Training method and system for multimodal feature vector embedder of fraudulent APP

Abstract

The present invention discloses a training method and system for a multimodal feature vector embedder of a fraudulent APP, and relates to the field of computer security technology. The steps of the method include: after a user provides protection authority, basic information of the application and user behavior data are collected; a current fraudulent risk value is calculated, and an initial fraudulent risk threshold is set; when the current fraudulent risk value is greater than the initial fraudulent risk threshold, a double-layer training embedding strategy is run, and a fraudulent APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraudulent APP feature classification model; when the current fraudulent risk value is less than or equal to the initial fraudulent risk threshold, an adaptive data migration strategy is directly run, and a migration cycle is obtained according to the active state of the APP and the fraudulent risk value; the present invention balances the model training efficiency and real-time response capability, and enables the system to flexibly adapt to different data qualities, and avoids the model performance being affected by noise data or low-quality data.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and specifically to a training method and system for a multimodal feature vector embedder for fraudulent APPs. Background Art

[0002] In recent years, the rapid development of the mobile application market has greatly promoted the prosperity of the digital economy. However, with the rapid growth of the number of apps, some illegal or fraudulent apps have begun to mix in with legitimate apps, using abuse of permissions, malicious behavior, privacy theft and other methods to harm user rights and interests, and even threaten financial security and social stability. Traditional fraudulent app identification technology mainly relies on static rule detection or single feature analysis, such as permission application or application behavior logs, but these methods are easily circumvented by malicious developers and cannot effectively deal with the concealment and diversity of fraudulent behaviors.

[0003] In order to meet this challenge, the industry has begun to explore fraud APP identification methods based on multimodal fusion. Multimodal fusion technology can integrate information from different modalities, such as text, images, audio, etc., to provide richer and more accurate feature representation. Through multi-level feature extraction and fusion, more accurate and effective identification of fraud APPs can be achieved. However, how to effectively train the multimodal feature vector embedder of fraudulent APPs and build the corresponding system is a problem that needs to be solved urgently.

[0004] For example, the existing Chinese patent with the authorization publication number CN115688107B discloses a fraudulent APP detection system and method, which is used to detect whether the application APP running on the smart device is fraudulent, including: an anti-fraud monitoring module, which includes: a feature data information monitoring module, a screen information monitoring module, and a result output module; the feature data information monitoring module finds the first-level suspected fraudulent APP according to the AndroidManifest information and the application name, and compares and analyzes the first-level suspected fraudulent APP with the whitelisted genuine APP signature certificate to determine the second-level suspected fraudulent APP; image recognition is performed on the interface image, text information is extracted, and the text information is analyzed to obtain the high and low values ​​of the possibility of the APP being fraudulent; the result output module outputs a list of APPs with a high possibility of being fraudulent. The suspected fraudulent APP samples are screened by using the "AndrodManifest feature matching + application name similarity comparison + whitelisted genuine APP signature certificate information filtering" technology, and then the webpage screenshot is used to extract text information from the screenshot through OCR technology, and the algorithm is used to determine whether the webpage is fraudulent.

[0005] However, this design does not take into account the problem that malicious developers use complex technical means to hide fraudulent behavior or imitate legitimate applications, which increases the difficulty of identification. In addition, for massive applications, the system needs to achieve rapid screening within a limited time and provide high-precision judgment. To this end, the present invention provides a training method and system for a multi-modal feature vector embedder for fraudulent APPs. Summary of the invention

[0006] The purpose of the present invention is to provide a training method and system for a multimodal feature vector embedder of fraudulent APPs to solve the existing problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides the following technical solution: a training method for a fraudulent APP multimodal feature vector embedder, comprising the following steps:

[0008] S1. After the user provides protection permissions, basic information of the application and user behavior data are collected;

[0009] S2. Calculate the current fraud risk value according to the basic information of the application and the user behavior data, and set an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, proceed to step S3; when the current fraud risk value is less than or equal to the initial fraud risk threshold, proceed to step S4;

[0010] S3. Setting a double-layer training embedding strategy, wherein the fraud risk value is used as the input of the double-layer training embedding strategy, a fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data;

[0011] S4. Set an adaptive data migration strategy, obtain the migration cycle based on the app's active status and fraud risk value, and migrate it back to S2.

