A task behavior identification method, device, equipment and storage medium thereof

Abstract

The present application belongs to the technical field of financial data processing, and relates to a task behavior identification method, apparatus, device and storage medium thereof, including that in the process of task behavior analysis model training and prediction, the training data and the data for subsequent prediction and identification are both in an encrypted state of an improved Bi‑DES encryption algorithm, thereby ensuring the security of financial data when being processed; before model training, the TimeGAN multi-dimensional data augmentation technology is used to augment the training data, thereby avoiding the fact that the trained model is not scientific and accurate enough due to too few positive and negative sample data, thereby ensuring the scientificity and accuracy of the trained task behavior analysis model; during model training, a time series feature analysis model composed of an AC‑LSTNet time series neural network architecture is used to train a task behavior analysis model, which can capture both short-term task features and long-term task features, thereby ensuring the accuracy of subsequent recognition of task features of task data to be predicted.

Description

Technical Field

[0001] The present application relates to the technical field of financial data processing, and in particular to a task behavior identification method, device, equipment and storage medium thereof. Background Art

[0002] Since online payment collection not only covers ordinary two-party purchase transactions, but also includes company or personal tax bills, bills, payrolls, social security forms, water and electricity payment records, etc., it is easy to cause privacy data leakage, resulting in financial regulators being unable to quickly identify abnormal transaction behaviors. However, there are often certain differences between normal transaction data and abnormal transaction data. For example, in terms of transaction time, transactions completed during regular daytime hours may involve fewer abnormal transactions, while users who often receive specific amount transfers or red envelopes sent by unspecified entities during the night to early morning hours are very likely to be illegal transaction entities. Therefore, how to use transaction data to more accurately identify abnormal transactions while ensuring the security of transaction data has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the embodiments of the present application is to propose a task behavior identification method, device, equipment and storage medium thereof, which can use transaction data to more accurately identify abnormal transactions while ensuring the security of transaction data, so as to assist financial regulators in quickly identifying abnormal transactions.

[0004] In order to solve the above technical problems, the present application embodiment provides a task behavior recognition method, which adopts the following technical solution:

[0005] A task behavior identification method comprises the following steps:

[0006] Collecting positive and negative sample data, wherein the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users, and the abnormal task data of blacklist users and the normal task data of whitelist users have been distinguished and marked in advance;

[0007] Preprocessing the positive and negative sample data to obtain model training data;

[0008] Inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by an AC-LSTNet time series neural network architecture;

[0009] Obtain the task data to be predicted;

[0010] The improved Bi-DES encryption algorithm is used to securely encrypt the user privacy data in the task data to be predicted, so as to obtain the encrypted task data to be predicted;

[0011] The encrypted task data to be predicted is input into the trained task behavior analysis model, and the task behavior category corresponding to the task data to be predicted is identified according to the output result of the model.

[0012] Furthermore, the preprocessing of the positive and negative sample data includes:

[0013] According to a preset identification rule, identifying the user privacy data in the task data;

[0014] The user privacy data is securely encrypted using an improved Bi-DES encryption algorithm to obtain encrypted task data;

[0015] The encrypted task data is amplified using a preset amplification technology to obtain amplified task data. Specifically, the preset amplification technology includes a multidimensional data amplification technology based on a TimeGAN model.

[0016] Furthermore, the step of identifying the user privacy data in the task data according to the preset identification rule specifically includes:

[0017] Obtaining a preset private data identification dictionary, wherein the private data identification dictionary contains encoding rules for target private data, and the encoding rules include data length rules and data character rules;

[0018] According to the data length rule and the data character rule, the user privacy data in the task data is identified.

[0019] Furthermore, before executing the step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data, the method further includes:

[0020] Inputting the user privacy data into a preset mask component, and obtaining the masked user privacy data output by the mask component, wherein the mask component includes at least one or more of a partial data mask component, a specific character mask component, and a regularity mask component;

[0021] The step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data specifically includes:

[0022] Using a preset extraction component to extract the user privacy data after the mask processing;

[0023] Inputting the masked user privacy data as encryption parameter values ​​into a preset improved Bi-DES encryption algorithm execution component;

[0024] Running the improved Bi-DES encryption algorithm execution component to obtain the encrypted content output by the improved Bi-DES encryption algorithm execution component;

[0025] The encrypted content is used to replace the corresponding user privacy data in the positive and negative sample data, and the replaced positive and negative sample data are obtained as the encrypted task data.

[0026] Furthermore, before executing the step of amplifying the encrypted task data using a preset amplification technology to obtain the amplified task data, the method further includes:

[0027] According to the distinguishing marks respectively corresponding to the normal task data and the abnormal task data in the positive and negative sample data, identifying the encrypted task data corresponding to the abnormal task data and the encrypted task data corresponding to the normal task data;

[0028] According to the task time sequence, the encrypted task data corresponding to the abnormal task data is processed in a time series to obtain first time series data, and

[0029] Performing time series processing on the encrypted task data corresponding to the normal task data to obtain second time series data;

[0030] The step of amplifying the encrypted task data using a preset amplification technology to obtain the amplified task data specifically includes:

[0031] Inputting the first time series data into a preset TimeGAN model, wherein the preset TimeGAN model refers to a TimeGAN model that has completed adversarial generation training;

[0032] Performing multidimensional feature vector encoding on the first time series data according to the encoder encoding component in the TimeGAN model to obtain a multidimensional feature vector corresponding to the first time series data;

[0033] Performing N decoding processes on the multidimensional feature vector corresponding to the first time series data through the decoder decoding component in the TimeGAN model to obtain N amplified sequences of the first time series data, where N is a positive integer;

[0034] Inputting the second time series data into the TimeGAN model;

[0035] Performing multidimensional feature vector encoding on the second time series data according to the encoder encoding component in the TimeGAN model to obtain a multidimensional feature vector corresponding to the second time series data;

[0036] The multidimensional feature vector corresponding to the second time series data is decoded M times by the decoder decoding component in the TimeGAN model to obtain M amplification sequences of the second time series data, where M is a positive integer.

