Abnormal user detection method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the technical field of deep learning, and relates to an abnormal user detection method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining user behavior data corresponding to user identification data according to a data burying point method; encoding the user behavior data to obtain a user feature matrix; and calling the trained deep learning model, and inputting the user feature matrix into the trained deep learning model for anomaly prediction to obtain an anomaly prediction result. According to the method, the user behavior data is encoded into the user feature matrix to describe the behavior operation of the user, the behavior of the user can be clearly described, the accuracy of subsequent anomaly detection is effectively guaranteed, in addition, anomaly prediction is performed on the feature matrix of the to-be-detected user behavior through the Transform model based on the self-attention mechanism, and the accuracy of anomaly detection is improved. Behavior features similar to abnormal user behaviors are further obtained, deep features of the user behaviors can be mined in a deeper level, and the anomaly detection accuracy is effectively guaranteed.

Description

Technical Field

[0001] The present application relates to the field of deep learning technology of artificial intelligence, and in particular to an abnormal user detection method, apparatus, computer equipment and storage medium. Background Art

[0002] With the rapid development of new generation information technology, enterprises and organizations are also facing more network security threats. Using artificial intelligence, big data, cloud computing and other technologies to detect abnormal user behavior can effectively detect existing network threats. At present, network security threat detection mainly uses User and Entity Behavior Analytics (UEBA) technology. User and Entity Behavior Analytics technology associates user activities with other related entities, including terminals and applications accessed by users. Through data analysis capabilities such as system log analysis, network traffic analysis, and identity analysis, the normal behavior of user entities is modeled, and then risk assessment and alarm are performed during the user access process, so as to adapt to the various network security threats that exist now.

[0003] Existing user entity behavior analysis methods and models are mainly based on rules that rely on expert experience and perform analysis through manually set thresholds. There are also commercial applications that combine user behavior analysis and machine learning to monitor changes in user behavior in real time and provide security teams with rapid threat detection and early warning capabilities.

[0004] However, the applicant has found that traditional user behavior analysis technology usually cannot clearly describe the user's behavior, which leads to low accuracy of user behavior anomaly detection and unreliable detection results. It can be seen that traditional user behavior anomaly detection methods have the problem of low accuracy. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide an abnormal user detection method, apparatus, computer equipment and storage medium to solve the problem of low accuracy of traditional user behavior abnormality detection methods.

[0006] In order to solve the above technical problems, the embodiment of the present application provides an abnormal user detection method, which adopts the following technical solution:

[0007] Receiving a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected;

[0008] Acquire user behavior data corresponding to the user identification data according to a data embedding method;

[0009] Performing encoding operation on the user behavior data to obtain a user feature matrix;

[0010] Calling a trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining an abnormality prediction result;

[0011] The abnormal prediction result is sent to the user terminal.

[0012] Furthermore, after the step of acquiring the user behavior data corresponding to the user identification data according to the data embedding method and before the step of encoding the user behavior data to obtain the user feature matrix, the following steps are also included:

[0013] Performing a data cleaning operation on the user behavior data to obtain cleaned behavior data;

[0014] Performing a data integration operation on the cleaning behavior data to obtain an integrated data table;

[0015] Performing a redundancy detection operation on the integrated data table to obtain a redundancy detection result;

[0016] Performing a data elimination operation on the user behavior data according to the redundant detection result to obtain pre-processed behavior data;

[0017] The step of encoding the user behavior data to obtain a user feature matrix specifically includes the following steps:

[0018] The preprocessed behavior data is encoded to obtain the user feature matrix.

[0019] Furthermore, the user behavior data includes process operation behavior and user preference behavior, and the step of encoding the user behavior data to obtain a user feature matrix specifically includes the following steps:

[0020] Encoding the process operation behavior and the user preference behavior respectively to obtain process operation characteristics and user preference characteristics respectively;

[0021] The process operation characteristics and the user preference characteristics are concatenated to obtain the user characteristic matrix.

