Risk identification method, device and equipment

Abstract

The embodiment of the invention discloses a risk identification method, device and equipment, and relates to the technical field of computers, and the method comprises the steps: obtaining time sequence behavior sequence data of a user; encoding the time sequence behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the time sequence behavior sequence data; based on the behavior sequence representation, retrieving a target data representation matched with the behavior sequence representation from a retrieval database; performing aggregation processing on the target data representation and the behavior sequence representation to perform data enhancement processing on the time sequence behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the time sequence behavior sequence data, and determining whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the time sequence behavior sequence data.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a risk identification method, device and equipment. Background Art

[0002] As people pay more and more attention to the security of their privacy data, risk identification has become an indispensable part of online services, and risk identification through user time-series behavior sequence data is an effective way to identify risks.

[0003] Generally, user temporal behavior representation models have a certain timeliness. In actual scenarios, user behavior patterns change over time and are easily affected by special events. As a result, the user representations produced by the user temporal behavior representation models trained with historical data are invalid in downstream tasks. This problem is called concept drift, and has long been one of the challenges faced by downstream tasks such as fraud detection and risk detection and identification of user behavior representation modeling. To this end, it is necessary to provide a technical solution that can effectively reduce the occurrence of user behavior sequence concept drift and improve the accuracy of risk identification. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a technical solution that can effectively reduce the occurrence of concept drift in user behavior sequences and improve the accuracy of risk identification.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows: A risk identification method provided in an embodiment of the present specification comprises: obtaining temporal behavior sequence data of a user. Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. Based on the behavior sequence representation, a target data representation matching the behavior sequence representation is retrieved from a retrieval database. The target data representation is aggregated with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and determining whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0006] A risk identification device provided in an embodiment of the present specification includes: a sequence data acquisition module, which acquires the user's time-series behavior sequence data. A first encoding module, which encodes the time-series behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the time-series behavior sequence data. A first retrieval module, which retrieves a target data representation that matches the behavior sequence representation from a retrieval database based on the behavior sequence representation. A risk identification module, which aggregates the target data representation with the behavior sequence representation to perform data enhancement processing on the time-series behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the time-series behavior sequence data, and determines whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the time-series behavior sequence data.

[0007] A risk identification device is provided in an embodiment of the present specification, and the risk identification device includes: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to: obtain temporal behavior sequence data of a user. The temporal behavior sequence data is encoded by an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. Based on the behavior sequence representation, a target data representation matching the behavior sequence representation is retrieved from a retrieval database. The target data representation is aggregated with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk.

[0008] The embodiments of this specification also provide a storage medium for storing computer-executable instructions, which implement the following process when executed by a processor: obtaining the user's temporal behavior sequence data. Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. Based on the behavior sequence representation, retrieve a target data representation that matches the behavior sequence representation from a retrieval database. Aggregate the target data representation with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and determine whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0009] The embodiments of this specification also provide a computer program product, including a computer program, which implements the following process when executed by a processor: obtaining the user's temporal behavior sequence data. Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. Based on the behavior sequence representation, retrieve a target data representation that matches the behavior sequence representation from a retrieval database. Aggregate the target data representation with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and determine whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 This is an embodiment of a risk identification method of this specification; Figure 2 This is another risk identification method embodiment of this specification; Figure 3 This is a schematic diagram of the risk identification process for this manual; Figure 4 This is another embodiment of a risk identification method of this specification; Figure 5 This is another embodiment of a risk identification method of this specification; Figure 6 This is a schematic diagram of another risk identification process in this manual; Figure 7 A schematic diagram of an encoder update process of this specification; Figure 8 This is an embodiment of a risk identification device in this specification; Fig. 9 This is an embodiment of a risk identification device in this specification. DETAILED DESCRIPTION

[0011] The embodiments of this specification provide a risk identification method, device and equipment.

[0012] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0013] The embodiments of this specification provide a risk identification mechanism based on enhanced user temporal behavior representation. Risk identification through user temporal behavior sequence data is an effective way to identify risks. Usually, user temporal behavior representation models have a certain timeliness. In actual scenarios, user temporal behavior sequence data is easily affected by changes in the external environment. Many user behavior patterns only appear for a period of time. Special events and changes in popular trends will lead to changes in user behavior habits. These phenomena suggest that user behavior patterns have changed over time and are easily affected by special events. Therefore, the user representations produced by the user temporal behavior representation model trained with historical data are invalid in downstream tasks. This problem is called concept drift, which has long been one of the challenges faced by downstream tasks such as risk detection and identification of user behavior representation modeling such as fraud detection.

[0014] By integrating additional information, it becomes a solution to the concept drift problem. Among them, some methods focus on using contextual information to assist the model to understand and infer more accurately, such as the preceding and following text segments in natural language sequences and the surrounding image segments of the research object in the image. However, in the context of user temporal behavior sequence data, the above is not applicable because user temporal behavior sequence data is significantly different from natural language data and image data, and usually lacks rich context scene information. In addition, the rapid dynamic update of user temporal behavior sequence data in the Internet platform makes it require higher data freshness of adjacent samples, thereby increasing the difficulty of solving the concept drift of the behavior sequence. To this end, the embodiment of this specification provides an implementation method, which considers the similarity between data, uses retrieval to effectively locate data related to the current user temporal behavior sequence data, and enhances the current user temporal behavior sequence data through data aggregation strategies, so that it can be provided to the prediction model later, thereby effectively reducing the occurrence of user behavior sequence concept drift phenomenon, and can improve the accuracy of risk identification. For specific processing, please refer to the specific content in the following embodiments.

[0015] like Figure 1As shown, the embodiment of this specification provides a risk identification method, and the execution subject of the method can be a terminal device or a server, etc., wherein the terminal device can be a mobile terminal device such as a mobile phone, a tablet computer, or a computer device such as a laptop or a desktop computer, or an IoT device (specifically such as a smart watch, a car device, etc.), etc., wherein the server can be an independent server, or a server cluster composed of multiple servers, etc., and the server can be a background server for financial services or online shopping services, or a background server for an application, etc. In this embodiment, the execution subject is taken as an example for detailed description. For the case where the execution subject is a terminal device, please refer to the following server situation processing, which will not be repeated here. The method can specifically include the following steps: In step S102, the user's temporal behavior sequence data is obtained.

