormal operation.

[0014] In one implementation, the target abnormal operation recognition model includes a feature extraction module, and a mutual covariance aggregation module and a second-order representation aggregation module connected in parallel. The inputs of the mutual covariance aggregation module and the second-order representation aggregation module are connected with the output of the feature extraction module.

[0015] In an implementation manner, the processing unit is further configured to: input the fused feature into the feature extraction module for processing to obtain intermediate features; input the intermediate features into the cross-covariance aggregation module for processing to obtain cross-covariance features, and input the intermediate features into the second-order representation aggregation module for processing to obtain second-order aggregated features; perform splicing processing on the cross-covariance features and the second-order aggregated features to obtain spliced features; and determine the abnormal operation recognition result of the target application of the to-be-identified object based on the spliced features.

[0016] In an implementation manner, the obtaining unit is further configured to obtain a basic portrait of the to-be-identified object, the basic portrait comprising one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on relevant data generated in a process of operating the target application by the to-be-identified object in a first time period; and the processing unit is further configured to determine a basic portrait feature of the to-be-identified object according to the basic portrait.

[0017] In an implementation manner, the obtaining unit is further configured to obtain interaction data generated in a process of operating the target application by the to-be-identified object in a second time period, the interaction data comprising one or more of login operation related information, click information and conversion information for specific services, application traffic information, and triggering information of specific functions; and the processing unit is further configured to determine a service feature of the to-be-identified object according to the interaction data.

[0018] In an implementation manner, the processing unit is further configured to: perform normalization processing on numerical features in the basic portrait feature, and perform discretization processing on non-numerical features in the basic portrait feature to obtain processed basic portrait features; perform normalization processing on numerical features in the service feature, and perform discretization processing on non-numerical features in the service feature to obtain processed service features; and perform fusion processing on the processed basic portrait features and the processed service features to obtain the fused feature.

[0019] In an implementation manner, the processing unit is further configured to: input the intermediate features into the cross-covariance aggregation module for processing to determine normalized features of the intermediate features; calculate the outer product of the intermediate features and the normalized features; and perform vectorization processing on the outer product of the intermediate features and the normalized features to obtain the cross-covariance features.

[0020] In an implementation manner, the processing unit is further configured to: input the intermediate features into the second-order representation aggregation module for processing to determine a feature matrix of the intermediate features; determine a second-order aggregation matrix based on the feature matrix and a transpose matrix of the feature matrix; calculate a matrix square root of the second-order aggregation matrix, and perform vectorization processing on the matrix square root to obtain the second-order aggregated features.

[0021] In an aspect, the present application provides a data processing device, comprising a processor adapted to implement one or more computer programs; and a computer storage medium storing one or more computer programs, which are loaded by the processor and implement the data processing method provided by the present application.

[0022] In an aspect, the present application provides a computer readable storage medium storing a computer program, the computer program comprising program instructions which, when executed by a processor, cause the processor to implement the data processing method provided by the present application.

[0023] In an aspect, the present application provides a computer program product comprising computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device implements the data processing method provided by the present application.

[0024] The abnormal operation identification model in the present application is trained in combination with the pseudo-label technology, so that when the number of sample data with labeled labels is insufficient to train the abnormal operation identification model, the pseudo-label of sample data without labeled labels is determined to increase the number of sample data with labels, so as to train the abnormal operation identification model well and improve the identification accuracy of the trained abnormal operation identification model. In the abnormal operation identification, the basic portrait feature and the business feature of the to-be-identified object associated with the target application are obtained, the basic portrait feature and the business feature are fused to obtain a fusion feature, and then the fusion feature is input into the abnormal operation identification model trained in combination with the pseudo-label technology for processing, so that the identification result of the to-be-identified object about the abnormal operation of the target application can be obtained accurately, and the above-mentioned method can realize automatic identification of abnormal operation and has higher identification efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0026] Figure 1 An abnormal operation identification scene schematic diagram provided for an embodiment of the present application;

[0027] Figure 2 A structure schematic diagram of a data processing system provided for an embodiment of the present application;

[0028] Figure 3 A flowchart of a data processing method provided for an embodiment of the present application is shown in FIG. 1.

[0029] Figure 4 An aggregation calculation diagram provided for an embodiment of the present application is shown in FIG. 2.

[0030] Figure 5 A structure diagram of a target abnormal operation identification model provided for an embodiment of the present application is shown in FIG. 3.

[0031] Figure 6 An abnormal operation identification result diagram provided for an embodiment of the present application is shown in FIG. 4.

[0032] Figure 7 A structure diagram of an abnormal operation identification model training method provided for an embodiment of the present application is shown in FIG. 5.

[0033] Figure 8 A flowchart of an abnormal operation identification model training method provided for an embodiment of the present application is shown in FIG. 6.

[0034] Figure 9a A residual network structure diagram provided for an embodiment of the present application is shown in FIG. 7.

[0035] Figure 9b A maximum pooling implementation process diagram provided for an embodiment of the present application is shown in FIG. 8.

[0036] Figure 9c A structure diagram of a domain discriminator provided for an embodiment of the present application is shown in FIG. 9.

[0037] Figure 10 A structure diagram of a data processing apparatus provided for an embodiment of the present application is shown in FIG. 10.

[0038] Figure 11 A structure diagram of a data processing device provided for an embodiment of the present application is shown in FIG. 11. DETAILED DESCRIPTION

[0039] The technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0040] In order to facilitate understanding, the terms involved in the present application are first described.

[0041] 1. Machine learning

[0042] A branch of Artificial Intelligence (AI) technology. Machine learning studies how computers simulate or implement human learning behavior to acquire new knowledge or skills, reorganize existing knowledge structure, and continuously improve their performance. It is the core of artificial intelligence and the fundamental approach to making computers intelligent. Deep learning (DL) is a new research direction in the field of machine learning. Deep learning is the learning of the internal laws and representation levels of sample data. The information obtained in this learning process is very helpful for the interpretation of data such as text, images, and sound. The ultimate goal of deep learning is to enable machines to have analytical learning ability like humans, and to recognize text, images, and sound data.

[0043] 2. Cloud technology / blockchain

[0044] Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or local area network to realize data calculation, storage, processing, and sharing. Blockchain is a new application mode of distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm, which is essentially a decentralized database and a series of data blocks associated using cryptography. Each data block contains information about a batch of network transactions, which is used to verify the validity (anti-fake) of the information and generate the next block.

[0045] 3. Convolutional Neural Networks (CNN)

[0046] CNN is a type of feedforward neural network that contains convolutional computation and has a deep structure, and is one of the representative algorithms of deep learning. Convolutional neural networks have representation learning capabilities and can perform shift-invariant classification on input information according to their hierarchical structure.

[0047] 4. Generative Adversarial Network (GAN)

[0048] GAN includes two models, one is a generative model, and the other is a discriminative model. The task of the generative model is to generate natural and real-looking instances similar to the original data. The task of the discriminative model is to determine whether a given instance looks natural and real or artificially fabricated (real instances come from the data set, and fake instances come from the generative model). GAN can effectively learn domain-invariant features.

[0049] 5, second-order representation

[0050] Since the ultimate goal of deep convolutional neural networks is to characterize complex classification boundaries in high-dimensional space, it is essential to enhance the network's ability to model nonlinearity by learning high-order representations. Similar to global mean pooling, global second-order pooling is embedded at the end of the network, which takes the covariance of the sample as the sample representation, and currently achieves leading performance in various business tasks such as image classification, fine-grained recognition and target detection.

[0051] 6, pseudo-label technology

[0052] The definition of pseudo-label technology comes from semi-supervised learning. The core is to use the model trained by the labeled data to predict the unlabeled data, filter the samples according to the prediction results, and then input them into the model again for training.