[0022] Furthermore, before the step of calling the trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining the abnormality prediction result, the following steps are also included:

[0023] Reading a system database, and obtaining historical user information in the system database, wherein the historical user information includes user type information and historical behavior information;

[0024] Encode each user's historical behavior information separately to obtain each user's historical feature matrix;

[0025] An initial deep learning model is constructed, and the historical feature matrix and the user type information are used as training samples and label information respectively to perform a model training operation on the initial deep learning model to obtain the trained deep learning model.

[0026] Furthermore, the deep learning model is composed of an encoder and a decoder, wherein the encoder is a recurrent neural network and the decoder is a decoder of a Transformer model.

[0027] Furthermore, after the step of calling the trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining the abnormality prediction result, the following steps are specifically included:

[0028] Sending the abnormal prediction result to the business terminal for verification;

[0029] Receive the verification result sent by the business terminal, and iterate and optimize the parameters of the trained deep learning model according to the verification result.

[0030] In order to solve the above technical problems, the embodiment of the present application further provides an abnormal user detection device, which adopts the following technical solution:

[0031] A request acquisition module, used to receive a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected;

[0032] A behavior data acquisition module, used to acquire user behavior data corresponding to the user identification data according to a data embedding method;

[0033] A first encoding module, used for encoding the user behavior data to obtain a user feature matrix;

[0034] An abnormality prediction module is used to call a trained deep learning model, input the user feature matrix into the trained deep learning model for abnormality prediction, and obtain an abnormality prediction result;

[0035] A result output module is used to send the abnormal prediction result to the user terminal.

[0036] Furthermore, the device further comprises: a data cleaning module, a data integration module, a redundancy detection module and a data elimination module, and the first encoding module further comprises: an encoding submodule, wherein:

[0037] The data cleaning module is used to perform a data cleaning operation on the user behavior data to obtain cleaned behavior data;

[0038] The data integration module is used to perform data integration operations on the cleaning behavior data to obtain an integrated data table;

[0039] The redundancy detection module is used to perform a redundancy detection operation on the integrated data table to obtain a redundancy detection result;

[0040] The data elimination module is used to perform a data elimination operation on the user behavior data according to the redundant detection result to obtain pre-processed behavior data;

[0041] The encoding submodule is used to perform encoding operation on the pre-processed behavior data to obtain the user feature matrix.

[0042] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0043] The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the abnormal user detection method as described above when executing the computer-readable instructions.

[0044] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0045] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the abnormal user detection method described above are implemented.

[0046] The present application provides an abnormal user detection method, including: receiving a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected; obtaining user behavior data corresponding to the user identification data according to a data embedding method; encoding the user behavior data to obtain a user feature matrix; calling a trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormal prediction, and obtaining an abnormal prediction result; and sending the abnormal prediction result to the user terminal. Compared with the prior art, the present application encodes the user behavior data into a user feature matrix, and uses the user feature matrix to describe the user's behavior operation. Compared with traditional user behavior analysis technology, it can clearly describe the user's behavior and effectively guarantee the accuracy of subsequent abnormal detection. In addition, the Transformer model based on the self-attention mechanism is used to perform abnormal prediction on the feature matrix of the user behavior to be detected, and further obtains behavioral features similar to abnormal user behavior, which can dig deeper into the deep features of user behavior, and finally confirm whether the user to be detected is an abnormal user, effectively guaranteeing the accuracy of abnormal detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0049] Figure 2 is a flowchart of an implementation of the abnormal user detection method provided in Example 1 of the present application;

[0050] Figure 3 is a structural diagram of an abnormal user detection device provided in Embodiment 2 of the present application;

[0051] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0053] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0054] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0055] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0056] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0057] The terminal devices 101, 102, and 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0058] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0059] It should be noted that the abnormal user detection method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the abnormal user detection device is generally set in the server / terminal device.

[0060] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0061] Embodiment 1

[0062] Continue to refer Figure 2 , shows a flow chart of an embodiment of an abnormal user detection method according to the present application. The abnormal user detection method comprises: step S201, step S202, step S203, step S204, step S205, step S206 and step S207.