[0012] A further improvement of the present invention is that the fraud risk value is obtained by weighted summation of the application basic information score and the user behavior score, and the application basic information score calculation process includes: S211, creating an application type score form, the application type score form includes the application category and the corresponding fraud risk indicator, the fraud risk indicator is obtained by the probability HP of fraud events occurring in the category in history; S212, extracting whether the current application developer has a bad record, if yes, it is recorded as P=1 point, if no, it is recorded as P=0 point, P is the developer's bad record impact value score; S213, extracting the current application's application store platform score Apr, and calculating the store score normalization value NApr=(Apr-1) / 4; S214, calculating the application basic information score Abi=(1-P)×wp+wap×(Apr-1) / 4+whp×HP, wherein wp represents the developer's bad record impact value score weight, wap represents the store platform score weight, and whp represents the weight of the fraud risk indicator.

[0013] A further improvement of the present invention is that the specific calculation process of the user behavior score includes:

[0014] S221, constructing a user behavior sequence model, including extracting the historical behavior sequence of the current user of the current application type in the application type rating form, wherein the behavior sequence includes click behavior features, interactive behavior features, and access duration features; the user behavior sequence model is based on the LSTM model to capture the time dependency of the user behavior and obtain the user's click behavior pattern Similarly, we can get the interactive behavior pattern of the current user and access duration mode ;

[0015] S222. Set the weight of historical behavior pattern and the current user's average behavior pattern weight , through the click behavior pattern, interactive behavior pattern and visit duration pattern, the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of visit duration are obtained;

[0016] S223, performing weighted summation of the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of access duration to obtain a user behavior score.

[0017] A further improvement of the present invention is that the calculation formula for the abnormal degree of the click behavior is:

[0018] ;

[0019] in, It represents the j-th click probability of the current user, which is obtained by the ratio of the number of clicks on the link to the total number of clicks. , represents the average click probability of the current user, and m represents the total number of clicks of the user; similarly, the abnormal degree of interactive behavior is obtained and abnormal visit duration .

[0020] The present invention is further improved in that the dual-layer training embedding strategy is implemented by a fraudulent APP judgment model, which is composed of a shallow feedforward neural network model and a deep fraudulent APP feature classification model; the input layer of the shallow feedforward neural network model is composed of the current user behavior feature vector and the current fraud risk value feature vector Composition: The user behavior feature vector This includes converting the historical click behavior pattern, interaction behavior pattern, and access time pattern of the current user during the use of the current application into a user behavior feature vector. ; The current fraud risk value feature vector is obtained by converting the current fraud risk value into a feature vector; then the feedforward process of the shallow feedforward neural network model is ,in, represents the output of the shallow feedforward neural network model, represents the activation function sigmoid, represents the weight matrix of the model, represents the bias vector; if , determine whether the current APP is a non-fraudulent type; if , determine whether the current APP is a fraud-related type; if , then run the deep fraud APP feature classification model.

[0021] The present invention is further improved in that the deep fraud APP feature classification model is based on the Skip-gram model training input features, extracts the input layer of the shallow feedforward neural network model, and extracts the user interaction behavior pattern as the central feature , and get the hidden layer vector , represents the weight matrix of the model, Represents one-hot encoding, and sets the feature window size to 2, and obtains the four feature lock shadow vector forms around the user interaction behavior pattern , then the deep fraud APP feature classification model uses the central feature Calculate the conditional probability of the surrounding feature vectors as , represents the dimension of the central feature, then the output layer is expressed as ;when Determine whether the current APP is a fraudulent type. Determine whether the current APP is a non-fraudulent type.

[0022] The present invention is further improved in that the adaptive data migration strategy includes a migration cycle calculation sub-strategy and a data quality calculation sub-strategy. The migration cycle calculation sub-strategy determines the initial migration cycle according to the current background activity status of the APP, and determines the initial migration cycle according to the fraud risk value. , and further adjust the migration period. The calculation formula for the migration period is: , where A represents the current active state of the APP, Indicates the APP active status adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Indicates the default migration period.

[0023] The present invention is further improved in that the data quality calculation sub-strategy includes extracting the model accuracy data and setting an adaptive risk threshold , dynamically adjust the threshold according to the model accuracy data , Represents the model accuracy data adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Represents the initial fraud risk threshold, and returns the adaptive risk threshold to S2 to update the model input data.