[0053] Abnormal operation refers to the abnormal behavior of the operation object when using the related application. These abnormal behaviors not only affect the operation of the related application, but also affect the service experience of other normal operation objects. For example, Figure 1 An abnormal operation identification scene provided by an embodiment of the present application is shown in FIG. 1, Figure 1 As shown in the figure, it is a use scenario of requesting to join an online conference. After the user enters the online conference APP, the user can input the login account, login password, conference number and entry password according to the "input box 1", "input box 2", "input box 3" and "input box 4" in the figure, and can also check the "open speaker", "open microphone", "open camera" and "open beauty" options in the APP page to set the entry. The user can click the "join the conference" icon to request to join the conference. If the target object continuously inputs the wrong conference number, continuously fails to log in, switches the login device or login address multiple times in a short period of time (such as 30 minutes), etc., it may be determined as an online conference black production malicious request behavior. For example, Figure 1As shown, if the user inputs the wrong password for joining the meeting for many times (such as 5 times), the abnormal behavior recognition can be performed to determine that the user has abnormal operation. For example, a certain account has the behavior of sending a large number of illegal messages (such as malicious advertisements, false information, etc.), adding a large number of friends, abnormal purchase behavior, etc., indicating that the account may have the risk of being stolen.

[0054] In the research of abnormal operation recognition, the following optimization schemes are proposed:

[0055] Scheme 1: According to the business experience of relevant staff, the rules for manually recognizing abnormal operation are summarized, and the abnormal operation is manually recognized.

[0056] Scheme 2: Based on the non-deep learning data mining method, a multi-dimensional feature is constructed for model training, and a normal operation recognition model is trained to predict the probability of abnormal operation.

[0057] From the above method, according to scheme 1, the number of rules determined based on the experience of staff is limited, and it is difficult to capture the high-dimensional feature information of the interaction between rules, and it is also difficult to determine the optimal parameters of each rule. For example, feature A is "male" and feature B is "20 to 25 years old", but it is difficult to determine the "young male" feature according to features A and B, thereby affecting the accuracy of the recognition result. According to scheme 2, abnormal operation can be recognized to a certain extent, but in some specific application scenarios, such as online meeting malicious request recognition scenarios, due to the complex behavior characteristics in this scenario, it is difficult to construct the feature information required for explicit expression of data representation by using traditional feature representation methods and non-deep learning models, so that the recognition result of abnormal operation is insufficient.

[0058] Based on the above analysis, the present application proposes a data processing method, which obtains the basic information of the to-be-identified object and the related information about the target application, processes the related information to obtain the basic portrait features and business features of the to-be-identified object, wherein the to-be-identified object is associated with the target application, and the business features are determined based on the interaction data generated by the to-be-identified object for the target application; the basic portrait features and the business features are fused and processed to obtain fused features that can improve the feature information expression effect; the fused features are input into the target abnormal operation recognition model for processing to obtain the abnormal operation recognition result of the to-be-identified object about the target application. The target abnormal operation model is a model constructed based on deep learning, convolutional neural network and the like, and is trained according to the first training sample set and the second training sample set. The first training sample set includes first sample data with labeled labels and second sample data without labeled labels. The second training sample set is constructed based on the first sample data and the second sample data with determined pseudo labels. The pseudo label is a predicted label obtained by processing the second sample data using the initial trained abnormal operation recognition model.

[0059] The above data processing method can be applied to a data processing system as shown in Figure 2 The data processing system as shown in Figure 1 includes one or more terminals 210 and one or more servers 220. The terminals 210 and the servers 220 are connected through a limited network or an unlimited network to establish a communication connection and exchange data.

[0060] The terminal 210 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle terminal, a smart home appliance, a smart voice interaction device, etc.

[0061] The terminal 210 can be used to install and run the target application to provide an operation environment for the to-be-identified object. The terminal 210 can store the basic portrait of one or more to-be-identified objects, such as object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, etc. The terminal 210 can also store the interaction data generated by the to-be-identified object during the operation of the target application in one or more time periods, such as login operation related information, click information and conversion information for specific business, application traffic information, etc. The terminal 210 can send the above basic portrait and interaction data to the server 220 through the network.

[0062] The server 220 can be a stand-alone physical server, a server cluster composed of multiple physical servers, or a distributed system, and can also be a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and basic cloud computing services such as big data and artificial intelligence platforms.

[0063] The server 220 can be configured to receive and store the basic portrait and interaction data of one or more to-be-identified objects sent by the terminal 210, and process the basic portrait and interaction data respectively to obtain the basic portrait features and service features. The server 220 can also be configured to obtain and store the basic portrait features and service features, fuse the basic portrait features and service features to obtain fused features, and input the fused features into a target abnormal operation recognition model for processing to obtain an abnormal operation recognition result of the to-be-identified object on the target application.

[0064] The data processing method provided by the embodiments of the present application is briefly introduced above, and the specific implementation manner of the data processing method is described in detail below.

[0065] It can be understood that in the specific embodiments of the present application, the data related to the basic portrait and interaction data of the to-be-identified object is involved. When the above embodiments of the present application are applied to specific products or technologies, the permission or consent of the relevant object is required for the relevant data, and the collection, use, and processing of the relevant data need to comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0066] Please refer to Figure 3 , Figure 3 A flowchart of a data processing method provided by an embodiment of the present application is shown in FIG. 1. The method is applied to a data processing device, which is a terminal or a server. As shown in FIG. 1, the data processing method includes but is not limited to the following steps: Figure 3

[0067] S301: Obtain the basic portrait features and service features of a to-be-identified object, the to-be-identified object being associated with a target application, and the service features being determined based on interaction data generated by the to-be-identified object for the target application.

[0068] The to-be-identified object can be an operation object of the target application. The target application can be any application in the terminal, such as a mobile phone browser, a computer online meeting application, or a small program. The basic portrait features of the to-be-identified object are used to represent the related basic information of the to-be-identified object, including object basic attributes (gender, age, etc.), device basic attributes (mobile phone brand, computer model, etc.), and geographic location attributes. The service features are determined based on the interaction data generated by the to-be-identified object when using the target application. ​

[0069] In an implementation manner, the method for obtaining the basic portrait feature of the to-be-identified object can be: obtaining a basic portrait of the to-be-identified object, the basic portrait including one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on relevant data generated in a process of operating a target application by the to-be-identified object in a first time period; and determining the basic portrait feature of the to-be-identified object according to the basic portrait.

[0070] For example, if the device basic attributes of the to-be-identified object appear different computer models or mobile phone brands multiple times in the first time period (such as one day), it indicates that the to-be-identified object frequently changes devices to use the target application in the time period, and there may be abnormal operation conditions, such as multiple people sharing the same account to do single brushing. For another example, the device basic attributes of the to-be-identified object frequently change login addresses (such as login addresses being A, B, and C places with remote geographic locations) in the first time period (such as 12 hours), which indicates that the to-be-processed object may have abnormal operation conditions, such as changing the geographic location by technical means to achieve the purpose of illegal operation.

[0071] In an implementation manner, the method for obtaining the business feature of the to-be-identified object can be: obtaining interaction data generated in a process of operating a target application by the to-be-identified object in a second time period, the interaction data including one or more of login operation related information, click information and conversion information for a specific business, application traffic information, and triggering information of a specific function; and determining the business feature of the to-be-identified object according to the interaction data. The business feature includes a click rate and a conversion rate for a specific business determined based on the click information and the conversion information for the specific business.

