A method and device for identifying illegal request behavior based on supervised model

Abstract

The present invention discloses a method and device for identifying illegal request behaviors based on a supervised model, the method comprising: obtaining information of an order to be identified, including information of user points of entry from login to payment, order behavior information, IP and device data; preprocessing the order information and extracting features to obtain order features; based on the order features, using a pre-trained illegal request behavior identification model to predict the illegal request probability of the order to be identified, wherein the illegal request identification model is constructed by an XGBoost method; based on the illegal request probability of the order to be identified, combined with a predetermined illegal request behavior judgment rule, the illegal request behavior of the order to be identified is identified by a voting method. The XGBoost identification model is introduced, and a plurality of identification rules formed by expert experience are combined to form a risk identification system based on the cross-application of the model and rules of the voting method, which can effectively realize the identification and judgment of each request.

Description

Technical Field

[0001] The present invention belongs to the technical field of illegal request behavior identification, and in particular, relates to an illegal request behavior identification method and device based on a supervised model. Background Art

[0002] Shared hardware services based on geographic location information are one of the important manifestations of the Internet O2O model, such as shared power banks, shared bicycles, etc. The emergence of shared hardware services has created great convenience and comfort for users' daily lives.

[0003] With the emergence and popularization of shared hardware service products, some criminals have obtained the right to use software by forging user request information and behavior information (such as cracking software for shared power banks), which brings great security risks and financial losses to the software.

[0004] Commonly used anti-cheating identification technologies usually use regular methods such as IP and user behavior density to identify abnormal request behaviors. In the process of implementing the present invention, it is found that the prior art has at least the following problems:

[0005] 1) It is impossible to identify the principle and specific method of illegal software making illegal requests, so it is impossible to distinguish illegal accounts forged by illegal software from legitimate platform accounts;

[0006] 2) Relying solely on rules for identification can easily result in identification accuracy that is lower than expected. Summary of the invention

[0007] In view of the problems existing in the prior art, the purpose of the embodiments of the present application is to provide a method and device for identifying illegal request behavior based on a supervised model.

[0008] According to a first aspect of an embodiment of the present application, a method for identifying illegal request behavior based on a supervised model is provided, comprising:

[0009] Obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data;

[0010] Preprocessing the order information and extracting features to obtain order features;

[0011] Based on the order features, using a pre-trained illegal request behavior recognition model to predict the illegal request probability of the order to be identified, wherein the illegal request recognition model is constructed by an XGBoost method;

[0012] Based on the illegal request probability of the order to be identified and in combination with predetermined illegal request behavior judgment rules, the illegal request behavior of the order to be identified is identified through a voting method.

[0013] Furthermore, it also includes:

[0014] Based on the identification result of the illegal request behavior of the order to be identified, the credibility level of the user is judged, and the user is dealt with accordingly according to the credibility level.

[0015] Furthermore, the order features include whether each node of the client has requested, whether the user has purchased a membership, the order amount, the frequency of hardware use by the user account, and whether the user IP is forged.

[0016] Furthermore, the user IP address is preprocessed as follows:

[0017] Use regular expressions to verify whether the IP address conforms to the standard format, fill in the missing IP address with a fixed value, and then convert the IPv4 address to a 32-bit integer and standardize or normalize the integer value of the IP address.

[0018] Furthermore, based on the illegal request probability of the order to be identified, combined with the predetermined illegal request behavior judgment rule, the illegal request behavior of the order to be identified is identified by a voting method, including:

[0019] Based on the illegal request probability of the order to be identified, setting a binary model identification result;

[0020] Based on the predetermined illegal request behavior judgment rule, a corresponding binary rule judgment result is obtained;

[0021] According to the model recognition result and the rule judgment result, the illegal request behavior recognition result is calculated by voting method.

[0022] Furthermore, according to the model recognition result and the rule judgment result, the illegal request behavior recognition result is calculated by voting method, and the formula is as follows:

[0023]

[0024] in, is the voting result for the order to be identified, that is, the identification result of the illegal request behavior, For the The binary rule judgment result of the rule is For the The weight of each rule; is the binary model recognition result, The weights of the model for identifying illegal requests, , is the number of rules.

[0025] According to a second aspect of an embodiment of the present application, a device for identifying illegal request behavior based on a supervised model is provided, comprising:

[0026] The information acquisition module is used to obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data;

[0027] A feature extraction module, used to pre-process the order information and extract features to obtain order features;

[0028] A model prediction module, used to predict the illegal request probability of the order to be identified based on the order features using a pre-trained illegal request behavior recognition model, wherein the illegal request recognition model is constructed using an XGBoost method;

[0029] The voting module is used to identify the illegal request behavior of the order to be identified by voting based on the illegal request probability of the order to be identified and in combination with predetermined illegal request behavior judgment rules.