[0016] Among them, the user's temporal behavior sequence data can be sequence data composed of various operations (such as clicking operations, sliding operations, input operations, etc.) performed by the user in chronological order during the process of the user performing a certain business. In addition, the user's temporal behavior sequence data may also include the temporal behavior sequence data of the user performing other businesses or operations before performing the current business. For example, before performing a transfer business, the user also performs login and identity authentication operations and / or performs information interaction through instant messaging applications or short messages. In addition to the temporal behavior sequence data of the user performing the transfer business (clicking the "transfer" button-clicking the input box for the transfer amount-entering data-clicking the "OK" button-clicking the "Finish" button, etc., which can be set according to actual conditions), the user's temporal behavior sequence data may also include the temporal behavior sequence data during the login and identity authentication operations and / or information interaction. At this time, the user's temporal behavior sequence data may include, for example: login and identity authentication operations (click the application icon - click the account input box - enter data - click the password input box - enter data - click the "login" button, etc.) - transfer business (click the "transfer" button - click the transfer amount input box - enter data - click the "OK" button - click the "finish" button, etc.), or, click the application icon - click the account input box - enter data - click the password input box - enter data - click the "login" button - click the "transfer" button - click the transfer amount input box - enter data - click the "OK" button - click the "finish" button, etc. It should be noted that the user's temporal behavior sequence data may also only include the temporal behavior sequence data of the current user performing the transfer business process, which can be set according to actual conditions, and the embodiments of this specification do not limit this.

[0017] In implementation, the user can perform certain services or operations through the application installed in the terminal device, and the terminal device can record the timing behavior during the execution of the above services or operations, and record the corresponding timing behavior sequence data in the cache or storage device of the terminal device. When a certain service or processing process requires risk identification, the terminal device can obtain the timing behavior sequence data related to the service or processing process from the above-mentioned timing behavior sequence data, and can send the obtained timing behavior sequence data related to the service or processing process to the server through the above-mentioned application, and the server can obtain the user's timing behavior sequence data, or, when a certain service or processing process requires risk identification, the terminal device can send a risk identification request for the user to the server, and the server receives the risk identification request for the user, and then can obtain the timing behavior sequence data related to the service or processing process from the above-mentioned timing behavior sequence data, so that the user's timing behavior sequence data can be obtained.

[0018] In step S104, the temporal behavior sequence data is encoded by an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data.

[0019] Among them, the encoder can be constructed in a variety of different ways. For example, the encoder can be constructed through a neural network model (such as a recurrent neural network RNN ​​model or a convolutional neural network CNN model, etc.), or the encoder can also be constructed through a specified algorithm (such as a specified data compression algorithm, etc.). The specific setting can be based on actual conditions, and the embodiments of this specification do not limit this.

[0020] In implementation, the architecture of the encoder can be pre-built to obtain corresponding training samples, which can be composed of time-series behavior sequence samples generated by different users in the process of executing business or processing. Then, the encoder can be trained using the training samples to obtain a trained encoder, which can encode the time-series behavior sequence data. After obtaining the time-series behavior sequence data of the user in the above manner, the time-series behavior sequence data can be input into the above-mentioned trained encoder, and the time-series behavior sequence data can be encoded by the trained encoder to obtain the behavior sequence representation corresponding to the time-series behavior sequence data.

[0021] It should be noted that in the process of encoding the time-series behavior sequence data, the encoder can be used to encode the behavior data of each time point in the time-series behavior sequence data. For example, the time-series behavior sequence data is "click the "Transfer" button-click the input box for the transfer amount-enter data-click the "OK" button-click the "Finish" button", then the encoder can first encode the behavior data of "clicking the "Transfer" button" to obtain the behavior representation corresponding to the behavior data, and then encode the behavior data of "clicking the input box for the transfer amount" to obtain the behavior representation corresponding to the behavior data,... Finally, the behavior data of "clicking the "Finish" button" can be encoded to obtain the behavior representation corresponding to the behavior data. The behavior representations corresponding to the behavior data at multiple time points can be fused or spliced ​​to obtain the behavior sequence representation corresponding to the time-series behavior sequence data.

[0022] In step S106, based on the behavior sequence representation, a target data representation matching the behavior sequence representation is retrieved from a retrieval database.

[0023] The retrieval database may store data representations, and may also store behavior data corresponding to the data representations, etc., which may be set specifically according to actual conditions. The data representations stored in the retrieval database may be data representations corresponding to relatively recent behavior data (which may be behavior data acquired within a preset time period before the current moment (such as the last 7 days, 1 month, or 1 year, etc.)).

[0024] In implementation, a retrieval database can be pre-set according to actual conditions, and specifically, corresponding retrieval databases can be set according to different fields or businesses. For knowledge databases set up for different fields or businesses, as many data pairs of behavior data-data representations within the field or business as possible can be collected, or as many data representations corresponding to different behavior data within the field or business as possible can be collected, or a data set of behavior data can be pre-set, and the data set can include a variety of different behavior data. As mentioned above, the behavior data can include behavior data within a preset time period before the current moment (such as the last 7 days, 1 month or 1 year, etc.), and then, the behavior data in the above data set can be encoded to obtain the corresponding data representation, and the obtained data representation can be used to construct a retrieval database, which can be set specifically according to actual conditions, and the embodiments of this specification do not limit this. The data representation corresponding to the behavior data may be obtained by encoding the behavior data through the above-mentioned encoder, or the data representation corresponding to the behavior data may not be obtained by encoding the behavior data through the above-mentioned encoder, but may be one or more data representations obtained by encoding the behavior data through one or more other encoders. If the data representation corresponding to the behavior data includes multiple data representations, the average value of the multiple data representations can be calculated, and the average value can be used to represent the corresponding multiple data representations.