[0063] In step S201, a detection request sent by a user terminal is received, wherein the detection request includes user identification data of a user to be detected.

[0064] In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for the convenience of understanding and are not used to limit the present application.

[0065] In the embodiments of the present application, user identification data is mainly used to uniquely identify and distinguish the user to be detected. As an example, the user identification data may be the user's ID card information, or the user identification data may be a number or identification code preset by the user. It should be understood that the examples of user identification data here are only for the convenience of understanding and are not used to limit the present application.

[0066] In step S202, user behavior data corresponding to the user identification data is obtained according to the data burial method.

[0067] In the embodiments of the present application, the data burying method is mainly used to collect behavioral data related to the user to be detected. These data usually include user operation behaviors such as clicks, browsing, purchases, registrations, and timestamps, behavior types, page paths, device information, and other important information about user behaviors. The data burying method can be to implant statistical codes at key points of product and service conversion. The data burying method can also be to implant multiple segments of code to track a series of user behaviors on the platform. The data burying method can also be combined with company engineering and ETL to collect and analyze the full amount of user behaviors, establish user portraits, restore user behavior models, etc. It should be understood that the examples of the data burying method here are only for the convenience of understanding and are not used to limit the present application.

[0068] In the embodiment of the present application, user behavior data refers to user operation behaviors such as clicking, browsing, purchasing, and registering, as well as important information about user behavior such as timestamp, behavior type, page path, and device information.

[0069] In step S203, the user behavior data is encoded to obtain a user feature matrix.

[0070] In an embodiment of the present application, after obtaining the user behavior data, the behavior information can be decomposed into a number of ordered sessions Yn={y1, y2, y3…yn}, and the session sequence can be used to identify the user's behavior, and the encoding operation is the process of decomposing the above user behavior data into a number of ordered sessions.

[0071] In step S204, the trained deep learning model is called, and the user feature matrix is ​​input into the trained deep learning model for anomaly prediction to obtain anomaly prediction results.

[0072] In the embodiment of the present application, the deep learning model is mainly used to identify the behavior characteristics similar to the abnormal user behavior from the user's feature matrix (i.e., the several sessions obtained after the above disassembly), so as to predict the behavior of the user to be detected and identify whether the user to be detected is an abnormal user. The deep learning model can be a Transformer model based on the self-attention mechanism. It should be understood that the examples of deep learning models here are only for the convenience of understanding and are not used to limit this application.

[0073] In step S205, the abnormal prediction result is sent to the user terminal.

[0074] In an embodiment of the present application, an abnormal user detection method is provided, including: receiving a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected; obtaining user behavior data corresponding to the user identification data according to a data embedding method; encoding the user behavior data to obtain a user feature matrix; calling a trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormal prediction, and obtaining an abnormal prediction result; and sending the abnormal prediction result to the user terminal. Compared with the prior art, the present application encodes the user behavior data into a user feature matrix, and uses the user feature matrix to describe the user's behavior operation. Compared with traditional user behavior analysis technology, it can clearly describe the user's behavior and effectively guarantee the accuracy of subsequent abnormal detection. In addition, the Transformer model based on the self-attention mechanism is used to perform abnormal prediction on the feature matrix of the user behavior to be detected, and further obtains behavioral features similar to abnormal user behavior, which can dig deeper into the deep features of user behavior, and finally confirm whether the user to be detected is an abnormal user, effectively guaranteeing the accuracy of abnormal detection.

[0075] In some optional implementations of this embodiment, after step S202 and before step S203, the following steps are further included:

[0076] Performing data cleaning operations on user behavior data to obtain cleaned behavior data;

[0077] Perform data integration operation on the cleaning behavior data to obtain an integrated data table;

[0078] Performing a redundancy detection operation on the integrated data table to obtain a redundancy detection result;

[0079] Perform data elimination operation on user behavior data according to the redundant detection result to obtain pre-processed behavior data;

[0080] The above step S203 specifically includes the following steps:

[0081] Perform encoding operation on the preprocessed behavior data to obtain the user feature matrix.