[0030] According to a third aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program / instruction, which implements the method described in the first aspect when executed by a processor.

[0031] According to a fourth aspect of an embodiment of the present application, there is provided an electronic device, including:

[0032] one or more processors;

[0033] A memory for storing one or more programs;

[0034] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect.

[0035] According to a fifth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0036] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0037] It can be seen from the above embodiments that the present application utilizes the user's tracking information, order behavior information, IP and device data in the order to construct features, and combines the features with significant influence into recognition rules through expert experience. At the same time, the above features are introduced into the XGBoost recognition model, and the output value in the model is used as one of the rules. Combined with multiple recognition rules formed by expert experience, a risk identification system based on the cross-application of models and rules based on the voting method is formed. This recognition system can effectively realize the identification and judgment of each request through request classification.

[0038] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] Figure 1 The present invention is a flowchart of a method for identifying illegal request behaviors based on a supervised model according to an exemplary embodiment.

[0041] Figure 2 The invention is a flow chart showing illegal software illegally requesting various hardware service platforms according to an exemplary embodiment.

[0042] Figure 3 It is a block diagram of an illegal request behavior identification device based on a supervised model according to an exemplary embodiment.

[0043] Figure 4 The diagram is a schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0044] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0046] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0047] Taking shared power banks as an example, users can download illegal software and register as members in the software. They can scan the code of any power bank cabinet through the software to obtain power banks without actual payment. The implementation of the above scenario mainly relies on illegal software to register as members on multiple power bank platforms. When users scan the code, the illegal software will request the power bank platform of the corresponding brand by disguising itself as a real user of the corresponding power bank brand and obtain unlocking.

[0048] Based on the relevant characteristics of user behavior and order behavior in the above scenarios, modeling is carried out through data preprocessing, and core features are extracted through expert experience, and then an identification system with cross-application of models and rules is built. Identified users are classified into high-risk, medium-risk, and low-risk users, and users at different levels are verified and managed accordingly to complete the overall identification and decision-making of illegal users.

[0049] This application provides a method for identifying illegal request behaviors based on a supervised model, such as Figure 1 As shown, the method may include the following steps:

[0050] Step S1: Obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data;

[0051] Step S2: preprocessing the order information and extracting features to obtain order features;

[0052] Step S3: Based on the order features, using a pre-trained illegal request behavior recognition model to predict the illegal request probability of the order to be recognized, wherein the illegal request recognition model is constructed by an XGBoost method;

[0053] Step S4: Based on the illegal request probability of the order to be identified and in combination with predetermined illegal request behavior judgment rules, the illegal request behavior of the order to be identified is identified by voting.

[0054] It can be seen from the above embodiments that the present application utilizes the user's tracking information, order behavior information, IP and device data in the order to construct features, and combines the features with significant influence into recognition rules through expert experience. At the same time, the above features are introduced into the XGBoost recognition model, and the output value in the model is used as one of the rules. Combined with multiple recognition rules formed by expert experience, a risk identification system based on the cross-application of models and rules based on the voting method is formed. This recognition system can effectively realize the identification and judgment of each request through request classification.

[0055] In the specific implementation of step S1, the client-side embedding information of all links from login to payment of the user in the order to be identified is obtained;

[0056] Specifically, illegal software requests each hardware service platform process (such as Figure 2 ): When a user scans the code of a hardware product provided by a hardware service platform through an illegal software APP, the illegal software APP will send the obtained Bluetooth key to the illegal software server. The server will crack the Bluetooth key, for example, by splicing user-related request information to crack the encryption rules of the hardware service platform, and then disguise itself as a hardware service platform to crack the Bluetooth key and complete the unlocking of the hardware products of the hardware service platform.

[0057] The normal unlocking principle is as follows: when a hardware service platform user scans the code of a hardware product, the hardware service platform APP or the hardware service platform mini-program will send an unlocking request and Bluetooth key to the hardware service platform server. The hardware service platform server uses the obtained Bluetooth key to send an unlocking instruction to the hardware product.

[0058] Based on the above illegal request principles, all client-side information from user login to payment is collected. The registered users of illegal software have characteristics such as "no client operation records" and "IP forgery". In order to save costs, the related accounts forged by illegal software on the hardware service platform will have characteristics such as "purchase of membership" and "small amount of actual payment".

[0059] In the specific implementation of step S2, the client embedding information is preprocessed and features are extracted to obtain order features;

[0060] Specifically, it is necessary to perform pre-processing operations such as data cleaning and feature engineering on the client tracking information. For example, for IP features, first use regular expressions to verify whether the IP address conforms to the standard format, and fill the missing IP address with a fixed value (such as "0.0.0.0"). Then convert the IPv4 address to a 32-bit integer, and standardize or normalize the integer value of the IP address so that the model can better handle it. For the feature content in the user request and use process, such as tracking features such as whether each node of the client requests, order behavior features such as whether the user purchases a membership, order amount, and frequency of hardware use by the user account, the above methods are used for data cleaning and feature engineering to obtain order features.