[0037] Furthermore, before executing the step of inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining the trained task behavior analysis model, the method further includes:

[0038] Integrate the first time series data and N amplified sequences of the first time series data to obtain N+1 pieces of model training data corresponding to the abnormal task data;

[0039] Integrate the second time series data and the M amplified sequences of the second time series data to obtain M+1 pieces of model training data corresponding to the normal task data;

[0040] The step of inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining the trained task behavior analysis model specifically includes:

[0041] Inputting N+1 pieces of model training data corresponding to the abnormal task data into the task behavior analysis model to be trained;

[0042] Capturing the task features of the abnormal task data through the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network;

[0043] deploying the task features of the abnormal task data as abnormal task data identification features to the task behavior analysis model;

[0044] Inputting M+1 pieces of model training data corresponding to the normal task data into the task behavior analysis model to be trained;

[0045] Capturing the task features of the normal task data through the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network;

[0046] Deploying the task features of the normal task data as normal task data identification features to the task behavior analysis model;

[0047] A task behavior analysis model in which both the abnormal task data identification features and the normal task data identification features are deployed is obtained to obtain the trained task behavior analysis model.

[0048] Furthermore, the step of inputting the encrypted task data to be predicted into the trained task behavior analysis model, and identifying the task behavior category corresponding to the task data to be predicted according to the output result of the model, specifically includes:

[0049] Inputting the encrypted task data to be predicted into the trained task behavior analysis model;

[0050] Capturing the task features of the task data to be predicted by the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network in the trained task behavior analysis model;

[0051] Calculating respectively the edit distances between the task feature of the task data to be predicted and the abnormal task data identification feature and the normal task data identification feature;

[0052] Based on the edit distance, a task behavior category corresponding to the to-be-predicted task data is identified, wherein the task behavior category includes a normal task category and an abnormal task category.

[0053] In order to solve the above technical problems, the embodiment of the present application further provides a task behavior recognition device, which adopts the following technical solution:

[0054] A task behavior recognition device, comprising:

[0055] A data collection module, used to collect positive and negative sample data, wherein the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users;

[0056] A data preprocessing module, used to preprocess the positive and negative sample data to obtain model training data;

[0057] A model training module, used for inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by an AC-LSTNet time series neural network architecture;

[0058] The module for obtaining data to be predicted is used to obtain task data to be predicted;

[0059] A data security processing module is used to perform security encryption processing on the user privacy data in the task data to be predicted by using an improved Bi-DES encryption algorithm to obtain the encrypted task data to be predicted;

[0060] The task behavior category identification module is used to input the encrypted task data to be predicted into the trained task behavior analysis model, and identify the task behavior category corresponding to the task data to be predicted according to the output result of the model.

[0061] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0062] A computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the task behavior identification method described above when executing the computer-readable instructions.

[0063] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0064] A computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the task behavior identification method as described above.

[0065] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0066] In the task behavior identification method described in the embodiment of the present application, during the training process of the task behavior analysis model and the subsequent process of using the trained task behavior analysis model to identify the task behavior category of the task data to be predicted, both the training data and the data for subsequent prediction and identification are in an encrypted state of the improved Bi-DES encryption algorithm, thereby ensuring the security of the financial data when it is processed; during model training, a time series feature analysis model composed of an AC-LSTNet time series neural network architecture is used to train the task behavior analysis model, which can capture both short-term task features and long-term task features, thereby ensuring the accuracy of subsequent recognition of the task features of the task data to be predicted. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0069] Figure 2A flowchart of an embodiment of a task behavior identification method according to the present application;

[0070] Figure 3 yes Figure 2 A flowchart of a specific embodiment of step 202 is shown;

[0071] Figure 4 yes Figure 3 A flowchart of a specific embodiment of step 301 is shown;

[0072] Figure 5 yes Figure 3 A flowchart of a specific embodiment of step 302 is shown;

[0073] Figure 6 yes Figure 3 A flowchart of a specific embodiment of step 303 is shown;

[0074] Figure 7 yes Figure 2 A flowchart of a specific embodiment of step 203 is shown;

[0075] Figure 8 yes Figure 2 A flowchart of a specific embodiment of step 205 is shown;

[0076] Fig. 9 yes Figure 2 A flowchart of a specific embodiment of step 206 is shown;

[0077] Fig.10 A structural diagram of an embodiment of a task behavior recognition device according to the present application;

[0078] Fig.11 A schematic structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0079] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0080] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0081] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0082] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0083] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0084] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV), laptop computers, desktop computers, etc.

[0085] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0086] It should be noted that the task behavior identification method provided in the embodiment of the present application is generally executed by a server, and accordingly, the task behavior identification device is generally set in the server.

[0087] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0088] Continue to refer Figure 2 , shows a flow chart of an embodiment of a task behavior identification method according to the present application. The task behavior identification method comprises the following steps:

[0089] Step 201, collecting positive and negative sample data.

[0090] Among them, the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users, and the abnormal task data of blacklist users and the normal task data of whitelist users have been distinguished and marked in advance, the abnormal task data includes abnormal transaction data, and the normal task data includes normal transaction data.