[0025] The business or field corresponding to the behavior sequence representation can be determined, and the data representation in the business or field determined above can be obtained from the retrieval database, and the behavior sequence representation can be used to search from the data representation in the retrieval database to obtain the target data representation that matches the behavior sequence representation. For example, the behavior sequence representation can be calculated to calculate the similarity between each data representation in the data representation in the retrieval database to obtain a corresponding similarity value, and the target data representation that matches the behavior sequence representation can be selected according to the size of the obtained similarity value (for example, the data representation corresponding to the similarity value greater than the first preset threshold can be selected as the target data representation that matches the behavior sequence representation). In the case where the same behavior data corresponds to multiple data representations, the behavior sequence representation can be calculated to calculate the similarity between the average value of the behavior sequence representation and the multiple data representations in the retrieval database to obtain the corresponding similarity value, and the average value corresponding to the maximum similarity value can be obtained, and then multiple data representations corresponding to the average value can be obtained, and the similarity between each data representation in the multiple data representations corresponding to the average value and the behavior sequence representation can be calculated, and the data representation corresponding to the similarity value greater than the second preset threshold can be obtained as the target data representation that matches the behavior sequence representation, or multiple data representations corresponding to the average value can be obtained as the target data representation that matches the behavior sequence representation, etc., which can also be set according to actual conditions.

[0026] The similarity calculation can be achieved through L2 distance, or can also be achieved through other offline similarity calculation tools. For example, it can be achieved through the FAISS (Facebook AI Similarity Search) tool that can efficiently perform dense representation similarity search and clustering design, etc. The specific settings can be made according to actual conditions.

[0027] In step S108, the target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the above-mentioned user has a preset risk.

[0028] Among them, the preset risk can be a pre-set risk, for example, the preset risk can be a fraud risk or an illegal financial transaction risk, etc., which can be set specifically according to actual conditions.

[0029] In implementation, an aggregation algorithm or aggregation rule may be pre-set, and the target data representation corresponding to the newer behavior data and the behavior sequence representation may be aggregated by the aggregation algorithm or aggregation rule. By aggregating the target data representation and the behavior sequence representation, data enhancement processing of the time series behavior sequence data by the target data representation may be achieved to obtain an enhanced behavior sequence representation corresponding to the time series behavior sequence data. The enhanced behavior sequence representation corresponding to the time series behavior sequence data may be used as basic data for risk identification, and the enhanced behavior sequence representation corresponding to the time series behavior sequence data may be input into a risk prediction model (or risk identification model) to obtain a risk identification result of whether the above-mentioned user has a preset risk. Alternatively, risk representations corresponding to various risks may be pre-set. At this time, the similarity between the enhanced behavior sequence representation corresponding to the time series behavior sequence data and each risk representation may be calculated, and whether the above-mentioned user has a risk may be determined based on the calculated similarity. If there is a risk, it may be determined to which risk the user belongs, etc.

[0030] The embodiments of the present specification provide a risk identification method, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0031] In practical applications, the specific processing methods of the above step S106 can be various, and an optional processing method is provided below, such as Figure 2 As shown, the processing may specifically include the following steps S1062 and S1064.

[0032] In step S1062, index information corresponding to the data representation stored in the retrieval database is obtained.

[0033] In implementation, in order to improve retrieval efficiency, index information can be created for the data representation stored in the retrieval database. In actual applications, the vector, matrix, or numerical value corresponding to the data representation can be used as the index data of the data representation. If the data representation is represented by a vector, matrix, or numerical value, the vector, matrix, or numerical value can be directly used as index information.

[0034] In step S1064, based on the similarity between the index information and the behavior sequence representation, a target data representation matching the behavior sequence representation in the retrieval database is determined.

[0035] In implementation, Figure 3 As shown (where the dataset to be encoded is retrieval , X t Represents time series behavior sequence data, x t Represents the behavior sequence representation, and the retrieval database is retrieval), the similarity between the index information (i.e., vector or matrix or value) and the vector or matrix or value corresponding to the behavior sequence representation can be calculated, and the similarity value obtained based on the calculation represents the size of the similarity between the index information and the behavior sequence representation. The index information corresponding to the similarity value greater than the preset similarity threshold can be obtained, and the data representation corresponding to the obtained index information is used as the target data representation that matches the behavior sequence representation in the retrieval database.

[0036] In practical applications, the index information corresponding to the data representation stored in the retrieval database can be constructed in the following manner, and the details can be seen in the processing of the following steps A2 to A8.

[0037] In step A2, a data node corresponding to each data representation stored in the retrieval database is determined.

[0038] In implementation, the vector corresponding to each data representation stored in the retrieval database (specifically, such as an embedding vector, etc.) can be determined, and based on the vector corresponding to each data representation, the data point corresponding to the vector can be determined in the coordinate system.

[0039] In step A4, clustering is performed on the data nodes corresponding to the data representations stored in the retrieval database to obtain one or more clustering point clusters.

[0040] In implementation, a clustering algorithm or a machine learning network model may be preset, for example, the clustering algorithm may be preset as a K-Means algorithm, a DBSCAN algorithm, etc., or the machine learning network model with clustering capability may be preset as a convolutional neural network model, a genetic algorithm model, etc., which may be set specifically according to actual conditions. The data nodes corresponding to the data representation stored in the retrieval database may be clustered by the above-set clustering algorithm or machine learning network model, so as to obtain one or more clustering point clusters.

[0041] In step A6, index information corresponding to each clustering point cluster is constructed based on the data nodes in each clustering point cluster.

[0042] In implementation, each clustering point cluster may contain one or more data nodes, and the average value of the vectors corresponding to the data nodes contained in each clustering point cluster (or the average value of the corresponding matrix or the average value of the corresponding numerical values) may be calculated to construct the index information corresponding to the clustering point cluster. For example, the calculated average value may be directly used as the index information corresponding to the clustering point cluster, or a corresponding storage location may be set for each average value to construct the index information corresponding to the clustering point cluster, etc. The specific setting may be based on actual conditions, and the embodiments of this specification do not limit this.

[0043] In step A8, based on the index information corresponding to each cluster point cluster, the index information corresponding to the data representation stored in the retrieval database is determined.

[0044] In implementation, the index information corresponding to each cluster point cluster can be used as the index information of the data nodes contained in the cluster point cluster. Through the above method, the index information corresponding to the data representation stored in the retrieval database can be obtained. Alternatively, for each cluster point cluster, sub-index information of the index information corresponding to the cluster point cluster can be set, thereby facilitating further retrieval processing in the cluster point cluster. The specific setting can be based on actual conditions.

[0045] In practical applications, the specific processing methods of the above step A6 can be varied. An optional processing method is provided below, which can specifically include the processing of the following steps A62 and A64.

