Telecommunication user abnormal risk assessment method, device, equipment, medium and product

Abstract

The invention provides a telecommunication user abnormal risk assessment method, device and equipment, a medium and a product, and the method comprises the steps: analyzing a network data package, and obtaining user behavior data; generating a website code collaborative vector based on the user behavior data; splicing the website accessed by the user and the main body elements of the webpage corresponding to the website, and inputting the spliced website and the main body elements into a webpage content classification model to obtain a webpage content type; on the basis of the webpage content type, constructing a website index content representation vector; splicing the website code collaborative vector and the website index content representation vector to obtain a collaborative embedded vector; and inputting the collaborative embedding vector into the large language model to obtain an exception judgment result. According to the method, the website information and the webpage content information in the user behavior data can be fully mined, and compared with a traditional method that only statistical information of the user behavior data can be considered, the semantic information in the user behavior data is fully mined, the abnormal recognition accuracy is improved, and potential novel abnormal access modes can be found easily.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, equipment, medium and product for evaluating abnormal risk of telecommunication users. Background Art

[0002] In recent years, the forms of abnormal behaviors in telecommunications network risks have varied greatly, and the initiators of abnormal behaviors use a variety of technical means, which are difficult to guard against and greatly increase the difficulty of anomaly detection.

[0003] Due to the security of user personal information, it is currently impossible to directly obtain user personal information. Therefore, the current abnormal risk assessment of telecommunications users is mainly carried out through machine learning algorithms combined with user behavior data and other information. However, these methods often only consider the statistical characteristics of user behavior, and the judgment results of identifying abnormal behavior are not accurate enough, and cannot adapt to the identification of abnormal behavior in various forms. Summary of the invention

[0004] The present invention provides a telecommunication user abnormal risk assessment method, device, equipment, medium and product, which are used to solve the technical problem that the abnormal risk assessment method for telecommunication users in the prior art only considers the statistical characteristics of user behavior and cannot adapt to the identification of abnormal behaviors in various forms, and realizes mining the semantic information in user behavior, thereby accurately detecting the abnormal risk assessment of telecommunication users' Internet behavior.

[0005] The present invention provides a method for evaluating abnormal risk of telecommunication users, comprising the following steps: Parsing network data packets to obtain user behavior data; the user behavior data includes user identification and user visited websites; Inputting the user behavior data into a latent factor model to obtain a URL encoding synergy vector output by the latent factor model; Splicing the URL visited by the user and the main elements of the corresponding web page to obtain splicing information; inputting the splicing information into the trained web page content classification model to obtain the web page content type output by the trained web page content classification model; Based on the webpage content type, construct a URL index content representation vector; Concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; The collaborative embedding vector is input into the trained large language model to obtain an abnormality judgment result for the user behavior data output by the large language model; the abnormality judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormality risk.

[0006] According to a method for assessing abnormal risk of telecommunication users provided by the present invention, after the URL encoding collaborative vector is concatenated with the URL index content representation vector to obtain a collaborative embedding vector, the method further includes: Mapping the collaborative embedding vector into a binary sequence using a sign function; Grouping the binary sequence at equal intervals, and converting the grouped binary sequence into a user behavior index sequence in IP form; The step of inputting the collaborative embedding vector into the trained large language model to obtain an abnormality judgment result output by the large language model for the user behavior data includes: The user behavior index sequence in IP form is input into the trained large language model to obtain an abnormality judgment result for the user behavior data output by the large language model.

[0007] According to a method for assessing abnormal risk of telecommunication users provided by the present invention, before parsing the network data packet to obtain the user behavior data, the method further includes: The pre-trained large language model is fine-tuned based on a sample user behavior index sequence of a sample user and a real state label corresponding to the sample user, and the trained large language model is obtained by semantically aligning the fine-tuned large language model using a preset instruction set.

[0008] According to a telecommunications user abnormal risk method provided by the present invention, the preset instruction set includes a first instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; the pre-trained large language model is semantically aligned with the preset instruction set to obtain the trained large language model, including: Generate the first instruction in the instruction-response pair using a template including a sequence of historically visited web addresses of a user sorted in chronological order, generate the first response in the instruction-response pair using a template including whether it is abnormal, the type of abnormality, and the degree of abnormality risk, and construct the first instruction set using a plurality of the first instructions and a plurality of the first responses; Based on the first instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0009] According to a telecommunications user abnormal risk method provided by the present invention, the preset instruction set includes a second instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; the pre-trained large language model is semantically aligned with the preset instruction set to obtain the trained large language model, including: Using part of the preset web page content prompt as a template to generate the second instruction in the instruction-response pair; the preset web page content prompt includes a website address, a title and text content contained in the website address, and an index corresponding to the web page; Using other prompts in the preset webpage content prompts except the part of prompts as a template to generate a second response in the command-response pair; constructing the second instruction set by using a plurality of the second instructions and a plurality of the second responses; Based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0010] According to a telecommunications user abnormal risk method provided by the present invention, the preset instruction set includes a third instruction set; the pre-trained large language model is semantically aligned with the preset instruction set to obtain the trained large language model, including: Based on the third instruction set, fine-tuning the pre-trained large language model to generate the trained large language model; Among them, each instruction in the third instruction set is expressed in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, and URL; several third responses in the third instruction set are responses of any desired style.

