A method, device, equipment and storage medium for real-time detection of user data

Abstract

The present disclosure provides a method, apparatus, device and storage medium for real-time detection of user data, wherein the method comprises: obtaining first operation feature data of a first user within a first time period, marking the first operation feature data based on a behavior feature, and matching the first operation feature data with the behavior feature based on the mark; if the match is successful, splitting the behavior feature according to the behavior stage to obtain a behavior path feature, summarizing the first operation feature data based on the behavior path feature to obtain a node portrait composed of at least one node feature; obtaining a blacklist and whitelist library of an account, using the first operation feature data and the node portrait as training data, and establishing a training model based on the blacklist and whitelist library; obtaining real-time account data of a second user, inputting the account data into the training model, and generating a risk determination result.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular to a method, device, equipment and storage medium for real-time detection of user data. Background Art

[0002] Currently, in the business scenario of telecommunications fraud prevention and control, the banking industry mainly relies on business experts to conduct direct manual review of account transaction details and transaction characteristics or to build expert rules for identification.

[0003] When business experts conduct audits directly, different experts have different evaluation criteria, which leads to high subjectivity and poor stability of the audit results. On the other hand, because the audit volume is often large, the efficiency of the audit is very low, which is completely unsuitable for the current business scenario requirements of large-scale electronic or electronic banking records. Summary of the invention

[0004] The present disclosure provides a method, device, equipment and storage medium for real-time detection of user data to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present disclosure, a method for real-time detection of user data is provided, the method comprising:

[0006] Acquire first operation feature data of a first user in a first time period, mark the first operation feature data based on a behavior feature, and match the first operation feature data with the behavior feature based on the mark;

[0007] If the match is successful, the behavior feature is split according to the behavior stage to obtain a behavior path feature, and the first operation feature data is summarized based on the behavior path feature to obtain a node portrait composed of at least one node feature;

[0008] Obtain a blacklist and whitelist library of an account, use the first operation feature data and the node portrait as training data, and establish a training model based on the blacklist and whitelist library;

[0009] Acquire real-time account data of the second user, input the account data into the training model, and generate a risk determination result.

[0010] In one possible implementation manner, the acquiring first operation characteristic data of the first user in a first time period, and marking the first operation characteristic data based on the behavior characteristic, includes:

[0011] Splitting the first time period into a second time period, a third time period and a fourth time period;

[0012] The first operation characteristic data includes: second operation characteristic data, abnormal operation characteristic data and processing characteristic data;

[0013] Acquire second operation characteristic data of the first user based on the second time period and acquire abnormal operation characteristic data of the first user based on the third time period;

[0014] Processing feature data of the first user is acquired based on the fourth time period, and the processing feature data is marked based on the behavior feature.

[0015] In one possible implementation, the matching the first operation feature data with the behavior feature based on the tag further includes:

[0016] If the match fails, adding the first user to the blacklist library in the blacklist library;

[0017] If the first user already exists in the blacklist database, the behavior data features of the first user are obtained, the behavior data features are identified based on the behavior features, a new behavior feature is established, and the new behavior feature is merged with the behavior feature.

[0018] In one possible implementation, obtaining a node portrait composed of at least one node feature further includes:

[0019] Annotating the node portrait based on experience, and judging the node portrait based on the annotation;

[0020] If the determination result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the blacklist and whitelist library;

[0021] If the determination result is a white sample, the first user corresponding to the node portrait is added to the white list library in the black and white list library.

[0022] In one possible implementation manner, the acquiring the real-time account data of the second user, inputting the account data into the training model, and generating the risk determination result includes:

[0023] extracting real-time processing feature data of the account data based on the behavior feature, matching the real-time processing feature data with the behavior feature, and establishing a node profile of the second user based on the matching result;

[0024] The node portrait of the second user is input into the training model to generate a risk determination result.

[0025] According to a second aspect of the present disclosure, a real-time detection device for user data is provided, the device comprising:

[0026] A feature extraction module, used to obtain first operation feature data of a first user within a first time period;

[0027] a behavior feature matching module, configured to mark the first operation feature data based on the behavior feature, and match the first operation feature data with the behavior feature based on the mark;

[0028] A node portrait summarization module is used for, if the match is successful, splitting the behavior feature according to the behavior stage to obtain the behavior path feature, summarizing the first operation feature data based on the behavior path feature to obtain a node portrait composed of at least one node feature;

[0029] A model building module, used to obtain a blacklist and whitelist library of an account, use the first operation feature data and the node portrait as training data, and build a training model based on the blacklist and whitelist library;

[0030] The inference module is used to obtain the real-time account data of the second user, input the account data into the training model, and generate a risk determination result.