[0024] On the other hand, the present invention provides a training system for a fraudulent APP multimodal feature vector embedder, comprising:

[0025] The data acquisition module is used to collect basic information of the application, user behavior data, and network interaction data after the user provides protection permissions;

[0026] A user behavior anomaly monitoring module, which calculates the current fraud risk value based on the basic information of the application and the user behavior data, and sets an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, it is sent to a step trainer construction module; when the current fraud risk value is less than or equal to the initial fraud risk threshold, it is sent to a step embedder update module;

[0027] A trainer construction module is used to carry and set a double-layer training embedding strategy. The fraud risk value is used as the input of the double-layer training embedding strategy. A fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data;

[0028] The embedder update module is used to set an adaptive data migration strategy, obtain the migration cycle based on the APP activity status and fraud risk value, and migrate it back to the user behavior abnormality monitoring module.

[0029] A further improvement of the present invention is that the embedder update module includes a migration cycle calculation unit and a data quality calculation unit; the migration cycle calculation unit is used to determine the preliminary migration cycle through the current background activity status of the APP; the data quality calculation unit is used to return the adaptive risk threshold to the user behavior anomaly monitoring module to update the model input data.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention firstly dynamically adjusts the data migration cycle based on the active status and fraud risk value of the APP, balances the model training efficiency and real-time response capability, ensures that high-risk data is processed in a timely manner, and low-risk data does not occupy too many computing resources;

[0032] Dynamically adjust the fraud risk threshold based on the model accuracy data, so that the system can flexibly adapt to different data qualities and avoid the model performance being affected by noisy data or low-quality data;

[0033] Through a simple and fast preliminary model, rapid screening is performed and only samples that need further processing are passed to more complex models, avoiding the use of complex reasoning processes for all APPs and improving response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of the training method of the fraud-related APP multimodal feature vector embedder of the present invention;

[0035] Figure 2 This is a double-layer training embedding strategy flow chart of the training method of the fraud-related APP multimodal feature vector embedder of the present invention;

[0036] Figure 3 This is a framework diagram of the training system for the fraudulent APP multimodal feature vector embedder of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations on the technical solution of the present invention. The embodiments of the present invention and the technical features in the embodiments may be combined with each other unless there is a conflict.

[0038] The term "and / or" is only a description of the association relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " generally indicates that the related objects are in an "or" relationship.

[0039] Figure 1The flowchart of the training method of the fraudulent APP multimodal feature vector embedder disclosed in this embodiment is shown, and the steps are as follows:

[0040] S1. After the user provides protection permissions, basic information of the application and user behavior data are collected;

[0041] S2. Calculate the current fraud risk value based on the basic information of the application and the user behavior data, and set an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, it represents a high risk and should be sent to the model trainer, and then go to step S3. When the current fraud risk value is less than or equal to the initial fraud risk threshold, it represents a low risk and can be directly used for training data update, and then go to step S4.

[0042] The fraud risk value is obtained by weighted summation of the application basic information score and the user behavior score. The application basic information score calculation process includes: S211, creating an application type score form, the application type score form includes the application category and the corresponding fraud risk index, the fraud risk index is obtained by the probability HP of fraud events occurring in the category in history; S212, extracting whether the current application developer has a bad record, if yes, it is recorded as P=1 point, if no, it is recorded as P=0 point, P is the developer's bad record impact value score; S213, extracting the current application's application store platform score Apr, and calculating the store score normalization value NApr=(Apr-1) / 4; S214, calculating the application basic information score Abi=(1-P)×wp+wap×(Apr-1) / 4+whp×HP, wherein wp represents the developer's bad record impact value score weight, wap represents the store platform score weight, and whp represents the weight of the fraud risk index.

[0043] The specific calculation process of the user behavior score includes:

[0044] S221, constructing a user behavior sequence model, including extracting the historical behavior sequence of the current user of the current application type in the application type rating form, wherein the behavior sequence includes click behavior features, interactive behavior features, and access duration features; the user behavior sequence model is based on the LSTM model to capture the time dependency of the user behavior and obtain the user's click behavior pattern Similarly, we can get the interactive behavior pattern of the current user and access duration mode ; Assume that the click behavior characteristics in the current user's historical behavior sequence are expressed as ,in, Represents the click behavior event feature of the current user at time node i. The click behavior feature is trained through the LSTM model to obtain the user's click behavior pattern Similarly, we can get the interactive behavior pattern of the current user and access duration mode ;

[0045] S222. Set the weight of historical behavior pattern and the current user's average behavior pattern weight , through the click behavior pattern, interactive behavior pattern and visit duration pattern, the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of visit duration are obtained;

[0046] The calculation formula for the abnormal degree of click behavior is:

[0047] ;

[0048] in, It represents the j-th click probability of the current user, which is obtained by the ratio of the number of clicks on the link to the total number of clicks. , represents the average click probability of the current user, and m represents the total number of clicks of the user; similarly, the abnormal degree of interactive behavior is obtained and abnormal visit duration ;

[0049] The calculation formula for the abnormal degree of interactive behavior is:

[0050] ;

[0051] in, Indicates the k-th interaction frequency of the current user, calculated by summing the number of shares and comments, and calculating its proportion in the total number of clicks. , represents the average interaction frequency of the current user, and L represents the total number of interactions of the user;

[0052] The calculation formula for the abnormal degree of access duration is:

[0053] ;

[0054] in, Indicates the current user The duration of the visit, , represents the average visit time of the current user, and B represents the number of visits of the user;

[0055] S223, performing weighted summation of the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of access duration to obtain a user behavior score.

[0056] S3. Setting a double-layer training embedding strategy, wherein the fraud risk value is used as the input of the double-layer training embedding strategy, a fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data;

[0057] S4. Set an adaptive data migration strategy, obtain the migration cycle based on the app's active status and fraud risk value, and migrate it back to S2.

[0058] Figure 2 The double-layer training embedding strategy flow chart of the training method of the fraud-related APP multimodal feature vector embedder disclosed in this embodiment is shown;

[0059] The dual-layer training embedding strategy is implemented by a fraud-related APP judgment model, which is composed of a shallow feedforward neural network model and a deep fraud-related APP feature classification model; the input layer of the shallow feedforward neural network model is composed of the current user behavior feature vector and the current fraud risk value feature vector Composition: The user behavior feature vector This includes converting the historical click behavior pattern, interaction behavior pattern, and access time pattern of the current user during the use of the current application into a user behavior feature vector. ; The current fraud risk value feature vector is obtained by converting the current fraud risk value into a feature vector; then the feedforward process of the shallow feedforward neural network model is ,in, represents the output of the shallow feedforward neural network model, represents the activation function sigmoid, represents the weight matrix of the model, represents the bias vector; if , determine whether the current APP is a non-fraudulent type; if , determine whether the current APP is a fraud-related type; if , then run the deep fraud APP feature classification model.

[0060] The deep fraud APP feature classification model is based on the Skip-gram model to train input features, extract the input layer of the shallow feedforward neural network model, and extract the user interaction behavior pattern as the central feature , and get the hidden layer vector , represents the weight matrix of the model, Represents one-hot encoding, and sets the feature window size to 2, and obtains the four feature lock shadow vector forms around the user interaction behavior pattern , then the deep fraud APP feature classification model uses the central feature Calculate the conditional probability of the surrounding feature vectors as , represents the dimension of the central feature, then the output layer is expressed as ;when Determine whether the current APP is a fraudulent type. Determine whether the current APP is a non-fraudulent type.

[0061] The deep fraud-related APP feature classification model in the present invention pays more attention to user interactive behavior patterns. The model for behavior classification is applied to target-oriented behavior classification tasks. By adding target embedding, the model can focus on classifying fraud risks based on target expressions in user behavior, solving the problem of small data sets in related fields.

[0062] The adaptive data migration strategy includes a migration cycle calculation sub-strategy and a data quality calculation sub-strategy. The migration cycle calculation sub-strategy determines the initial migration cycle according to the current background activity status of the APP. In this embodiment, the migration cycle is adjusted according to the following factors:

[0063] Impact of APP active status: Real-time monitoring of APP background active status, monitoring time interval is tt, get APP active status and A1 within time TT, then APP current active status , the active status of each monitored APP is expressed as:

[0064] Active state (A2 = 1): When the app is in the active state, the user may be using the app, and the system needs to migrate data more frequently to ensure data timeliness and user experience;

[0065] Inactive state (A2 = 0): When the app is inactive, the migration cycle should be appropriately extended to reduce system resource consumption;

[0066] Assuming that the migration period is shorter in the active state and longer in the inactive state, it is necessary to set a basic range for the migration period.

[0067] The user's risk value will also affect the migration cycle. If the user's risk is high, the system may need to check or update their behavior status more frequently to avoid potential security issues. , and further adjust the migration period. The calculation formula for the migration period is: , where A represents the current active state of the APP, Indicates the APP active status adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Indicates the default migration period.