[0091] In this embodiment, the transaction data includes internal factor data used to characterize the transaction situation, such as: transaction volume, transaction amount, transaction time, transaction frequency, transaction subject, transaction method, transaction subject type, etc., and external factor data that affects the transaction situation, such as: market change status, industrial technology upgrading status, etc. The market change status can be jointly predicted by the transaction data of upstream and downstream intermediate products in the same industrial chain within a specific transaction cycle, for example: supply and demand are on an upward trend, commodity unit prices are on an upward trend, etc. The industrial technology upgrading status can be obtained by analyzing the latest industry news, for example: the production mode is converted from manual assembly lines to industrial robots. These external factor data will more or less affect the transaction situation.

[0092] Specifically, the collection of transaction data includes extracting from various income and expenditure detail data sheets such as tax bills, bills, payrolls, social security forms, water and electricity payment records, etc. These income and expenditure detail data sheets contain personal financial information, income status, consumption records and other private data information.

[0093] Step 202: pre-process the positive and negative sample data to obtain model training data.

[0094] Continue to refer Figure 3 , Figure 3 yes Figure 2 The flowchart of a specific embodiment of step 202 shown includes:

[0095] Step 301, identifying user privacy data in the task data according to a preset identification rule;

[0096] In this embodiment, the user privacy data in the task data includes transaction account information, account password, user ID number, enterprise unified social credit code, etc.

[0097] Continue to refer Figure 4 , Figure 4 yes Figure 3 The flowchart of a specific embodiment of step 301 shown includes:

[0098] Step 401, obtaining a preset private data identification dictionary, wherein the private data identification dictionary contains encoding rules for target private data, and the encoding rules include data length rules and data character rules;

[0099] Step 402: Identify user privacy data in the task data according to the data length rule and the data character rule.

[0100] Specifically, taking the user ID number as an example, the privacy data identification dictionary includes the encoding rules of the user ID number, wherein the encoding rules include the length rules of the ID number, the length of the ID number is 18 digits, and the encoding rules also include the character rules in the ID number, for example: the first two digits represent the provincial administrative division identification code, the third and fourth digits represent the prefecture-level administrative division identification code, the fifth and sixth digits represent the county-level administrative division identification code, the seventh to the fourteenth digits represent the date of birth, the fifteenth and sixteenth digits represent the identification code of the police station where the ID card was issued, the seventeenth digit represents the gender, and the eighteenth digit represents the check code. As for the encoding rules of other types of privacy data, they will not be repeated here one by one.

[0101] By pre-entering the encoding rules of the target privacy data (for example, transaction account information, account password, user ID number, enterprise unified social credit code, etc.) into the privacy data identification dictionary, the user privacy data in the transaction data can be directly identified through the privacy data identification dictionary in the future, which is more conducive to the rapid identification of privacy data in the transaction data and improves data processing efficiency.

[0102] Step 302, using an improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain encrypted task data;

[0103] In this embodiment, before executing the step of securely encrypting the user privacy data using the improved Bi-DES encryption algorithm to obtain the encrypted task data, the method further includes: inputting the user privacy data into a preset mask component to obtain the masked user privacy data output by the mask component, wherein the mask component includes at least one or more of a partial data mask component, a specific character mask component, and a regularity mask component;

[0104] The mask component may convert characters with information meaning into designated characters without information meaning, for example, converting numerical characters or alphabetical characters into "***" and the like.

[0105] Specifically, the mask component can be flexibly set according to actual needs. For example, if only part of the user's private data needs to be masked, for example, only the date of birth in the ID card number needs to be masked, then a partial data mask component can be used, and the partial data mask component specifies the position information of the masked data, that is, the number of digits of the masked data in a complete piece of user private data, that is, the 7th to 14th digits in the ID card number are masked; furthermore, if the date of birth of a male in the ID card number information needs to be masked, then a regular mask component is used, and the regular mask component is used to mask the 7th to 14th digits in the ID card number information. Two identification steps are performed at least. First, the male ID number in the user's private data is identified. Then, based on the previous identification, it is identified again to determine the date of birth. After that, the male's date of birth finally identified is masked, that is, the 7th to 14th digits and the 17th digit in the ID number are masked; secondly, continuous characters are masked, such as masking "123" or "abc" in the account password information. Of course, according to actual masking requirements, there are often cases where partial data mask components, specific character mask components, and regular mask components are used in combination, which will not be elaborated here.

[0106] Before the improved Bi-DES encryption algorithm is used to encrypt the user privacy data, the user privacy data is masked, thereby further improving the security of the user privacy data in the transaction data when it is processed, and preventing data leakage.

[0107] Continue to refer Figure 5 , Figure 5 yes Figure 3 The flowchart of a specific embodiment of step 302 shown includes:

[0108] Step 501, using a preset extraction component to extract the user privacy data after the masking process, wherein the extraction component includes a character extraction component based on optical OCR technology;

[0109] Step 502: input the masked user privacy data as an encryption parameter value into a preset improved Bi-DES encryption algorithm execution component, wherein the improved Bi-DES encryption algorithm execution component performs encryption processing twice in succession. Compared with the conventional DES encryption algorithm, the improved Bi-DES encryption algorithm execution component has a longer key length generation subcomponent and generates two encryption keys at one time. The key generation subcomponent includes generating two encryption keys at one time based on a random number generation method. The two encryption keys are used to perform encryption processing twice in succession, which increases the difficulty of cracking and improves data security.