[0046] In step A62, each cluster point cluster is converted into corresponding multi-level graph structure data, the bottom layer in the multi-level graph structure data contains all the data nodes in the cluster point cluster, and the set of data nodes contained in the upper layer in the multi-level graph structure data is a subset of the set of data nodes contained in the lower layer.

[0047] In implementation, the index information corresponding to each cluster point cluster can be constructed by the HNSW (Hierarchical Navigable Small World) algorithm, wherein the HNSW algorithm constructs a neighbor graph structure data with a hierarchical structure, and the number of data nodes contained in each layer gradually decreases and follows an exponential decay probability distribution. During the retrieval process, queries are made from top to bottom, thereby improving the retrieval efficiency. The bottom layer of the graph structure data contains all the data nodes in the cluster point cluster, and the set of data nodes contained in each subsequent upper layer is a subset of the set of data nodes contained in the next layer.

[0048] In step A64, index information corresponding to each cluster point cluster is constructed based on the data nodes contained in the top layer of the multi-level graph structure data corresponding to each cluster point cluster.

[0049] In implementation, the average value of the vectors corresponding to the data nodes contained in the top layer of the multi-level graph structure data corresponding to each cluster point cluster (or the average value of the corresponding matrix or the average value of the corresponding numerical value) can be calculated to construct the index information corresponding to the cluster point cluster. For example, the calculated average value can be directly used as the index information corresponding to the cluster point cluster, or a corresponding storage location can be set for each average value to construct the index information corresponding to the cluster point cluster, etc. The specific setting can be based on actual conditions, and the embodiments of this specification are not limited to this.

[0050] In practical applications, the specific processing methods of the above step S1064 can be varied. An optional processing method is provided below, such as Figure 4 As shown, the processing may specifically include the following steps S10642 to S10646.

[0051] In step S10642, the distance between the embedding vector corresponding to the index information and the embedding vector corresponding to the behavior sequence representation is calculated, and based on the calculated distance, the similarity between the index information and the behavior sequence representation is determined.

[0052] The distance between the embedding vector corresponding to the above index information and the embedding vector corresponding to the behavior sequence representation can be achieved in a variety of ways, for example, by using a Euclidean distance algorithm, a cosine distance algorithm, and the like.

[0053] In step S10644, the target index information whose similarity is greater than a preset threshold is obtained, and based on the data nodes and behavior sequence representation contained in the cluster point cluster corresponding to the target index information, the data node matching the behavior sequence representation is determined from the cluster point cluster corresponding to the target index information through the K-nearest KNN algorithm.

[0054] In step S10646, the data representation corresponding to the determined data node that matches the behavior sequence representation is used as the target data representation that matches the behavior sequence representation in the retrieval database.

[0055] With respect to the specific processing of the above-mentioned steps S10642 to S10646, for the method of constructing the nearest neighbor graph structure data through the HNSW algorithm and then constructing the index information corresponding to each cluster point cluster, the vector representation of the index information corresponding to each cluster point cluster can be assigned to the data nodes of each level (which can be implemented based on the vector distance (e.g., Euclidean distance) metric). In order to find the nearest neighbor data node of a given query point through the KNN algorithm, the retrieval process can start from a random point at the highest level. The HNSW algorithm always queries the neighbor data node of the current data node. If it is indeed closer, it moves to the neighbor data node closest to the query point. This process will continue until no neighbor data node closer to the query is found. Subsequently, the search starts from the nearest point found in the previous level and enters the next level. This process is repeated on all levels until the data node closest to the query vector is identified, thereby effectively completing the nearest neighbor retrieval. At the same time, in order to improve efficiency, the HNSW algorithm marks the access points to prevent redundant queries in subsequent steps. HNSW optimizes the number of candidate data nodes to balance retrieval speed and accuracy, thereby performing efficient nearest neighbor retrieval on high-dimensional data. The use of the HNSW algorithm can effectively reduce space consumption and retrieval time.

[0056] In practical applications, the number threshold of data nodes that match the behavior sequence representation is determined by the KNN algorithm and predicted by a node number prediction model, wherein the node number prediction model can be trained by processing the following steps B2 to B10.

[0057] In step B2, the temporal behavior sequence samples and label information corresponding to the temporal behavior sequence samples are obtained.

[0058] The label information may be a threshold value of the number of data nodes that match the time series behavior sequence sample.

[0059] The specific processing method of the above step B2 can refer to the above related content and will not be repeated here.

[0060] In step B4, based on the sequence sample representation corresponding to the temporal behavior sequence sample, a first data representation matching the sequence sample representation is retrieved from a retrieval database.

[0061] The specific processing method of the above step B4 can refer to the above related content and will not be repeated here.

[0062] In step B6, the first data representation and the sequence sample representation are aggregated to perform data enhancement processing on the temporal behavior sequence samples through the first data representation to obtain an enhanced sequence sample representation corresponding to the temporal behavior sequence samples.

[0063] The specific processing method of the above step B6 can refer to the above related content and will not be repeated here.

[0064] In step B8, the enhanced sequence sample representation is input into the node quantity prediction model to obtain a first quantity threshold of data nodes that match the sequence sample representation determined by the KNN algorithm.

[0065] Among them, the node quantity prediction model can be constructed by a specified algorithm or machine learning network. For example, the node quantity prediction model can be constructed by a convolutional neural network, or the node quantity prediction model can be constructed by a recurrent neural network, etc., which can be set according to actual conditions.

[0066] In implementation, the optimal K value depends on the specific dataset and downstream task. It is a challenging problem to determine the ideal value before starting the training of the node number prediction model. To solve this problem, an adaptive component can be set. First, consider k A set of possible values ​​of that are less than the upper limit K, that is,

[0067] Then, set up an adaptive k network (i.e., node number prediction model ), and allows the node number prediction model to evaluate different k values ​​and select a better k value

[0068] in,

[0069] It can be derived by using the enhanced behavior sequence representation based on the following formula , and then obtain the first quantity threshold. The process of determining the quantity threshold of data nodes matching the behavior sequence representation by the KNN algorithm can also refer to the above processing process, which will not be repeated here.

[0070] In step B10, based on the first quantity threshold, the time series behavior sequence samples and the label information, the corresponding loss information is determined through a preset first loss function, and the model parameters in the node quantity prediction model are adjusted based on the loss information to obtain the node quantity prediction model.