[0011] According to a telecommunications user abnormal risk method provided by the present invention, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; the pre-trained large language model is semantically aligned with the preset instruction set to obtain the trained large language model, including: Generate a fourth instruction in the instruction-response pair using a template including user behavior or user intention, generate a fourth response in the instruction-response pair using a template including whether it is abnormal, the type of abnormality, and the degree of abnormal risk, and construct the fourth instruction set with multiple fourth instructions and multiple fourth responses; Based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0012] According to a telecommunications user abnormal risk method provided by the present invention, the instruction fine-tuning of the pre-trained large language model to generate the trained large language model includes: The target loss value between the output sequence of the pre-trained large language model and the true label sequence is determined based on a preset loss function; the preset loss function L is: ; in, represents a pair of command-response pairs in a batch of data and the target output corresponding to each piece of data in the batch of data, is the target output The jth word in express All previous words; Adjusting the network parameters in the pre-trained large language model according to the target loss value until a training end condition is met, thereby obtaining the fine-tuned large language model; The real label sequence is a sequence corresponding to the response form in the form of the command-response pair.

[0013] The present invention also provides a telecommunication user abnormal risk assessment device, comprising: The data packet parsing module is used to parse the network data packet to obtain user behavior data; the user behavior data includes the user identity and the website visited by the user; A URL encoding synergy vector generation module, used for inputting the user behavior data into a latent factor model to obtain a URL encoding synergy vector output by the latent factor model; The webpage content classification module is used to splice the URL visited by the user and the main elements of the corresponding webpage to obtain splicing information; input the splicing information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model; A URL index content representation vector construction module, used to construct a URL index content representation vector based on the web page content type; A collaborative embedding vector concatenation module, used for concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; The abnormal risk prediction module is used to input the collaborative embedding vector into the trained large language model to obtain the abnormal judgment result of the large language model for the user behavior data; the abnormal judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormal risk.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned methods for assessing abnormal risks of telecommunication users is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the abnormal risk assessment method for telecommunication users as described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the abnormal risk assessment method for telecommunication users described in any one of the above is implemented.

[0017] The method, device, equipment, medium and product for evaluating abnormal risk of telecommunication users provided by the present invention obtain user behavior data by parsing network data packets; the user behavior data includes user identity identification and user visited websites; the user behavior data is input into a latent factor model to obtain a website encoding synergy vector output by the latent factor model; the user visited website and the main elements of the corresponding web page are spliced ​​to obtain splicing information; the splicing information is input into a trained web page content classification model to obtain the web page content type output by the trained web page content classification model; based on the web page content type, a website index content representation vector is constructed; the website encoding synergy vector is spliced ​​with the website index content representation vector to obtain a synergy embedding vector; the synergy embedding vector is input into a trained large language model to obtain an abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of abnormality, abnormality type and abnormality risk degree. This method uses the powerful generalization ability of the generative model to directly generate abnormal risk assessment results based on user behavior data (including the content of the URLs visited by users), fully mining the URL information and web page content information in the user behavior data. Compared with the traditional statistical information that only considers user behavior data, this application also fully mines the semantic information therein, improves the accuracy of abnormal identification, and helps to discover potential new abnormal access patterns. Furthermore, this application also constructs a URL encoding coordination vector for representing the relationship between the user and the access address based on the user behavior data, as well as a URL index content representation vector associated with the user access address and the web page content, and splices these two vectors to achieve compressed representation of the URL and web page content, as well as the precise input construction of the large language model, so as to extract standardized and accurate information from the network data packet, thereby outputting accurate abnormal judgment results. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of the abnormal risk assessment method for telecommunication users provided by the present invention.

[0020] Figure 2It is a sequence diagram of user interaction behavior data provided by the present invention.

[0021] Figure 3 It is a schematic diagram of the processing flow of user behavior data by the collaborative model provided by the present invention.

[0022] Figure 4 It is a structural schematic diagram of a telecommunication user abnormal risk assessment device provided by the present invention.

[0023] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Combine the following Figure 1-Figure 5 Specific embodiments of the present invention are described.

[0026] Figure 1 FIG. 1 is a flow chart of a method for assessing abnormal risk of telecommunication users provided by the present invention. Figure 1 As shown, the method includes the following.

[0027] Step 101: parse the network data packet to obtain user behavior data; the user behavior data includes user identity and user visited website.