[0072] For example, the specific business can be an advertising business in the target application, and a merchant can place an advertisement in the target application to improve the popularity and promote products. The effect of the merchant placing a recommended advertisement is mainly measured by a click rate (CTR) and a conversion rate (CVR). The click rate refers to the ratio of the number of times of clicking the recommended advertisement to the number of times of displaying the recommended advertisement when browsing the recommended advertisement. The conversion rate refers to the ratio of generating a transaction record when entering the merchant's store. The to-be-identified object can have abnormal operations such as generating false traffic by frequently clicking the advertisement, causing a false impression of a high click rate of the advertisement. False traffic not only reduces the actual conversion rate of the advertisement, infringes the interests of the advertiser, but also can harm the brand image of the advertiser. Therefore, the target abnormal operation identification model needs to be used to identify the business feature of the to-be-identified object, and corresponding measures need to be taken to maintain the interests of the merchant such as brand revenue and brand image safety.

[0073] Exemplarily, the login operation related information can be a login frequency of the to-be-identified object in the second time period, a login failure frequency, etc. If the to-be-identified object performs login in a high frequency in the first time period or the login failure frequency is greater than a threshold value, it indicates that there is a possibility of abnormal operation. The click information and the conversion information for a specific business can be a click frequency of an advertisement displayed in the target application, a purchase behavior generated after clicking the advertisement, and the like. If the to-be-identified object clicks the advertisement for hundreds of times or even thousands of times in the second time period, it indicates that the to-be-identified object has an abnormal behavior of false click on the advertisement. The application traffic information can be that the to-be-processed object sends data exceeding a threshold range in the second time period, for example, a bit of data is sent for sending a login request of an account once, and the to-be-identified object sends b bits (a and b are natural numbers, and b is much greater than a) of data. It indicates that the to-be-processed object can have an abnormal operation behavior. The triggering information of a specific function can be an abnormal operation judgment standard obtained by summarizing business experience. For example, in an application scenario of malicious request for an online meeting, the triggering information of a specific function can be that N meetings are entered in a short time (such as 1 hour) or a conference number is inputted for 5 times in succession.

[0074] S302: Perform fusion processing on the basic portrait feature and the business feature to obtain a fusion feature.

[0075] The fusion feature can improve the expression effect of the feature information, and facilitate subsequent identification of abnormal operation of the to-be-identified object by using the fusion feature.

[0076] In an implementation manner, the numerical features in the basic portrait feature can be normalized, and the non-numerical features in the basic portrait feature can be discretized to obtain a processed basic portrait feature. The numerical features in the business feature can be normalized, and the non-numerical features in the business feature can be discretized to obtain a processed business feature. The processed basic portrait feature and the processed business feature are fused to obtain the fusion feature.

[0077] Exemplarily, the numerical features can be age of the to-be-identified object, login frequency, and information such as price of a device and memory of the device. A suitable normalization method can be selected according to the distribution of the numerical features to eliminate the dimensional difference between the features. For example, for features conforming or approximately conforming to a normal distribution, Gaussian normalization processing is performed. The numerical features can be normalized in a Gaussian normalization manner.

[0078] For example, for non-numeric features, one-hot encoding can be used for discretization processing, which can solve the problem of feature data processing and also expand the features to a certain extent, thereby improving the rationality and feasibility of data processing. For example, the feature of "male" in the gender feature of the basic portrait feature is (1, 0) after one-hot encoding, and the feature of "female" is (0, 1) after one-hot encoding.

[0079] For example, for non-numeric features, count encoding can also be used for discretization processing. For example, the interaction data can also include point of information (POI) information, which represents information related to POI. POI can refer to some fixed places, such as hotels, restaurants, shopping malls, and gyms. Information related to POI includes but is not limited to the type and number of times the identified object has visited the POI, and the evaluation and consumption of the POI by the identified object. Count encoding of POI information, that is, using statistical features of categories to replace original categories. Taking the number of times the identified object arrives at a certain POI as an example of POI statistical information. Assuming that the identified object clicks "food-Chinese food-Sichuan cuisine" in the target application 3 times in the second time period (for example, 1 month), the count encoding feature is 3, and the above count encoding feature is included in the business features of the identified object. As can be seen, the larger the count encoding feature corresponding to a certain POI, the higher the interest of the identified object in the POI. At the same time, based on the count encoding feature, the use habits of the identified object for the target application, etc., it is beneficial to determine whether the identified object has abnormal operation. For example, if the count encoding feature of the identified object for the shopping page POI in the target application is very large, it means that the identified object may have abnormal operation of "brushing".

[0080] For example, for non-numeric features, consolidation encoding can also be used for discretization processing, mapping different features to the same feature. For example, multiple values under certain category variables can be summarized into the same information. The device basic information can include, but is not limited to, the system version number of the terminal device. Taking the system version number of the terminal device as an example, assuming that the terminal device is an Android system version, the Android system version includes multiple values such as "4.2", "4.4" and "5.0". Based on experience, a variable division rule is determined, which can be to summarize the three values of the Android system version as "low version Android system". For example, assuming that the system version number of the terminal device used by the target user is "4.2", the consolidation encoding feature corresponding to "system version number" is 0. The Android system version also includes multiple values such as "6.0", "7.0", "8.0", "9.0" and "10.0". Based on experience, a variable division rule is determined, which can be to summarize the five values of the Android system version as "high version Android system". For example, assuming that the system version number of the terminal device used by the target user is "9.0", the consolidation encoding feature corresponding to "system version number" is 1.

[0081] In an implementation manner, the basic portrait features and business features of different time spans can be aggregated in combination with the time dimension. For example, the aggregated portraits of the target object in the last half year, the last three months, the last month, the last week, etc. can be calculated. The aggregation calculation methods include summation, median, and standard deviation. For example, the aggregation calculation schematic diagram can be shown in FIG. 2, in which the average value of the feature points in the neighborhood is calculated, which can reduce the feature size, thereby reducing the calculation amount and the required storage space. Figure 4

[0082] In an implementation manner, after the fusion operation of the processed basic portrait features and business features is performed to obtain the fusion features, the fusion features can be stored offline in a distributed file system (Hadoop Distributed FileSystem, HDFS), which facilitates the subsequent process to quickly access the fusion features of the target object. Optionally, for each target object, the obtained fusion features can be an N x 1 numeric vector, such as (1, 0, 31, 4, 0.2, 9.3, 8.8, …, 0, 0, 1, 2, 34). Through this processing, the fusion features can more accurately and comprehensively describe the features of the target object, which is beneficial to abnormal operation recognition based on the features.

[0083] ​S303: input the fusion feature into the target abnormal operation recognition model for processing to obtain an abnormal operation recognition result of the to-be-identified object on the target application; wherein the target abnormal operation recognition model is trained based on a first training sample set and a second training sample set, the first training sample set includes first sample data with labeled labels and second sample data without labeled labels; the second training sample set is constructed based on the first sample data and the second sample data with determined pseudo labels, the pseudo labels are prediction labels obtained by processing the second sample data using an initially trained abnormal operation recognition model; the initially trained abnormal operation recognition model is trained using the first sample data on an initial abnormal operation recognition model, and the target abnormal operation recognition model is trained using the second training sample set on the initially trained abnormal operation recognition model; the sample data includes feature data of an associated object of the target application, and the label of the sample data is used to indicate whether the associated object has abnormal operation.

[0084] Optionally, the first training sample set includes one or more first sample data with labeled labels and second sample data without labeled labels. Wherein, the sample data includes fusion features obtained by fusing the basic portrait features and business features of the user object of the target application.

[0085] In an implementation manner, the target abnormal operation recognition model includes a feature extraction module, and a mutual covariance aggregation module and a second-order representation aggregation module connected in parallel; the inputs of the mutual covariance aggregation module and the second-order representation aggregation module are connected with the output of the feature extraction module. The structure diagram of the target abnormal operation recognition model can be shown as Figure 5 .

