A method and device for building a risk control model for marketing scenarios

Abstract

The present invention relates to a method and device for building a risk control model for marketing scenarios, and to the technical field of information security and risk control technology. The present invention includes three parts: unsupervised algorithm model construction, unsupervised algorithm model recognition result validity judgment, and supervised algorithm model construction; by using an unsupervised algorithm to build a risk control recognition model that does not rely on sample labels, using a relative entropy algorithm to identify large-scale and traffic-concentrated abnormal behaviors with a large difference in distribution from normal behaviors, and using an isolated forest to identify a small number of abnormal behaviors with a large difference from normal data, the ability to actively discover new risks is built.

Description

Technical Field

[0001] The present invention relates to the field of information security and risk control technology, and in particular to a method and device for building a risk control model for marketing scenarios. Background Art

[0002] In the current marketing environment, risk issues such as fraud and false transactions are becoming increasingly serious, seriously affecting the economic benefits and user experience of enterprises. Traditional risk control models often rely on supervised learning methods and require a large amount of labeled data for training.

[0003] In the existing technical solutions, the key points of risk control model construction mainly include sample construction, feature engineering and algorithm model training and tuning. The current mainstream solution is mainly to train classification recognition models for abnormal samples that have been identified in the past to explore their potential behavioral patterns, and then apply them to new traffic to identify abnormal users with similar behaviors. In this solution, sample construction is mainly based on the accumulation of risk behaviors intercepted by the rule engine and expert labeled data. Feature engineering includes operations such as feature calculation, data cleaning, standardization, and feature selection, which are then input into supervised classification algorithms such as logistic regression and random forest for model training and tuning.

[0004] The advantage of this solution is that it can use supervised classification algorithms to identify segment header problems and accuracy problems in the rule engine. However, this solution also has the disadvantages of being unable to automatically discover new risk behaviors and having high sample compliance costs. Summary of the invention

[0005] The present invention intends to provide a method, device, equipment and storage medium for building a risk control model for marketing scenarios to solve the deficiencies in the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0006] In a first aspect, a method for building a risk control model for a marketing scenario, the method comprising:

[0007] Step 1: Build an unsupervised algorithm model:

[0008] constructing a list of characteristics based on perceptions of risky behavior;

[0009] According to the relative entropy algorithm, risk behaviors are identified by identifying distribution differences;

[0010] According to the isolation forest algorithm, risky behaviors are identified by identifying outliers;

[0011] Step 2: updating the risk sample library according to the recognition result of the unsupervised algorithm model;

[0012] Step 3: Build a supervised algorithm model:

[0013] The behaviors existing in the risk sample library are taken as positive samples, and the behaviors with business conversion effects are taken as negative samples;

[0014] Constructing a classification and recognition model according to the DeepFM algorithm as a supervised algorithm model; splitting the positive samples and negative samples into a training set and a validation set, and evaluating and iteratively tuning the classification and recognition model;

[0015] The traffic to be evaluated is input into a supervised classification recognition model, a risk score is output, and whether to execute a risk control strategy is determined based on the risk score.

[0016] In some implementations, the identifying risky behavior by identifying distribution differences according to the relative entropy algorithm specifically includes:

[0017] Collect statistics on the baseline distribution of each dimension and feature; collect statistics on the distribution of the dimension corresponding to the flow to be evaluated in all features;

[0018] Performing relative entropy analysis on the benchmark distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormal score of the flow to be evaluated in each feature;

[0019] The anomaly scores of all features under the same dimension in the traffic to be evaluated are accumulated as an anomaly score; the anomaly scores of all features under all dimensions in the traffic to be evaluated are accumulated as a total anomaly score;

[0020] According to the total anomaly score and the distribution interval of its characteristic values, it is determined whether the traffic to be evaluated triggers a risk strategy.

[0021] In some implementations, the identifying risky behavior by identifying outliers according to the isolation forest algorithm specifically includes:

[0022] Based on the recognition of historical risk behaviors, a feature list is constructed to capture risk behaviors;

[0023] According to the features, the categorical features are preprocessed and converted into numerical features by performing LabelEncoder as sample data;

[0024] According to the sample data, multiple isolated trees are constructed by random subsampling to form an isolation forest model;

[0025] According to the sample data corresponding to the flow to be evaluated, the anomaly score is analyzed by calling the isolation forest model, and the risk control strategy is executed when the anomaly score is higher than the set threshold.