[0071] Among them, the first loss function may include multiple types. For example, the first loss function may be a mean square error loss function, an absolute error loss function, etc., which can be specifically set according to actual conditions.

[0072] In implementation, the corresponding loss information can be calculated based on the first quantity threshold, the time series behavior sequence samples and the label information through the first loss function, the model parameters in the node quantity prediction model can be adjusted through the loss information, and the node quantity prediction model can be iteratively trained based on the model parameters of the adjusted node quantity prediction model, as well as the next time series behavior sequence samples and the corresponding label information, so as to continue to adjust the model parameters of the node quantity prediction model until the first loss function converges, thereby obtaining the trained node quantity prediction model.

[0073] In practical applications, for the processing of determining the data nodes matching the behavior sequence representation from the cluster point cluster corresponding to the target index information through the KNN algorithm, the target data representation includes multiple, then in the above step S108, the target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the time series behavior sequence data through the target data representation, and the specific processing method for obtaining the enhanced behavior sequence representation corresponding to the time series behavior sequence data can be various, and an optional processing method is provided below, such as Figure 5 As shown, the processing may specifically include the following steps S1082 to S1086.

[0074] In step S1082, the weight corresponding to each target data representation is obtained.

[0075] In implementation, in some cases, the retrieved target data representation may introduce interference. For example, when K=10 is set and a KNN algorithm-based retrieval is performed on the cluster point clusters, the result will provide the top 10 closest data nodes. If the first two data nodes found are from positive samples and are very close to the original data nodes, while the remaining eight are from negative samples and are far away from the original data nodes, then using the average weight method for the data nodes obtained during the retrieval process will introduce significant noise. To this end, a weighted strategy can be adopted for the retrieved target data representation, which involves aggregating the above target data representations to obtain the final composite representation. To this end, if Figure 6 As shown, a corresponding weight can be set for each target data representation. At this time, the target data representation can be aggregated into a vector or matrix with the same size as the behavior sequence representation. The Gaussian kernel can be used to implement the above processing. For the query data node and t Retrieval dataset at the moment Any dense data node in the set of multiple target data representations (i.e., target data representation), the Gaussian kernel function is defined as

[0076] The Gaussian kernel function can be used as the weight corresponding to each of the above target data representations. express and x The distance between represents the Gaussian kernel function (the weight corresponding to the target data representation), is the parameter corresponding to K.

[0077] In step S1084, based on the weight corresponding to each target data representation and each target data representation, weighted aggregate data of multiple target data representations are obtained.

[0078] In implementation, the weight corresponding to each target data representation and each target data representation can be substituted into the following formula:

[0079] get t time The corresponding weighted aggregate data represented by multiple target data, where: express The corresponding weighted aggregate data.

[0080] In step S1086, the weighted aggregated data of the multiple target data representations are aggregated with the behavior sequence representation, so as to perform data enhancement processing on the temporal behavior sequence data through the multiple target data representations to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0081] In implementation, Figure 6 As shown, the weighted aggregate data and behavior sequence representation of multiple target data representations can be substituted into the following formula

[0082] To perform aggregation processing, and then perform data enhancement processing on the time series behavior sequence data through multiple target data representations, to obtain the enhanced behavior sequence representation corresponding to the time series behavior sequence data, where: Represents time series behavior in sequence data t The enhanced behavior sequence representation corresponding to the behavior data at each moment, are learnable parameters.

[0083] In practical applications, the index information corresponding to the data representation stored in the retrieval database may also be constructed in the following manner, and for details, please refer to the processing of the following steps C2 to C8.

[0084] In step C2, preset disturbance information is added to each data representation stored in the retrieval database to obtain intermediate data corresponding to each data representation.

[0085] The disturbance information may be pre-set specified disturbance information or randomly generated disturbance information, etc., which may be set according to actual conditions. The intermediate data may be represented in a variety of forms, for example, the intermediate data may be represented in the form of vectors, matrices or numerical values, etc., which may be set according to actual conditions.

[0086] In implementation, a local sensitive hashing algorithm can be used to construct index information, that is, a hash function can be used to map similar objects to the same hash bucket with a higher probability. Specifically, random perturbation information can be added to the vector corresponding to each data representation stored in the retrieval database based on the local hashing algorithm, thereby obtaining the intermediate data corresponding to each data representation. Among them, the local sensitive hashing algorithm can include multiple types, such as the SimHash algorithm, the MinHash algorithm, etc.

[0087] In step C4, the locally sensitive hash value of the intermediate data corresponding to each data representation is obtained, and based on the locally sensitive hash value of the intermediate data corresponding to each data representation, the data representations stored in the retrieval database are grouped to obtain one or more data representation groups.

[0088] In the implementation, in the case of Euclidean distance, the SimHash algorithm is used to define a random direction for the vector of the intermediate data corresponding to each data representation. The vector of the intermediate data corresponding to each data representation can be input into the following formula respectively: =1,2,…, M in, is a vector of elements independently selected from a Gaussian distribution with mean 0 and standard deviation 1, From 0 to W Then, the local sensitive hash value of the intermediate data corresponding to each data representation can be obtained by the following formula:

[0089] For the local sensitive hash value of the intermediate data corresponding to each data representation, if two local sensitive hash values ​​are the same, they can be placed in the same hash bucket, thereby grouping the data representations stored in the retrieval database to obtain one or more data representation groups.

[0090] In step C6, index information corresponding to each data representation group is constructed based on the data representations in each data representation group.

[0091] In implementation, in practical applications, the process of building index information using a local sensitive hashing algorithm often requires a large number of hash tables to achieve good retrieval quality. To this end, the above processing can be improved. Specifically, it can be distinguished from the basic local sensitive hashing algorithm by not storing each local sensitive hash value. In order to speed up the retrieval process, the index information of the average value of the local sensitive hash value in each hash bucket can be retained instead of storing the entire hash table, aiming to provide a non-parametric method based on the distribution of the data set to supplement the parametric method that relies on using the above HNSW algorithm to build index information for retrieval based on the KNN algorithm. The non-parametric method can be very fast without losing too much performance because its retrieval return value does not rely on the calculation vector, but directly provides the average value of the hash bucket where the query vector is placed.

[0092] In step C8, based on the index information corresponding to each data representation group, the index information corresponding to the data representation stored in the search database is determined.