[0086] In an implementation manner, as shown in the model structure diagram Figure 5 , the fusion feature can be input into the feature extraction module for processing to obtain intermediate features; the intermediate features are input into the mutual covariance aggregation module for processing to obtain mutual covariance features, and the intermediate features are input into the second-order representation aggregation module for processing to obtain second-order aggregation features; the mutual covariance features and the second-order aggregation features are spliced to obtain spliced features; and the abnormal operation recognition result of the to-be-identified object on the target application is determined based on the spliced features.

[0087] In an implementation manner, the intermediate features can be input into the mutual covariance aggregation module for processing to determine normalized features of the intermediate features; the outer product of the intermediate features and the normalized features is calculated, and the calculation formula is as follows:

[0088]

[0089] Wherein represents the outer product calculation result, . represents an intermediate feature, ; represents an outer product operator, softmax is a normalization function, and represents that the intermediate feature is normalized to a real number between 0 and 1, and the sum of the normalized features is 1, and the sum of the probabilities is also 1; the outer product of the intermediate feature and the normalized feature is vectorized to obtain the cross-covariance feature. The cross-covariance between the normalized feature and the intermediate feature can more effectively learn the domain-invariant feature with distinguishability, which is beneficial to the identification of abnormal operations of the model on the object to be processed.

[0090] In an implementation manner, before the intermediate feature is input into the cross-covariance aggregation module for processing, the intermediate feature can be subjected to global average pooling (GAP) processing to obtain a processed intermediate feature, that is, in the above formula, Through GAP, an average value of the entire feature map of the intermediate feature can be obtained, which facilitates the second-order aggregation operation of the cross-covariance aggregation module. The traditional method is to process through a fully connected layer and then perform activation classification, while the GAP idea is to replace the fully connected layer with GAP (i.e., using the pooling layer to reduce the dimension), thereby retaining the spatial information and semantic information extracted by the previous convolutional layers and pooling layers. Therefore, the effect is also improved in actual application, and in addition, GAP removes the size limitation of the input.

[0091] In an implementation manner, the intermediate feature is input into the second-order representation aggregation module for processing to determine a feature matrix of the intermediate feature; a second-order aggregation matrix is determined based on the feature matrix and a transpose matrix of the feature matrix; a matrix square root of the second-order aggregation matrix is calculated, and the matrix square root is vectorized to obtain a second-order aggregation feature. Compared with the first-order feature, the second-order feature can capture more abundant information.

[0092] Optionally, to avoid a high dimension of the generated feature, before the intermediate feature is input into the second-order representation aggregation module, a 1x1 convolution kernel can be used to reduce the dimension of the feature channel of the intermediate feature output by the feature extraction module, which is beneficial to reducing the feature size, thereby reducing the calculation amount and the required storage space. For example, the dimension of the intermediate feature output by the feature extraction module is 2048, and the dimension is reduced to 128 by the convolution kernel.

[0093] Optionally, the second-order aggregation operation of determining the second-order aggregation matrix based on the feature matrix and the transpose matrix of the feature matrix can be represented by the following formula:

[0094]

[0095] wherein, This represents the feature matrix after the intermediate features are expanded. This represents the matrix obtained after the second-order aggregation operation. .

[0096] In one implementation, the target anomalous operation identification model further includes a concatenation module and a classification module. The input of the concatenation module is connected to the output of the cross-covariance aggregation module and the output of the second-order representation aggregation module, respectively. Specifically, the concatenation module concatenates the cross-covariance features and the second-order aggregation features to obtain concatenated features; the classification module determines the anomalous operation identification result of the target object regarding the target application based on the concatenated features.

[0097] In one implementation, the types of abnormal operations can be categorized. When the identification result of the object to be identified indicates the presence of abnormal operations, the specific category of the abnormal operation can be further determined, thereby taking corresponding measures. For example, restricting the object's access to specific functions in the target application can prevent the object from continuing to perform abnormal operations. For instance, if it is identified that the object's account has logged in from a different location, the object can be required to verify its identity (e.g., by sending a specified verification code through the contact information linked to the account). Another example is that if the object is identified as engaging in "brushing" (fake online orders), its account can be banned. Yet another example is that if the abnormal operation of the object is identified as sending multiple violations within one hour, the object's account can be temporarily banned (e.g., banned for 24 hours) or permanently banned.

[0098] For example, please refer to Figure 6 , Figure 6 This diagram illustrates an abnormal operation identification result provided in an embodiment of this application. When the target application is an online meeting, the user to be identified can sequentially enter their login account, login password, meeting ID, and meeting password through input boxes 1-4. Figure 6 As shown, if the target user has entered the wrong password multiple times, the server can input the fusion features of the target user into the target abnormal operation identification model for processing, thereby determining that the target user has an abnormal operation. A prompt box can be displayed to inform the target user that the wrong password has been entered multiple times. If the target application is still needed, the user should try to enter the online meeting again after 15 minutes.

[0099] The abnormal operation identification model in the present application is trained in combination with pseudo-label technology, so that when the number of sample data with labeled labels is insufficient to train the abnormal operation identification model, the number of sample data with labels can be increased by determining the pseudo-labels of sample data without labels, so as to train the abnormal operation identification model well and improve the identification accuracy of the trained abnormal operation identification model. When identifying abnormal operations, the basic portrait features and business features of the to-be-identified object associated with the target application are obtained, the basic portrait features and business features are fused to obtain fused features, and then the fused features are input into the abnormal operation identification model trained in combination with the pseudo-label technology for processing, so that the identification result of the to-be-identified object about the abnormal operation of the target application can be obtained accurately, and the above-mentioned method can realize automatic identification of abnormal operations and has higher identification efficiency.

[0100] The traditional solution for identifying abnormal operations usually prepares training samples according to manual labeling of relevant staff, and directly trains a model according to the identification rules determined based on business experience, which will cause two problems: first, the number of training samples labeled manually and rules determined based on manual experience is limited, a large amount of manpower is needed, and it is difficult to determine the optimal parameters of each rule and capture high-dimensional feature information of the interaction between rules; second, in some specific application scenarios, such as online meeting malicious request identification scenarios, due to the complex behavior characteristics in this scenario, it is difficult to construct the feature information required for explicit expression of data representation using traditional feature representation methods and non-deep learning models, so that the identification result of abnormal operations is insufficient.

[0101] To solve the above two problems, the present application provides a model training method based on deep learning technology. Figure 7 The structure diagram of the abnormal operation identification model training method provided by the present application is shown in Figure 7 The abnormal operation identification model includes a feature extraction module, a mutual covariance aggregation module, a second-order representation aggregation module, a splicing module and a classification module. The specific functions of each module will be explained in the following embodiments.

[0102] Please refer to Figure 8 , Figure 8 The flowchart of the abnormal operation identification model training method provided by the present application is shown in Figure 8 The abnormal operation identification model training method includes but is not limited to the following steps:

[0103] S801: Obtain a first training sample set, the first training sample set including first sample data with labeled labels and second sample data without labeled labels.

[0104] The first training sample set can be one or more, and each first training sample set includes one or more first sample data and second sample data. The specific number of data is not limited in the present application. The first sample data and the second sample data include fusion features of an associated object of a target application, and the label of the sample data is used to indicate whether the associated object has an abnormal operation. The label of the sample data can be a category label annotated by a relevant staff based on business logic, for example, the label is 1 if the associated object has an abnormal operation, and the label is 0 if the associated object does not have an abnormal operation. The fusion features are determined based on basic portrait features and business features of the associated object, wherein the business features are determined based on interaction data generated by the associated object for the target application.