[0026] In some implementations, the calculation of the anomaly score s(x, n) is as shown in formula (1):

[0027] ;

[0028] Wherein, E(h(x)) is the average path length of the sample point x in all trees, n is the sample size of the training data, c(n) is the average path length of the tree, and the anomaly partition interval is [0,1].

[0029] In some implementations, the classification and recognition model specifically includes a neural network part and a factor decomposition machine part; the neural network part and the factor decomposition machine part respectively extract low-order features and high-order features.

[0030] In a second aspect, an embodiment of the present invention provides a risk control model building device for a marketing scenario, the device comprising:

[0031] Unsupervised algorithm model building modules, including:

[0032] The first building block is used to construct a list of characteristics based on the perception of risky behavior;

[0033] Anomaly identification unit, used to identify risky behaviors by identifying distribution differences based on a relative entropy algorithm;

[0034] A risk judgment unit is used to identify risky behaviors by identifying outliers based on the isolation forest algorithm;

[0035] An updating module, used to update the risk sample library according to the recognition result of the unsupervised algorithm model;

[0036] Supervised algorithm model building modules, including:

[0037] A behavior conversion unit, which uses behaviors existing in the risk sample library as positive samples and behaviors with business conversion effects as negative samples;

[0038] A sample splitting unit is used to construct a classification recognition model according to the DeepFM algorithm as a supervised algorithm model; split the positive samples and negative samples into a training set and a validation set, and evaluate and iteratively tune the classification recognition model;

[0039] The risk assessment unit is used to input the traffic to be assessed into a supervised classification recognition model, output a risk score, and determine whether to execute a risk control strategy based on the risk score.

[0040] In some implementations, the abnormality identification unit specifically includes:

[0041] The statistical subunit is used to count the baseline distribution of each dimension and feature; and to count the distribution of the dimension corresponding to the flow to be evaluated in all features;

[0042] A scoring subunit, used to perform relative entropy analysis on the reference distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormal score of the flow to be evaluated in each feature;

[0043] An accumulation subunit, configured to accumulate the anomaly scores of all features under the same dimension in the traffic to be evaluated as an anomaly score; and accumulate the anomaly scores of all features under all dimensions in the traffic to be evaluated as a total anomaly score;

[0044] The evaluation subunit is used to determine whether the flow to be evaluated triggers a risk strategy according to the total anomaly score and the distribution interval of its characteristic values.

[0045] In some implementations, the risk determination unit specifically includes:

[0046] The capture subunit is used to construct a feature list to capture risk behaviors based on the recognition of historical risk behaviors;

[0047] An execution subunit, used for converting the categorical features into numerical features by preprocessing and executing LabelEncoder on the categorical features according to the features as sample data;

[0048] Using sub-units to construct multiple isolated trees through random sub-sampling according to the sample data to form an isolation forest model;

[0049] The calling subunit is used to perform anomaly score analysis by calling the isolation forest model according to the sample data corresponding to the flow to be evaluated, and execute the risk control strategy when the anomaly score is higher than the set threshold.

[0050] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein when the one or more computer instructions are executed by the processor, the method described in the first aspect above is implemented.

[0051] In a fourth aspect, an embodiment of the present invention provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it is used to implement the method described in the first aspect.

[0052] The embodiments of the present invention include the following advantages:

[0053] The present invention consists of three parts: unsupervised algorithm model construction, unsupervised algorithm model recognition result validity judgment, and supervised algorithm model construction. The unsupervised algorithm is used to build a risk control recognition model that does not rely on sample labels, and the relative entropy algorithm is used to identify large-scale and traffic-concentrated abnormal behaviors with a large difference in distribution from normal behaviors. The isolated forest is used to identify a small number of abnormal behaviors with a large difference from normal data, thereby building the ability to actively discover new risks.

[0054] The sample library is improved by using the output of the unsupervised algorithm model. The sample accuracy judgment module is constructed by combining the output of the unsupervised recognition model and the business effect data. Users with high risk rates and poor business effect conversion are screened and updated to the risk sample library.