[0093] In implementation, the index information corresponding to each data representation group can be used as the index information corresponding to the data representation stored in the retrieval database, or a corresponding algorithm can be pre-set, and the index information corresponding to each data representation group can be calculated accordingly by the algorithm, and the calculation result can be used as the index information corresponding to the data representation stored in the retrieval database. The algorithm can be, for example, a data aggregation algorithm, a mean calculation algorithm, etc., which can be set specifically according to actual conditions, and the embodiments of this specification do not limit this.

[0094] In practical applications, such as Figure 7 As shown, the encoder can be trained in the following manner, which may specifically include: obtaining a first temporal behavior sequence sample; based on the first sequence sample representation corresponding to the first temporal behavior sequence sample, retrieving a second data representation that matches the first sequence sample representation from a retrieval database; aggregating the second data representation with the first sequence sample representation to perform data enhancement processing on the first temporal behavior sequence sample through the second data representation to obtain an enhanced sequence sample representation corresponding to the first temporal behavior sequence sample; based on the first sequence sample representation and the enhanced sequence sample representation corresponding to the first temporal behavior sequence sample, determining the corresponding loss information through a preset second loss function, and adjusting the parameters in the encoder based on the loss information to obtain the encoder. Among them, the second loss function may be a cross entropy loss function or a contrastive learning loss function, etc., which may be set according to actual conditions.

[0095] For the training of the encoder, the encoder can be updated and trained at the following times, which may specifically include the following: when a preset update cycle is reached, the encoder is updated and the index information corresponding to the data representation stored in the retrieval database is reconstructed. The update cycle is determined based on the duration of performing a preset number of gradient descent processes.

[0096] The preset number of times can be set according to actual conditions, such as 5 or 10.

[0097] In implementation, Figure 7 As shown (where retrieval Represents the dataset to be encoded, X i Represents time series behavior sequence data, x i Represents the behavior sequence representation), and the stop gradient operation is applied on the retrieval side of the network. The corresponding encoder is updated once every mSGD step (i.e., the duration of the gradient descent SGD process of the preset number m). The update of the encoder immediately triggers the reconstruction of the index information. The algorithm code for the reconstruction is shown in Table 1. In practical applications, the encoder can be updated when saving a checkpoint.

[0098] Table 1

[0099] In practical applications, such as Figure 3 As shown, the retrieval database can be constructed in the following manner, and the details can be seen in the processing of the following steps D2 to D6.

[0100] In step D2, a data set to be encoded is obtained, wherein the data set includes historical time-series behavior sequence data of different users.

[0101] In step D4, the historical temporal behavior sequence data is encoded by an encoder to obtain a data representation corresponding to the historical temporal behavior sequence data.

[0102] In step D6, a retrieval database is constructed based on the data representation corresponding to the historical temporal behavior sequence data.

[0103] It should be noted that in actual applications, during the risk identification process, if the latest time series behavior sequence data that has not appeared before is detected, the latest time series behavior sequence data that has not appeared before can be set in the retrieval database through the processing of the above steps D2 to D6, thereby expanding the coverage of the retrieval database to improve the retrieval effect and accuracy of the retrieval.

[0104] In practical applications, the specific processing methods for determining whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the time-series behavior sequence data in step S108 can be various, such as Figure 6 As shown, an optional processing method is provided below, which may specifically include the following contents: inputting the enhanced behavior sequence representation corresponding to the time series behavior sequence data into a pre-trained risk prediction model to obtain a prediction result of whether the user has a preset risk, the preset risk includes fraud risk, and the risk prediction model includes a model built based on a multi-layer perceptron.

[0105] Among them, the risk prediction model can be constructed through a variety of different algorithms or models. For example, the risk prediction model can be constructed through a convolutional neural network model, or the risk prediction model can be constructed through a large model, etc. In this embodiment, the risk prediction model includes a model constructed based on a multi-layer perceptron.

[0106] The embodiments of the present specification provide a risk identification method, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0107] The above is a risk identification method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a risk identification device, such as Figure 8 shown.

[0108] The risk identification device comprises: a sequence data acquisition module 801, a first encoding module 802, a first retrieval module 803 and a risk identification module 804, wherein: The sequence data acquisition module 801 acquires the user's time series behavior sequence data; A first encoding module 802 encodes the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; A first retrieval module 803, based on the behavior sequence representation, retrieves a target data representation that matches the behavior sequence representation from a retrieval database; The risk identification module 804 aggregates the target data representation and the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and determines whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0109] In the embodiment of this specification, the first search module 803 includes: An index acquisition unit, which acquires index information corresponding to the data representation stored in the retrieval database; The retrieval unit determines, based on the similarity between the index information and the behavior sequence representation, a target data representation in the retrieval database that matches the behavior sequence representation.

[0110] In the embodiment of this specification, the device further includes: A data node determination module, which determines a data node corresponding to each data representation stored in the retrieval database; A clustering module performs clustering processing on the data nodes corresponding to the data representations stored in the retrieval database to obtain one or more clustering point clusters; A first index building module builds index information corresponding to each of the clustering point clusters based on the data nodes in each of the clustering point clusters; The first index determination module determines the index information corresponding to the data representation stored in the retrieval database based on the index information corresponding to each of the clustering point clusters.

[0111] In the embodiment of this specification, the first index construction module includes: A graph structure data conversion unit converts each of the cluster point clusters into corresponding multi-level graph structure data, wherein the bottom layer of the multi-level graph structure data contains all the data nodes in the cluster point cluster, and the set of data nodes contained in the upper layer of the multi-level graph structure data is a subset of the set of data nodes contained in the lower layer; The index building unit builds index information corresponding to each cluster point cluster based on the data nodes contained in the top layer of the multi-level graph structure data corresponding to each cluster point cluster.

[0112] In an embodiment of the present specification, the retrieval unit calculates the distance between the embedding vector corresponding to the index information and the embedding vector corresponding to the behavior sequence representation, and determines the similarity between the index information and the behavior sequence representation based on the calculated distance; obtains the target index information whose similarity is greater than a preset threshold, and based on the data nodes contained in the clustering point cluster corresponding to the target index information and the behavior sequence representation, determines the data node matching the behavior sequence representation from the clustering point cluster corresponding to the target index information through a K-nearest neighbor KNN algorithm; and uses the data representation corresponding to the determined data node matching the behavior sequence representation as the target data representation matching the behavior sequence representation in the retrieval database.