[0105] Optionally, the associated object can be an object with strong correlation to the target application, which is selected from a use object of the target application based on manual annotation and business logic. According to the basic information of the associated object and the interaction data in a period of time (such as the last 3 months), the basic portrait features and the business features of the associated object can be determined. In addition, the associated object with abnormal data can be filtered based on the distribution anomaly theorem, for example, the Chauvenet criterion can be used as an abnormal value judgment standard. Assuming that a set of detection data (referring to a feature of the associated object) only contains random errors, the standard deviation is obtained by calculating and processing, and an interval is determined according to a certain probability. It is considered that the error exceeding this interval is not a random error but a gross error, and the data containing the error should be removed.

[0106] In an implementation manner, a basic portrait of the associated object corresponding to the first training sample set can be obtained, the basic portrait including one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on related data generated in a process of operating the target application by the to-be-identified object in a first time period; and a basic portrait feature of the to-be-identified object is determined according to the basic portrait.

[0107] In an implementation manner, interaction data generated in a process of operating the target application by the associated object in a second time period can be obtained, the interaction data including one or more of login operation related information, click information and conversion information for a specific business, application traffic information, and trigger information of a specific function; and a business feature of the to-be-identified object is determined according to the interaction data. The business feature includes a click rate and a conversion rate for a specific business, which are determined based on the click information and the conversion information for the specific business.

[0108] It should be noted that the specific construction manner and principle of the basic image features and the business features can refer to the above-mentioned embodiments of the data processing method, and will not be described herein again.

[0109] S802: input the first training sample set into the abnormal operation recognition model for initial training to obtain a predicted label of the second sample data.

[0110] The abnormal operation recognition model is a domain adaptation model, and the structure of the abnormal operation recognition model is based on a conditional adversarial domain adaptation network. The first sample data in the first training sample set is used as source domain data with a labeled label, and the second sample data is used as target domain data without a labeled label. The first sample data and the labeled label of the first sample data are input into the abnormal operation recognition model for training, so that the predicted label of the second sample data and the predicted probability corresponding to the predicted label of the second sample data can be obtained. The first training sample set includes positive samples and negative samples. In the present application, the sample data with the labeled label of the existing abnormal operation is used as the positive sample, and the sample data with the labeled label of the non-existing abnormal operation is used as the negative sample.

[0111] Optionally, a stochastic gradient descent (SGD) with momentum can be used as an optimizer in the abnormal operation recognition model to optimize the model training process, and the learning rate can be 0.001. The learning rate is a hyperparameter for updating the weight in the gradient descent process. The lower the learning rate, the slower the change speed of the loss function in the model training, which can ensure that any local minimum value will not be missed in the training process.

[0112] S803: obtain a second training sample set, the second training sample set including the first sample data with a labeled label and the second sample data with a determined pseudo label.

[0113] From the predicted label of the second sample data in the first training sample, the high-confidence high predicted label with a predicted probability higher than a threshold value is selected as a pseudo label according to the size of the predicted probability of each predicted label. The threshold value of the predicted probability can be set or changed according to the requirements of the business scenario. Optionally, the first training sample can be trained multiple times to obtain the predicted label of the second sample data for screening, thereby reducing the error. The second training sample set can be one or more, and the first sample data and the second sample data therein can also be one or more, which are not limited in the present application.

[0114] The pseudo-label technology can solve the problem of imbalance between positive samples and negative samples in the training sample set. If the number of positive samples in the first training sample set is insufficient, and the number of negative samples is sufficient, only a certain number of sample data indicated as positive samples by the pseudo-label can be screened to construct the second sample data. If the number of positive samples is sufficient, and the number of negative samples is insufficient, only a certain number of sample data indicated as negative samples by the pseudo-label can be screened to construct the second sample data. If the number of positive samples and the number of negative samples are both insufficient, a certain amount of sample data indicated as positive samples by the pseudo-label and a certain amount of sample data indicated as negative samples by the pseudo-label can be screened to construct the second sample data.

[0115] S804: inputting the second training sample set into the initial trained abnormal operation recognition model, and obtaining the intermediate feature corresponding to each sample data in the second training sample set through a feature extraction module.

[0116] The fusion feature corresponding to the first sample data in the second training sample set and the fusion feature corresponding to the second sample data with the pseudo-label are input into the initial trained abnormal operation recognition model, and each intermediate feature is obtained by processing through the feature extraction module. Optionally, the feature extraction module can be a backbone network, and the backbone network can be a residual network (Residual Network 50, ResNet50). The number 50 means that the ResNet50 has 50 layers. Using the ResNet50 can make the network structure of feature extraction simpler and will not reduce the performance of the network.

[0117] For example, please refer to Figure 9a , Figure 9a A residual network structure diagram provided by the embodiment of the application, wherein the first stage (Stage 1) to the fourth stage (Stage 4) have the same structure. As shown in Figure 9a , the input (112, 112, 64) means that the channel number (channel) of the input network is 112, the height (height) is 112, and the width (width) is 64, that is, the input (C, H, W). In the network, max-pooling is also used, that is, a convolution kernel (filter) extracts a plurality of feature values, only the maximum value of the pooling layer is retained as the reserved value, and the other values are discarded, and the original plane structure is maintained for feature extraction, and the maximum value indicates that the strongest feature in these feature values is retained. In Figure 9aIn the middle, the convolution layer (convolution) is usually abbreviated as conv, 7x7 refers to the size of the convolution kernel, 64 refers to the number of convolution kernels (i.e. the number of channels of the output of the convolution layer), and s=2 refers to the step size of the convolution kernel is 2; BN layer is the abbreviation of Batch Normalization, and the BN layer can accelerate the convergence speed of the network; ReLU represents the linear rectification function (Linear Rectification Function, ReLU). For example, the implementation process of max-pooling can be referred to as Figure 9b . Figure 9b Indicates that only the largest value in a small block with a size (pooling size) of 2x2 is retained, and 20, 30, 112 and 37 are respectively.

[0118] S805: Pooling processing is performed on the intermediate feature, and a first classification feature and a first classification loss parameter are determined.

[0119] Among them, the pooling processing performed on the intermediate feature can be global average pooling (GAP), and the intermediate feature after the pooling processing is input into the classifier in the classification module, then the first classification feature and the first classification loss parameter can be determined, and then S806 is executed.

[0120] It should be noted that the application does not limit the execution order between S805 and S807, which can be executed in S805 first and then in S807, or in S807 first and then in S805, or S805 and S807 can be executed simultaneously.

[0121] S806: The first classification feature is input into the cross-covariance aggregation module for processing to obtain a cross-covariance aggregation feature.

[0122] The cross-covariance feature can effectively model more complex data distribution. Among them, the intermediate feature can be input into the cross-covariance aggregation module for processing to determine the normalized feature of the intermediate feature; the outer product of the intermediate feature and the normalized feature is calculated, and the calculation formula is as follows:

[0123]

[0124] Among them, represents the outer product calculation result, . represents the first classification feature, . represents the outer product calculation symbol, and softmax is a normalization function, which represents the normalization processing of the first classification feature to map it to a real number between 0 and 1, so that the sum after processing is 1, and the sum of the probabilities is also 1; the outer product of the intermediate feature and the normalized feature The vectorization processing is performed to obtain the cross-covariance feature. The cross-covariance feature can be represented as represents the number of categories of classification.

[0125] S807: The intermediate feature is input into a second-order representation aggregation module for processing to obtain a second-order aggregated feature.

[0126] The intermediate feature is input into the second-order representation aggregation module for processing to determine a feature matrix of the intermediate feature; a second-order aggregated matrix is determined based on the feature matrix and a transpose matrix of the feature matrix; a matrix square root of the second-order aggregated matrix is calculated, and the matrix square root is subjected to vectorization processing to obtain the second-order aggregated feature. Compared with the first-order feature, the second-order feature can capture more abundant information.

