User identification method and apparatus, related device, and storage medium

By determining the strategy based on the user's network access duration and using plaintext or privacy-preserving computation methods in conjunction with multiple nodes to predict fraudulent users, the problem of insufficient identification accuracy in existing technologies is solved, achieving accurate identification of fraudulent users and privacy protection.

CN118157891BActive Publication Date: 2026-04-21CHINA MOBILE COMM LTD RES INST +1
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
CHINA MOBILE COMM LTD RES INST
Filing Date
2022-12-07
Publication Date
2026-04-21

AI Technical Summary

Technical Problem

Existing technologies have poor accuracy in identifying fraudulent users, especially new users. Furthermore, due to data silos, the models are underperforming and cannot accurately identify cross-enterprise fraud.

Method used

By determining different strategies based on the user's network access duration, and using plaintext or privacy-preserving computation methods in conjunction with multiple nodes to predict whether a user is a fraudulent user, the system uses query lists or federated learning models for identification, ensuring that user privacy information is not leaked.

Benefits of technology

It has enabled accurate identification of fraudulent users, improved the accuracy of identifying new users, protected user privacy information, and enhanced the identification efficiency of cross-enterprise data sharing.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN118157891B_ABST
    Figure CN118157891B_ABST
Patent Text Reader

Abstract

This application discloses a user identification method, apparatus, platform, first node, second node, and storage medium. The method includes: the platform determining a strategy for the first user based on the first user's first information; different strategies corresponding to the first information of different users; wherein the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; and predicting whether the first user is a fraudulent user.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a user identification method, apparatus, related equipment, and storage medium. Background Technology

[0002] With online fraud becoming increasingly rampant, businesses are investing heavily in anti-fraud efforts to identify users at risk of fraud.

[0003] However, current technologies offer very limited improvement in identification effectiveness; in other words, the accuracy of identifying fraudulent users is poor among related technologies. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide a user identification method, apparatus, related devices, and storage medium.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a user identification method applied to a platform, including:

[0007] The strategy for the first user is determined based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy;

[0008] Predict whether the first user is a fraudulent user.

[0009] In the above scheme, predicting whether the first user is a fraudulent user includes:

[0010] Send a second message to the first node, the second message indicating at least whether the first user is a fraudulent user, and the first node and at least one associated second node jointly predict whether the first user is a fraudulent user;

[0011] Receive third information sent by the first node, wherein the third information represents the prediction result for the first user;

[0012] Use third-party information to predict whether the first user is a fraudulent user.

[0013] The method in the above scheme further includes:

[0014] Determine the first information of the first user.

[0015] In the above scheme, the first information of the first user includes the first user's network access duration being less than or equal to a first duration; the strategy for the first user includes confirming whether the user is a fraudulent user by querying a list.

[0016] In the above scheme, the second information includes the query-related information of the first user.

[0017] The above scheme uses plaintext querying;

[0018] or,

[0019] The query uses privacy-preserving computation.

[0020] In the above scheme, the first information of the first user includes the duration of the first user's network access being greater than the first duration, and the strategy for the first user includes confirming whether the user is a fraudulent user through model prediction.

[0021] In the above scheme, the second information includes the identity-related information of the first user.

[0022] The above scheme uses plaintext prediction;

[0023] or,

[0024] Predictions are made using privacy-preserving computation methods.

[0025] This application embodiment also provides a user identification method, applied to a first node, including:

[0026] The receiving platform sends a second message, which at least indicates whether the first user is predicted to be a fraudulent user.

[0027] Using the second information, and combining it with at least one second node associated with the first node, it is predicted whether the first user is a fraudulent user;

[0028] A third message is sent to the platform, the third message representing the prediction result for the first user.

[0029] In the above scheme, the second information includes the query-related information of the first user.

[0030] The above scheme uses plaintext querying;

[0031] or,

[0032] The query uses privacy-preserving computation.

[0033] In the above scheme, if fraud-related information matching the query information is found in the local database, the third information is sent to the platform.

[0034] In the above scheme, if no fraud-related information matching the query-related information is found in the local database, the query-related information is sent to the at least one second node, and fourth information is obtained, wherein the fourth information represents the prediction result of the first node for the first user;

[0035] The system receives at least one fifth piece of information sent by the at least one second node, the fifth piece of information representing the prediction result of the second node for the first user.

[0036] In the above scheme, the second information includes the identity-related information of the first user.

[0037] The above scheme uses plaintext prediction;

[0038] or,

[0039] Predictions are made using privacy-preserving computation methods.

[0040] In the above scheme, the step of using the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user includes:

[0041] Using the identity-related information and the first model, sixth information is obtained, which represents the prediction result of the first node for the first user; and the identity-related information is sent to the at least one second node.

[0042] Receive at least one seventh message sent by the at least one second node, the seventh message representing the prediction result of the second node for the first user;

[0043] Based on the sixth piece of information and at least one seventh piece of information, predict whether the first user is a fraudulent user.

[0044] The method in the above scheme further includes:

[0045] Based on Private Set Intersection (PSI), the intersection data of the first dataset of the first node and at least one second dataset of the at least one second node is determined;

[0046] A federated model is trained using the intersection data, the federated model including the first model.

[0047] This application embodiment also provides a user identification method, applied to a second node, including:

[0048] Receive second information sent by the first node, the second information indicating at least whether the first user is predicted to be a fraudulent user;

[0049] The second information is used to predict whether the first user is a fraudulent user, so as to achieve the joint prediction of whether the first user is a fraudulent user by the first node.

[0050] In the above scheme, the second information includes the query-related information of the first user.

[0051] In the above scheme, the step of using the second information to predict whether the first user is a fraudulent user includes:

[0052] Search the local database for fraud-related information that matches the query information to obtain matching results;

[0053] A fifth message is sent to the first node, the fifth message representing the second node's prediction result for the first user.

[0054] The above scheme uses plaintext querying;

[0055] or,

[0056] The query uses privacy-preserving computation.

[0057] In the above scheme, the second information includes the identity-related information of the first user.

[0058] In the above scheme, the step of using the second information to predict whether the first user is a fraudulent user includes:

[0059] Using the identity-related information and the second model, predict whether the first user is a fraudulent user;

[0060] A seventh message is sent to the first node, the seventh message representing the prediction result of the second node for the first user.

[0061] The above scheme uses plaintext prediction;

[0062] or,

[0063] Predictions are made using privacy-preserving computation methods.

[0064] This application embodiment also provides a communication device, disposed on a platform, including:

[0065] The first processing unit is used to determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and in each strategy, at least two nodes jointly predict whether the user is a fraudulent user;

[0066] The first prediction unit is used to predict whether the first user is a fraudulent user.

[0067] This application embodiment also provides a communication device, disposed at a first node, including:

[0068] The first receiving unit is configured to receive second information sent by the platform, the second information indicating at least whether the first user is predicted to be a fraudulent user.

[0069] The second prediction unit is used to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user.

[0070] A sending unit is used to send third information to the platform, the third information representing the prediction result for the first user.

[0071] This application embodiment also provides a communication device, disposed at a second node, including:

[0072] The second receiving unit is used to receive second information sent by the first node, the second information indicating at least whether the first user is predicted to be a fraudulent user.

[0073] The third prediction unit is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

[0074] This application embodiment also provides a platform, including: a first processor and a first communication interface; wherein,

[0075] The first processor is configured to determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; and predict whether the first user is a fraudulent user.

[0076] This application embodiment also provides a first node, including: a second processor and a second communication interface; wherein,

[0077] The second communication interface is used to receive second information sent by the platform, the second information indicating at least whether the predicted first user is a fraudulent user;

[0078] The second processor is configured to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user; and to send third information to the platform, the third information representing the prediction result for the first user.

[0079] This application embodiment also provides a second node, including: a third processor and a third communication interface; wherein,

[0080] The third communication interface is used to receive second information sent by the first node, the second information indicating at least whether the first user is a fraudulent user;

[0081] The third processor is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

[0082] This application also provides a platform, including: a first processor and a first memory for storing computer programs capable of running on the processor.

[0083] Wherein, when the first processor is used to run the computer program, it executes the steps of any of the above-described platform-side methods.

[0084] This application also provides a first node, including: a second processor and a second memory for storing computer programs capable of running on the processor.

[0085] Wherein, when the second processor is used to run the computer program, it executes the steps of any of the methods described above on the first node side.

[0086] This application also provides a second node, including: a third processor and a third memory for storing computer programs capable of running on the processor.

[0087] The third processor is used to execute any of the steps of the second node-side method when running the computer program.