[0031] In one possible implementation, the feature extraction module is further used to split the first time period into a second time period, a third time period and a fourth time period; the first operation feature data includes: second operation feature data, abnormal operation feature data and processing feature data; the second operation feature data of the first user is obtained based on the second time period and the abnormal operation feature data of the first user is obtained based on the third time period; the processing feature data of the first user is obtained based on the fourth time period, and the processing feature data is marked based on the behavior feature;

[0032] The reasoning module is also used to extract real-time processing feature data of the account data based on the behavioral characteristics, match the real-time processing feature data with the behavioral characteristics, and establish a node portrait of the second user based on the matching results; input the node portrait of the second user into the training model to generate a risk determination result.

[0033] In one embodiment, the device further comprises:

[0034] a behavior feature updating module, configured to add the first user to a blacklist library in the blacklist library if the match fails; if the first user already exists in the blacklist library, obtain the behavior data feature of the first user, identify the behavior data feature based on the behavior feature, establish a new behavior feature, and merge the new behavior feature with the behavior feature;

[0035] A node portrait determination module is used to annotate the node portrait based on experience and to determine the node portrait based on the annotation; if the determination result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the blacklist library; if the determination result is a white sample, the first user corresponding to the node portrait is added to the whitelist library in the blacklist library.

[0036] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0037] at least one processor; and

[0038] a memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present disclosure.

[0040] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the present disclosure.

[0041] The present invention discloses a method, device, equipment and storage medium for real-time detection of user data. The operation characteristics of accounts in different time periods are obtained in segments, compared with existing behavioral characteristics (fraud patterns), and user node portraits are constructed. A training model is established to detect the risk of telecommunications fraud of transaction accounts in real time based on the training model, and the behavioral characteristics (fraud patterns) are continuously updated through data accumulation. The risk results of the account are thus obtained quickly. This avoids the situation where different experts have different judgment scales when direct manual judgment is used, and the efficiency in processing large-scale data is improved. In the telecommunications fraud scenario, while considering the different behavioral characteristics of customers in different time windows, different fraud patterns are adaptively optimized, adjusted and updated, so as to more comprehensively and accurately determine the final account risk situation.

[0042] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0044] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0045] Figure 1 A schematic diagram of the implementation process of a method for real-time detection of user data according to an embodiment of the present disclosure is shown;

[0046] Figure 2 A schematic diagram of the implementation process of a user data model building method according to an embodiment of the present disclosure is shown;

[0047] Figure 3 A schematic diagram of the implementation flow of a method for inference detection of user data according to an embodiment of the present disclosure is shown;

[0048] Figure 4 A schematic diagram of a real-time detection device for user data according to an embodiment of the present disclosure is shown;

[0049] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0050] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0051] Figure 1 FIG. 1 is a schematic diagram showing an implementation flow of a method for real-time detection of user data according to an embodiment of the present disclosure; Figure 1 As shown, a real-time detection method for user data in an embodiment of the present disclosure includes the following steps:

[0052] Step 101: Acquire first operation feature data of a first user in a first time period, mark the first operation feature data based on a behavior feature, and match the first operation feature data with the behavior feature based on the mark.

[0053] In the embodiment of the present disclosure, the first operation characteristic data of the first user in the first time period is obtained, wherein the first user is a user who has been defrauded by telecommunications, the first time period is a period of time from the time period of the user being defrauded as a node, and the first operation characteristic data includes: second operation characteristic data, abnormal operation characteristic data and processing characteristic data. At the same time, the first time period can be divided into three sections, including: the second time period, the third time period and the fourth time period. The second time period is the time period farthest from the time line of the defrauded time period. The operation of the user account in this time period is generally normal operation, and the corresponding second operation characteristic data is the portrait feature of the user during normal transactions, such as: trusted device, trusted IP, trusted counterparty, trusted transaction time, etc. The third time period occurs in the time period immediately adjacent to the time period of the user being defrauded. During this period, the user is easily induced by the fraudster, and the account has abnormal operation characteristics, including: a large number of abnormal operations such as login, transfer, and fund collection. The fourth time period refers to the property loss time period of the user being defrauded, and the corresponding processing characteristic data includes: login, withdrawal, abnormal operation, transfer, etc. Among them, the processing characteristic data is the data when the user performs transaction processing, and the behavior characteristics refer to the data characteristics of the fraudulent operation on the user.