[0055] A supervised recognition model is built based on the DeepFM algorithm. By automatically learning the interactions between features, the need for manual feature engineering is reduced, and complex nonlinear relationships can be modeled, thus having stronger model expression capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a flow chart of a method for building a risk control model for a marketing scenario provided by an embodiment of the present invention;

[0057] Figure 2 is a flowchart of constructing an unsupervised recognition model provided by an embodiment of the present invention;

[0058] Figure 3 is a flow chart of constructing an independent forest algorithm model provided by an embodiment of the present invention;

[0059] Figure 4 It is a flow chart of updating a sample library with the unsupervised algorithm model recognition result provided by the present invention;

[0060] Figure 5 It is a flowchart of constructing a supervised algorithm model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0062] Embodiment 1:

[0063] Figure 1 A flow chart of a method for building a risk control model for a marketing scenario is shown. Figure 1 As shown, the risk control model building method for marketing scenarios provided in this embodiment includes:

[0064] First, follow step 1 to build an unsupervised algorithm model:

[0065] S11, constructing a list of characteristics based on the perception of risky behavior;

[0066] S12, identifying risky behaviors by identifying distribution differences according to the relative entropy algorithm;

[0067] S13, identifying risky behaviors by identifying outliers according to the isolation forest algorithm;

[0068] Most existing risk control models are based on supervised classification algorithms to identify known risk behaviors. This solution can only identify known risks by mining the behavioral patterns behind risk samples, but has a delay in identifying new risk behaviors. Only when abnormal fluctuations occur in business data can it be converted into known anomalies through expert analysis and identification.

[0069] This step requires the use of unsupervised algorithms to build a risk control identification model that does not rely on sample labels, the use of relative entropy algorithms to identify large-scale and traffic-concentrated abnormal behaviors that are significantly different from normal behavior distributions, and the use of isolation forests to identify "few but different" abnormal behaviors, that is, those that are small in number and significantly different from normal data, to build the ability to proactively discover new risks.

[0070] Specifically include:

[0071] According to S12, risky behaviors can only obtain the desired benefits when they accumulate to a certain level. However, attackers do not know the true distribution of normal user behaviors, so they will naturally have anomalies in some dimensions. The unsupervised relative entropy model can be used to identify risky behaviors. This model mainly includes three parts: baseline distribution calculation, feature construction, and anomaly score calculation. Figure 2 As shown, specifically including:

[0072] S121, performing statistics on the baseline distribution of each dimension and feature; performing statistics on the distribution of the dimension corresponding to the flow to be evaluated in all features;

[0073] For each ordering behavior, the data distribution in multiple dimensions and features is counted, including:

[0074] Dimensions: Comprehensive scoring of multiple dimensions to improve the confidence of recognition results, such as C-end user identification, traffic source, product identification, etc.

[0075] Features: Rich features can cover more possible attack methods and improve the recall rate of recognition.

[0076] S122, performing relative entropy analysis on the reference distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormality score of the flow to be evaluated in each feature;

[0077] First, the anomaly scores of n features are calculated, then the anomaly scores of m dimensions are calculated, and finally the sum of the anomaly scores of all dimensions is accumulated as the anomaly score of the user.

[0078] ;

[0079] ;

[0080] ;

[0081] Among them, p(x i ) is the normal traffic probability distribution (k-dimensional vector), q(x i ) is the probability distribution of the traffic to be evaluated.

[0082] S123, accumulating the anomaly scores of all features under the same dimension in the traffic to be evaluated as an anomaly score; accumulating the anomaly scores of all features under all dimensions in the traffic to be evaluated as a total anomaly score;

[0083] S124: Determine whether the traffic to be evaluated triggers a risk strategy based on the total anomaly score and the distribution interval of its characteristic values.

[0084] All behaviors are sorted in descending order by anomaly score, and behaviors whose anomaly scores are higher than a certain threshold and whose corresponding feature values ​​are in the distribution anomaly interval are screened out, and corresponding risk control strategies are executed based on the risk control level.

[0085] According to S13, the risk identification model based on relative entropy determines the risk of behavior by identifying the difference in distribution. This requires that such behavior accumulates to a certain level before it can be judged. It has a better identification effect on risk behaviors with large scale and high concentration. In order to improve the recall ability of risk behaviors with small amount and dispersion, the isolation forest algorithm is used to build the identification model. This algorithm belongs to unsupervised learning and is particularly suitable for detecting outliers in data. These outliers may represent potential risks or abnormal behaviors, such as Figure 3 As shown, specifically including:

[0086] S131, based on the recognition of historical risk behaviors, construct a feature list to capture risk behaviors;

[0087] S132, according to the features, converting the categorical features into numerical features by preprocessing and performing LabelEncoder on the categorical features as sample data;

[0088] Fill missing values ​​in the feature list with reasonable values ​​such as default values, average values, etc.; perform LabelEncoder to convert categorical features into numerical features.