[0082] In an embodiment of the present application, the user behavior data obtained by means of data embedding contains a large amount of data information of different categories and quantities, and there is duplicate data. If the user behavior data is directly encoded as user feature data for subsequent anomaly prediction, the data of the input model will be complicated, thereby reducing the model detection efficiency. Therefore, it is necessary to preprocess the collected user behavior data. Specifically, the user behavior data is integrated to combine the data from multiple data sources into a coherent data table, and data redundancy detection is performed based on the data table to obtain redundant data information.

[0083] In the embodiment of the present application, the redundancy detection may be implemented as follows:

[0084] 1) Analyze the relationship between data tables:

[0085] ① Check how each table is connected and whether there are redundant key values ​​and data columns;

[0086] ② Eliminate duplicate data by deleting these columns, modifying the table structure, or merging tables;

[0087] 2) Retrieve duplicate records:

[0088] ① Use SQL statements to query all duplicate data items in the table and mark invalid records;

[0089] ② After marking, you can delete them manually or write SQL commands to automatically delete them;

[0090] 3. Database design analysis:

[0091] ① Use tools such as ER diagram (entity-relationship diagram) and data dictionary to analyze database design and find the existence of redundant data;

[0092] 4. Database query analysis:

[0093] ① By querying the database, analyzing the relationship between data tables, and identifying whether there is redundant data;

[0094] 5. Database statistical analysis:

[0095] ① Count the data in the statistical table, analyze the data distribution, and identify whether there is redundant data;

[0096] ②If a data value appears multiple times in multiple data tables, there may be redundant data;

[0097] 6. Database index analysis:

[0098] ① By analyzing the indexes in the database, identify whether there are duplicate indexes and redundant indexes. Duplicate indexes and redundant indexes will cause database performance to degrade and increase the complexity of data management;

[0099] 7. Use deduplication technology:

[0100] In spreadsheet software such as Excel, you can use the "conditional formatting" function to mark duplicate rows, and then delete redundant data based on the marked content;

[0101] In the database, you can directly use deduplication commands similar to the dist inct function.

[0102] It should be understood that the examples of redundant detection operations here are only for ease of understanding and are not intended to limit the present application.

[0103] In some optional implementations of this embodiment, the above step S203 specifically includes the following steps:

[0104] Encoding the process operation behavior and the user preference behavior respectively to obtain the process operation characteristics and the user preference characteristics respectively;

[0105] The process operation characteristics and user preference characteristics are concatenated to obtain the user feature matrix.

[0106] In the embodiment of the present application, a complete visit behavior of a user can be recorded and identified through a series of orderly sessions. Taking the process of a user's insurance claim reporting as an example, it can be simply broken down into the process of logging into the system - checking the insurance policy - reporting the case - investigating - uploading documents - settling the account - filling in payment information - closing the case - payment completion, etc. These processes can be broken down into several orderly sessions. This session sequence can be used to identify user behavior. In fact, in addition to the main business process operations, when a user logs into the system, he may also carry some request session information with user operation habits or other preferences, such as clicking on pages or advertisements that he is interested in. This session sequence can be used to identify different users. So we can get To record user behavior and identify different users.

[0107] In some optional implementations of this embodiment, before step S204, the following steps may also be performed:

[0108] Read the system database and obtain historical user information from the system database, wherein the historical user information includes user type information and historical behavior information;

[0109] Encode each user's historical behavior information separately to obtain each user's historical feature matrix;

[0110] An initial deep learning model is constructed, and the historical feature matrix and user type information are used as training samples and label information to perform model training operations on the initial deep learning model to obtain a trained deep learning model.

[0111] In the embodiment of the present application, the system database is mainly used to store user behavior data. Specifically, it can add tracking points through apps and web applications to collect user session information, including user access records and page response data. The session information of easy-to-litigate users and risky users is extracted as training samples.

[0112] In the embodiment of the present application, all the session information of a certain user is taken from the above training samples and arranged in chronological order. Take the ith session and record the user's access records of the session in sequence as the feature vector xi=(x1,x2,x3…xn)(n∈N). Then all the session sequences of the user can be represented as the feature matrix Q=mxn(n∈N,m∈M), where m represents the user's mth session record and n represents the nth access record of the session.