[0088] This application embodiment also provides a storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described platform-side methods, or the steps of any of the above-described first node-side methods, or the steps of any of the above-described second node-side methods.

[0089] The user identification method, apparatus, related devices, and storage medium provided in this application embodiment determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; predicting whether the first user is a fraudulent user. The solution provided in this application embodiment involves the business system (i.e., the platform) determining different joint anti-fraud strategies for different types of users based on their network access duration, and predicting whether a user is a fraudulent user by combining multiple nodes (such as the first node and the second node) based on the user's joint anti-fraud strategy. That is, different nodes share data to jointly predict whether a user is a fraudulent user, thus enabling accurate identification of fraudulent users. Attached Figure Description

[0090] Figure 1 This is a schematic flowchart of the first user identification method according to an embodiment of this application;

[0091] Figure 2 This is a schematic flowchart of the second user identification method according to an embodiment of this application;

[0092] Figure 3 This is a schematic flowchart of the third user identification method according to an embodiment of this application;

[0093] Figure 4 This is a schematic diagram of the structure of the data service network used in this application.

[0094] Figure 5 This is a schematic diagram illustrating the user identification method based on a data service network, which is an application example of this application.

[0095] Figure 6 This is a flowchart illustrating the method for identifying users using black / grey lists, which is an application example of this application.

[0096] Figure 7 This is a flowchart illustrating the method for identifying users using a federated model, which is an application example of this application.

[0097] Figure 8 This is a schematic diagram of the structure of a first type of communication device according to an embodiment of this application;

[0098] Figure 9 This is a schematic diagram of the structure of a second type of communication device according to an embodiment of this application;

[0099] Figure 10 This is a schematic diagram of the third type of communication device structure according to an embodiment of this application;

[0100] Figure 11 This is a schematic diagram of the platform structure in an embodiment of this application;

[0101] Figure 12 This is a schematic diagram of the first node structure in an embodiment of this application;

[0102] Figure 13 This is a schematic diagram of the second node structure in an embodiment of this application;

[0103] Figure 14 This is a schematic diagram of the user identification system structure according to an embodiment of this application. Detailed Implementation

[0104] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0105] In related technologies, anti-fraud systems have been proposed to identify fraudulent users. In these systems, different companies build anti-fraud models using local datasets to identify fraudulent users. However, if a company's local dataset is small or lacks sufficient features—meaning related business data exists in silos across different companies—the resulting models will have insufficient performance and low accuracy in identifying fraudulent users. Furthermore, since a fraudster often uses different business identities to commit fraud across different companies, the amount of fraud data accumulated by each company is limited. Relying solely on the fraud data accumulated by one company to identify fraudsters leads to low accuracy.

[0106] Based on this, in various embodiments of this application, the service platform determines different joint anti-fraud strategies for different types of users according to their network access duration, and predicts whether a user is a fraudulent user by combining multiple nodes based on the user's joint anti-fraud strategy. That is, different nodes share data to jointly predict whether a user is a fraudulent user. The solution provided by the embodiments of this application, by adopting different strategies for different types of users and predicting whether a user is a fraudulent user by sharing data among various nodes, can achieve accurate identification of fraudulent users.

[0107] This application provides a user identification method, applied to a platform, such as... Figure 1 As shown, the method includes:

[0108] Step 101: Determine the strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and in each strategy, at least two nodes jointly predict whether the user is a fraudulent user;

[0109] Step 102: Predict whether the first user is a fraudulent user.

[0110] In practical applications, the platform can also be called a business platform, business system, etc. This application embodiment does not limit the name of the platform, as long as its functions are implemented. The node can also be called a computing node, computing engine, engine, etc. This application embodiment does not limit the name of the node, as long as its functions are implemented. Different nodes can belong to different operators, or can be understood as different nodes belonging to different organizations. Since each strategy requires at least two nodes to jointly predict whether a user is a fraudulent user, the strategy can also be called a joint anti-fraud strategy.

[0111] Here, before step 101, in order to determine the strategy for the first user, the platform needs to determine the first information of the first user.

[0112] Based on this, in one embodiment, the method may further include:

[0113] Determine the first information of the first user.

[0114] In practical applications, a user's first information can be understood as the user's attributes. Therefore, the first information of the first user can also be understood as the attributes of the first user.

[0115] It should be noted that the first user's network access duration can be understood as the duration of the first user's access to the platform, or as the duration of the first user's connection with the platform. Therefore, the platform can search for access-related information corresponding to the first user in the local database to determine the first user's first information.

[0116] In step 102, a determined strategy is used to predict whether the first user is a fraudulent user. Here, predicting whether the first user is a fraudulent user can also be understood as determining whether the first user is a fraudulent user, or judging whether the first user is a fraudulent user. That is, in this embodiment of the application, prediction, determination, and judgment can be understood in the same way.

[0117] In related technologies, it is impossible to identify whether a newly registered user (i.e., a user with a short registration period, also known as a new user) is a fraudulent user, while it is possible to identify whether a long-term registered user (i.e., a long-term registered user, also known as a long-term registered user) is a fraudulent user to a certain extent. Therefore, in this embodiment, users are divided into two types based on their registration period: new users and long-term users. Different joint anti-fraud strategies are adopted for new users and long-term users.

[0118] The platform determines a strategy for the first user based on the first user's first information; wherein, the first user can include newly registered users. Specifically, in one embodiment, the first user's first information includes that the first user's registration duration is less than or equal to a first duration; the strategy for the first user includes confirming whether the user is a fraudulent user by querying a list.

[0119] Here, if the first user's network access duration is less than or equal to the first duration, the platform can determine that the first user is a newly accessed user. The value of the first duration can be set as needed, such as 3 months. This application embodiment does not limit this.

[0120] In practical applications, when query rules are inconsistent, the platform needs to align keywords with the first node and the at least one second node in order to unify the query rules on the platform side and the node side.

[0121] In related technologies, federated models are typically used to predict fraudulent users. However, federated models cannot predict newly registered users. In this embodiment, for newly registered users, the platform can use a defined strategy, namely, querying a list, to jointly predict whether the first user is a fraudulent user by combining the at least two nodes.

[0122] Based on this, in one embodiment, predicting whether the first user is a fraudulent user includes:

[0123] Send a second message to the first node, the second message indicating at least whether the first user is a fraudulent user, and the first node and at least one associated second node jointly predict whether the first user is a fraudulent user;

[0124] Receive third information sent by the first node, wherein the third information represents the prediction result for the first user;

[0125] Use third-party information to predict whether the first user is a fraudulent user.

[0126] The second information includes query-related information of the first user.

[0127] In practical applications, for newly registered users, the platform can employ different query methods, combining the first node with at least one associated second node to predict whether the first user is a fraudulent user. Specifically, queries can be performed in plaintext or using privacy-preserving computation methods.

[0128] Here, during the plaintext query process, the platform can directly send the query-related information to the first node. This query-related information may include query keywords. After receiving the query keywords, the first node searches its local database for fraud-related information matching the query keywords. If fraud-related information matching the query keywords is found in the local database, the first node sends the third information to the platform, enabling the platform to use the third information to predict whether the first user is a fraudulent user. The platform can communicate with the first node based on an Application Programming Interface (API). Here, the query keywords may include the first user's identifier, i.e., the first user's identity identifier, such as a user ID, also called an identity ID, which is an identifier that can identify the user's identity, such as including the user's name, mobile phone number, or ID card number. This embodiment does not limit this, as long as it can identify the user's identity.

[0129] For example, if fraud-related information matching the query keywords is found in the local database, the prediction result includes the first node predicting that the first user is a fraudulent user. In this case, the platform can predict that the first user is a fraudulent user.

[0130] If no fraud-related information matching the query keyword is found in the local database, the first node sends the query keyword to the at least one second node through at least one API interface provided by the at least one second node to perform a query through the local database of the at least one second node. Then, the first node sends the third information to the platform so that the platform can use the third information to make a prediction about the first user. The third information may include the query results of the first node and the at least one second node.

[0131] For example, if no fraud-related information matching the query keyword is found in the local database of the at least one second node, that is, if the third information indicates that a second node predicts that the first user is a fraudulent user, then the platform can predict that the first user is a fraudulent user.

[0132] During the query process using plaintext, the relevant information is presented in plaintext, and correspondingly, the third information is also presented in plaintext.

[0133] In practical applications, in order to protect users' privacy information from being leaked, the platform can use privacy computing to query the first user, that is, use privacy computing to query in order to protect users' privacy information.