[0068] The data quality calculation sub-strategy includes extracting the model accuracy data, setting an adaptive risk threshold , dynamically adjust the threshold according to the model accuracy data , Represents the model accuracy data adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Indicates the initial fraud risk threshold.

[0069] When the model accuracy is low, will become larger, making the threshold closer , at this time, the system will be more inclined to accept high-risk data for training to help the model improve accuracy;

[0070] When the model accuracy is high, The size will change, making the threshold lower, so that more low-risk data can be included in the training data update.

[0071] The problem that the collected data may contain noise, duplication or invalid information due to the sensitivity of fraud-related apps, affecting the model training effect is solved.

[0072] The threshold and weight may be set by default according to the present invention, or may be set by an operator.

[0073] Figure 3 The framework diagram of the training system of the fraudulent APP multimodal feature vector embedder of the present invention is shown. Based on the same inventive concept as that of Embodiment 1 and Embodiment 2, the present invention provides a training system of the fraudulent APP multimodal feature vector embedder, including:

[0074] The data acquisition module is used to collect basic information of the application, user behavior data, and network interaction data after the user provides protection permissions;

[0075] A user behavior anomaly monitoring module, which calculates the current fraud risk value based on the basic information of the application and the user behavior data, and sets an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, it is sent to a step trainer construction module; when the current fraud risk value is less than or equal to the initial fraud risk threshold, it is sent to a step embedder update module;

[0076] A trainer construction module is used to carry and set a double-layer training embedding strategy. The fraud risk value is used as the input of the double-layer training embedding strategy. A fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data;

[0077] The embedder update module is used to set an adaptive data migration strategy, obtain the migration cycle based on the APP activity status and fraud risk value, and migrate it back to the user behavior abnormality monitoring module.

[0078] The embedder update module includes a migration cycle calculation unit and a data quality calculation unit; the migration cycle calculation unit is used to determine the preliminary migration cycle based on the current background activity status of the APP; the data quality calculation unit is used to return the adaptive risk threshold to the user behavior anomaly monitoring module to update the model input data.

[0079] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0080] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0081] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0082] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0083] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A training method for a multimodal feature vector embedder for fraudulent apps, characterized by: The following steps are involved: S1. After the user provides protection permissions, basic information of the application and user behavior data are collected; S2. Calculate the current fraud risk value according to the basic information of the application and the user behavior data, and set an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, proceed to step S3; when the current fraud risk value is less than or equal to the initial fraud risk threshold, proceed to step S4; S3. Setting a double-layer training embedding strategy, wherein the fraud risk value is used as the input of the double-layer training embedding strategy, a fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data; The dual-layer training embedding strategy is implemented by a fraud-related APP judgment model, which is composed of a shallow feedforward neural network model and a deep fraud-related APP feature classification model; the input layer of the shallow feedforward neural network model is composed of the current user behavior feature vector and the current fraud risk value feature vector Composition: The user behavior feature vector This includes converting the historical click behavior pattern, interaction behavior pattern, and access time pattern of the current user during the use of the current application into a user behavior feature vector. ; The current fraud risk value feature vector is obtained by converting the current fraud risk value into a feature vector; then the feedforward process of the shallow feedforward neural network model is ,in, represents the output of the shallow feedforward neural network model, represents the activation function sigmoid, represents the weight matrix of the model, represents the bias vector; if , determine whether the current APP is a non-fraudulent type; if , determine whether the current APP is a fraud-related type; if , then run the deep fraud APP feature classification model; S4. Set an adaptive data migration strategy, obtain the migration cycle based on the app's active status and fraud risk value, and migrate it back to S2.

2. The training method of the fraudulent APP multimodal feature vector embedder according to claim 1 is characterized in that: The fraud risk value is obtained by weighted summation of the application basic information score and the user behavior score. The application basic information score calculation process includes: S211, creating an application type score form, the application type score form includes the application category and the corresponding fraud risk index, the fraud risk index is obtained by the probability HP of fraud events occurring in the category in history; S212, extracting whether the current application developer has a bad record, if yes, it is recorded as P=1 point, if no, it is recorded as P=0 point, P is the developer's bad record impact value score; S213, extracting the current application's application store platform score Apr, and calculating the store score normalization value NApr=(Apr-1) / 4; S214, calculating the application basic information score Abi=(1-P)×wp+wap×(Apr-1) / 4+whp×HP, wherein wp represents the developer's bad record impact value score weight, wap represents the store platform score weight, and whp represents the weight of the fraud risk index.