[0054] In the disclosed embodiment, the processing feature data is marked based on the behavioral features. The behavioral features refer to the dynamic fraud patterns of different operations of the same type obtained by analyzing the account behavior features. The fraud patterns include various features in the fraud process, such as login, abnormal operation, withdrawal, transfer, etc. By marking the behavioral features in the processing feature data, the dynamic operation behavior with randomness is converted into a fraud behavior with a fixed pattern and matched with the fraud pattern existing in the behavioral features.

[0055] Step 102: If the match is successful, the behavior feature is split according to the behavior stage to obtain the behavior path feature, and the first operation feature data is summarized based on the behavior path feature to obtain a node portrait composed of at least one node feature.

[0056] In the disclosed embodiment, the fraud path refers to some fixed operation sequence paths when the user is defrauded. By summarizing the fraud path, the processing feature data in the first operation feature that matches successfully is summarized according to the summarized fraud path to obtain a node portrait composed of at least one node feature. Among them, the node features include: when logging in: whether it is a trusted device, whether it is a trusted time, etc.; when withdrawing cash: whether it is accustomed to withdrawing cash, whether it is accustomed to withdrawing cash at a time, whether it is accustomed to withdrawing cash, etc.; when transferring money: whether the counterparty is credible, whether it is an unfamiliar counterparty, the time interval between transfer and login, etc.

[0057] In the disclosed embodiment, the node portrait is annotated based on experience, wherein the node portrait can be manually judged based on the annotation; if the judgment result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the black and white list library, and the account is deemed to be at risk of being defrauded; if the judgment result is a white sample, the first user corresponding to the node portrait is added to the whitelist library in the black and white list library, and the account is deemed to be not at risk of being defrauded. The manual judgment method can quickly generate a small but high-quality data set, which is helpful for the initial training and verification of the model. In this way, the deficiencies of the model can be quickly discovered and optimized and adjusted, accelerating the iteration process of the project. When the amount of data annotation reaches a certain level, the manual judgment work can be stopped, and the iteration of the method can be realized by using a large amount of data in the black and white list library.

[0058] In the disclosed embodiment, if the match fails, the first user is added to the blacklist library in the blacklist library; if the first user already exists in the blacklist library, the behavior data characteristics of the first user are obtained, the behavior data characteristics are identified based on the behavior characteristics, a new behavior characteristic is established, and the new behavior characteristic is merged with the behavior characteristic. Among them, the blacklist library can be an account with electronic fraud risk obtained through official channels and / or a blacklist of electronic fraud accounts accumulated by the bank itself. Among them, the established new behavior characteristics include a new fraud pattern. After the new behavior characteristics are merged with the behavior characteristics, the update of the fraud pattern in the behavior characteristics is completed.

[0059] Step 103, obtain the blacklist and whitelist library of the account, use the first operation feature data and the node portrait as training data, and establish a training model based on the blacklist and whitelist library.

[0060] In the disclosed embodiments, preferably, the model used is a distributed gradient boosting library model, which is a gradient boosting algorithm based on a decision tree.

[0061] Step 104, obtaining the real-time account data of the second user, inputting the account data into the training model, and generating a risk determination result.

[0062] In the disclosed embodiment, the real-time processing feature data of the account data is extracted based on the behavioral features, the real-time processing feature data is matched with the fraud features, and a node portrait of the second user is established based on the matching results; the node portrait of the second user is input into the training model to generate a risk determination result. The second user is a user who has not entered the black and white list library or an account that conducts transactions in real time. The risk determination result is generally the risk result of the account, that is, the black and white attribute value of the account.

[0063] Figure 2 FIG. 1 is a schematic diagram showing an implementation flow of a method for constructing a user data model according to an embodiment of the present disclosure; Figure 2 As shown, a method for constructing a user data model in an embodiment of the present disclosure includes the following steps:

[0064] Step 201: extracting user feature data.