[0113] In the embodiment of this specification, the number threshold of data nodes matching the behavior sequence representation is determined by the KNN algorithm and predicted by the node number prediction model, and the device further includes: A sample acquisition module, which acquires a temporal behavior sequence sample and label information corresponding to the temporal behavior sequence sample; A second retrieval module, based on the sequence sample representation corresponding to the temporal behavior sequence sample, retrieves a first data representation matching the sequence sample representation from a retrieval database; A data enhancement module aggregates the first data representation and the sequence sample representation to perform data enhancement processing on the time series behavior sequence sample through the first data representation to obtain an enhanced sequence sample representation corresponding to the time series behavior sequence sample; A prediction module, inputting the enhanced sequence sample representation into the node quantity prediction model, and obtaining a first quantity threshold of data nodes that match the sequence sample representation determined by a KNN algorithm; The training module determines the corresponding loss information based on the first quantity threshold, the time series behavior sequence sample and the label information through a preset first loss function, and adjusts the model parameters in the node quantity prediction model based on the loss information to obtain the node quantity prediction model.

[0114] In the embodiment of this specification, the target data representation includes multiple, and the risk identification module 804 includes: A weight acquisition unit, which acquires a weight corresponding to each of the target data representations; A weighted aggregation unit, which obtains weighted aggregation data of a plurality of target data representations based on a weight corresponding to each target data representation and each target data representation; The data enhancement unit aggregates the weighted aggregate data of the multiple target data representations with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the multiple target data representations to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0115] In the embodiment of this specification, the device further includes: A disturbance module, which adds preset disturbance information to each data representation stored in the retrieval database to obtain intermediate data corresponding to each data representation; A local hash determination module obtains a local sensitive hash value of the intermediate data corresponding to each data representation, and groups the data representations stored in the retrieval database based on the local sensitive hash value of the intermediate data corresponding to each data representation to obtain one or more data representation groups; A second index construction module constructs index information corresponding to each of the data representation groups based on the data representations in each of the data representation groups; The second index determination module determines the index information corresponding to the data representation stored in the retrieval database based on the index information corresponding to each of the data representation groups.

[0116] In the embodiment of this specification, the device further includes: An update module updates the encoder and reconstructs index information corresponding to the data representation stored in the retrieval database when a preset update cycle is reached, wherein the update cycle is determined based on the duration of performing a preset number of gradient descent processes.

[0117] In the embodiment of this specification, the device further includes: A data set acquisition module, which acquires a data set to be encoded, wherein the data set includes historical time-series behavior sequence data of different users; A third encoding module, encoding the historical time series behavior sequence data through the encoder to obtain a data representation corresponding to the historical time series behavior sequence data; A database construction module constructs the retrieval database based on the data representation corresponding to the historical time-series behavior sequence data.

[0118] In an embodiment of the present specification, the risk identification module 804 inputs the enhanced behavior sequence representation corresponding to the time-series behavior sequence data into a pre-trained risk prediction model to obtain a prediction result of whether the user has a preset risk, wherein the preset risk includes a fraud risk, and the risk prediction model includes a model built based on a multi-layer perceptron.

[0119] The embodiments of the present specification provide a risk identification device, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0120] The above is a risk identification device provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a risk identification device, such as Fig. 9 shown.

[0121] The risk identification device may provide a terminal device or a server, etc. for the above-mentioned embodiment.

[0122] The risk identification device may have relatively large differences due to different configurations or performances, and may include one or more processors 901 and memory 902, and the memory 902 may store one or more storage applications or data. Among them, the memory 902 may be a short-term storage or a persistent storage. The application stored in the memory 902 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the risk identification device. Furthermore, the processor 901 may be configured to communicate with the memory 902 and execute a series of computer executable instructions in the memory 902 on the risk identification device. The risk identification device may also include one or more power supplies 903, one or more wired or wireless network interfaces 904, one or more input and output interfaces 905, and one or more keyboards 906.

[0123] Specifically in this embodiment, the risk identification device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the risk identification device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following: Obtain the user's time series behavior sequence data; Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; Based on the behavior sequence representation, retrieving a target data representation that matches the behavior sequence representation from a retrieval database; The target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and whether the user has a preset risk is determined based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0124] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the risk identification device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0125] The embodiments of the present specification provide a risk identification device, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0126] Furthermore, based on the above Figures 1 to 7 In one embodiment, the present specification further provides a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instruction information stored in the storage medium is executed by the processor, the following process can be implemented: Obtain the user's time series behavior sequence data; Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; Based on the behavior sequence representation, retrieving a target data representation that matches the behavior sequence representation from a retrieval database; The target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and whether the user has a preset risk is determined based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0127] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0128] The embodiments of the present specification provide a storage medium, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0129] Furthermore, based on the above Figures 1 to 7 In one or more embodiments of the present specification, a computer program product is provided, including a computer program. When the computer program in the computer program product is executed by a processor, the following process can be implemented: Obtain the user's time series behavior sequence data; Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; Based on the behavior sequence representation, retrieving a target data representation that matches the behavior sequence representation from a retrieval database; The target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and whether the user has a preset risk is determined based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

[0130] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned computer program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0131] The embodiments of the present specification provide a computer program product, which obtains the user's temporal behavior sequence data, and then can encode the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data. After that, based on the behavior sequence representation, a target data representation matching the behavior sequence representation can be retrieved from a retrieval database. Finally, the target data representation and the behavior sequence representation can be aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data. Based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data, it is determined whether the user has a preset risk. In this way, by continuously aggregating the adjacent data (i.e., the target data representation) of the user's temporal behavior sequence data, the performance degradation of the model when the user's behavior pattern changes is prevented to a certain extent, and not only can the occurrence of user behavior sequence concept drift phenomenon be effectively reduced, but also the accuracy of risk identification can be improved. In addition, the scope of application of this method is very wide, and it can be directly applied to a variety of user temporal behavior representation models. It has good scalability and is easy to migrate, which also saves machine resources.