[0110] Step 503, running the improved Bi-DES encryption algorithm execution component to obtain the encrypted content output by the improved Bi-DES encryption algorithm execution component;

[0111] Step 504: Replace the corresponding user privacy data in the positive and negative sample data with the encrypted content, and obtain the replaced positive and negative sample data as the encrypted task data.

[0112] In this embodiment, after executing the step of securely encrypting the user privacy data using the improved Bi-DES encryption algorithm to obtain the encrypted task data, the method further includes: encapsulating the mask component, the extraction component and the improved Bi-DES encryption algorithm execution component into the same component according to the processing sequence to obtain the encryption processing component. The mask component, the extraction component and the improved Bi-DES encryption algorithm execution component are encapsulated into the same component according to the processing sequence to obtain the encryption processing component, so that when the transaction behavior category prediction is performed on the transaction data to be predicted later, the encapsulated encryption processing component is directly called to complete the comprehensive encryption processing of the user privacy data in the transaction data to be predicted.

[0113] Step 303: A preset amplification technology is used to amplify the encrypted task data to obtain amplified task data. Specifically, the preset amplification technology includes a multidimensional data amplification technology based on a TimeGAN model.

[0114] In this embodiment, before executing the step of amplifying the encrypted task data using a preset amplification technology to obtain the amplified task data, the method further includes: identifying the encrypted task data corresponding to the abnormal task data and the encrypted task data corresponding to the normal task data according to the distinguishing marks respectively corresponding to the normal task data and the abnormal task data in the positive and negative sample data; performing time series processing on the encrypted task data corresponding to the abnormal task data according to the time sequence of the tasks to obtain first time series data, and performing time series processing on the encrypted task data corresponding to the normal task data to obtain second time series data;

[0115] Continue to refer Figure 6 , Figure 6 yes Figure 3 The flowchart of a specific embodiment of step 303 shown includes:

[0116] Step 601, inputting the first time series data into a preset TimeGAN model, wherein the preset TimeGAN model refers to a TimeGAN model that has completed adversarial generation training;

[0117] Step 602, performing multi-dimensional feature vector encoding on the first time series data according to the encoder encoding component in the TimeGAN model to obtain a multi-dimensional feature vector corresponding to the first time series data;

[0118] Step 603, performing N decoding processes on the multidimensional feature vector corresponding to the first time series data through the decoder decoding component in the TimeGAN model to obtain N amplified sequences of the first time series data, where N is a positive integer;

[0119] Step 604, inputting the second time series data into the TimeGAN model;

[0120] Step 605, performing multi-dimensional feature vector encoding on the second time series data according to the encoder encoding component in the TimeGAN model to obtain a multi-dimensional feature vector corresponding to the second time series data;

[0121] Step 606: Perform M decoding processes on the multidimensional feature vector corresponding to the second time series data through the decoder decoding component in the TimeGAN model to obtain M amplification sequences of the second time series data, where M is a positive integer.

[0122] Specifically, the TimeGAN model is a TimeGAN model that has completed adversarial generation training, that is, there is no need to perform augmentation model training again, and it is an augmentation model that can be used by calling previous training. The encrypted task data is augmented using a multidimensional data augmentation technology based on the TimeGAN model, which can omit some conventional data preprocessing steps. For example, there is no need to perform data outlier processing or missing value processing. As the data is amplified, the proportion of data outliers or missing values ​​will become smaller and smaller. Therefore, data processing efficiency can be improved to a certain extent.

[0123] Of course, in order to ensure the accuracy and scientificity of the later prediction of the transaction data category, the following steps can also be included when the positive and negative sample data are pre-processed: missing value filling and outlier correction processing are performed on the positive and negative sample data; according to a pre-set numerical range interval, the specific numerical values ​​in the positive and negative sample data are mapped to the corresponding range interval, and the corresponding specific numerical values ​​are represented by the range interval, or, according to a pre-set category range interval, the specific numerical values ​​in the positive and negative sample data are mapped to the corresponding category range interval, and the specific numerical values ​​are represented by the corresponding category. Specifically, the category range interval can first rule the levels corresponding to different numerical range intervals, and represent the specific numerical values ​​with the corresponding levels.

[0124] Step 203, input the model training data into the task behavior analysis model to be trained, perform model training, and obtain a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by the AC-LSTNet time series neural network architecture.

[0125] The task behavior analysis model described above, combined with specific usage scenarios, can be a transaction behavior analysis model.

[0126] In this embodiment, before executing the step of inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining the trained task behavior analysis model, the method further includes: integrating the first time series data and N amplified sequences of the first time series data to obtain N+1 model training data corresponding to the abnormal task data; integrating the second time series data and M amplified sequences of the second time series data to obtain M+1 model training data corresponding to the normal task data;

[0127] Continue to refer Figure 7 , Figure 7 yes Figure 2 The flowchart of a specific embodiment of step 203 shown includes:

[0128] Step 701, inputting N+1 model training data corresponding to the abnormal task data into the task behavior analysis model to be trained;

[0129] Step 702, capturing the task features of the abnormal task data through the convolutional layer, the recurrent layer and the recurrent skip layer in the AC-LSTNet temporal neural network, the task features of the abnormal task data, that is, the transaction features of the abnormal transaction data;

[0130] Step 703, deploying the task features of the abnormal task data as abnormal task data identification features to the task behavior analysis model;

[0131] Step 704, inputting the M+1 model training data corresponding to the normal task data into the task behavior analysis model to be trained;

[0132] Step 705, capturing the task features of the normal task data through the convolutional layer, the recurrent layer and the recurrent skip layer in the AC-LSTNet temporal neural network, the task features of the normal task data, that is, the transaction features of the normal transaction data;

[0133] Step 706, deploying the task features of the normal task data as normal task data identification features to the task behavior analysis model;

[0134] Step 707: Obtain a task behavior analysis model in which both the abnormal task data identification features and the normal task data identification features are deployed, and obtain the trained task behavior analysis model.