[0061] In the specific implementation of step S3, based on the order features, a pre-trained illegal request behavior recognition model is used to predict the illegal request probability of the order to be identified, wherein the illegal request recognition model is constructed by an XGBoost method;

[0062] Specifically, as an efficient machine learning algorithm for gradient boosting, XGBoost can classify and predict request behaviors by outputting prediction results and important features after inputting feature contents such as arrays and feature matrices and setting a series of hyperparameters such as learning rate (learning_rate), maximum tree depth (max_depth), and regularization parameters (lambda, alpha). The mathematical model formula of XGBoost can be expressed as: .in Corresponding to an independent tree structure ( is the number of tree structures), each tree structure will input the order characteristics Map to the corresponding leaf node and calculate the weight 𝑤 of the leaf node to get the probability of illegal request of the order .

[0063] Before training the illegal request behavior recognition model, it is necessary to obtain the order set and extract the features of each order through steps S1-S2, and mark whether the order has illegal request behavior, so as to construct the training set and test set, and use K-fold cross validation to achieve data set division. For the test set data results, evaluation indicators such as accuracy and recall are used to control the model quality.

[0064] In the specific implementation of step S4, based on the illegal request probability of the order to be identified, combined with the predetermined illegal request behavior judgment rule, the illegal request behavior of the order to be identified is identified by voting method;

[0065] The predicted value output by the model may have problems such as poor interpretability and insufficient coverage in actual recognition applications. Therefore, this application uses the predicted value output by the XGBoost model as one of the rules, and integrates it with the rules formed based on expert experience to screen out a set of reasonable screening logic. During the fusion process, this application uses a voting method to integrate the rule content and output the results, that is, voting on all rules, calculating the frequency of output results of "1" and "0" after each request, and combining the weights of all rules to calculate the final voting results. The following sub-steps may be included:

[0066] S41: Setting a binary model recognition result based on the illegal request probability of the order to be identified;

[0067] Specifically, the probability of illegal requests predicted by the model is usually a non-integer between 0 and 1. In order to facilitate the subsequent voting method, it needs to be binarized. In the specific implementation, the area under the receiver operating characteristic curve (ROC curve) AUC can be calculated based on the prediction results of the model for the test set. If the probability of illegal requests predicted by the model is higher than AUC, the model recognition result is set to 1, otherwise it is set to 0.

[0068] S42: Based on the predetermined illegal request behavior judgment rule, a corresponding binary rule judgment result is obtained;

[0069] Specifically, it is determined whether the order to be identified has any illegal request behavior under each rule. If so, the rule judgment result is set to 1, otherwise it is set to 0.

[0070] S43: Calculate the illegal request behavior identification result by voting method according to the model identification result and rule judgment result.

[0071] The formula for the voting method in the regular voting process is as follows:

[0072]

[0073] in, is the voting result for the order to be identified (i.e. the final identification result of illegal request behavior), For the The binary rule judgment result of the rule is illegal. ,otherwise , For the The weight of each rule; is the binary model recognition result. If it is illegal, ,otherwise , The weights of the model for identifying illegal requests, , is the number of rules.

[0074] In a specific implementation, after identifying whether an order contains illegal request behavior, the user can be dealt with accordingly based on the identification result to reduce the losses caused by illegal request behavior. Therefore, the present application may also include:

[0075] Step S5: Based on the identification result of the illegal request behavior of the order to be identified, determine the credibility level of the user, and take corresponding measures against the user according to the credibility level;

[0076] Specifically, for orders that are identified to contain illegal requests, the users involved are assigned a credibility level based on the voting results (for example, classified as high-risk, medium-risk, or low-risk users), and corresponding measures are taken, such as secondary verification, restricting requests, restricting account usage, etc., thereby enabling users to make high-precision decisions and block risks.

[0077] In summary, this application can achieve the following beneficial effects:

[0078] 1) Utilize the tracking information, order behavior information, IP and device data left by users on the client from login to payment, that is, obtain the behavior data and trace information of the entire process from the request to the return of the hardware, and compile it into identification features after processing, so as to identify the principle and specific method of illegal software making illegal requests, and then distinguish the illegal accounts forged by illegal software from the legitimate accounts of the platform;

[0079] 2) Applying models and rules together to identify abnormal behaviors can avoid the problem of low interpretability of the model on the one hand, and the problem of difficulty in improving the recognition accuracy of pure rules on the other hand. It can improve the recognition accuracy better with higher interpretability.