[0127] In an implementation manner, the second-order representation aggregation module can include three structural layers, i.e., a second-order aggregation layer (Self-origanizing Maps, SOM), a matrix square root normalization layer (M_Sqrt), and an upper triangular vectorization layer (TriU). The second-order aggregation layer calculates the inner product of the intermediate feature to depict the correlation between channels in the intermediate feature. The second-order aggregation operation for determining the second-order aggregated matrix based on the feature matrix and the transpose matrix of the feature matrix can be represented by the following formula:

[0128]

[0129] wherein, represents the feature matrix after the intermediate feature is unfolded, represents the matrix obtained after the second-order aggregation operation, The matrix output by the matrix square root normalization layer is represented by , which is a symmetric matrix. The matrix is subjected to vectorization on the upper triangular part to obtain the second-order aggregated feature corresponding to the intermediate feature .

[0130] In an implementation manner, to avoid excessively high dimension of the subsequently generated feature, before the intermediate feature is input into the second-order representation aggregation module, a 1x1 convolution kernel can be used to reduce the dimension of the feature channel of the intermediate feature output by the feature extraction module, which is beneficial to reduce the feature size, thereby reducing the calculation amount and the required storage space.

[0131] S808: The cross-covariance feature and the second-order aggregated feature are input into a concatenation module to obtain a concatenated feature.

[0132] The concatenation module concatenates the cross-covariance feature and the second-order aggregated feature ​​Cascade is performed to obtain the spliced feature .

[0133] S809: input the spliced feature after gradient reversal into the classification module, and determine the second classification loss parameter according to the processing result of the classification module and the first classification loss parameter.

[0134] The gradient reversal layer (GRL) is between the feature extraction module and the classification module. In the process of back propagation, the gradient of the domain classification loss of the domain discriminator in the classification module will be automatically reversed before being back propagated to the parameters of the feature extractor in the feature extraction module, thereby constructing an adversarial loss similar to a generative adversarial network (GAN), and avoiding the two-stage training process of GAN through the layer. The process of gradient reversal and the loss function after processing by the gradient reversal layer can be calculated according to the following formulas in turn:

[0135]

[0136]

[0137] The structure of the domain discriminator in the classification module can be as shown in Figure 9c , which is composed of one or more modules as shown by 90 in the figure and a binary classifier, wherein the module 90 is composed of a fully connected layer and an activation function, and ReLU, Dropout and Sigmoid are all activation functions. In the entire network of the abnormal operation recognition model, the second loss parameter is composed of two parts: the classification loss parameter of the source domain classifier , which is minimized to ensure the classification performance of the model; and the loss parameter of the domain discriminator , which is optimized to continuously improve the recognition ability of the domain discriminator, and at the same time makes the source domain feature (such as the first sample data) and the target domain feature (such as the second sample data) more and more difficult to distinguish, thereby improving the effect of the abnormal operation recognition model. and can be calculated by the following formulas respectively:

[0138]

[0139]

[0140] wherein, represents the first classification loss parameter, which is a cross-entropy loss function; is a deep convolutional neural network (including a backbone network and a classifier); a domain discriminator; and respectively represent the source domain feature and the target domain feature extracted by the model.

[0141] In an implementation, the loss parameter is assigned the same weight for all sample data, but in actual application scenarios, the sample data with uncertain prediction information for some categories is not applicable. Therefore, in order to ensure the transferability of the feature, an entropy condition can be introduced to measure the uncertainty of the prediction category of the sample data. The sample with smaller entropy is given a larger weight, and vice versa. The entropy can be calculated by the following formula:

[0142]

[0143] wherein, indicates the number of categories; indicates the probability that the sample belongs to the i-th category. The weight calculation formula is as follows:

[0144] Based on this, the calculation formula of the loss parameter of the domain discriminator

[0145]

[0146] S810: Adjusting the model parameters of the abnormal operation recognition model based on the second classification loss parameter to determine a target abnormal operation recognition model.

[0147] In an implementation, a batch of sample data can be selected from the first training sample set and the second training sample set each time to train the abnormal operation recognition model and adjust the model parameters. The S804-S810 are repeatedly executed until the model converges to end the loop.

[0148]

[0149] ​​​It can be seen that, by using the abnormal operation identification model training method provided in the embodiments of the present application, the pseudo label technology can be used to determine the pseudo label of the second sample data based on the first sample data, the number of labeled samples is increased on the basis of reducing the number of manually labeled samples, data enhancement of the training samples is realized, and the generalization ability of the model is improved; the effective learning of the domain invariant feature can be performed by using the second-order aggregated feature of the training samples and the mutual covariance between the feature and the predicted value; meanwhile, in the process of model training, the entropy condition is introduced to balance the uncertainty of the classifier prediction, so as to ensure the transferability of the feature; in addition, the gradient flip layer is used to construct the adversarial loss similar to the generative adversarial network (GAN), which can avoid the complex training process in the GAN, and significantly improve the generalization ability of the model, the recognition accuracy of the target abnormal operation identification model, and the reusability of the target abnormal operation identification model.

[0150] Please refer to Figure 10 , Figure 10 The structure schematic diagram of a data processing apparatus provided in the embodiments of the present application is shown in FIG. 1. As shown in FIG. 1, the data processing apparatus includes: Figure 10

[0151] The acquisition unit 101 is configured to acquire a basic portrait feature and a business feature of a to-be-identified object, the to-be-identified object is associated with a target application, and the business feature is determined based on interaction data generated by the to-be-identified object for the target application;

[0152] The processing unit 102 is configured to perform fusion processing on the basic portrait feature and the business feature to obtain a fusion feature.

[0153] The processing unit 102 is further configured to input the fusion feature into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the to-be-identified object for the target application.

[0154] The target abnormal operation identification model is trained based on a first training sample set and a second training sample set, the first training sample set includes first sample data with labeled labels and second sample data without labeled labels, the second training sample set is constructed based on the first sample data and the second sample data with determined pseudo labels, the pseudo labels are predicted labels obtained by processing the second sample data using an initially trained abnormal operation identification model, the initially trained abnormal operation identification model is trained using an initial abnormal operation identification model based on the first sample data, the target abnormal operation identification model is trained using the second training sample set based on the initially trained abnormal operation identification model, the sample data includes feature data of an associated object of the target application, and the label of the sample data is used to indicate whether the associated object has an abnormal operation. ​

[0155] In an implementation manner, the target abnormal operation identification model comprises a feature extraction module, and a cross-covariance aggregation module and a second-order representation aggregation module connected in parallel; inputs of the cross-covariance aggregation module and the second-order representation aggregation module are connected with an output of the feature extraction module.

[0156] In an implementation manner, the processing unit 102 is further configured to: input the fused feature into the feature extraction module to obtain intermediate features; input the intermediate features into the cross-covariance aggregation module to obtain cross-covariance features, and input the intermediate features into the second-order representation aggregation module to obtain second-order aggregated features; perform splicing processing on the cross-covariance features and the second-order aggregated features to obtain spliced features; and determine the abnormal operation identification result of the target application of the to-be-identified object based on the spliced features.

[0157] In an implementation manner, the obtaining unit 101 is further configured to obtain a basic portrait of the to-be-identified object, the basic portrait comprising one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on relevant data generated in a process of operating the target application by the to-be-identified object in a first time period; and the processing unit 102 is further configured to determine a basic portrait feature of the to-be-identified object according to the basic portrait.

[0158] In an implementation manner, the obtaining unit 101 is further configured to obtain interaction data generated in a process of operating the target application by the to-be-identified object in a second time period, the interaction data comprising one or more of login operation related information, click information and conversion information for specific services, application traffic information, and triggering information of specific functions; and the processing unit 102 is further configured to determine a service feature of the to-be-identified object according to the interaction data.