[0089] Feature screening: Since the isolation forest algorithm is based on data distribution, data that is different from the distribution of most data (low-frequency values) will be considered as outliers. Therefore, features with smaller distribution differences contribute less to the model effect and can be deleted.

[0090] S133, constructing multiple isolated trees through random subsampling according to the sample data to form an isolation forest model;

[0091] M (M is much smaller than the size of the entire sample set) samples are randomly selected with replacement from the entire sample set to form a training subset. Based on this subset, an isolated binary tree is constructed by randomly selecting features and split points. This process is repeated until N (N is generally greater than 100) trees are established to form an isolation forest.

[0092] S134, according to the sample data corresponding to the flow to be evaluated, the anomaly score is analyzed by calling the isolation forest model, and the risk control strategy is executed when the anomaly score is higher than the set threshold.

[0093] Anomaly score calculation: For each sample x, the calculation formula of its anomaly score s(x, n) is as follows:

[0094] ;

[0095] Where E(h(x)) is the average path length of sample point x in all trees, n is the sample size of training data, c(n) is the average path length of the tree, and the anomaly partition interval is [0,1].

[0096] Determination of abnormal threshold: Based on the existing risk behavior sample library, business effect conversion data and behavior data, expert evaluation is conducted on abnormal samples screened by different abnormal score thresholds, and the abnormal score threshold is determined based on the sample recognition accuracy of different threshold evaluations.

[0097] Step 2: Figure 4 As shown, the risk sample library is updated according to the recognition result of the unsupervised algorithm model;

[0098] Currently, risk samples are mostly accumulated by intercepting results from rule engines and manually labeling by experts, which results in high labeling costs and fails to cover all risk scenarios.

[0099] In this step, the unsupervised recognition model does not rely on sample labels and has the ability to automatically discover risks. Therefore, we can consider using the output results of this type of model to improve the sample library, and build a sample accuracy judgment module based on the output results of the unsupervised recognition model and business effect data to screen users with high risk rates and poor business effect conversion and update them to the risk sample library.

[0100] In order to reduce the cost of labeling risk samples and improve the timeliness of updating new abnormal risk behaviors, the recognition results of the unsupervised algorithm model need to be automatically updated to the sample library. In order to ensure the accuracy of the samples, further filtering is required in combination with business conversion data and risk characteristics to exclude behaviors with conversion effects but no obvious risk characteristics.

[0101] Step 3: Figure 5 As shown, a supervised algorithm model is constructed:

[0102] S31, taking the behaviors existing in the risk sample library as positive samples, and taking the behaviors with business conversion effects as negative samples;

[0103] Positive and negative samples are constructed based on the risk sample library and business conversion data. When the ratio of positive and negative samples is too large, negative sampling is required to keep the ratio of positive and negative samples within 1:10.

[0104] S32, constructing a classification and recognition model according to the DeepFM algorithm as a supervised algorithm model; splitting the positive samples and negative samples into a training set and a validation set, and evaluating and iteratively tuning the classification and recognition model;

[0105] Based on the cognition of historical risk behaviors, a feature list is constructed, and preprocessing such as missing value processing and standardization is performed. Finally, the features are encapsulated. For example, continuous features can be directly spliced ​​into dense data; single-value discrete features are converted into vectors through the Embedding layer; multi-value discrete features are also processed through Embedding, and the average value of all Embedding vectors is taken.

[0106] In order to improve the recognition ability of the model, the DeepFM algorithm is used to build a classification recognition model. The model consists of a neural network part and a factor decomposition machine, which are responsible for the extraction of low-order features and high-order features respectively, and can well mine the rules hidden behind the data. In the model training stage, the cross entropy loss function is used to update the model parameters, and the model effect is evaluated based on indicators such as auc and f1-score on the training set and the validation set, and the model effect is optimized by adjusting the learning rate, regularization, dropout and other methods. ‌

[0107] S33, input the traffic to be evaluated into a supervised classification recognition model, output a risk score, and determine whether to execute a risk control strategy based on the risk score.

[0108] For the new estimated traffic, the feature list is obtained by splicing, the trained DeepFM model is called to calculate the risk score, and the corresponding risk control strategy is executed based on the risk score level.