[0065] In the disclosed embodiment, the characteristic statistics of the account are divided into three stages, namely, the historical information accumulation stage, the account theft / induction stage, and the fraudulent operation stage. These three stages are arranged in chronological order. Among them, the historical information accumulation stage is the stage from 7 days to 3 months before the account was defrauded and suffered property losses. The behavior of the account at this stage is generally normal, so the statistics at this stage are the portrait features of the user during normal transactions. For example: trusted devices, trusted IPs, trusted counterparties, trusted transaction times, etc. It is used to record trusted information and summarize user portraits.

[0066] In the disclosed embodiment, the account theft / induction stage is generally within 7 days before the user suffers property loss. The customer to whom the account belongs in this stage is induced by the fraudster, and a large number of abnormal operations such as login, transfer, and fund collection occur. It may be a transfer between different card accounts of the same customer, or a withdrawal of relatives, friends, funds, and stocks. The trusted counterparty account in the previous stage basically covers the above-mentioned situations. The characteristics mainly include abnormal behavior feature statistics and account information statistical features. Among them, the abnormal login situation includes: first login to online banking, login to online banking in a different place, first login to mobile banking, login to mobile banking in a different place, password modification of online banking, password modification of mobile banking, login to a different place and a new device, modification of transfer limit in a different place, modification of transfer limit, modification of bank-to-card limit, etc. Abnormal collection situations include: loan application, credit card withdrawal, regular redemption, trusted counterparty account transfer, fund wealth management product redemption, same account card collection, etc. Account information statistical features include: total number of logins to the account on the same day, total amount of transfers to the account on the same day, time span of operation on the account on the same day, number of logins to the account in a different place on the same day, total number of transfers to the account on the same day, etc. Achieve marking of abnormal situations in the past 1 / 3 / 7 days.

[0067] In the disclosed embodiment, the fraud operation stage is the stage where the account owner suffers property loss and is also the stage where telecommunications fraud is implemented. The features extracted at this stage include account transaction data, transfer data, payment data, etc., mainly involving feature extraction when the amount is transferred. The feature processing and extraction at this stage will be used for subsequent fraud pattern matching and generating user node portraits.

[0068] In the disclosed embodiment, the features extracted during the historical information accumulation stage, the account theft / induction stage, and the fraudulent operation stage are sorted into feature data collection according to time.

[0069] Step 202, matching the characteristic data with the fraud pattern.

[0070] In the disclosed embodiment, by analyzing the account behavior characteristics, the dynamic pattern behaviors of different operations of the same type are marked and identified, so as to convert the dynamic operation behaviors with randomness into fraud patterns with fixed patterns for classification and identification. Among them, the fraud pattern is composed of fixed behavior characteristics, including: login, withdrawal, abnormal operation, transfer, etc., and different fraud patterns are formed by interspersing other operation characteristics or changing the order of a certain operation characteristic.

[0071] Step 203: Generate a node portrait of the user.

[0072] In the disclosed embodiment, if the above-mentioned fraud pattern successfully matches the characteristic data of the account behavior, the portrait features of the account at different stages of the fraud pattern will be summarized according to the characteristic data of the account behavior to generate a node portrait of the user.

[0073] In the disclosed embodiment, the path characteristics may be: login—withdrawal—transfer, wherein the node characteristics corresponding to the login include: whether it is a trusted device, whether it is a trusted address, whether it is a familiar time, the time interval between the last login, the number of accounts logged into the device in the past 24 hours, etc.; the node characteristics corresponding to the withdrawal include: whether it is a familiar withdrawal, whether it is a familiar withdrawal time, whether it is a familiar withdrawal amount, the withdrawal-login time interval, etc.; the node characteristics corresponding to the transfer include: whether the counterparty is a trusted counterparty, whether it is an unfamiliar counterparty, whether it is a familiar transfer time, whether it is a familiar transfer amount, the transfer-login time interval, the number of accounts transferred into the counterparty in the past 24 hours, the cumulative amount transferred into the counterparty in the past 24 hours, etc.

[0074] Step 204: Determine the account risk based on the node profile.

[0075] In the disclosed embodiment, the node portrait generated by the above module is judged by manual judgment. This method is one of the common methods for dealing with cold start data when there are no available data labels in the early stage of building a real-time detection method for identifying telecommunications fraud based on customer-side behavior. Its advantage is that in the cold start stage of the project, manual judgment can quickly generate a small but high-quality data set, which is helpful for the initial training and verification of the model. In this way, the shortcomings of the model can be quickly discovered and optimized and adjusted, accelerating the iteration process of the project.