[0028] Among them, a network data packet is a unit of data in TCP / IP communication transmission. User behavior data refers to the interactive behavior data generated by users during the Internet access process, such as visiting websites, interface jumps, downloading apps, loading official website resources, sharing screens, accessing transfer accounts, and other behavior records. Figure 2 As shown, Figure 2 It is a sequence diagram of user interaction behavior data, which includes user identity identification (ie user ID, Identity document) and user access URL (ie URL, Uniform Resource Locator).

[0029] Specifically, this application is mainly used in actual business to detect abnormal behaviors of users surfing the Internet, such as behaviors that do not conform to the norms and affect the security of the entire network environment. First, obtain network data packets, and use DPI (Deep Packet Inspection) technology to parse the above network data packets to obtain user behavior data, including unstructured data such as interaction records that occur when users surf the Internet (such as website visits, APP downloads, etc.). The user behavior data extracted by DPI can be expressed in the data form shown in Table 1 below.

[0030] Table 1

[0031] Step 102: input the user behavior data into a latent factor model to obtain a URL encoding coordination vector output by the latent factor model.

[0032] Among them, the URL encoding synergy vector refers to the encoded data obtained by fusing multimodal data such as URLs and user identity, which is generally used in the feature extraction process. The Latent Factor Model is a common data dimensionality reduction technology that can represent high-dimensional data as a factor decomposition form in a low-dimensional feature space.

[0033] In step 102, for the above user behavior data, the collaborative model is first used to construct the interactive relationship between the user (User ID) and the URL visited by the user, wherein the collaborative model is as follows: Figure 3 As shown, for the user behavior data in Table 1 above, the interaction record of user 1 visiting URL 2 appears in DPI, then user 1 and URL 2 are connected in a directed way. Then the traditional latent factor model is used to analyze the above interaction relationship table to obtain the vector representation of the relationship between the user ID and the URL, and the URL is used to encode the synergy vector Step 102 can be described by the following expression: ; in, Indicates is a collaborative model with parameters; is the d-dimensional embedding vector of the URL encoding collaborative information (i.e., the URL encoding collaborative vector).

[0034] Step 103, concatenate the URL accessed by the user and the main elements of the corresponding web page to obtain concatenation information; input the concatenation information into the trained web page content classification model to obtain the web page content type output by the trained web page content classification model.

[0035] The web page content type refers to the classification of the web page content corresponding to the URL accessed by the user, such as conference category, personal information category, customer service category, etc.

[0036] Specifically, the URL string, title and description (i.e., the text content in the tag of the HTML webpage source code, i.e., the main element of the webpage) visited by the user are spliced ​​to obtain splicing information. The splicing information is input into the trained webpage content classification model to obtain the webpage content type. Among them, the trained webpage content classification model is based on the BERT-based model (including but not limited to BERT, RoBERTa, XLM-RoBERTa, etc.), and the URL content classification label is obtained by fine-tuning the parameters of the BERT-based model. The main function of the BERT model is to perform language representation learning, understand the contextual information of the language, and generate high-quality language representation.

[0037] Step 104: construct a URL index content representation vector based on the webpage content type.

[0038] Specifically, the BERT model can generate a text representation of the URL based on the URL string, title, and description of the URL visited by the user. The text representation can be in vector form, so the embedding vector with the [CLS] tag is obtained. , which is the URL index content representation vector , where the [CLS] tag is the abbreviation of "Classification" and is used to indicate the main idea or central idea in a sentence.

[0039] Step 105: Encode the URL coordination vector The URL index content representation vector Concatenate and get the collaborative embedding vector .

[0040] Specifically, the above two types of vector representations are concatenated to obtain the collaborative embedding vector .

[0041] Step 106: embed the collaborative vector The data is input into the trained large language model to obtain an abnormality judgment result for the user behavior data output by the large language model; the abnormality judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormality risk.

[0042] Specifically, the above collaborative embedding vector Input into the trained large language model (LLM) to obtain the abnormal judgment result output by the large language model, such as "there is abnormal risk, the abnormal risk type is financial management behavior, and the risk level is high". Among them, since the large language model is generally a model trained on a large amount of training data, if a specific task is to be performed later, it only needs to be fine-tuned using the data set of the specific field. Therefore, the large language model capable of performing specific tasks used in this application is obtained by fine-tuning the model parameters on the sample user behavior index sequence of sample users and the real state labels corresponding to these sample users (including whether it is abnormal, the type of abnormality and at least one of the abnormal risk level) of the existing large language model. In addition, since the large language model is generally a generative model, that is, the model can generate innovative texts based on known information, but may generate texts that do not conform to human preferences. Therefore, in order to align the expression of human preferences, the fine-tuned large language model is also semantically aligned on the preset instruction set, that is, it can output a standardized judgment result according to the preset prompt statement.