[0135] In this embodiment, the time series feature analysis model formed by the AC-LSTNet (adaptive channel LSTNet) time series neural network architecture is compared to the time series feature analysis model formed by the conventional LSTNet time series neural network architecture. On the basis of the convolution layer, the recurrent layer, the recurrent skip layer, the autoregressive layer and the fully connected layer, an inter-layer adaptive channel (adaptive channel) feature adjustment layer is also set before the fully connected layer, which is used to adaptively adjust the channel features between the convolution layer, the recurrent layer and the recurrent skip layer, so that the task behavior analysis model can adaptively allocate the size of the convolution kernel according to the sequence length during training and prediction to extract multi-scale features, thereby improving the performance and generalization ability of the model. Among them, the convolution layer uses the convolutional neural network CNN with a fusion attention mechanism to capture the short-term task features of the task data, and the recurrent layer and the recurrent skip layer are used to capture the long-term task features of the task data, wherein the recurrent layer uses a bidirectional long short-term memory network to model the long-term dependency of the time series data. At the same time, in order to highlight the information of important time steps when mining the dependencies of time series, the recurrent jump layer uses jump connections to enhance the model's ability to capture long-term trends. By connecting the output of the recurrent layer with the historical data of several previous time steps, a feature representation of a global view is formed. This jump connection can help the model better capture the long-term trends and periodic structures in the sequence data, thereby obtaining the identification features of normal task data and abnormal task data based on the short-term task features and the long-term task features. By introducing an inter-layer adaptive channel feature adjustment layer, the recognition accuracy of the task behavior analysis model is improved.

[0136] Step 204, obtaining task data to be predicted.

[0137] In this embodiment, the step of obtaining the task data to be predicted specifically includes: first determining the user information for which the positive or abnormal situation of the transaction data is to be predicted, for example: the enterprise information or personal information for which the positive or abnormal situation of the transaction data is to be predicted; then, based on the tax bills, bills, payrolls, social security tables, water and electricity payment records, etc. provided by the enterprise or individual, the transaction data to be predicted is extracted as the task data to be predicted.

[0138] Step 205: Use the improved Bi-DES encryption algorithm to perform security encryption processing on the user privacy data in the task data to be predicted, and obtain the encrypted task data to be predicted.

[0139] In this embodiment, before executing the step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data in the task data to be predicted to obtain the encrypted task data to be predicted, the method further includes: identifying the user privacy data in the task data to be predicted according to the privacy data identification dictionary;

[0140] Continue to refer Figure 8 , Figure 8 yes Figure 2 The flowchart of a specific embodiment of step 205 shown includes:

[0141] Step 801, inputting the user privacy data in the task data to be predicted into the encryption processing component;

[0142] Step 802, obtaining the encrypted content corresponding to the user privacy data in the task data to be predicted by sequentially processing the mask component, the extraction component and the improved Bi-DES encryption algorithm execution component in the encryption processing component;

[0143] Step 803: Replace the user privacy data in the task data to be predicted with the encrypted content to obtain the encrypted task data to be predicted.

[0144] Step 206: input the encrypted task data to be predicted into the trained task behavior analysis model, and identify the task behavior category corresponding to the task data to be predicted according to the output result of the model.

[0145] Continue to refer Fig. 9 , Fig. 9 yes Figure 2 The flowchart of a specific embodiment of step 206 shown includes:

[0146] Step 901, inputting the encrypted task data to be predicted into the trained task behavior analysis model;

[0147] Step 902, capturing the task features of the task data to be predicted through the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network in the trained task behavior analysis model;

[0148] Step 903, respectively calculating the edit distances between the task feature of the task data to be predicted and the abnormal task data identification feature and the normal task data identification feature;

[0149] Specifically, the edit distance can be calculated using a similarity algorithm or a difference algorithm, for example: obtaining the similarity between the task characteristics of the task data to be predicted and the identification characteristics of the abnormal task data, and obtaining the similarity between the task characteristics of the task data to be predicted and the identification characteristics of the normal task data; or obtaining the difference between the task characteristics of the task data to be predicted and the identification characteristics of the abnormal task data, and obtaining the difference between the task characteristics of the task data to be predicted and the identification characteristics of the normal task data.

[0150] Step 904 : Based on the edit distance, identify the task behavior category corresponding to the task data to be predicted, wherein the task behavior category includes a normal task category and an abnormal task category.

[0151] Specifically, the task behavior category corresponding to the task data to be predicted can be identified based on the similarity or difference obtained in step 903. For example, if the task characteristics of the task data to be predicted are highly similar to the identification characteristics of the normal task data, then the task behavior category corresponding to the task data to be predicted is a normal task category; or, if the task characteristics of the task data to be predicted are highly different from the identification characteristics of the normal task data, then the task behavior category corresponding to the task data to be predicted is an abnormal task category.