[0076] Step 205: construct a blacklist and whitelist set of accounts according to the determination result.

[0077] In the disclosed embodiment, if it is determined to be a black sample, it will be added to the black sample black and white list of the account, proving that the account is indeed at risk of being defrauded; otherwise, it will be added to the white sample list of the account and determined to be free of fraud risk. When the amount of data annotation reaches a certain level, the manual judgment work can be stopped, and the iteration of the method can be realized by using only a large amount of data in the black and white list library.

[0078] Step 206, construct a telecommunications fraud model for determining account fraud risk.

[0079] In the disclosed embodiment, the initially extracted features and generated portrait features are utilized in a supervised scenario with annotated account blacklist and whitelist libraries, and a machine learning method is used. The model used at this stage is the Extreme Gradient Boosting (XGBoost) library, which is a gradient boosting algorithm based on decision trees.

[0080] In the disclosed embodiment, the model is iterated through multiple rounds, and each round of iteration generates a weak classifier, and each classifier is trained based on the residual of the previous round of classifiers. The requirements for weak classifiers are generally simple enough, and have low variance and high deviation. Because the training process is to continuously improve the accuracy of the final classifier by reducing the deviation. Weak classifiers are generally selected as classification and regression trees, and XGBoost also supports linear classifiers. Due to the above high deviation and simple requirements, the depth of each classification and regression tree will not be very deep. The final total classifier is obtained by weighted summing the weak classifiers obtained in each round of training. This algorithm is a mature and widely used model. The specific principles of the model will not be elaborated here.

[0081] In the disclosed embodiment, by training the model, after multiple rounds of iterations, the model will effectively divide each account, thus completing the construction of the telecommunications fraud model.

[0082] Step 207, associate suspicious accounts.

[0083] In the disclosed embodiment, if the above-mentioned characteristic data fails to match the fraud pattern, the account and the account blacklist library are associated with the account number in the electronic fraud detection account blacklist accumulated by the bank itself.

[0084] Step 208: Generate a new fraud model and update the fraud model.

[0085] In the disclosed embodiment, if a high correlation is found after the accounts are linked, the behavioral data features of the suspicious account are extracted, and a new fraud pattern is identified from the behavioral features. After extraction, the above-mentioned fraud pattern is added to complete the update of the fraud pattern.

[0086] In the disclosed embodiment, the fraud model is initially initialized based on the existing business experience, but as the model method is constructed and massive data is input, it will be continuously updated to add the latest fraud models.

[0087] In the disclosed embodiment, the above-mentioned model building method needs to complete a series of tasks in batches with account data, which is an offline operation.

[0088] Figure 3 FIG. 4 is a schematic diagram showing an implementation flow of a method for inferring and detecting user data according to an embodiment of the present disclosure; Figure 3 As shown, a method for inference detection of user data in an embodiment of the present disclosure includes the following steps:

[0089] Step 301, extracting account feature data in real time.

[0090] In the disclosed embodiment, the characteristic data of the transaction account is obtained in real time, including historical characteristic data and real-time characteristic data. Preferably, the historical characteristic data includes the historical transaction data of the account in the past three months. The real-time characteristic data is the characteristic data of the two parties of the current transaction of the user.

[0091] Step 302, matching the fraud pattern with the real-time extracted account feature data.

[0092] In the disclosed embodiment, the characteristic data of the transaction account acquired in real time is matched according to the above-mentioned fraud patterns to check whether the characteristic data of the account conforms to one of the fraud patterns.

[0093] Step 303, construct a node portrait based on the matching results.

[0094] In the disclosed embodiment, after matching, a node profile of the user is constructed based on the characteristic data of the transaction account, including the transaction characteristics of each node.

[0095] Step 304, input the constructed node portrait into the telecommunications fraud model.

[0096] In the disclosed embodiment, the node portrait of the user is input into the telecommunications fraud model constructed above, and the model is used to analyze the risk ratio of telecommunications fraud in the account.

[0097] Step 305: output the account risk result.

[0098] In the disclosed embodiment, based on the above telecommunication fraud model, the risk result of the account, that is, the black and white attribute value of the account is outputted. The risk ratio of the account being defrauded is analyzed based on the black and white attribute value of the account number.