[0159] In an implementation manner, the processing unit 102 is further configured to: perform normalization processing on numerical features in the basic portrait feature, and perform discretization processing on non-numerical features in the basic portrait feature to obtain processed basic portrait features; perform normalization processing on numerical features in the service feature, and perform discretization processing on non-numerical features in the service feature to obtain processed service features; and perform fusion processing on the processed basic portrait features and the processed service features to obtain the fused feature.

[0160] In an implementation manner, the processing unit 102 is further configured to: input the intermediate features into the cross-covariance aggregation module to determine normalized features of the intermediate features; calculate an outer product of the intermediate features and the normalized features; and perform vectorization processing on the outer product of the intermediate features and the normalized features to obtain the cross-covariance features.

[0161] In an implementation manner, the processing unit 102 is further configured to: input the intermediate features into a second-order feature representation aggregation module for processing, to determine a feature matrix of the intermediate features; determine a second-order aggregation matrix based on the feature matrix and a transpose matrix of the feature matrix; calculate a matrix square root of the second-order aggregation matrix, and vectorize the matrix square root to obtain second-order aggregated features.

[0162] According to an embodiment of the present application, Figure 3 The data processing method and Figure 8 The steps involved in the model training method shown Figure 10 The modules in the data processing apparatus shown Figure 3 S301 and Figure 8 S801 and S803 shown in S801 and S803 Figure 10 in the acquisition unit 101, Figure 3 S302, S303, S304 and Figure 8 S802, S804, S805, S806, S807, S808, S809, S810 shown in S802, S804, S805, S806, S807, S808, S809, S810 Figure 10 in the processing unit 102.

[0163] According to an embodiment of the present application, Figure 10 The modules in the data processing apparatus shown The modules in the data processing apparatus shown

[0164] According to an embodiment of the present application, Figure 3 The computer program (including program codes) capable of executing the steps involved in the corresponding method shown in Figure 8 in the processing unit 102. Figure 10The data processing apparatus described in the present application and the data processing method for implementing the embodiments of the present application. The above computer program can be recorded on a computer readable recording medium, for example, and loaded into the above computing device through the computer readable recording medium, and run therein.

[0165] It can be understood that the functions of each functional unit of the data processing apparatus described in the embodiments of the present application can be specifically implemented according to the methods in the above method embodiments, and the specific implementation process can refer to the related description of the above method embodiments, which will not be repeated here.

[0166] The abnormal operation identification model in the present application is trained in combination with the pseudo-label technology, so that when the number of sample data with labeled labels is insufficient to train the abnormal operation identification model, the pseudo-label of the sample data without labeled labels can be determined to increase the number of sample data with labels, thereby training the abnormal operation identification model and improving the identification accuracy of the trained abnormal operation identification model. In the abnormal operation identification, the basic portrait feature and the business feature of the to-be-identified object associated with the target application are obtained, the basic portrait feature and the business feature are fused to obtain a fused feature, and then the fused feature is input into the abnormal operation identification model trained in combination with the pseudo-label technology for processing, so that the accurate identification result of the to-be-identified object about the abnormal operation of the target application can be obtained, and the above method can realize automatic identification of abnormal operation, and the identification efficiency is higher.

[0167] Please refer to Figure 11 , Figure 11 The structure diagram of a data processing device provided in the embodiments of the present application. The data processing device described in the embodiments of the present application is used to execute the data processing method described above, and can also be used to execute the model training method described above. The data processing device includes a processor 111, a communication interface 112 and a memory 113. The processor 111, the communication interface 112 and the memory 113 can be connected through a bus or other means, and the embodiments of the present application take the connection through the bus as an example.

[0168] The processor 111 (or central processing unit (CPU)) is the computing core and control core of the computer device, which can parse various instructions in the computer device and process various data of the computer device. For example, the CPU can be used to parse the power-on / off instruction sent to the computer device and control the computer device to perform power-on / off operation; for another example, the CPU can transmit various interactive data between the internal structures of the computer device, and the like. The communication interface 112 can optionally include a standard wired interface, a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), and is controlled by the processor 111 to receive and transmit data. The memory 113 is a memory device in the computer device, used to store programs and data. It can be understood that the memory 113 herein can include the built-in memory of the computer device, and of course can also include the expansion memory supported by the computer device. The memory 113 provides a storage space that stores the operating system of the computer device, which can include but is not limited to: an Android system, an iOS system, a Windows Phone system, and the like, and the present application does not make any limitation thereto.

[0169] In the embodiment of the present application, the processor 111 executes the following operations by running the executable program code in the memory 113:

[0170] Obtain the basic portrait feature and the business feature of the to-be-identified object, the to-be-identified object is associated with the target application, and the business feature is determined based on the interaction data of the to-be-identified object for the target application;

[0171] Fuse the basic portrait feature and the business feature to obtain a fused feature;

[0172] Input the fused feature into the target abnormal operation recognition model for processing to obtain an abnormal operation recognition result of the to-be-identified object for the target application;

[0173] The target abnormal operation recognition model is trained based on a first training sample set and a second training sample set. The first training sample set includes first sample data with labeled labels and second sample data without labeled labels. The second training sample set is constructed based on the first sample data and the second sample data with determined pseudo-labels. The pseudo-labels are prediction labels obtained by processing the second sample data using an initially trained abnormal operation recognition model. The initially trained abnormal operation recognition model is trained using the first sample data on an initial abnormal operation recognition model. The target abnormal operation recognition model is trained using the second training sample set on the initially trained abnormal operation recognition model. The sample data includes feature data of an associated object of the target application. The label of the sample data is used to indicate whether the associated object has abnormal operation.

[0174] In an implementation manner, the processor 111, by running the executable program code in the memory 113, can further perform the following operations: input the fusion feature into the feature extraction module for processing to obtain intermediate features; input the intermediate features into the cross-covariance aggregation module for processing to obtain cross-covariance features, and input the intermediate features into the second-order representation aggregation module for processing to obtain second-order aggregated features; perform splicing processing on the cross-covariance features and the second-order aggregated features to obtain spliced features; and determine the abnormal operation recognition result of the target application of the to-be-identified object based on the spliced features.

[0175] In an implementation manner, the processor 111, by running the executable program code in the memory 113, can further perform the following operations: obtain a basic portrait of the to-be-identified object, the basic portrait including one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on relevant data generated in a process of operating the target application by the to-be-identified object in a first time period; and determine a basic portrait feature of the to-be-identified object according to the basic portrait.

[0176] In an implementation manner, the processor 111, by running the executable program code in the memory 113, can further perform the following operations: obtain interaction data generated in a process of operating the target application by the to-be-identified object in a second time period, the interaction data including one or more of login operation related information, click information and conversion information for specific services, application traffic information, and triggering information of specific functions; and the processing unit is further configured to determine a service feature of the to-be-identified object according to the interaction data.

[0177] In an implementation manner, the processor 111, by running the executable program code in the memory 113, can further perform the following operations: perform normalization processing on the numerical features in the basic portrait feature, and perform discretization processing on the non-numerical features in the basic portrait feature to obtain processed basic portrait features; perform normalization processing on the numerical features in the service feature, and perform discretization processing on the non-numerical features in the service feature to obtain processed service features; and perform fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

[0178] In an implementation manner, the processor 111, by running the executable program code in the memory 113, can further perform the following operations: input the intermediate features into the cross-covariance aggregation module for processing to determine normalized features of the intermediate features; calculate the outer product of the intermediate features and the normalized features; and perform vectorization processing on the outer product of the intermediate features and the normalized features to obtain cross-covariance features.