[0132] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0133] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0134] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0135] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0136] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0137] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0138] The embodiments of this specification are described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0141] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0142] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0143] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0144] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0145] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0147] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0148] The above description is only an embodiment of this specification and is not intended to limit this document. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. A risk identification method, the method comprising: Obtain the user's time series behavior sequence data; Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; Based on the behavior sequence representation, retrieving a target data representation that matches the behavior sequence representation from a retrieval database; The target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and whether the user has a preset risk is determined based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

2. The method according to claim 1, wherein the step of retrieving a target data representation matching the behavior sequence representation from a search database based on the behavior sequence representation comprises: Obtaining index information corresponding to the data representation stored in the retrieval database; Based on the similarity between the index information and the behavior sequence representation, a target data representation matching the behavior sequence representation in the retrieval database is determined.

3. The method according to claim 2, further comprising: Determine a data node corresponding to each data representation stored in the retrieval database; Performing clustering processing on the data nodes corresponding to the data representations stored in the retrieval database to obtain one or more clustering point clusters; Constructing index information corresponding to each of the clustering point clusters based on the data nodes in each of the clustering point clusters; Based on the index information corresponding to each of the clustering point clusters, the index information corresponding to the data representation stored in the retrieval database is determined.

4. The method according to claim 3, wherein the step of constructing index information corresponding to each of the clustering point clusters based on the data nodes in each of the clustering point clusters comprises: Converting each of the clustering point clusters into corresponding multi-level graph structure data, wherein the bottom layer of the multi-level graph structure data contains all the data nodes in the clustering point cluster, and the set of data nodes contained in the upper layer of the multi-level graph structure data is a subset of the set of data nodes contained in the lower layer; The index information corresponding to each cluster point cluster is constructed based on the data nodes contained in the top layer of the multi-level graph structure data corresponding to each cluster point cluster.

5. The method according to any one of claims 2 to 4, wherein determining the target data representation in the search database that matches the behavior sequence representation based on the similarity between the index information and the behavior sequence representation comprises: Calculating a distance between an embedding vector corresponding to the index information and an embedding vector corresponding to the behavior sequence representation, and determining a similarity between the index information and the behavior sequence representation based on the calculated distance; Obtain the target index information whose similarity is greater than a preset threshold, and determine the data node matching the behavior sequence representation from the cluster point cluster corresponding to the target index information through a K-nearest neighbor KNN algorithm based on the data nodes contained in the cluster point cluster corresponding to the target index information and the behavior sequence representation; The data representation corresponding to the determined data node matching the behavior sequence representation is used as the target data representation matching the behavior sequence representation in the retrieval database.

6. The method according to claim 5, wherein the number threshold of data nodes matching the behavior sequence representation is determined by a KNN algorithm and is predicted by a node number prediction model, and the method further comprises: Obtaining time series behavior sequence samples and label information corresponding to the time series behavior sequence samples; Based on the sequence sample representation corresponding to the temporal behavior sequence sample, retrieving a first data representation matching the sequence sample representation from a retrieval database; Aggregating the first data representation with the sequence sample representation, so as to perform data enhancement processing on the temporal behavior sequence sample through the first data representation, and obtain an enhanced sequence sample representation corresponding to the temporal behavior sequence sample; Inputting the enhanced sequence sample representation into the node quantity prediction model to obtain a first quantity threshold of data nodes that match the sequence sample representation determined by a KNN algorithm; Based on the first quantity threshold, the temporal behavior sequence sample and the label information, the corresponding loss information is determined through a preset first loss function, and the model parameters in the node quantity prediction model are adjusted based on the loss information to obtain the node quantity prediction model.

7. According to the method of claim 5, the target data representation includes a plurality of representations, and the step of aggregating the target data representation with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data comprises: Obtaining a weight corresponding to each of the target data representations; Based on the weight corresponding to each of the target data representations and each of the target data representations, obtaining weighted aggregate data of the plurality of the target data representations; The weighted aggregated data of the multiple target data representations are aggregated with the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the multiple target data representations to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

8. The method according to claim 2, further comprising: Adding preset disturbance information to each data representation stored in the retrieval database respectively to obtain intermediate data corresponding to each data representation; Obtaining a local sensitive hash value of the intermediate data corresponding to each data representation, and grouping the data representations stored in the retrieval database based on the local sensitive hash value of the intermediate data corresponding to each data representation to obtain one or more data representation groups; Constructing index information corresponding to each of the data representation groups based on the data representations in each of the data representation groups; Based on the index information corresponding to each of the data representation groups, the index information corresponding to the data representation stored in the retrieval database is determined.

9. The method according to claim 3 or 8, further comprising: When a preset update period is reached, the encoder is updated and index information corresponding to the data representation stored in the retrieval database is reconstructed, wherein the update period is determined based on the duration of performing a preset number of gradient descent processes.

10. The method according to claim 1, further comprising: Acquire a data set to be encoded, wherein the data set includes historical time-series behavior sequence data of different users; The encoder encodes the historical time series behavior sequence data to obtain a data representation corresponding to the historical time series behavior sequence data; The retrieval database is constructed based on the data representation corresponding to the historical temporal behavior sequence data.

11. The method according to claim 1, wherein determining whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data comprises: The enhanced behavior sequence representation corresponding to the time-series behavior sequence data is input into a pre-trained risk prediction model to obtain a prediction result of whether the user has a preset risk, wherein the preset risk includes a fraud risk, and the risk prediction model includes a model built based on a multi-layer perceptron.

12. A risk identification device, comprising: A sequence data acquisition module is used to acquire the user's temporal behavior sequence data; A first encoding module encodes the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; A first retrieval module, based on the behavior sequence representation, retrieves a target data representation matching the behavior sequence representation from a retrieval database; The risk identification module aggregates the target data representation and the behavior sequence representation to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and determines whether the user has a preset risk based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

13. A risk identification device, comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Obtain the user's time series behavior sequence data; Encoding the temporal behavior sequence data through an encoder to obtain a behavior sequence representation corresponding to the temporal behavior sequence data; Based on the behavior sequence representation, retrieving a target data representation that matches the behavior sequence representation from a retrieval database; The target data representation and the behavior sequence representation are aggregated to perform data enhancement processing on the temporal behavior sequence data through the target data representation to obtain an enhanced behavior sequence representation corresponding to the temporal behavior sequence data, and whether the user has a preset risk is determined based on the enhanced behavior sequence representation corresponding to the temporal behavior sequence data.

Images