[0099] In the disclosed embodiment, real-time feature generation, model calculation and other operations are performed on the account, and the judgment result of the account is generated online and in real time.

[0100] Figure 4 A schematic diagram of a real-time detection device for user data according to an embodiment of the present disclosure is shown; Figure 4 As shown, a real-time detection device for user data in an embodiment of the present disclosure includes:

[0101] The feature extraction module 401 is used to obtain first operation feature data of a first user within a first time period.

[0102] The feature extraction module 401 is also used to split the first time period into a second time period, a third time period and a fourth time period; the first operation feature data includes: second operation feature data, abnormal operation feature data and processing feature data; the second operation feature data of the first user is obtained based on the second time period and the abnormal operation feature data of the first user is obtained based on the third time period; the processing feature data of the first user is obtained based on the fourth time period, and the processing feature data is marked based on the behavioral characteristics.

[0103] The behavior feature matching module 402 is configured to mark the first operation feature data based on the behavior feature, and match the first operation feature data with the behavior feature based on the mark.

[0104] The node portrait summarizing module 403 is used to split the behavior features according to the behavior stages to obtain behavior path features if the match is successful, and summarize the first operation feature data based on the behavior path features to obtain a node portrait composed of at least one node feature.

[0105] The model building module 404 is used to obtain the blacklist and whitelist library of the account, use the first operation feature data and the node portrait as training data, and build a training model based on the blacklist and whitelist library.

[0106] The reasoning module 405 is used to obtain the real-time account data of the second user, input the account data into the training model, and generate a risk determination result.

[0107] The reasoning module 405 is also used to extract real-time processing feature data of the account data based on the behavioral characteristics, match the real-time processing feature data with the behavioral characteristics, and establish a node portrait of the second user based on the matching results; input the node portrait of the second user into the training model to generate a risk determination result.

[0108] The behavior feature update module 406 is used to add the first user to the blacklist library in the blacklist and whitelist library if the match fails; if the first user already exists in the blacklist library, obtain the behavior data features of the first user, identify the behavior data features based on the behavior features, establish a new behavior feature, and merge the new behavior feature with the behavior feature.

[0109] The node portrait determination module 407 is used to mark the node portrait based on experience and to determine the node portrait based on the marking; if the determination result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the blacklist library; if the determination result is a white sample, the first user corresponding to the node portrait is added to the whitelist library in the blacklist library.

[0110] In an exemplary embodiment, the feature extraction module 401, the behavior feature matching module 402, the node portrait induction module 403, the model building module 404, the reasoning module 405, the behavior feature update module 406, the node portrait determination module 407, etc. can be implemented by one or more central processing units (CPU), graphics processing units (GPU), application specific integrated circuits (ASIC), DSP, programmable logic devices (PLD), complex programmable logic devices (CPLD), field programmable gate arrays (FPGA), general-purpose processors, controllers, microcontrollers (MCU), microprocessors, or other electronic components.

[0111] Regarding the device in the above embodiment, the specific manner in which each module and unit performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0112] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0113] Figure 5A schematic block diagram of an example electronic device 500 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0114] like Figure 5 As shown, the device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0115] A number of components in the device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0116] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as a real-time detection method for user data. For example, in some embodiments, a real-time detection method for user data may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the real-time detection method for user data described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform a real-time detection method for user data in any other appropriate manner (e.g., by means of firmware).