[0152] In the training process of the task behavior analysis model of the present application, as well as in the subsequent process of using the trained task behavior analysis model to identify the task behavior category of the task data to be predicted, both the training data and the user privacy data in the subsequent prediction and identification data are in an encrypted state using the improved Bi-DES encryption algorithm, thereby ensuring the security of the user privacy data when the financial data is processed and avoiding the leakage of the user privacy data; before model training, the TimeGAN multi-dimensional data amplification technology is used to amplify the training data, thereby avoiding the fact that the trained model is not scientific and accurate enough due to too few positive and negative sample data, thereby ensuring the scientificity and accuracy of the trained task behavior analysis model; during model training, the time series feature analysis model composed of the AC-LSTNet time series neural network architecture is used to train the task behavior analysis model, which can capture both short-term task features and long-term task features, thereby ensuring the accuracy of the subsequent recognition of the task features of the task data to be predicted.

[0153] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0154] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0155] In an embodiment of the present application, the task behavior analysis method is applied to the financial field. For example, the task behavior is a transaction behavior, and the task data is transaction data. In the training process of the transaction behavior analysis model, and in the subsequent process of using the trained transaction behavior analysis model to identify the transaction behavior category of the transaction data to be predicted, both the training data and the subsequent data for prediction and identification are in an encrypted state of the improved Bi-DES encryption algorithm, thereby ensuring the security of the financial data when being processed. Before model training, the TimeGAN multidimensional data amplification technology is used to amplify the training data, thereby avoiding the fact that the trained model is not scientific and accurate enough due to too few positive and negative sample data, thereby ensuring the scientificity and accuracy of the trained transaction behavior analysis model. During model training, a time series feature analysis model composed of an AC-LSTNet time series neural network architecture is used to train a transaction behavior analysis model, which can capture both short-term and long-term transaction features, thereby ensuring the accuracy of subsequent recognition of transaction features of the transaction data to be predicted.

[0156] Further references Fig.10 , as a response to the above Figure 2 The present application provides an embodiment of a task behavior recognition device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0157] like Fig.10 As shown, the task behavior identification device described in this embodiment includes: a data acquisition module 10a, a data preprocessing module 10b, a model training module 10c, a to-be-predicted data acquisition module 10d, a data security processing module 10e and a task behavior category identification module 10f. Among them:

[0158] The data collection module 10a is used to collect positive and negative sample data, wherein the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users, and the abnormal task data of blacklist users and the normal task data of whitelist users are distinguished and marked in advance;

[0159] The data preprocessing module 10b is used to preprocess the positive and negative sample data to obtain model training data, wherein the preprocessing of the positive and negative sample data includes: identifying the user privacy data in the task data according to the preset identification rules; using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data; using the preset amplification technology to amplify the encrypted task data to obtain the amplified task data, specifically, the preset amplification technology includes a multi-dimensional data amplification technology based on the TimeGAN model;

[0160] The model training module 10c is used to input the model training data into the task behavior analysis model to be trained, perform model training, and obtain a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by an AC-LSTNet time series neural network architecture;

[0161] The module 10d for obtaining data to be predicted is used to obtain task data to be predicted;

[0162] The data security processing module 10e is used to perform security encryption processing on the user privacy data in the task data to be predicted by using an improved Bi-DES encryption algorithm to obtain the encrypted task data to be predicted;

[0163] The task behavior category identification module 10f is used to input the encrypted task data to be predicted into the trained task behavior analysis model, and identify the task behavior category corresponding to the task data to be predicted according to the output result of the model.

[0164] In the training process of the task behavior analysis model of the present application, as well as in the subsequent process of using the trained task behavior analysis model to identify the task behavior category of the task data to be predicted, both the training data and the data for subsequent prediction and identification are in an encrypted state of the improved Bi-DES encryption algorithm, thereby ensuring the security of the financial data when being processed; before model training, the TimeGAN multi-dimensional data amplification technology is used to amplify the training data, thereby avoiding the fact that the trained model is not scientific and accurate enough due to too few positive and negative sample data, thereby ensuring the scientificity and accuracy of the trained task behavior analysis model; during model training, the time series feature analysis model composed of the AC-LSTNet time series neural network architecture is used to train the task behavior analysis model, which can capture both short-term task features and long-term task features, thereby ensuring the accuracy of subsequent recognition of task features of the task data to be predicted.

[0165] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0166] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0167] To solve the above technical problems, the present application also provides a computer device. Fig.11 , Fig.11 This is a basic structural block diagram of the computer device in this embodiment.

[0168] The computer device 11 includes a memory 11a, a processor 11b, and a network interface 11c which are interconnected through a system bus. It should be noted that: Fig.11 Only a computer device 11 having a memory 11a, a processor 11b, and a network interface 11c is shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital processor (DSP), an embedded device, etc.

[0169] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0170] The memory 11a includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 11a can be an internal storage unit of the computer device 11, such as a hard disk or memory of the computer device 11. In other embodiments, the memory 11a can also be an external storage device of the computer device 11, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 11. Of course, the memory 11a can also include both the internal storage unit of the computer device 11 and its external storage device. In this embodiment, the memory 11a is generally used to store the operating system and various application software installed on the computer device 11, such as computer-readable instructions of the task behavior recognition method, etc. In addition, the memory 11a can also be used to temporarily store various types of data that have been output or are to be output.

[0171] The processor 11b may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 11b is generally used to control the overall operation of the computer device 11. In this embodiment, the processor 11b is used to run the computer-readable instructions stored in the memory 11a or process data, such as running the computer-readable instructions of the task behavior recognition method.

[0172] The network interface 11c may include a wireless network interface or a wired network interface. The network interface 11c is generally used to establish a communication connection between the computer device 11 and other electronic devices.