[0080] 3) The voting method is used to realize the cross-application of models and rules, which effectively avoids the inefficiency caused by the exhaustive combination of models and rules in the global optimization method, and effectively realizes the optimal global value through the quantification of application results.

[0081] Corresponding to the aforementioned embodiment of the method for identifying illegal request behavior based on a supervised model, the present application also provides an embodiment of an apparatus for identifying illegal request behavior based on a supervised model.

[0082] Figure 3 1 is a block diagram of an illegal request behavior identification device based on a supervised model according to an exemplary embodiment. Figure 3 , the device may include:

[0083] The information acquisition module 21 is used to obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data;

[0084] A feature extraction module 22 is used to pre-process the order information and extract features to obtain order features;

[0085] A model prediction module 23, used to predict the illegal request probability of the order to be identified based on the order features using a pre-trained illegal request behavior recognition model, wherein the illegal request recognition model is constructed by an XGBoost method;

[0086] The voting module 24 is used to identify the illegal request behavior of the order to be identified by voting based on the illegal request probability of the order to be identified and in combination with predetermined illegal request behavior judgment rules.

[0087] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0088] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0089] Accordingly, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned method for identifying illegal request behavior based on a supervised model.

[0090] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned illegal request behavior identification method based on the supervised model. Figure 4 As shown in FIG. 1 , a hardware structure diagram of an illegal request behavior identification device based on a supervised model provided by an embodiment of the present invention is provided in any device with data processing capability, except Figure 4In addition to the processor, memory and network interface shown, any device with data processing capability in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capability, which will not be described in detail.

[0091] Accordingly, the present application also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by the processor, the illegal request behavior identification method based on the supervised model as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

[0092] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0093] It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A method for identifying illegal request behaviors based on a supervised model, characterized in that: include: Obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data; Preprocessing the order information and extracting features to obtain order features; Based on the order features, the illegal request probability of the order to be identified is predicted using a pre-trained illegal request behavior recognition model, wherein the illegal request recognition model is constructed using the XGBoost method, wherein the model formula of XGBoost is: ,in Corresponding to an independent tree structure, is the number of tree structures, each tree structure will enter the order characteristics Map to the corresponding leaf node and calculate the weight of the leaf node w , thus obtaining the probability of illegal request of the order ; Based on the illegal request probability of the order to be identified and in combination with predetermined illegal request behavior judgment rules, the illegal request behavior of the order to be identified is identified through a voting method, including: setting a binary model recognition result based on the illegal request probability of the order to be identified; obtaining a corresponding binary rule judgment result based on the predetermined illegal request behavior judgment rule; and calculating the illegal request behavior identification result through a voting method based on the model recognition result and the rule judgment result.

2. The method according to claim 1, characterized in that Also includes: Based on the identification result of the illegal request behavior of the order to be identified, the credibility level of the user is judged, and the user is dealt with accordingly according to the credibility level.

3. The method according to claim 1, characterized in that The order features include whether each node of the client has requested, whether the user has purchased a membership, the order amount, the frequency of hardware use by the user account, and whether the user IP is forged.

4. The method according to claim 3, characterized in that For the user IP address, perform the following preprocessing: Use regular expressions to verify whether the IP address conforms to the standard format, fill in the missing IP address with a fixed value, and then convert the IPv4 address to a 32-bit integer and standardize or normalize the integer value of the IP address.

5. The method according to claim 1, characterized in that According to the model recognition results and rule judgment results, the illegal request behavior recognition results are calculated by voting method, and the formula is as follows: ， in, is the voting result for the order to be identified, that is, the identification result of the illegal request behavior, For the The binary rule judgment result of the rule is For the The weight of each rule; is the binary model recognition result, The weights of the model for identifying illegal requests, , is the number of rules.

6. A device for identifying illegal request behavior based on a supervised model, characterized in that: include: The information acquisition module is used to obtain the order information to be identified, including the user's tracking information from login to payment, order behavior information, IP and device data; A feature extraction module, used to pre-process the order information and extract features to obtain order features; A model prediction module is used to predict the illegal request probability of the order to be identified based on the order features using a pre-trained illegal request behavior recognition model, wherein the illegal request recognition model is constructed using the XGBoost method, wherein the model formula of XGBoost is: ,in Corresponding to an independent tree structure, is the number of tree structures, each tree structure will enter the order characteristics Map to the corresponding leaf node and calculate the weight of the leaf node w , thus obtaining the probability of illegal request of the order ; The voting module is used to identify the illegal request behavior of the order to be identified by voting based on the illegal request probability of the order to be identified and the predetermined illegal request behavior judgment rule, including: setting a binary model recognition result based on the illegal request probability of the order to be identified; obtaining a corresponding binary rule judgment result based on the predetermined illegal request behavior judgment rule; and calculating the illegal request behavior recognition result by voting according to the model recognition result and the rule judgment result.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images