[0109] Common machine learning classification algorithms have problems such as weak generalization ability and high dependence on feature engineering, which leads to high cost of optimizing model effects.

[0110] In this step, a supervised recognition model is built based on the DeepFM algorithm. By automatically learning the interactions between features, the need for manual feature engineering is reduced, and complex nonlinear relationships can be modeled, thus having stronger model expression capabilities.

[0111] Embodiment 2:

[0112] An embodiment of the present invention provides a risk control model building device for marketing scenarios, the device comprising:

[0113] Unsupervised algorithm model building modules, including:

[0114] The first building block is used to construct a list of characteristics based on the perception of risky behavior;

[0115] Anomaly identification unit, used to identify risky behaviors by identifying distribution differences based on a relative entropy algorithm;

[0116] A risk judgment unit is used to identify risky behaviors by identifying outliers based on the isolation forest algorithm;

[0117] An updating module, used to update the risk sample library according to the recognition result of the unsupervised algorithm model;

[0118] Supervised algorithm model building modules, including:

[0119] A behavior conversion unit, which uses behaviors existing in the risk sample library as positive samples and behaviors with business conversion effects as negative samples;

[0120] A sample splitting unit is used to construct a classification recognition model according to the DeepFM algorithm as a supervised algorithm model; split the positive samples and negative samples into a training set and a validation set, and evaluate and iteratively tune the classification recognition model;

[0121] The risk assessment unit is used to input the traffic to be assessed into a supervised classification recognition model, output a risk score, and determine whether to execute a risk control strategy based on the risk score.

[0122] Furthermore, the abnormality identification unit specifically includes:

[0123] The statistical subunit is used to count the baseline distribution of each dimension and feature; and to count the distribution of the dimension corresponding to the flow to be evaluated in all features;

[0124] A scoring subunit, used to perform relative entropy analysis on the reference distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormal score of the flow to be evaluated in each feature;

[0125] An accumulation subunit, configured to accumulate the anomaly scores of all features under the same dimension in the traffic to be evaluated as an anomaly score; and accumulate the anomaly scores of all features under all dimensions in the traffic to be evaluated as a total anomaly score;

[0126] The evaluation subunit is used to determine whether the flow to be evaluated triggers a risk strategy according to the total anomaly score and the distribution interval of its characteristic values.

[0127] Furthermore, the risk judgment unit specifically includes:

[0128] The capture subunit is used to construct a feature list to capture risk behaviors based on the recognition of historical risk behaviors;

[0129] An execution subunit, used for converting the categorical features into numerical features by preprocessing and executing LabelEncoder on the categorical features according to the features as sample data;

[0130] Using sub-units to construct multiple isolated trees through random sub-sampling according to the sample data to form an isolation forest model;

[0131] The calling subunit is used to perform anomaly score analysis by calling the isolation forest model according to the sample data corresponding to the flow to be evaluated, and execute the risk control strategy when the anomaly score is higher than the set threshold.

[0132] Embodiment three:

[0133] This embodiment further provides an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions implement the method of embodiment 1 when executed by the processor;

[0134] In practical applications, the processor can be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller unit (MCU), a microprocessor or other electronic components to execute the methods in the above embodiments.

[0135] The method implemented in this embodiment is as shown in Embodiment 1.

[0136] Embodiment 4:

[0137] This embodiment further provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, the method of the first embodiment is implemented;

[0138] Among them, the computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0139] The method implemented in this embodiment is as shown in Embodiment 1.