[0134] Among the related technologies, schemes for identifying fraudulent users through privacy computation in situations involving only two parties can include schemes based on homomorphic encryption (HE), oblivious transfer (OT), and covert query. HE-based schemes have high computational complexity; OT-based schemes typically involve a large amount of data transmitted between the server and client, requiring the server to simultaneously send ciphertext data proportional to the amount transmitted to the client; covert query-based schemes are only suitable for scenarios where the data volumes of the two parties are unbalanced, with a significant difference in data volume. In other words, privacy computation requires different processes designed for different schemes, each with significant process differences, preventing users from choosing according to their needs. Furthermore, different schemes are applicable to different scenarios; for example, HE is suitable for low-bandwidth scenarios. Meanwhile, the process of identifying fraudulent users through privacy computing differs between keyword queries and key feature queries, making the query steps cumbersome. Keyword queries involve the platform sending a user ID to a node, which then returns a query result, either yes or no. Yes indicates the user is fraudulent, while no indicates the user is not. Keyword feature queries involve the platform sending a user ID and the user's desired query feature information (such as fraud probability) to a node. Upon receiving the user ID, the node first checks if the user ID is in its local database. If it is, the node returns the user's fraud probability as the query result to the platform; otherwise, it returns the query result indicating that the user was not found.

[0135] In this embodiment of the application, during the query process using privacy computing, the keyword query and key feature query processes are merged to ensure that the query process remains unchanged regardless of the query method. That is, the second information can include the query keywords or query features (such as query ID and fraud probability). Whether targeting query keywords or query features, the platform can use the same process to query the first user to predict whether the first user is a fraudulent user.

[0136] In practical applications, the privacy computation method may specifically include covert queries, also known as anonymous queries. The privacy computation method means that the platform can return fraud-related information that matches the query-related information to the platform without disclosing the query-related information to the first node and / or the at least one second node, and without disclosing information other than the fraud-related information that matches the query-related information.

[0137] In practical applications, before querying using privacy computing, the platform can also negotiate bucketing technology and encryption methods with the first node and the at least one second node. The bucketing technology is used to divide the data, and the encryption method is used to encrypt the transmitted data.

[0138] Here, for the first node and / or at least one second node, each node can employ bucketing technology to divide the data stored in its local database to improve query efficiency. For example, if the amount of data stored in the local database on the first node side reaches a pre-configured first threshold, then the first node can use bucketing technology to divide the data stored in its local database into different buckets, with the data volume in each bucket being greater than or equal to a pre-configured second threshold. The second threshold can be understood as indistinguishability, and the values ​​of the first and second thresholds can be set as needed. The bucketing technology specifically includes consistent hashing algorithms, cuckoo filters, modulo operations, etc. If the amount of data stored in the local database on the first node side does not reach the first threshold, then the first node may not need to divide the data stored in its local database.

[0139] In practical applications, during the query process using privacy computing, the platform can employ the same bucketing technology as the first node, using the query-related information to determine the bucket identifier, which may include the query identifier. The platform sends the bucket identifier to the first node. After receiving the bucket identifier, the first node can encrypt all data (also known as the obfuscation candidate set) of the bucket corresponding to the bucket identifier using a negotiated encryption method (such as blinded RSA or homomorphic encryption), and return the encrypted obfuscation candidate set to the platform. After receiving the encrypted obfuscation candidate set, the platform uses the same encryption method to encrypt the query-related information. Using the encrypted query-related information and the encrypted obfuscation candidate set, the platform can determine the prediction result for the first user. The platform can communicate with the first node based on a hidden query API interface.

[0140] In practical applications, if the amount of data stored in the local database of the first node does not reach the first threshold, the first node may not need to partition the data stored in its local database. In this case, the platform can use a negotiated encryption method to encrypt the query-related information and send the encrypted query-related information to the first node. After receiving the encrypted query-related information from the platform, the first node uses the same encryption method to encrypt all data stored in its local database (also known as the obfuscated candidate set) and returns the encrypted obfuscated candidate set to the platform. Using the encrypted query-related information and the encrypted obfuscated candidate set, the platform can determine the prediction result for the first user.

[0141] For example, if the platform can obtain the intersection data (i.e. the same data) using the encrypted query-related information and the encrypted obfuscated candidate set, then it means that it can find fraud-related information that matches the query-related information from the first node side. Therefore, the platform can predict that the first user is a fraudulent user.

[0142] If the platform cannot obtain the intersection data using the encrypted query-related information and the encrypted obfuscated candidate set, it indicates that it cannot find fraud-related information matching the query-related information from the first node. In this case, the first node can send the bucket identifier to the at least one second node and receive at least one encrypted obfuscated candidate set sent by the at least one second node. By sending at least one encrypted obfuscated candidate set sent by the at least one second node to the platform, the platform can determine the prediction result for the first user based on the encrypted query-related information and at least one encrypted obfuscated candidate set.

[0143] In practical applications, when fraud-related information matching the query information is found from the first node, the platform can also obtain the fraud-related information matching the query information from the first node as needed, so as to make a more accurate prediction of the first user based on the fraud-related information. The fraud-related information may include the first user's fraud probability, consumption information, etc. For example, if it is necessary to obtain the fraud-related information matching the query information from the first node, the platform can use the encrypted query information and the encrypted obfuscation candidate set to determine the location information of the encrypted query information in the encrypted obfuscation candidate set; based on the negotiated encryption method (such as OT, Oblivious Pseudo Random Function (OPRF) or homomorphic encryption), the platform can send an eighth message to the first node to request the fraud-related information corresponding to the location information.

[0144] In practical applications, models can be used for prediction of historical users. For historical users, the large amount of user data stored on the node side ensures the performance of the constructed model, i.e., the recognition accuracy. Therefore, the platform can use model prediction, combining the first node and at least one second node, to predict the first user.

[0145] Specifically, in one embodiment, the first information of the first user includes the fact that the duration of the first user's network access is greater than a first duration, and the strategy for the first user includes confirming whether the user is a fraudulent user through model prediction. The second information may include identity-related information of the first user. Specifically, the identity-related information may include the first user's identity identifier, that is, the first user's identifier, such as an identity ID, which is an identifier that can identify the user's identity, such as including the user's name, mobile phone number, or ID card number, etc. This application embodiment does not limit this, as long as it can identify the user's identity.

[0146] The model prediction method may include a federated learning model. That is, the strategy for the first user includes using a federated learning model to determine whether the user is a fraudulent user.

[0147] Here, for historical users, the platform can also employ different prediction methods, combining the first node with at least one associated second node to predict the first user. Specifically, prediction can be performed in plaintext or using privacy-preserving computation.

[0148] Here, during the plaintext prediction process, the platform can directly send the identity-related information to the first node. After receiving the identity identifier, the first node uses the first model and the identity identifier to obtain sixth information. The first model is the model trained by the first node, and the sixth information represents the prediction result of the first node for the first user. Simultaneously, to ensure recognition accuracy, the first node can also jointly predict the first user with at least one second node. Specifically, the first node can also send the identity identifier to at least one associated second node to obtain at least one seventh piece of information using the second model of the at least one second node. The seventh information represents the prediction result of the second node for the first user, and the second model is the model trained by the second node. Then, the first node can send the sixth information and the at least one seventh piece of information to the platform for the platform to predict whether the first user is a fraudulent user. Thus, the joint prediction of whether the first user is a fraudulent user by the first node and the at least one second node is achieved.

[0149] For example, assuming there are three operator nodes, namely node A (i.e., the first node), node B (i.e., the second node), and node C (i.e., the third node), after the platform receives the first predicted value (i.e., the sixth information) from node A, the second predicted value (i.e., the seventh information) from node B, and the third predicted value (i.e., the seventh information) from node C, it can use the first, second, and third predicted values ​​to calculate the final predicted value of the first user (which can be understood as the fraud probability, for example, 0.91) by averaging. If the final predicted value is greater than or equal to the third threshold, the platform can predict that the first user is a fraudulent user; otherwise, the platform can predict that the first user is not a fraudulent user. The value of the third threshold can be set as needed, such as 0.9, and this embodiment of the application does not limit it.

[0150] In the process of predicting using plaintext, the identity-related information is presented in plaintext form, and correspondingly, the third information is also presented in plaintext form.