[0179] In an implementation manner, the processor 111 can also perform the following operations by running the executable program code in the memory 113: inputting the intermediate features into a second-order feature representation aggregation module for processing to determine a feature matrix of the intermediate features; determining a second-order aggregation matrix based on the feature matrix and a transpose matrix of the feature matrix; calculating a matrix square root of the second-order aggregation matrix, vectorizing the matrix square root to obtain second-order aggregated features.

[0180] The abnormal operation identification model in the present application is trained in combination with the pseudo-label technology, so that when the number of sample data with labeled labels is insufficient to train the abnormal operation identification model, the number of sample data with labels can be increased by determining the pseudo-labels of sample data without labels, so as to train the abnormal operation identification model well and improve the identification accuracy of the trained abnormal operation identification model. When identifying abnormal operations, the basic portrait features and business features of the to-be-identified object associated with the target application are obtained, the basic portrait features and business features are fused to obtain fused features, and then the fused features are input into the abnormal operation identification model trained in combination with the pseudo-label technology for processing, so that the identification result of the to-be-identified object about the abnormal operation of the target application can be obtained accurately, and the above-mentioned method can realize automatic identification of abnormal operations and has higher identification efficiency.

[0181] The embodiment of the present application further provides a computer readable storage medium, wherein instructions are stored in the computer readable storage medium, and when the instructions are run on a computer, the computer executes the data processing method described in the embodiment of the present application. The specific implementation manner can refer to the foregoing description, and will not be described here.

[0182] The embodiment of the present application further provides a computer program product, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute the data processing method described in the embodiment of the present application. The specific implementation manner can refer to the foregoing description, and will not be described here.

[0183] The terms "first", "second", and the like in the specification and claims and drawings of the embodiment of the present application are used to distinguish different objects, and are not used to describe a specific order. In addition, the term "comprises" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, device, product or equipment.

[0184] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0185] The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow Figure 1 The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow Figure 1 The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow Figure 1 The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow Figure 1 The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow Figure 1 The method and related apparatus provided by the embodiments of the present application are described with reference to the method flowchart and / or structural schematic diagram provided by the embodiments of the present application. Each flow and / or block in the method flowchart and / or structural schematic diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device implemented in the flow

[0186] The above disclosure is only the preferred embodiments of the present application, and of course cannot limit the scope of the present application. Therefore, equivalent changes made in accordance with the claims of the present application are still within the scope of the present application.

Claims

1. A data processing method, characterized by, The method comprises: obtaining basic portrait features and business features of a to-be-identified object, the to-be-identified object being associated with a target application, the business features being determined based on interaction data generated by the to-be-identified object for the target application; fusing the basic portrait features and the business features to obtain fused features; inputting the fused features into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the to-be-identified object for the target application; The target abnormal operation identification model comprises a feature extraction module, and a mutual covariance aggregation module and a second-order representation aggregation module connected in parallel; the inputs of the mutual covariance aggregation module and the second-order representation aggregation module are connected with the output of the feature extraction module; the target abnormal operation identification model is trained based on a first training sample set and a second training sample set; the first training sample set comprises first sample data with labeled labels and second sample data without labeled labels; the second training sample set is constructed based on the first sample data and second sample data with determined pseudo-labels; the pseudo-labels are prediction labels obtained by processing the second sample data using an initially trained abnormal operation identification model; the initially trained abnormal operation identification model is trained using an initial abnormal operation identification model and the first sample data; the target abnormal operation identification model is trained using the second training sample set and the initially trained abnormal operation identification model; sample data comprises feature data of associated objects of the target application, and the labels of sample data are used to indicate whether the associated objects have abnormal operations.

2. The method of claim 1, wherein, The method comprises: inputting the fused features into the feature extraction module for processing to obtain intermediate features; inputting the intermediate features into the mutual covariance aggregation module for processing to obtain mutual covariance features, and inputting the intermediate features into the second-order representation aggregation module for processing to obtain second-order aggregated features; splicing the mutual covariance features and the second-order aggregated features to obtain spliced features; determining the abnormal operation identification result of the to-be-identified object for the target application based on the spliced features.

3. The method according to claim 1 or 2, characterized in that, The method comprises: obtaining a basic portrait of the to-be-identified object, the basic portrait comprising one or more of object basic attributes, device basic attributes, network connection attributes, and geographic location attributes, the device basic attributes, the network connection attributes, and the geographic location attributes being determined based on related data generated during the process of the to-be-identified object operating the target application in a first time period; determining the basic portrait features of the to-be-identified object based on the basic portrait.

4. The method according to claim 1 or 2, characterized in that, The method comprises: obtain interaction data generated in a process in which the to-be-identified object operates the target application in a second time period, the interaction data including one or more of login operation related information, click information and conversion information for specific services, application traffic information, and triggering information of specific functions; determine a service feature of the to-be-identified object according to the interaction data.

5. The method of claim 1, wherein, The fusion processing of the basic portrait feature and the service feature includes: perform normalization processing on the numerical features in the basic portrait feature, and perform discretization processing on the non-numerical features in the basic portrait feature to obtain processed basic portrait features; perform normalization processing on the numerical features in the service feature, and perform discretization processing on the non-numerical features in the service feature to obtain processed service features; perform fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

6. The method of claim 2, wherein, The processing of the intermediate feature in the inter-covariance aggregation module includes: input the intermediate feature into the inter-covariance aggregation module to process the intermediate feature to determine a normalized feature of the intermediate feature; calculate the outer product of the intermediate feature and the normalized feature; vectorize the outer product of the intermediate feature and the normalized feature to obtain the inter-covariance feature.

7. The method of claim 2, wherein, The processing of the intermediate feature in the second-order representation aggregation module includes: input the intermediate feature into the second-order representation aggregation module to process the intermediate feature to determine a feature matrix of the intermediate feature; determine a second-order aggregation matrix based on the feature matrix and a transpose matrix of the feature matrix; calculate the matrix square root of the second-order aggregation matrix, and vectorize the matrix square root to obtain the second-order aggregation feature.

8. A data processing apparatus, characterized by, The apparatus includes: an obtaining unit, configured to obtain a basic portrait feature and a service feature of a to-be-identified object, the to-be-identified object being associated with a target application, and the service feature being determined based on interaction data generated by the to-be-identified object for the target application; a processing unit, configured to perform fusion processing on the basic portrait feature and the service feature to obtain fusion features; the processing unit is further configured to input the fusion features into a target abnormal operation recognition model to process the fusion features, and obtain an abnormal operation recognition result of the to-be-identified object for the target application; The target abnormal operation identification model comprises a feature extraction module, and a parallelly connected mutual covariance aggregation module and a second-order representation aggregation module; inputs of the mutual covariance aggregation module and the second-order representation aggregation module are connected with an output of the feature extraction module; the target abnormal operation identification model is trained based on a first training sample set and a second training sample set; the first training sample set comprises first sample data with labeled labels and second sample data without labeled labels; the second training sample set is constructed based on the first sample data and second sample data with determined pseudo labels; the pseudo labels are predicted labels obtained by processing the second sample data by an initially trained abnormal operation identification model; the initially trained abnormal operation identification model is trained by using the first sample data on an initial abnormal operation identification model; the target abnormal operation identification model is trained by using the second training sample set on the initially trained abnormal operation identification model; sample data comprises feature data of an associated object of the target application, and a label of sample data is used for indicating whether the associated object has abnormal operation.

9. A data processing device, characterized by Comprise: a processor adapted to implement one or more computer programs; and a computer storage medium storing one or more computer programs, which are loaded and implemented by the processor to implement the data processing method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a computer program, which is executed by the processor to implement the data processing method according to any one of claims 1-7.

11. A computer program product, characterised in that, The computer program product comprises a computer program stored in a computer storage medium, which is executed by the processor to implement the data processing method according to any one of claims 1-7.

Images