[0113] In the embodiment of the present application, the user's conversation sequence is an ordered sequence. When modeling, the context of the conversation needs to be comprehensively considered. Therefore, a transformer model with short-term memory is selected for modeling. The conversation sequence collected above is converted into a conversation matrix as a training sample input to generate a transformer model.

[0114] In some optional implementations of this embodiment, the deep learning model is composed of an encoder and a decoder, wherein the encoder is a recurrent neural network and the decoder is a decoder of a Transformer model.

[0115] In an embodiment of the present application, by replacing the encoder of the deep learning model with a recurrent neural network (RNN), a stronger sequence modeling capability can be provided for the deep learning model. At the same time, the decoder of the Transformer model is used as the decoder of the deep learning model, thereby providing the model with powerful generation capabilities. The present application combines the decoder of the recurrent neural network (RNN) and the Transformer model, effectively utilizing the advantages of RNN in sequence modeling and the advantages of Transformer in generation, to provide higher accuracy for anomaly prediction.

[0116] In some optional implementations of this embodiment, after step S204, the following steps may also be performed:

[0117] Send the abnormal prediction results to the business terminal for verification;

[0118] Receive the verification results sent by the business terminal, and iterate and optimize the parameters of the trained deep learning model based on the verification results.

[0119] In an embodiment of the present application, the buried data of each user is obtained, and the users who are prone to litigation and those who are at risk are predicted through the model and pushed to the designated business personnel. The users who are prone to litigation and those who are at risk are further determined through manual confirmation, and used as small batch samples to perform small batch gradient descent optimization on the model to improve the prediction accuracy of the model.

[0120] In some optional implementations of this embodiment, abnormal users can be divided into users who are prone to litigation and risky users. The access records of users who are prone to litigation mainly include those who give low scores to system services, frequently communicate with claims adjusters but fail to solve problems or have bad attitudes, and frequently visit complaint-related pages in the application. The access records of risky users mainly include those who visit specific pages or products with clear goals, organization, and plan (eg: organized insurance fraud). Both types of users have behaviors that are different from those of ordinary users in the access session, and can be identified or predicted through models, and users who are prone to litigation and risky users can be identified in advance to reduce user complaints and risky cases.

[0121] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0122] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0123] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0124] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0125] Embodiment 2

[0126] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of an abnormal user detection device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0127] like Figure 3 As shown, the abnormal user detection device 200 of this embodiment includes:

[0128] The request acquisition module 210 is used to receive a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected;

[0129] The behavior data acquisition module 220 is used to acquire user behavior data corresponding to the user identification data according to the data embedding method;

[0130] The first encoding module 230 is used to perform encoding operation on the user behavior data to obtain a user feature matrix;

[0131] The abnormality prediction module 240 is used to call the trained deep learning model, input the user feature matrix into the trained deep learning model for abnormality prediction, and obtain the abnormality prediction result;

[0132] The result output module 250 is used to send the abnormal prediction result to the user terminal.

[0133] In this embodiment, an abnormal user detection device 200 is provided, including: a request acquisition module 210, used to receive a detection request sent by a user terminal, wherein the detection request includes user identification data of the user to be detected; a behavior data acquisition module 220, used to obtain user behavior data corresponding to the user identification data according to a data embedding method; a first encoding module 230, used to encode the user behavior data to obtain a user feature matrix; an abnormal prediction module 240, used to call a trained deep learning model, input the user feature matrix into the trained deep learning model for abnormal prediction, and obtain an abnormal prediction result; a result output module 250, used to send the abnormal prediction result to the user terminal. Compared with the prior art, the present application encodes user behavior data into a user feature matrix, which is used to describe the user's behavior operations. Compared with traditional user behavior analysis technology, the present application can clearly describe the user's behavior and effectively ensure the accuracy of subsequent anomaly detection. In addition, the Transformer model based on the self-attention mechanism is used to perform anomaly prediction on the feature matrix of the user behavior to be detected, and further obtain behavioral features similar to abnormal user behavior, which can more deeply explore the deep characteristics of user behavior, and finally confirm whether the user to be detected is an abnormal user, effectively ensuring the accuracy of anomaly detection.