[0151] In practical applications, using plaintext prediction may leak users' privacy information. For example, taking a vertical federated model, suppose there is a business system (i.e., the platform), node A (i.e., the first node), and node B (i.e., the second node). The business system sends the user's identity identifier to node A. Node A and node B determine the user's intersection and input the user's identity identifier into nodes A and B respectively to obtain the joint prediction result of nodes A and B. At this time, nodes A and B will receive the user identifier sent by the business system in plaintext form, which is not conducive to protecting the user information of the business system. In order to protect the user's privacy information (such as identity identifier) ​​from being leaked, privacy computing can be used for prediction to protect the user's privacy information.

[0152] In practical applications, privacy-preserving computation can specifically include covert prediction, also known as stealth prediction. Before using privacy-preserving computation for prediction, the platform can also negotiate an encryption method with the first node and the at least one second node. This encryption method is used to encrypt the transmitted data.

[0153] In practical applications, during the prediction process using privacy-preserving computation, the first node and the at least one second node can respectively substitute all user-related information from their local databases into the first model and the second model to obtain corresponding model prediction values ​​(also known as obfuscation candidate sets), specifically including a first obfuscation candidate set and at least one second obfuscation candidate set. The platform encrypts the identity-related information using a negotiated encryption method and sends the encrypted identity-related information to the first node. After receiving the encrypted identity-related information, the first node sends the encrypted first obfuscation candidate set (i.e., the sixth information) to the platform. Simultaneously, the first node can also send the encrypted identity-related information to the at least one second node, allowing the at least one second node to send at least one encrypted second obfuscation candidate set (i.e., the seventh information) to the platform through the first node. Then, the platform compares the encrypted first obfuscation candidate set and at least one second obfuscation candidate set sent by the first node and at least one second node with the encrypted identity-related information. If encrypted identity-related information is simultaneously in the encrypted obfuscation candidate sets of both the first node and at least one second node, the platform obtains the sub-model prediction values ​​of the identity-related information on the first and second node sides based on the negotiated encryption method (such as OT, OPRF, or homomorphic encryption). Based on the sub-model prediction values ​​on the first and second node sides, and according to the model rules, the platform obtains the final prediction value of the identity-related information. During the above prediction process, the first node and the at least one second node are unaware of the original data of the identity-related information queried by the platform, thus protecting the security of the platform's data.

[0154] In this way, the platform can predict the first user without disclosing the user's identity information, thus ensuring data security on both the platform side and the node side.

[0155] As can be seen from the above description, in this embodiment of the application, different nodes can share data and jointly predict whether a user is a fraudulent user by means of privacy computing technology, without leaving the original data in the database. In this way, the accurate identification of fraudulent users can be achieved.

[0156] Accordingly, embodiments of this application provide a user identification method, applied to the first node, such as... Figure 2 As shown, the method includes:

[0157] Step 201: Receive second information sent by the platform, the second information indicating at least whether the predicted first user is a fraudulent user;

[0158] Step 202: Using the second information, combine at least one second node associated with the first node to predict whether the first user is a fraudulent user;

[0159] Step 203: Send third information to the platform, the third information representing the prediction result for the first user.

[0160] In practical application, in step 201, for newly registered users, the second information includes query-related information of the first user; for historical users, the second information includes identity-related information of the first user. That is, based on the attributes of the first user, the first node can receive the corresponding second information sent by the platform. Then, the first node can work with at least one second node associated with it to predict whether the first user is a fraudulent user; that is, the first node and the at least one second node can jointly predict whether the first user is a fraudulent user.

[0161] Here, when querying the first user through a list for newly registered users, the first node can perform a query based on its local database after receiving the query-related information sent by the platform.

[0162] Specifically, in one embodiment, if fraud-related information matching the query-related information is found in the local database, the third information is sent to the platform.

[0163] In practical applications, the local database can also be called a list database, specifically including a blacklist database and / or a graylist database. The blacklist database contains fraud-related information of at least one user who has committed fraud, and the graylist database contains fraud-related information of at least one user whose fraud probability is greater than a fourth threshold. The fraud probability is determined by the first node based on preset rules. The preset rules can be understood as rules preset by the operator corresponding to the first node, or rules preset by the organization corresponding to the first node. The value of the fourth threshold can be set as needed, such as 0.8. This application embodiment does not limit this.

[0164] In practical applications, if a plaintext query is used, the first node receives the query-related information directly from the platform, presented in plaintext. Then, the first node searches its local database for fraud-related information matching the query-related information to determine if the first user's fraud-related information exists in the local database. If fraud-related information matching the query-related information is found in the local database, the first node can predict that the first user is a fraudster and send the third information to the platform.

[0165] If a privacy-preserving computation method is used for the query, and the first node does not use bucketing technology to divide the data stored in its local database, after receiving the encrypted query-related information sent by the platform, the first node can use a negotiated encryption method to encrypt all the data in its local database to obtain an encrypted obfuscated candidate set, and send the encrypted obfuscated candidate set to the platform so that the platform can determine the prediction result for the first user.

[0166] When the first node uses bucketing technology to divide the data stored in the local database, after receiving the bucket identifier sent by the platform, the first node can use the negotiated encryption algorithm to encrypt all the data in the bucket corresponding to the bucket identifier, obtain the encrypted obfuscation candidate set, and send the encrypted obfuscation candidate set to the platform so that the platform can determine the prediction result for the first user; wherein, the bucket identifier is obtained based on the query related information.

[0167] In practical applications, if the first node does not find any fraud-related information matching the query information in the local database, that is, the fraud-related information of the first user is not in the local database, then the first node needs to query in conjunction with the associated second node.

[0168] Based on this, in one embodiment, if no fraud-related information matching the query-related information is found in the local database, the query-related information is sent to the at least one second node, and fourth information is obtained, wherein the fourth information represents the prediction result of the first node for the first user;

[0169] The system receives at least one fifth piece of information sent by the at least one second node, the fifth piece of information representing the prediction result of the second node for the first user.

[0170] Here, if no fraud-related information matching the query information is found in the local database, the first node can obtain the fourth information, which includes the first node's prediction that the first user is not a fraudulent user. Simultaneously, the first node sends the query-related information to at least one second node to jointly perform the query with the at least one second node.

[0171] Specifically, if a plaintext query is used, the first node can directly send the query-related information to each of the at least one second node, so that each second node can search its local database for fraud-related information that matches the query-related information. For each second node, if a fraud-related information matching the query-related information is found in its local database, the second node can send the fifth information to the first node, the fifth information containing the second node's prediction that the first user is a fraudulent user; if no fraud-related information matching the query-related information is found in its local database, the second node can send the fifth information to the first node, the fifth information containing the second node's prediction that the first user is not a fraudulent user. By sending the fourth information and the at least one fifth information to the platform, the platform can predict whether the first user is a fraudulent user.

[0172] Before predicting the first user using a model prediction method for historical users, it is necessary to train the models on the first node side and the second node side so that the trained models can be used to predict the first user.

[0173] Based on this, in one embodiment, the method may further include:

[0174] Based on PSI, determine the intersection data of the first dataset of the first node and the second dataset of the at least one second node;

[0175] A federated model is trained using the intersection data, the federated model including the first model.

[0176] The first dataset may contain all data stored in the local database of the first node; each second dataset may contain all data stored in the local database of the second node.

[0177] In related technologies, the type of federated model needs to be determined manually, which reduces query efficiency.

[0178] In embodiments of this application, the type of the federated model can be automatically determined by the first node, thereby improving query efficiency. Specifically, based on PSI, the first node can determine the intersection data of the first dataset and the at least one second dataset. The intersection data can be understood as the same data in the first dataset and the second dataset, and the intersection data can include identity-related information (such as user ID) and user characteristics. Based on the determined intersection data, the first node can determine the data overlap, which can be understood as the similarity between the intersection data and the first dataset. Then, based on the data overlap, the first node can determine the type of the federated model (such as a horizontal federated model or a vertical federated model) and synchronize the determined type of the federated model to the at least one second node. The federated model includes a first model of the first node and at least one second model of the at least one second node.

[0179] For example, assuming there are nodes A (i.e., the first node) and B (i.e., the second node), if the data overlap is greater than a fifth threshold (e.g., 0.5), node A can determine that the type of the federated model is horizontal federation and synchronize the determined horizontal federation type to node B. If the data overlap is less than or equal to the fifth threshold, node A can determine that the type of the federated model is vertical federation and synchronize the determined vertical federation type to node B.

[0180] In practical applications, the process of training the federated model may include: the first node and at least one second node performing initialization processing on the first model and at least one second model, respectively; during each iteration, the first node sends encrypted parameters of the first model to the second node, so that the second node updates the parameters of the second model based on the encrypted parameters of the first model; correspondingly, the second node also sends encrypted parameters of the second model to the first node, so that the first node updates the parameters of the first model based on the encrypted parameters of the second model; during the iteration process, if the iteration termination condition is met, the trained first model and second model are obtained, and the iteration termination condition may include the number of iterations reaching a sixth threshold or the federated model reaching a stable state.