[0140] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0141] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0142] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0143] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0144] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0145] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0146] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for building a risk control model for marketing scenarios, characterized in that: The method comprises: Step 1: Build an unsupervised algorithm model: constructing a list of characteristics based on perceptions of risky behavior; Construct an unsupervised algorithm model based on the relative entropy algorithm and the isolation forest algorithm; According to the relative entropy algorithm, risk behaviors are identified by identifying distribution differences; According to the isolation forest algorithm, risky behaviors are identified by identifying outliers; Step 2: updating the risk sample library according to the recognition result of the unsupervised algorithm model; Step 3: Build a supervised algorithm model: The behaviors existing in the risk sample library are taken as positive samples, and the behaviors with business conversion effects are taken as negative samples; Constructing a classification and recognition model according to the DeepFM algorithm as a supervised algorithm model; splitting the positive samples and negative samples into a training set and a validation set, and evaluating and iteratively tuning the classification and recognition model; Input the traffic to be evaluated into a supervised classification recognition model, output a risk score, and determine whether to execute a risk control strategy based on the risk score; Wherein, the identifying of risk behaviors by identifying distribution differences according to the relative entropy algorithm specifically includes: Collect statistics on the baseline distribution of each dimension and feature; collect statistics on the distribution of the dimension corresponding to the flow to be evaluated in all features; Performing relative entropy analysis on the benchmark distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormal score of the flow to be evaluated in each feature; The anomaly scores of all features under the same dimension in the traffic to be evaluated are accumulated as an anomaly score; the anomaly scores of all features under all dimensions in the traffic to be evaluated are accumulated as a total anomaly score; Determine whether the traffic to be evaluated triggers a risk strategy according to the total anomaly score and the distribution interval of its characteristic values; The step of identifying risk behaviors by identifying outliers based on the isolation forest algorithm specifically includes: Based on the recognition of historical risk behaviors, a feature list is constructed to capture risk behaviors; According to the features, the categorical features are preprocessed and converted into numerical features by performing LabelEncoder as sample data; According to the sample data, multiple isolated trees are constructed by random subsampling to form an isolation forest model; According to the sample data corresponding to the flow to be evaluated, the anomaly score is analyzed by calling the isolation forest model, and the risk control strategy is executed when the anomaly score is higher than the set threshold; The calculation of the anomaly score s(x, n) is shown in formula (1): ； Wherein, E(h(x)) is the average path length of sample point x in all trees, n is the sample size of training data, c(n) is the average path length of the tree, and the abnormality partition interval is [0,1]; The classification and recognition model specifically includes a neural network part and a factor decomposition machine part; the neural network part and the factor decomposition machine part respectively extract low-order features and high-order features.

2. A risk control model building device for marketing scenarios, The method according to claim 1, characterized in that The device comprises: Unsupervised algorithm model building modules, including: The first building block is used to construct a list of characteristics based on the perception of risky behavior; Anomaly identification unit, used to identify risky behaviors by identifying distribution differences based on a relative entropy algorithm; A risk judgment unit is used to identify risky behaviors by identifying outliers based on the isolation forest algorithm; An updating module, used to update the risk sample library according to the recognition result of the unsupervised algorithm model; Supervised algorithm model building modules, including: A behavior conversion unit, which uses behaviors existing in the risk sample library as positive samples and behaviors with business conversion effects as negative samples; A sample splitting unit is used to construct a classification recognition model according to the DeepFM algorithm as a supervised algorithm model; split the positive samples and negative samples into a training set and a validation set, and evaluate and iteratively tune the classification recognition model; The risk assessment unit is used to input the traffic to be assessed into a supervised classification recognition model, output a risk score, and determine whether to execute a risk control strategy based on the risk score.

3. The device according to claim 2, characterized in that The abnormality identification unit specifically includes: The statistical subunit is used to count the baseline distribution of each dimension and feature; and to count the distribution of the dimension corresponding to the flow to be evaluated in all features; A scoring subunit, used to perform relative entropy analysis on the reference distribution of each dimension and each feature and the distribution corresponding to the flow to be evaluated, to obtain an abnormal score of the flow to be evaluated in each feature; An accumulation subunit, configured to accumulate the anomaly scores of all features under the same dimension in the traffic to be evaluated as an anomaly score; and accumulate the anomaly scores of all features under all dimensions in the traffic to be evaluated as a total anomaly score; The evaluation subunit is used to determine whether the flow to be evaluated triggers a risk strategy according to the total anomaly score and the distribution interval of its characteristic values.

4. The device according to claim 2, characterized in that The risk judgment unit specifically includes: The capture subunit is used to construct a feature list to capture risk behaviors based on the recognition of historical risk behaviors; An execution subunit, used for converting the categorical features into numerical features by preprocessing and executing LabelEncoder on the categorical features according to the features as sample data; Using sub-units to construct multiple isolated trees through random sub-sampling according to the sample data to form an isolation forest model; The calling subunit is used to perform anomaly score analysis by calling the isolation forest model according to the sample data corresponding to the flow to be evaluated, and execute the risk control strategy when the anomaly score is higher than the set threshold.

5. An electronic device, characterized in that: It includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the risk control model building method for marketing scenarios as described in claim 1 above.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it is used to implement the risk control model building method for marketing scenarios as described in claim 1 above.

Images