[0134] In some optional implementations of this embodiment, the abnormal user detection device 200 further includes: a data cleaning module, a data integration module, a redundancy detection module and a data elimination module, and the first encoding module further includes: an encoding submodule, wherein:

[0135] A data cleaning module is used to perform data cleaning operations on user behavior data to obtain cleaned behavior data;

[0136] A data integration module is used to perform data integration operations on the cleaning behavior data to obtain an integrated data table;

[0137] A redundancy detection module is used to perform a redundancy detection operation on the integrated data table to obtain a redundancy detection result;

[0138] A data elimination module is used to perform a data elimination operation on the user behavior data according to the redundant detection result to obtain pre-processed behavior data;

[0139] The encoding submodule is used to encode the preprocessed behavior data to obtain a user feature matrix.

[0140] In some optional implementations of this embodiment, the first encoding module 230 includes:

[0141] The first encoding submodule is used to encode the process operation behavior and the user preference behavior to obtain the process operation characteristics and the user preference characteristics respectively;

[0142] The splicing submodule is used to splice the process operation characteristics and the user preference characteristics to obtain the user feature matrix.

[0143] In some optional implementations of this embodiment, the abnormal user detection device 200 further includes:

[0144] The historical data return module is used to read the system database and obtain historical user information from the system database, where the historical user information includes user type information and historical behavior information;

[0145] The second encoding module is used to encode the historical behavior information of each user to obtain a historical feature matrix of each user;

[0146] The model training module is used to build an initial deep learning model, and use the historical feature matrix and user type information as training samples and label information to perform model training operations on the initial deep learning model to obtain a trained deep learning model.

[0147] In some optional implementations of this embodiment, the deep learning model is composed of an encoder and a decoder, wherein the encoder is a recurrent neural network and the decoder is a decoder of a Transformer model.

[0148] In some optional implementations of this embodiment, the abnormal user detection device 200 further includes:

[0149] The result sending module is used to send the abnormal prediction results to the business terminal for verification processing;

[0150] The parameter optimization module is used to receive the verification results sent by the business terminal and iterate and optimize the parameters of the trained deep learning model according to the verification results.

[0151] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0152] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital processors (DSPs), embedded devices, etc.

[0153] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0154] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 310 can be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 can also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory 310 can also include both the internal storage unit of the computer device 300 and its external storage device. In this embodiment, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of the abnormal user detection method, etc. In addition, the memory 310 can also be used to temporarily store various data that have been output or are to be output.

[0155] The processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 320 is generally used to control the overall operation of the computer device 300. In this embodiment, the processor 320 is used to run computer-readable instructions or process data stored in the memory 310, such as computer-readable instructions for running the abnormal user detection method.

[0156] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0157] The computer device provided by the present application encodes user behavior data into a user feature matrix, and uses the user feature matrix to describe the user's behavior operations. Compared with traditional user behavior analysis technology, it can clearly describe the user's behavior and effectively ensure the accuracy of subsequent anomaly detection. In addition, the feature matrix of the user behavior to be detected is predicted to be abnormal through the Transformer model based on the self-attention mechanism, and behavioral features similar to abnormal user behavior are further obtained. It is possible to more deeply explore the deep characteristics of user behavior, and finally confirm whether the user to be detected is an abnormal user, effectively ensuring the accuracy of anomaly detection.

[0158] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the abnormal user detection method as described above.

[0159] The computer-readable storage medium provided by the present application encodes user behavior data into a user feature matrix, and uses the user feature matrix to describe the user's behavior operations. Compared with traditional user behavior analysis technology, it can clearly describe the user's behavior and effectively ensure the accuracy of subsequent anomaly detection. In addition, the feature matrix of the user behavior to be detected is used for anomaly prediction through a Transformer model based on a self-attention mechanism, and behavioral features similar to abnormal user behaviors are further obtained, which can dig deeper into the deep features of user behavior, and finally confirm whether the user to be detected is an abnormal user, effectively ensuring the accuracy of anomaly detection.