[0181] In practical applications, when predicting the first user based on a model prediction method for historical users, after the first node receives the identity-related information sent by the platform, it can work with at least one associated second node to predict whether the first user is a fraudulent user.

[0182] Specifically, in one embodiment, the step of using the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user includes:

[0183] Using the identity-related information and the first model, sixth information is obtained, which represents the prediction result of the first node for the first user; and the identity-related information is sent to the at least one second node.

[0184] Receive at least one seventh message sent by the at least one second node, the seventh message representing the prediction result of the second node for the first user;

[0185] Based on the sixth piece of information and at least one seventh piece of information, predict whether the first user is a fraudulent user.

[0186] Here, in the plaintext prediction process, after the first node receives the identity-related information directly sent by the platform, it uses the first model and the identity-related information to obtain the sixth information. The sixth information may include the first node's prediction value for the first user. Simultaneously, the first node can also send the identity-related information to at least one second node to obtain at least one seventh information using the second model of the at least one second node. The seventh information may include the second node's prediction value for the first user. Then, by sending the sixth information and the at least one seventh information to the platform, the platform can predict whether the first user is a fraudulent user.

[0187] Accordingly, embodiments of this application provide a user identification method, applied to the second node, such as... Figure 3 As shown, the method includes:

[0188] Step 301: Receive second information sent by the first node, the second information indicating at least whether the predicted first user is a fraudulent user;

[0189] Step 302: Use the second information to predict whether the first user is a fraudulent user, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

[0190] In practical applications, when searching for newly registered users by querying a list, if no fraud-related information matching the query information is found in the local database of the first node, the second node can perform a query based on its local database after receiving the query information sent by the first node.

[0191] Specifically, in one embodiment, predicting whether the first user is a fraudulent user using the second information includes:

[0192] Search the local database for fraud-related information that matches the query information to obtain matching results;

[0193] A fifth message is sent to the first node, the fifth message representing the second node's prediction result for the first user.

[0194] In practical applications, if the platform uses a plaintext query method, the second node can receive the query-related information sent by the first node. This query-related information is unencrypted. Then, the second node can search its local database for fraud-related information that matches the query-related information to determine whether the first user's fraud-related information exists in the local database.

[0195] Here, if the second node finds fraud-related information that matches the query-related information in the local database, the second node can predict that the first user is a fraudulent user and send the fifth information to the first node. The fifth information may include the second node's prediction that the first user is a fraudulent user.

[0196] If no fraud-related information matching the query information is found in the local database, the second node can predict that the first user is not a fraudulent user and send the fifth information to the first node. The fifth information may include the second node's prediction that the first user is not a fraudulent user.

[0197] In practical applications, if the platform uses privacy-preserving computation for querying, and the second node does not use bucketing technology to partition the data stored in its local database, after receiving the encrypted query-related information sent by the first node, the second node can use a negotiated encryption method to encrypt all data in its local database, obtaining an encrypted obfuscated candidate set. The second node then sends the encrypted obfuscated candidate set to the first node, which in turn sends it to the platform, allowing the platform to determine the prediction result for the first user.

[0198] If the platform uses privacy-preserving computation for querying, and the second node uses bucketing technology to divide the data stored in its local database, after receiving the bucket identifier sent by the first node, the second node can use a negotiated encryption algorithm to encrypt all the data in the bucket corresponding to the bucket identifier, obtain an encrypted obfuscation candidate set, and send the encrypted obfuscation candidate set to the first node, which then sends it to the platform so that the platform can determine the prediction result for the first user.

[0199] During the prediction of the first user using a model-based prediction method for historical users, the second node can receive the identity-related information sent by the first node to jointly predict whether the first user is a fraudulent user.

[0200] Specifically, in one embodiment, predicting whether the first user is a fraudulent user using the second information includes:

[0201] Using the identity-related information and the second model, predict whether the first user is a fraudulent user;

[0202] A seventh message is sent to the first node, the seventh message representing the prediction result of the second node for the first user.

[0203] In practical applications, during the plaintext prediction process, after the second node receives the identity-related information sent by the first node, it uses the second model and the identity-related information to obtain the seventh information. The seventh information may include the second node's prediction value for the first user. Then, the second node can send the seventh information to the first node, which in turn sends it to the platform, enabling the platform to predict whether the first user is a fraudulent user.

[0204] The user identification method provided in this application embodiment involves a platform determining a strategy for a first user based on the first user's first information; different strategies correspond to different users' first information; wherein the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; predicting whether the first user is a fraudulent user. The solution provided in this application embodiment involves a business system (i.e., the platform) determining different joint anti-fraud strategies for different types of users based on their network access duration, and predicting whether a user is a fraudulent user by combining multiple nodes (such as a first node and a second node) based on the user's joint anti-fraud strategy. That is, different nodes share data and jointly predict whether a user is a fraudulent user, thus enabling accurate identification of fraudulent users.

[0205] The following section provides a more detailed description of this application with reference to application examples.

[0206] This application example proposes an anti-fraud user identification scheme based on a data sharing service network; where, for example... Figure 4 As shown, the data sharing service network in this application example includes a first operator, a second operator, and a third operator. Each operator has a local computing node and a local database. The business system (i.e., the platform mentioned above) is associated with the local node of the first operator. The local node A of the first operator communicates with the local node B of the second operator and the local node C of the third operator through the network.

[0207] Combination Figure 4 This application example is based on a fraud-prevention user identification method using a data sharing service network, such as... Figure 5 As shown, it includes the following steps:

[0208] Step 501: The business system determines whether the user is a new user;

[0209] Here, after a user logs into the business system and enters a query keyword, the business system can retrieve the user's corresponding network access duration from the local database based on the user's login information, and make a judgment based on the user's network access duration.

[0210] Specifically, if the user's network access duration is less than or equal to three months (i.e., the first duration mentioned above), the business system determines that the user is a new user and then executes step 502; if the user's network access duration is more than three months, the business system determines that the user is not a new user but a historical user and then executes step 504.

[0211] Step 502: The business system determines whether to use a blacklist / greylist database to check whether a user has a fraud risk;

[0212] For new users, a blacklist query method is used. Two query methods are supported based on the business system requirements: plaintext API query and anonymous query. Among related technologies, there are many implementation principles and different processes for anonymous queries. This application example demonstrates that the anonymous query process remains unchanged regardless of the encryption method used, supporting multiple methods such as OT, OPRF, and HE, thus exhibiting high applicability.

[0213] Specifically, the process of using blacklists / greylists to check whether a user poses a fraud risk, such as... Figure 6 As shown, it includes the following steps:

[0214] Step 601: The business system determines whether to choose the hidden query method for the query;

[0215] The business system in question is the querying party.

[0216] Here, the business system can determine whether to choose to perform a hidden query based on data security requirements (such as whether the user's query ID can be leaked).

[0217] In practical applications, if the querying party chooses the hidden query method, the querying party will align the keywords with the querying party and then execute step 606; if the querying party chooses the plaintext query method, the querying party will align the keywords with the querying party and then execute step 602.

[0218] Step 602: The queried party generates a black / grey list database API;

[0219] The queried parties include node A of the first operator, node B of the second operator, and node C of the third operator.

[0220] In practical applications, nodes A, B, and C generate corresponding APIs based on their local blacklist / greylist databases. Next, step 603 is executed.

[0221] Step 603: The queried party sends the generated API path to the business system; then, proceed to step 604;

[0222] Step 604: The business system sends the user's query ID to the queried party;

[0223] In this process, the business system sends the user's query ID to node A via the API path, enabling node A to determine whether the user is in its local blacklist / greylist database. If the user is in the local blacklist / greylist database, step 605 is executed; otherwise, node A sends the query ID to nodes B and C to perform a query using their local blacklist / greylist databases, and then executes step 605.

[0224] Step 605: The queried party returns the query results to the business system;

[0225] In practical applications, if node A determines that the user is in the local blacklist / greylist database, node A will return the query results to the business system. If node A determines that the user is not in the local blacklist / greylist database, node A will receive the query results from nodes B and C, and then return the query results from nodes A, B, and C to the business system.

[0226] Step 606: The queried party generates a black / grey list to conceal the query API;

[0227] In this process, nodes A, B, and C generate hidden query APIs based on their local blacklist / greylist databases. Next, step 607 is executed.