[0117] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0119] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0122] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0123] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0124] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0125] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A real-time detection method for user data, It is characterized in that The method comprises: Acquire first operation characteristic data of a first user in a first time period, mark the first operation characteristic data based on a dynamic pattern, and match the first operation characteristic data with the dynamic pattern based on the mark; If the match is successful, the dynamic pattern is split according to the behavior stage to obtain the behavior path feature, and the first operation feature data is summarized based on the behavior path feature to obtain a node portrait composed of at least one node feature; Obtain a blacklist and whitelist library of an account, use the first operation feature data and the node portrait as training data, and establish a training model based on the blacklist and whitelist library; Acquire real-time account data of the second user, input the account data into the training model, and generate a risk determination result; The first time period is divided into a historical information accumulation stage, an account theft / induction stage, and a property loss stage; the first operation feature data includes: portrait feature data during normal transactions, abnormal operation feature data, and processing feature data; Acquire the portrait feature data of the first user during normal transactions based on the historical information accumulation stage and acquire the abnormal operation feature data of the first user based on the account theft / induction stage; Acquire the processing characteristic data of the first user based on the property loss stage, and mark the processing characteristic data based on the dynamic mode; The matching the first operation characteristic data with the dynamic pattern based on the mark further includes: If the match fails, adding the first user to the blacklist library in the blacklist library; If the first user already exists in the blacklist database, obtaining the behavior data features of the first user, identifying the behavior data features based on the dynamic pattern, establishing a new dynamic pattern, and merging the new dynamic pattern with the dynamic pattern; Wherein, a user portrait is established based on the portrait feature data during the normal transaction, and the user portrait, the abnormal operation feature data and the processing feature data are summarized based on the behavior path feature to obtain the node portrait composed of the at least one node feature; Among them, the historical information accumulation stage, the account theft / induction stage and the property loss stage are arranged in chronological order.

2. The method according to claim 1, It is characterized in that The obtaining of a node portrait composed of at least one node feature also includes: Annotating the node portrait based on experience, and judging the node portrait based on the annotation; If the determination result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the blacklist and whitelist library; If the determination result is a white sample, the first user corresponding to the node portrait is added to the white list library in the black and white list library.

3. The method according to claim 1, It is characterized in that The acquiring real-time account data of the second user, inputting the account data into the training model, and generating a risk determination result includes: extracting real-time processing feature data of the account data based on the dynamic pattern, matching the real-time processing feature data with the dynamic pattern, and establishing a node profile of the second user based on the matching result; The node portrait of the second user is input into the training model to generate a risk determination result.

4. A real-time detection device for user data, It is characterized in that The device comprises: A feature extraction module, used to obtain first operation feature data of a first user within a first time period; The feature extraction module is further used to divide the first time period into a historical information accumulation stage, an account theft / induction stage, and a property loss stage; the first operation feature data includes: portrait feature data during normal transactions, abnormal operation feature data, and processing feature data; the portrait feature data of the first user during normal transactions is obtained based on the historical information accumulation stage, and the abnormal operation feature data of the first user is obtained based on the account theft / induction stage; the processing feature data of the first user is obtained based on the property loss stage, and the processing feature data is marked based on the dynamic mode; A dynamic pattern matching module, configured to mark the first operation characteristic data based on a dynamic pattern, and match the first operation characteristic data with the dynamic pattern based on the mark; A dynamic pattern updating module, configured to add the first user to a blacklist library in the blacklist library if the match fails; if the first user already exists in the blacklist library, obtain the behavior data features of the first user, identify the behavior data features based on the dynamic pattern, establish a new dynamic pattern, and merge the new dynamic pattern with the dynamic pattern; A node portrait summarization module is used for, if the match is successful, splitting the dynamic pattern according to the behavior stage to obtain the behavior path feature, summarizing the first operation feature data based on the behavior path feature to obtain a node portrait composed of at least one node feature; The node portrait summarization module is further used to establish a user portrait based on the portrait feature data during the normal transaction, summarize the user portrait, the abnormal operation feature data and the processing feature data based on the behavior path feature, and obtain the node portrait composed of the at least one node feature; A model building module, used to obtain a blacklist and whitelist library of an account, use the first operation feature data and the node portrait as training data, and build a training model based on the blacklist and whitelist library; The inference module is used to obtain the real-time account data of the second user, input the account data into the training model, and generate a risk determination result.

5. The device according to claim 4, It is characterized in that The inference module is further used to extract real-time processing feature data of the account data based on the dynamic pattern, match the real-time processing feature data with the dynamic pattern, and establish a node profile of the second user based on the matching result; The node portrait of the second user is input into the training model to generate a risk determination result.

6. The device according to claim 4, It is characterized in that The device also includes: A node portrait determination module is used to annotate the node portrait based on experience and to determine the node portrait based on the annotation; if the determination result is a black sample, the first user corresponding to the node portrait is added to the blacklist library in the blacklist library; if the determination result is a white sample, the first user corresponding to the node portrait is added to the whitelist library in the blacklist library.

7. An electronic device, It is characterized in that include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 3.

8. A non-transitory computer-readable storage medium storing computer instructions, It is characterized in that The computer instructions are used to make a computer execute the method according to any one of claims 1-3.

Images