[0173] The computer device proposed in this embodiment belongs to the field of financial data processing technology. In the training process of the task behavior analysis model, and in the subsequent identification process of the task behavior category of the task data to be predicted using the trained task behavior analysis model, both the training data and the subsequent prediction and identification data are in an encrypted state using the improved Bi-DES encryption algorithm, ensuring the security of the financial data when it is processed; before model training, the TimeGAN multi-dimensional data amplification technology is used to amplify the training data, avoiding the lack of scientificity and accuracy of the trained model due to too few positive and negative sample data, ensuring the scientificity and accuracy of the trained task behavior analysis model; during model training, the time series feature analysis model composed of the AC-LSTNet time series neural network architecture is used to train the task behavior analysis model, which can capture both short-term task features and long-term task features, ensuring the accuracy of the subsequent identification of task features of the task data to be predicted.

[0174] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by a processor to enable the processor to perform the steps of the task behavior identification method as described above.

[0175] The computer-readable storage medium proposed in this embodiment belongs to the field of financial data processing technology. In the training process of the task behavior analysis model, and in the subsequent process of using the trained task behavior analysis model to identify the task behavior category of the task data to be predicted, both the training data and the subsequent prediction and identification data are in an encrypted state of the improved Bi-DES encryption algorithm, ensuring the security of the financial data when being processed; before model training, the TimeGAN multi-dimensional data amplification technology is used to amplify the training data, avoiding the lack of positive and negative sample data that leads to the trained model being not scientific and accurate enough, ensuring the scientificity and accuracy of the trained task behavior analysis model; during model training, the time series feature analysis model composed of the AC-LSTNet time series neural network architecture is used to train the task behavior analysis model, which can capture both short-term task features and long-term task features, ensuring the accuracy of the subsequent recognition of task features of the task data to be predicted.

[0176] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0177] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A task behavior identification method, It is characterized in that The steps include: Collecting positive and negative sample data, wherein the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users; Preprocessing the positive and negative sample data to obtain model training data, wherein preprocessing the positive and negative sample data includes: According to a preset identification rule, identifying the user privacy data in the task data; The user privacy data is securely encrypted using an improved Bi-DES encryption algorithm to obtain encrypted task data. Specifically, Before executing the step of securely encrypting the user privacy data using the improved Bi-DES encryption algorithm to obtain the encrypted task data, the method further includes: Inputting the user privacy data into a preset mask component, and obtaining the masked user privacy data output by the mask component, wherein the mask component includes at least one or more of a partial data mask component, a specific character mask component, and a regularity mask component; The step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data specifically includes: Using a preset extraction component to extract the user privacy data after the mask processing; The user privacy data after the masking process is input as an encryption parameter value into a preset improved Bi-DES encryption algorithm execution component. Specifically, the key generation subcomponent of the improved Bi-DES encryption algorithm execution component generates two encryption keys at one time based on a random number generation method, and the two encryption keys are used to perform encryption processes twice in succession; Running the improved Bi-DES encryption algorithm execution component to obtain the encrypted content output by the improved Bi-DES encryption algorithm execution component; Replacing corresponding user privacy data in the positive and negative sample data with the encrypted content, and obtaining the replaced positive and negative sample data as the encrypted task data; After executing the step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain encrypted task data, the method further includes: According to the processing sequence, the mask component, the extraction component and the improved Bi-DES encryption algorithm execution component are encapsulated into the same component to obtain an encryption processing component; Amplifying the encrypted task data using a preset amplification technology to obtain amplified task data. Specifically, the preset amplification technology includes a multidimensional data amplification technology based on a TimeGAN model. Input the model training data into the task behavior analysis model to be trained, perform model training, and obtain a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by an AC-LSTNet timing neural network architecture. Specifically, compared with the conventional LSTNet timing neural network architecture, the AC-LSTNet timing neural network architecture is based on a convolutional layer, a recurrent layer, a recurrent skip layer, an autoregressive layer, and a fully connected layer. An inter-layer adaptive channel feature adjustment layer is also provided before the fully connected layer to adaptively adjust the channel features between the convolutional layer, the recurrent layer, and the recurrent skip layer; Obtain the task data to be predicted; The encryption processing component is used to perform secure encryption processing on the user privacy data in the task data to be predicted, so as to obtain the encrypted task data to be predicted; The encrypted task data to be predicted is input into the trained task behavior analysis model, and the task behavior category corresponding to the task data to be predicted is identified according to the output result of the trained task behavior analysis model.

2. The task behavior identification method according to claim 1, It is characterized in that The step of identifying the user privacy data in the task data according to the preset identification rule specifically includes: Obtaining a preset private data identification dictionary, wherein the private data identification dictionary contains encoding rules for target private data, and the encoding rules include data length rules and data character rules; According to the data length rule and the data character rule, the user privacy data in the task data is identified.

3. The task behavior identification method according to claim 1, It is characterized in that Before executing the step of amplifying the encrypted task data using a preset amplification technology to obtain amplified task data, the method further includes: According to the distinguishing marks respectively corresponding to the normal task data and the abnormal task data in the positive and negative sample data, identifying the encrypted task data corresponding to the abnormal task data and the encrypted task data corresponding to the normal task data; According to the task time sequence, the encrypted task data corresponding to the abnormal task data is processed in a time series to obtain first time series data, and Performing time series processing on the encrypted task data corresponding to the normal task data to obtain second time series data; The step of amplifying the encrypted task data using a preset amplification technology to obtain the amplified task data specifically includes: Inputting the first time series data into a preset TimeGAN model, wherein the preset TimeGAN model refers to a TimeGAN model that has completed adversarial generation training; Performing multidimensional feature vector encoding on the first time series data according to the encoder encoding component in the TimeGAN model to obtain a multidimensional feature vector corresponding to the first time series data; Performing N decoding processes on the multidimensional feature vector corresponding to the first time series data through the decoder decoding component in the TimeGAN model to obtain N amplified sequences of the first time series data, where N is a positive integer; Inputting the second time series data into the TimeGAN model; Performing multidimensional feature vector encoding on the second time series data according to the encoder encoding component in the TimeGAN model to obtain a multidimensional feature vector corresponding to the second time series data; The multidimensional feature vector corresponding to the second time series data is decoded M times by the decoder decoding component in the TimeGAN model to obtain M amplification sequences of the second time series data, where M is a positive integer.