[0228] Step 607: The queried party sends the API path to the business system;

[0229] Step 608: The business system sends an encrypted query ID to the queried party;

[0230] Here, the business system will negotiate the encryption method with the queried party, and use the negotiated encryption method to encrypt the query ID to obtain the encrypted query ID, and send the encrypted query ID to node A.

[0231] Step 609: The business system in the queried direction returns an obfuscation candidate set;

[0232] In practical applications, after receiving the encrypted query ID, if the local data of node A does not exceed the threshold, it will use the negotiated encryption method to encrypt all local data to obtain an encrypted obfuscation candidate set, and then send the encrypted obfuscation candidate set to the business system.

[0233] If node A's local data exceeds the threshold, bucketing will be used to divide the local data into different buckets. Correspondingly, the business system will also use the same bucketing technique, using a query ID to determine the corresponding bucket number and sending the bucket number to node A. This allows node A to encrypt the data corresponding to the bucket number and then feed back the encrypted obfuscation candidate set to the business system.

[0234] Similarly, node A can send the encrypted query ID to nodes B and C to obtain the corresponding candidate sets through nodes B and C. Then, node A feeds back the obfuscated candidate sets corresponding to nodes A, B, and C to the business system.

[0235] Step 610: The business system determines whether the query ID is in the obfuscation candidate set;

[0236] If the query ID is in the obfuscation candidate set, proceed to step 611; otherwise, proceed to step 616.

[0237] In practical applications, business systems use blinded RSA or homomorphic encryption to obtain the intersection of the encrypted query ID and the encrypted obfuscation candidate set. If the intersection can be determined, it means that the query ID is in the obfuscation candidate set. If the intersection is empty, it means that the query ID is not in the obfuscation candidate set.

[0238] Step 611: The business system determines the position S of the query ID in the obfuscation candidate set; then, it executes step 612.

[0239] Step 612: The business system determines whether it is necessary to provide feedback on the user characteristics corresponding to location S;

[0240] If it is determined that the user characteristics corresponding to S need to be fed back, then step 613 is executed; otherwise, step 616 is executed.

[0241] Step 613: The business system sends location S to the queried party, so that the queried party can determine the data corresponding to location S in the encrypted obfuscation candidate set based on location S, and then execute step 614.

[0242] Here, the business system uses methods such as unintentional transmission, OPRF, and homomorphic encryption to obtain the feature information corresponding to the location S of the queried party, while the feature information of other locations cannot be obtained.

[0243] Step 614: The queried party sends specific data to the business system;

[0244] Step 615: The business system receives the data corresponding to location S sent by the queried party, and then executes step 616;

[0245] Step 616: End the current process.

[0246] Step 503: Node A sends the query results to the business system;

[0247] The query results include the results returned by node A in steps 605 and 609 above.

[0248] Step 504: The business system determines to use a joint prediction library to predict whether a user has a fraud risk;

[0249] The joint prediction library includes a federated model prediction library.

[0250] For historical users, their historical behavioral characteristics are used to identify fraud risks in a joint anti-fraud model. Traditional joint modeling processes involve manual confirmation of the federated learning type, and the training processes for horizontal and vertical federation are inconsistent. In the process proposed in this application example, nodes automatically select the modeling type based on overlap and unify the training processes for horizontal and vertical federation, achieving automated modeling and reducing human intervention. Furthermore, by improving the model prediction process, the business system uses a hidden query method to obtain the prediction results of different institutional sub-models and merges them to obtain the final federated model prediction result. This protects the business system's data from being leaked to the nodes while the business system completes its prediction function.

[0251] Specifically, the process of predicting whether a user has a fraud risk using a joint prediction library, such as... Figure 7 As shown, it includes the following steps:

[0252] Step 701: Node A and Node B use PSI to obtain the user ID and feature intersection, and then proceed to step 702;

[0253] Step 702: Node A calculates the overlap between the user ID and the feature intersection based on the intersection results, and then executes step 703;

[0254] Step 703: Node A determines the type of federated model based on the degree of overlap;

[0255] In this context, node A can determine the type of federated model by setting thresholds. For example, different joint modeling types can be used when the overlap between features and users is within different threshold ranges.

[0256] Step 704: Node A sends the type of federated model to Node B;

[0257] Step 705: Node A prepares the model according to the type of federated model;

[0258] Model preparation can be understood as node A initiating a horizontal federated model or a vertical federated model.

[0259] Step 706: Node B prepares the model according to the type of federated model;

[0260] Model preparation can be understood as node B initiating a horizontal federation model or a vertical federation model.

[0261] It should be noted that the execution order of steps 705 and 706 is not important.

[0262] Step 707: Node A initializes its local sub-model; then, proceed to step 709.

[0263] Step 708: Node B initializes its local sub-model;

[0264] It should be noted that the execution order of steps 707 and 708 is not important.

[0265] Step 709: During the iteration process, node A and node B interact with the encrypted model parameters in each iteration to update their local sub-models respectively;

[0266] In practical applications, nodes A and B use methods such as federated averaging to aggregate encrypted model parameters from different nodes in order to update the local sub-model.

[0267] Step 710: Node A determines that the local model is stable;

[0268] Step 711: Node B determines that the local model is stable;

[0269] It should be noted that the execution order of steps 710 and 711 is not important.

[0270] Step 712: Node A inputs the local dataset into the local model to obtain the sub-model prediction values;

[0271] Step 713: Node B inputs the local dataset into the local model to obtain the sub-model prediction values;

[0272] Step 714: The business system sends the encrypted user ID to node A;

[0273] Step 715: After receiving the encrypted user ID, node A sends the encrypted user ID to node B at the same time, and uses the encrypted user ID to determine the corresponding sub-model prediction value.

[0274] Step 716: Node A sends the predicted value of its sub-model to the business platform;

[0275] Step 717: After receiving the encrypted user ID, node B uses the encrypted user ID to determine the corresponding sub-model prediction value, and sends the sub-model prediction value of node B to the business platform through node A.

[0276] Step 718: The business system obtains the final predicted value based on the sub-model predicted value of node A and the sub-model predicted value of node B, and then executes step 719;

[0277] Step 719: End the current process.

[0278] Step 505: Node A sends the prediction results to the business system.

[0279] The prediction results include the results returned by node A in steps 716 and 717 above.

[0280] In this application example, different identification schemes are used based on user attributes, which can not only predict whether historical users are fraudulent users, but also whether new users are fraudulent users.

[0281] Secondly, the federated model prediction process proposed in this application example involves the business system using an implicit prediction method to obtain the sub-model prediction results corresponding to different operators. The final federated model prediction result is obtained by combining the prediction results of these different sub-models. In this way, the business system can obtain the predicted value of the query ID without disclosing the query ID, protecting the data security of both the business system and the data provider (i.e., the operator). Furthermore, the process proposed in this application example merges keyword queries and key feature queries, ensuring that the process remains consistent regardless of the implementation scheme, thus not increasing operational complexity.

[0282] In addition, this application example, by unifying the vertical and horizontal prediction processes, can protect business systems from leaking user IDs and also protect operator data.

[0283] To implement the platform-side method of this application embodiment, this application embodiment also provides a user identification device, which is installed on the platform, such as... Figure 8 As shown, the device includes:

[0284] The first processing unit 801 is used to determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and in each strategy, at least two nodes jointly predict whether the user is a fraudulent user;

[0285] The first prediction unit 802 is used to predict whether the first user is a fraudulent user.

[0286] In one embodiment, the first prediction unit 802 is configured to:

[0287] Send a second message to the first node, the second message indicating at least whether the first user is a fraudulent user, and the first node and at least one associated second node jointly predict whether the first user is a fraudulent user;

[0288] Receive third information sent by the first node, wherein the third information represents the prediction result for the first user;

[0289] Use third-party information to predict whether the first user is a fraudulent user.

[0290] In one embodiment, the first processing unit 801 is further configured to determine the first information of the first user.

[0291] In practical applications, the first processing unit 801 and the first prediction unit 802 can be implemented by the processor in the user identification device in conjunction with the communication interface.

[0292] To implement the method on the first node side of this application embodiment, this application embodiment also provides a user identification device, which is disposed on the first node, such as... Figure 9 As shown, the device includes:

[0293] The first receiving unit 901 is used to receive second information sent by the platform, the second information indicating at least whether the first user is predicted to be a fraudulent user;

[0294] The second prediction unit 902 is used to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user.