[0160] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0161] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for detecting abnormal users, characterized in that: The steps include: Receiving a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected; Acquire user behavior data corresponding to the user identification data according to a data embedding method; Performing encoding operation on the user behavior data to obtain a user feature matrix; Calling a trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining an abnormality prediction result; The abnormal prediction result is sent to the user terminal.

2. The abnormal user detection method according to claim 1, characterized in that: After the step of acquiring the user behavior data corresponding to the user identification data according to the data embedding method and before the step of encoding the user behavior data to obtain a user feature matrix, the following steps are also included: Performing a data cleaning operation on the user behavior data to obtain cleaned behavior data; Performing a data integration operation on the cleaning behavior data to obtain an integrated data table; Performing a redundancy detection operation on the integrated data table to obtain a redundancy detection result; Performing a data elimination operation on the user behavior data according to the redundant detection result to obtain pre-processed behavior data; The step of encoding the user behavior data to obtain a user feature matrix specifically includes the following steps: The preprocessed behavior data is encoded to obtain the user feature matrix.

3. The abnormal user detection method according to claim 1, characterized in that: The user behavior data includes process operation behavior and user preference behavior. The step of encoding the user behavior data to obtain a user feature matrix specifically includes the following steps: Encoding the process operation behavior and the user preference behavior respectively to obtain process operation characteristics and user preference characteristics respectively; The process operation characteristics and the user preference characteristics are concatenated to obtain the user characteristic matrix.

4. The abnormal user detection method according to claim 1, characterized in that: Before the step of calling the trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining the abnormality prediction result, the following steps are also included: Reading a system database, and obtaining historical user information in the system database, wherein the historical user information includes user type information and historical behavior information; Encode each user's historical behavior information separately to obtain each user's historical feature matrix; An initial deep learning model is constructed, and the historical feature matrix and the user type information are used as training samples and label information respectively to perform a model training operation on the initial deep learning model to obtain the trained deep learning model.

5. The abnormal user detection method according to claim 1, characterized in that: The deep learning model is composed of an encoder and a decoder, wherein the encoder is a recurrent neural network and the decoder is a decoder of a Transformer model.

6. The abnormal user detection method according to claim 1, characterized in that: After the step of calling the trained deep learning model, inputting the user feature matrix into the trained deep learning model for abnormality prediction, and obtaining the abnormality prediction result, the following steps are specifically included: Sending the abnormal prediction result to the business terminal for verification; Receive the verification result sent by the business terminal, and iterate and optimize the parameters of the trained deep learning model according to the verification result.

7. An abnormal user detection device, characterized in that: include: A request acquisition module, used to receive a detection request sent by a user terminal, wherein the detection request includes user identification data of a user to be detected; A behavior data acquisition module, used to acquire user behavior data corresponding to the user identification data according to a data embedding method; A first encoding module, used for encoding the user behavior data to obtain a user feature matrix; An abnormality prediction module is used to call a trained deep learning model, input the user feature matrix into the trained deep learning model for abnormality prediction, and obtain an abnormality prediction result; A result output module is used to send the abnormal prediction result to the user terminal.

8. The abnormal user detection device according to claim 7, characterized in that: The device further comprises: a data cleaning module, a data integration module, a redundancy detection module and a data elimination module, and the first encoding module further comprises: an encoding submodule, wherein: The data cleaning module is used to perform a data cleaning operation on the user behavior data to obtain cleaned behavior data; The data integration module is used to perform data integration operations on the cleaning behavior data to obtain an integrated data table; The redundancy detection module is used to perform a redundancy detection operation on the integrated data table to obtain a redundancy detection result; The data elimination module is used to perform a data elimination operation on the user behavior data according to the redundant detection result to obtain pre-processed behavior data; The encoding submodule is used to perform encoding operation on the pre-processed behavior data to obtain the user feature matrix.

9. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the abnormal user detection method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the abnormal user detection method according to any one of claims 1 to 6 are implemented.

Images