3. The training method of the fraudulent APP multimodal feature vector embedder according to claim 2 is characterized in that: The specific calculation process of the user behavior score includes: S221, constructing a user behavior sequence model, including extracting the historical behavior sequence of the current user of the current application type in the application type rating form, wherein the behavior sequence includes click behavior features, interactive behavior features, and access duration features; the user behavior sequence model is based on the LSTM model to capture the time dependency of the user behavior and obtain the user's click behavior pattern , similarly, we can get the interactive behavior pattern of the current user and access duration mode ; S222. Set the weight of historical behavior pattern and the current user's average behavior pattern weight , through the click behavior pattern, interactive behavior pattern and visit duration pattern, the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of visit duration are obtained; S223, performing weighted summation of the abnormal degree of click behavior, the abnormal degree of interactive behavior and the abnormal degree of access duration to obtain a user behavior score.

4. The training method of the fraudulent APP multimodal feature vector embedder according to claim 3 is characterized in that: The calculation formula for the abnormal degree of click behavior is: ； in, It represents the j-th click probability of the current user, which is obtained by the ratio of the number of clicks on the link to the total number of clicks. , represents the average click probability of the current user, and m represents the total number of clicks of the user; similarly, the abnormal degree of interactive behavior is obtained and abnormal visit duration .

5. The training method of the fraudulent APP multimodal feature vector embedder according to claim 4 is characterized in that: The deep fraud APP feature classification model is based on the Skip-gram model to train input features, extract the input layer of the shallow feedforward neural network model, and extract the user interaction behavior pattern as the central feature , and get the hidden layer vector , represents the weight matrix of the model, Represents one-hot encoding, and sets the feature window size to 2, and obtains the four feature lock shadow vector forms around the user interaction behavior pattern , then the deep fraud APP feature classification model uses the central feature Calculate the conditional probability of the surrounding feature vectors as , represents the dimension of the central feature, then the output layer is expressed as ;when Determine whether the current APP is a fraudulent type. Determine whether the current APP is a non-fraudulent type.

6. The training method of the fraudulent APP multimodal feature vector embedder according to claim 5 is characterized in that: The adaptive data migration strategy includes a migration cycle calculation sub-strategy and a data quality calculation sub-strategy. The migration cycle calculation sub-strategy determines the initial migration cycle based on the current background activity status of the APP and the fraud risk value. , and further adjust the migration period. The calculation formula for the migration period is: , where A represents the current active state of the APP, Indicates the APP active status adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Indicates the default migration period.

7. The training method of the fraudulent APP multimodal feature vector embedder according to claim 6 is characterized in that: The data quality calculation sub-strategy includes extracting the model accuracy data, setting an adaptive risk threshold , dynamically adjust the threshold according to the model accuracy data , Represents the model accuracy data adjustment coefficient, It represents the adjustment coefficient of the fraud risk value. Represents the initial fraud risk threshold, and returns the adaptive risk threshold to S2 to update the model input data.

8. A training system for a fraudulent APP multimodal feature vector embedder, used to execute the training method for a fraudulent APP multimodal feature vector embedder as claimed in any one of claims 1 to 7, characterized in that: include: The data acquisition module is used to collect basic information of the application, user behavior data, and network interaction data after the user provides protection permissions; A user behavior anomaly monitoring module, which calculates the current fraud risk value based on the basic information of the application and the user behavior data, and sets an initial fraud risk threshold. When the current fraud risk value is greater than the initial fraud risk threshold, it is sent to a step trainer construction module; when the current fraud risk value is less than or equal to the initial fraud risk threshold, it is sent to a step embedder update module; A trainer construction module is used to carry and set a double-layer training embedding strategy. The fraud risk value is used as the input of the double-layer training embedding strategy. A fraud APP judgment model is formed by combining a shallow feedforward neural network model and a deep fraud APP feature classification model, and the F1 index of the fraud APP judgment model is output as the model accuracy data; The embedder update module is used to set an adaptive data migration strategy, obtain the migration cycle based on the APP activity status and fraud risk value, and migrate it back to the user behavior abnormality monitoring module.

9. The training system of the fraudulent APP multimodal feature vector embedder according to claim 8, characterized in that: The embedder update module includes a migration cycle calculation unit and a data quality calculation unit; the migration cycle calculation unit is used to determine the preliminary migration cycle based on the current background activity status of the APP; the data quality calculation unit is used to return the adaptive risk threshold to the user behavior anomaly monitoring module to update the model input data.

Images