[0295] The sending unit 903 is used to send third information to the platform, the third information representing the prediction result for the first user.

[0296] In one embodiment, the second prediction unit 902 is configured to:

[0297] Using the identity-related information and the first model, sixth information is obtained, which represents the prediction result of the first node for the first user; and the identity-related information is sent to the at least one second node.

[0298] Receive at least one seventh message sent by the at least one second node, the seventh message representing the prediction result of the second node for the first user;

[0299] Based on the sixth piece of information and at least one seventh piece of information, predict whether the first user is a fraudulent user.

[0300] In one embodiment, the second prediction unit 902 is further configured to:

[0301] Based on PSI, determine the intersection data of the first dataset of the first node and at least one second dataset of the at least one second node;

[0302] A federated model is trained using the intersection data, the federated model including the first model.

[0303] In practical applications, the first receiving unit 901 and the sending unit 903 can be implemented by the communication interface in the user identification device; the second prediction unit 902 can be implemented by the processor in the user identification device in combination with the communication interface.

[0304] To implement the method on the second node side of this application embodiment, this application embodiment also provides a user identification device, which is disposed on the second node, such as... Figure 10 As shown, the device includes:

[0305] The second receiving unit 1001 is used to receive second information sent by the first node, the second information indicating at least whether the first user is predicted to be a fraudulent user;

[0306] The third prediction unit 1002 is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

[0307] The third prediction unit 1002 is used for:

[0308] Search the local database for fraud-related information that matches the query information to obtain matching results;

[0309] A fifth message is sent to the first node, the fifth message representing the second node's prediction result for the first user.

[0310] In one embodiment, the third prediction unit 1002 is configured to:

[0311] Using the identity-related information and the second model, predict whether the first user is a fraudulent user;

[0312] A seventh message is sent to the first node, the seventh message representing the prediction result of the second node for the first user.

[0313] In practical applications, the second receiving unit 1001 can be implemented by the communication interface in the user identification device; the third prediction unit 1002 can be implemented by the processor in the user identification device in combination with the communication interface.

[0314] It should be noted that the user identification device provided in the above embodiments is only illustrated by the division of the above program modules when performing user identification. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the user identification device and the user identification method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0315] Based on the hardware implementation of the above program modules, and in order to implement the platform-side method of the embodiments of this application, the embodiments of this application also provide a platform, such as... Figure 11 As shown, the platform 1100 includes:

[0316] The first communication interface 1101 is capable of exchanging information with the first node;

[0317] The first processor 1102 is connected to the first communication interface 1101 to enable information interaction with the first node and to execute the methods provided by one or more technical solutions on the platform side when running a computer program.

[0318] The computer program is stored in the first memory 1103.

[0319] Specifically, the first processor 1102 is used for:

[0320] The strategy for the first user is determined based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy;

[0321] Predict whether the first user is a fraudulent user.

[0322] In one embodiment, the first processor 1102 is configured to:

[0323] The first node sends second information to the first node through the first communication interface 1101. The second information at least indicates whether the first user is a fraudulent user. The first node and at least one associated second node jointly predict whether the first user is a fraudulent user.

[0324] The third information sent by the first node is received through the first communication interface 1101, and the third information represents the prediction result for the first user;

[0325] Use third-party information to predict whether the first user is a fraudulent user.

[0326] In one embodiment, the first processor 1102 is further configured to determine first information of the first user.

[0327] It should be noted that the specific processing procedures of the first processor 1102 and the first communication interface 1101 can be understood by referring to the above method.

[0328] Of course, in practical applications, the various components in platform 1100 are coupled together through bus system 1104. It can be understood that bus system 1104 is used to implement communication between these components. In addition to a data bus, bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 11 The general designated all buses as Bus System 1104.

[0329] The first memory 1103 in this embodiment is used to store various types of data to support the operation of the platform 1100. Examples of such data include any computer program used to operate on the platform 1100.

[0330] The methods disclosed in the above embodiments of this application can be applied to the first processor 1102, or implemented by the first processor 1102. The first processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 1102. The first processor 1102 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 1102 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 1103. The first processor 1102 reads the information in the first memory 1103 and completes the steps of the aforementioned method in combination with its hardware.

[0331] In an exemplary embodiment, platform 1100 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned methods.

[0332] Based on the hardware implementation of the above program modules, and in order to implement the method on the first node side of the embodiments of this application, the embodiments of this application also provide a first node, such as... Figure 12 As shown, the first node 1200 includes:

[0333] The second communication interface 1201 is capable of exchanging information with the platform and the second node;

[0334] The second processor 1202 is connected to the second communication interface 1201 to enable information interaction with the platform and the second node, and to execute the methods provided by one or more technical solutions on the first node side when running a computer program;

[0335] The computer program is stored in the second memory 1203.

[0336] Specifically, the second communication interface 1001 is used to receive second information sent by the platform, the second information indicating at least whether the first user is a fraudulent user; and to send third information to the platform, the third information representing the prediction result for the first user;

[0337] The second processor 1202 is used to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user.

[0338] In one embodiment, the second processor 1202 is configured to use the identity-related information and the first model to obtain sixth information, wherein the sixth information represents the prediction result of the first node for the first user;

[0339] The second communication interface is further configured to send the identity-related information to the at least one second node; and to receive at least one seventh piece of information sent by the at least one second node, the seventh piece of information representing the prediction result of the second node for the first user;

[0340] The second processor 1202 is used to predict whether the first user is a fraudulent user based on the sixth information and the at least one seventh information.

[0341] In one embodiment, the second processor 1202 is further configured to:

[0342] Based on PSI, determine the intersection data of the first dataset of the first node and the second dataset of the at least one second node;

[0343] A federated model is trained using the intersection data, the federated model including the first model.

[0344] It should be noted that the specific processing procedures of the second processor 1202 and the second communication interface 1201 can be understood by referring to the above method.

[0345] Of course, in practical applications, the various components in the first node 1200 are coupled together through the bus system 1204. It can be understood that the bus system 1204 is used to implement communication between these components. In addition to the data bus, the bus system 1204 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 12 The general designated all buses as Bus System 1204.

[0346] The second memory 1203 in this embodiment is used to store various types of data to support the operation of the first node 1200. Examples of such data include any computer program used to operate on the first node 1200.

[0347] The methods disclosed in the embodiments of this application can be applied to the second processor 1202, or implemented by the second processor 1202. The second processor 1202 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the second processor 1202. The second processor 1202 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1202 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the second memory 1203. The second processor 1202 reads the information in the second memory 1203 and completes the steps of the aforementioned method in combination with its hardware.

[0348] In an exemplary embodiment, the first node 1200 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0349] Based on the hardware implementation of the above program modules, and in order to implement the method on the second node side of the embodiments of this application, the embodiments of this application also provide a second node, such as... Figure 13 As shown, the second node 1300 includes:

[0350] The third communication interface 1301 is capable of interacting with the first node;

[0351] The third processor 1302 is connected to the third communication interface 1301 to interact with the first node and execute the methods provided by one or more technical solutions on the second node side when running a computer program.

[0352] The computer program is stored in the third memory 1303.

[0353] Specifically, the third communication interface 1301 is used to receive second information sent by the first node, the second information indicating at least whether the first user is a fraudulent user;

[0354] The third processor 1302 is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

[0355] In one embodiment, the third processor 1302 is used to search a local database for fraud-related information that matches the query-related information, and obtain a matching result;

[0356] The third communication interface 1301 is also used to send fifth information to the first node, the fifth information representing the second node's prediction result for the first user.

[0357] In one embodiment, the third processor 1302 is used to predict whether the first user is a fraudulent user by utilizing the identity-related information and the second model;

[0358] The third communication interface 1301 is also used to send seventh information to the first node, the seventh information representing the prediction result of the second node for the first user.

[0359] It should be noted that the specific processing procedures of the third processor 1302 and the third communication interface 1301 can be understood by referring to the above method.

[0360] Of course, in practical applications, the various components in the second node 1300 are coupled together through the bus system 1304. It can be understood that the bus system 1304 is used to implement communication between these components. In addition to the data bus, the bus system 1304 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 13 The general designated all buses as Bus System 1304.

[0361] The third memory 1303 in this embodiment is used to store various types of data to support the operation of the second node 1300. Examples of such data include any computer program used to operate on the second node 1300.

[0362] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the third processor 1302. The third processor 1302 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the software form of the third processor 1302. The third processor 1302 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1302 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a third memory 1303. The third processor 1302 reads information from the third memory 1303 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0363] In an exemplary embodiment, the second node 1300 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0364] It is understood that the memories (first memory 1103, second memory 1203, and third memory 1303) in the embodiments of this application can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache.By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM). The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memory.