4. The task behavior identification method according to claim 3, It is characterized in that Before executing the step of inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining the trained task behavior analysis model, the method further includes: Integrate the first time series data and N amplified sequences of the first time series data to obtain N+1 pieces of model training data corresponding to the abnormal task data; Integrate the second time series data and the M amplified sequences of the second time series data to obtain M+1 pieces of model training data corresponding to the normal task data; The step of inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining the trained task behavior analysis model specifically includes: Inputting N+1 pieces of model training data corresponding to the abnormal task data into the task behavior analysis model to be trained; Capturing the task features of the abnormal task data through the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network; deploying the task features of the abnormal task data as abnormal task data identification features to the task behavior analysis model; Inputting M+1 pieces of model training data corresponding to the normal task data into the task behavior analysis model to be trained; Capturing the task features of the normal task data through the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network; Deploying the task features of the normal task data as normal task data identification features to the task behavior analysis model; A task behavior analysis model in which both the abnormal task data identification features and the normal task data identification features are deployed is obtained to obtain the trained task behavior analysis model.

5. The task behavior identification method according to claim 4, It is characterized in that The step of inputting the encrypted task data to be predicted into the trained task behavior analysis model, and identifying the task behavior category corresponding to the task data to be predicted according to the output result of the trained task behavior analysis model specifically includes: Inputting the encrypted task data to be predicted into the trained task behavior analysis model; Capturing the task features of the task data to be predicted by the convolutional layer, the recurrent layer, and the recurrent skip layer in the AC-LSTNet temporal neural network in the trained task behavior analysis model; Calculating respectively the edit distances between the task feature of the task data to be predicted and the abnormal task data identification feature and the normal task data identification feature; Based on the edit distance, a task behavior category corresponding to the to-be-predicted task data is identified, wherein the task behavior category includes a normal task category and an abnormal task category.

6. A task behavior recognition device, It is characterized in that include: A data collection module, used to collect positive and negative sample data, wherein the positive and negative sample data include abnormal task data of blacklist users and normal task data of whitelist users; A data preprocessing module is used to preprocess the positive and negative sample data to obtain model training data, wherein the preprocessing of the positive and negative sample data includes: According to a preset identification rule, identifying the user privacy data in the task data; The user privacy data is securely encrypted using an improved Bi-DES encryption algorithm to obtain encrypted task data. Specifically, Before executing the step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data, the method further includes: Inputting the user privacy data into a preset mask component, and obtaining the masked user privacy data output by the mask component, wherein the mask component includes at least one or more of a partial data mask component, a specific character mask component, and a regularity mask component; The step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data specifically includes: Using a preset extraction component to extract the user privacy data after the mask processing; The user privacy data after the masking process is input as an encryption parameter value into a preset improved Bi-DES encryption algorithm execution component. Specifically, the key generation subcomponent of the improved Bi-DES encryption algorithm execution component generates two encryption keys at one time based on a random number generation method, and the two encryption keys are used to perform encryption processes twice in succession; Running the improved Bi-DES encryption algorithm execution component to obtain the encrypted content output by the improved Bi-DES encryption algorithm execution component; Replacing corresponding user privacy data in the positive and negative sample data with the encrypted content, and obtaining the replaced positive and negative sample data as the encrypted task data; After executing the step of using the improved Bi-DES encryption algorithm to securely encrypt the user privacy data to obtain the encrypted task data, the method further includes: According to the processing sequence, the mask component, the extraction component and the improved Bi-DES encryption algorithm execution component are encapsulated into the same component to obtain an encryption processing component; Amplifying the encrypted task data using a preset amplification technology to obtain amplified task data. Specifically, the preset amplification technology includes a multidimensional data amplification technology based on a TimeGAN model. A model training module, used for inputting the model training data into the task behavior analysis model to be trained, performing model training, and obtaining a trained task behavior analysis model, wherein the task behavior analysis model includes a time series feature analysis model formed by an AC-LSTNet timing neural network architecture. Specifically, compared with the conventional LSTNet timing neural network architecture, the AC-LSTNet timing neural network architecture is provided with an inter-layer adaptive channel feature adjustment layer before the fully connected layer on the basis of a convolutional layer, a recurrent layer, a recurrent skip layer, an autoregressive layer, and a fully connected layer, for adaptively adjusting the channel features between the convolutional layer, the recurrent layer, and the recurrent skip layer; The module for obtaining data to be predicted is used to obtain task data to be predicted; A data security processing module, used to use the encryption processing component to perform security encryption processing on the user privacy data in the task data to be predicted, so as to obtain the encrypted task data to be predicted; The task behavior category identification module is used to input the encrypted task data to be predicted into the trained task behavior analysis model, and identify the task behavior category corresponding to the task data to be predicted according to the output result of the trained task behavior analysis model.

7. A computer device, It is characterized in that The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the task behavior identification method according to any one of claims 1 to 5 when executing the computer-readable instructions.

8. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the task behavior identification method according to any one of claims 1 to 5 are implemented.

Images