[0365] To implement the method provided in the embodiments of this application, the embodiments of this application also provide a user identification system, such as... Figure 14 As shown, the system includes: platform 1401, first node 1402 and at least one second node 1403.

[0366] It should be noted that the specific processing procedures of platform 1401, first node 1402 and second node 1403 have been detailed above and will not be repeated here.

[0367] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium. For example, it may include a first memory 1103 storing a computer program, which can be executed by a first processor 1102 of platform 1100 to complete the steps described in the aforementioned platform-side method. Another example is a second memory 1203 storing a computer program, which can be executed by a second processor 1202 of first node 1200 to complete the steps described in the aforementioned first-node-side method. Yet another example is a third memory 1303 storing a computer program, which can be executed by a third processor 1302 of second node 1300 to complete the steps described in the aforementioned second-node method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0368] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0369] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0370] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A user identification method, characterized in that, Applied to platforms, including: The strategy for the first user is determined based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; the first information is used to classify users into new users and historical users; the strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. Predict whether the first user is a fraudulent user.

2. The method according to claim 1, characterized in that, The prediction of whether the first user is a fraudulent user includes: Send a second message to the first node, the second message indicating at least whether the first user is a fraudulent user, and the first node and at least one associated second node jointly predict whether the first user is a fraudulent user; Receive third information sent by the first node, wherein the third information represents the prediction result for the first user; Use third-party information to predict whether the first user is a fraudulent user.

3. The method according to claim 1, characterized in that, The method further includes: Determine the first information of the first user.

4. The method according to any one of claims 1 to 3, characterized in that, The first information of the first user includes that the duration of the first user's network access is less than or equal to a first duration; the strategy for the first user includes confirming whether the user is a fraudulent user by querying a list.

5. The method according to claim 4, characterized in that, The second information includes query-related information from the first user.

6. The method according to claim 4, characterized in that, Search using plaintext; or, The query uses privacy-preserving computation.

7. The method according to any one of claims 1 to 3, characterized in that, The first information of the first user includes that the duration of the first user's network access is greater than the first duration, and the strategy for the first user includes confirming whether the user is a fraudulent user through model prediction.

8. The method according to claim 7, characterized in that, The second information includes identity-related information of the first user.

9. The method according to claim 7, characterized in that, Predict using plaintext; or, Predictions are made using privacy-preserving computation methods.

10. A user identification method, characterized in that, Applied to the first node, including: The receiving platform sends a second message, which at least indicates whether the first user is a fraudulent user. The second message is sent based on a strategy for the first user. The strategy for the first user is determined based on the first message for the first user. The first message is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. Using the second information, and combining it with at least one second node associated with the first node, it is predicted whether the first user is a fraudulent user; A third message is sent to the platform, the third message representing the prediction result for the first user.

11. The method according to claim 10, characterized in that, The second information includes query-related information from the first user.

12. The method according to claim 11, characterized in that, Search using plaintext; or, The query uses privacy-preserving computation.

13. The method according to claim 11, characterized in that, If fraud-related information matching the query information is found in the local database, the third information is sent to the platform.

14. The method according to claim 11, characterized in that, If no fraud-related information matching the query-related information is found in the local database, the query-related information is sent to the at least one second node, and fourth information is obtained, wherein the fourth information represents the prediction result of the first node for the first user; The system receives at least one fifth piece of information sent by the at least one second node, the fifth piece of information representing the prediction result of the second node for the first user.

15. The method according to claim 10, characterized in that, The second information includes identity-related information of the first user.

16. The method according to claim 15, characterized in that, Predict using plaintext; or, Predictions are made using privacy-preserving computation methods.

17. The method according to claim 15, characterized in that, The step of using the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user includes: Using the identity-related information and the first model, sixth information is obtained, which represents the prediction result of the first node for the first user; and the identity-related information is sent to the at least one second node. Receive at least one seventh message sent by the at least one second node, the seventh message representing the prediction result of the second node for the first user; Based on the sixth piece of information and at least one seventh piece of information, predict whether the first user is a fraudulent user.

18. The method according to claim 17, characterized in that, The method further includes: Based on the privacy set intersection PSI, the intersection data of the first dataset of the first node and at least one second dataset of the at least one second node is determined; A federated model is trained using the intersection data, the federated model including the first model.

19. A user identification method, characterized in that, Applied to the second node, including: The system receives second information sent by the first node. The second information at least indicates whether the first user is a fraudulent user. The second information is sent based on a strategy for the first user. The strategy for the first user is determined based on the first information of the first user. The first information is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The second information is used to predict whether the first user is a fraudulent user, so as to achieve the joint prediction of whether the first user is a fraudulent user by the first node.

20. The method according to claim 19, characterized in that, The second information includes query-related information from the first user.

21. The method according to claim 20, characterized in that, The step of using the second information to predict whether the first user is a fraudulent user includes: Search the local database for fraud-related information that matches the query information to obtain matching results; A fifth message is sent to the first node, the fifth message representing the second node's prediction result for the first user.

22. The method according to claim 21, characterized in that, Search using plaintext; or, The query uses privacy-preserving computation.

23. The method according to claim 19, characterized in that, The second information includes identity-related information of the first user.

24. The method according to claim 23, characterized in that, The step of using the second information to predict whether the first user is a fraudulent user includes: Using the identity-related information and the second model, predict whether the first user is a fraudulent user; A seventh message is sent to the first node, the seventh message representing the prediction result of the second node for the first user.

25. The method according to claim 24, characterized in that, Predict using plaintext; or, Predictions are made using privacy-preserving computation methods.

26. A user identification device, characterized in that, The settings on the platform include: The first processing unit is used to determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein, the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; the first information is used to classify users into new users and historical users; the strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The first prediction unit is used to predict whether the first user is a fraudulent user.

27. A user identification device, characterized in that, Set in the first node, including: The first receiving unit is used to receive second information sent by the platform. The second information at least indicates whether the first user is a fraudulent user. The second information is sent based on a strategy for the first user. The strategy for the first user is determined based on the first information of the first user. The first information is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The second prediction unit is used to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user. A sending unit is used to send third information to the platform, the third information representing the prediction result for the first user.

28. A user identification device, characterized in that, The second node is configured to include: The second receiving unit is used to receive second information sent by the first node. The second information at least indicates whether the first user is a fraudulent user. The second information is sent based on a strategy for the first user. The strategy for the first user is determined based on the first information of the first user. The first information is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The third prediction unit is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

29. A platform, characterized in that, include: A first processor and a first communication interface; wherein... The first processor is configured to determine a strategy for the first user based on the first user's first information; different strategies correspond to different users' first information; wherein the first user's first information is associated with the first user's network access duration, and at least two nodes jointly predict whether the user is a fraudulent user in each strategy; the first information is used to classify users into new users and historical users; the strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model; and to predict whether the first user is a fraudulent user.

30. A first node, characterized in that, include: A second processor and a second communication interface; wherein... The second communication interface is used to receive second information sent by the platform. The second information at least indicates whether the first user is a fraudulent user. The second information is sent based on a strategy for the first user. The strategy for the first user is determined based on the first information of the first user. The first information is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The second processor is configured to use the second information, in conjunction with at least one second node associated with the first node, to predict whether the first user is a fraudulent user; and to send third information to the platform, the third information representing the prediction result for the first user.

31. A second node, characterized in that, include: A third processor and a third communication interface; wherein... The third communication interface is used to receive second information sent by the first node. The second information at least indicates whether the first user is a fraudulent user. The second information is sent based on a strategy for the first user. The strategy for the first user is determined based on the first information of the first user. The first information is used to classify users into new users and historical users. The strategy for new users includes a list database query, and the strategy for historical users includes a federated learning model. The third processor is used to predict whether the first user is a fraudulent user using the second information, so as to achieve joint prediction of whether the first user is a fraudulent user by the first node.

32. A platform, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 9.

33. A first node, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 10 to 18.

34. A second node, characterized in that, include: A third processor and a third memory for storing computer programs that can run on the processor. When the third processor runs the computer program, it performs the steps of the method according to any one of claims 19 to 25.

35. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9, or the steps of the method according to any one of claims 10 to 18, or the steps of the method according to any one of claims 19 to 25.

Citation Information

Patent Citations

  • Identification method and device, electronic equipment and computer storage medium

    CN115330529A

  • Systems and methods for identifying synthetic identities associated with network communications

    US20220247754A1