[0043] In the above embodiment, user behavior data is obtained by parsing network data packets; user behavior data includes user identity identification and user visited websites; user behavior data is input into the latent factor model to obtain the URL encoding synergy vector output by the latent factor model; the user visited website and the main elements of the corresponding web page are spliced ​​to obtain splicing information; the splicing information is input into the trained web page content classification model to obtain the web page content type output by the trained web page content classification model; based on the web page content type, a URL index content representation vector is constructed; the URL encoding synergy vector is spliced ​​with the URL index content representation vector to obtain a synergy embedding vector; the synergy embedding vector is input into the trained large language model to obtain the abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of abnormality, abnormality type and abnormal risk degree. The method utilizes the powerful generalization ability of the generative model to directly generate abnormal risk assessment results based on user behavior data (including the content of the website visited by the user), fully mines the website information and web page content information in the user behavior data, and compared with the traditional statistical information that only considers the user behavior data, the present application also fully mines the semantic information therein, improves the accuracy of abnormal recognition, and helps to discover potential new abnormal access patterns. Furthermore, the present application also constructs a URL encoding coordination vector for representing the relationship between the user and the access address based on the user behavior data, as well as a URL index content representation vector that associates the user access address with the web page content, thereby realizing the precise input construction of a large language model, and being able to extract standardized and accurate information from network data packets, avoiding cumbersome feature engineering and traditional classification algorithm steps, thereby outputting accurate abnormality judgment results. Furthermore, the method abandons the practice of directly using the original URL or ID as input, and instead adopts a method based on compressed vectors to construct an index. This method not only solves the problem that large models are not good at long sequence input, but also ensures that the index can capture the potential semantic associations between user access information.

[0044] In one embodiment, after the above step 105, the present application further uses a fully connected layer to embed the collaborative embedding vector Map it into a suitable space so as to convert it into a binary sequence later. Specifically, the above step 105 further includes the following steps (1)-(2): (1) Using the symbolic function, the synergy is embedded into the vector Mapped to a binary sequence; ; in, represents a binary representation of URL-encoded collaborative information, , are the weights and biases of the fully connected layer, is the activation function, is a symbolic function.

[0045] (2) Grouping the binary sequence at equal intervals, and converting the grouped data sequence into a user behavior index sequence in IP form.

[0046] Specifically, at this point, we have converted the URL embedding vector into a binary representation, which can be directly input into the LLM (Large Language Model). However, the binary sequence is long at this time, which is not conducive to the processing of the large model. Therefore, this proposal considers further compressing the binary sequence and constructing a compression function .

[0047] ; Specifically, we divide the binary sequence into groups of 8 bits each, perform binary to decimal conversion, and use "." as a separator. For example, "10101100 / 00010000 / 11111110 / 00000011" can be compressed to "172.16.254.3". Since the original training corpus of the large language model contains a large amount of IP information, the method of this application can maintain the converted vector (i.e. user behavior index sequence in IP format ) semantic features can be understood by LLM.

[0048] The above-mentioned step 106 includes: inputting the user behavior index sequence in the above-mentioned IP form into the trained large language model, and obtaining the abnormality judgment result for the user behavior data output by the large language model; the abnormality judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormal risk.

[0049] Specifically, the user behavior index sequence in the above IP format, such as "172.16.254.3", is input into the trained large language model (LLM) to obtain the abnormal judgment result output by the large language model, such as "there is abnormal risk, the abnormal risk type is financial management behavior, and the risk level is high."

[0050] In the above embodiment, the URL encoding coordination vector and the URL index content representation vector are concatenated and compressed to generate a user behavior index sequence in the form of IP, thereby realizing the compressed representation of the URL and the web page content, so that the data input into the large language model can adapt to the existing large language model's ability to parse IP addresses, and the existing pre-trained large language model can be used directly without excessive training and labeling, thereby improving the recognition accuracy of the large language model for user behavior data and also improving the development efficiency of the large language model on this specific task.

[0051] In one embodiment, before the above step 101, it also includes: fine-tuning the pre-trained large language model based on the user behavior data of the sample user and the real state label corresponding to the sample user, and obtaining the trained large language model after semantically aligning the pre-trained large language model using a preset instruction set.

[0052] This application also designs a series of fine-tuning processes for specific tasks, including but not limited to autoregressive generation tasks, semantic similarity tasks, and prediction tasks based on user intent, to enhance LLM's ability to understand abnormal risk signals. By adding semantic alignment tasks to the fine-tuning process, the model is prompted to better match the language semantics captured in the user behavior data with the actual abnormal behavior patterns, thereby improving the model's accuracy in identifying user abnormal behavior risks.

[0053] In one embodiment, the preset instruction set includes a first instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; before the above step 101, it also includes: using the preset instruction set to semantically align the pre-trained large language model to obtain the trained large language model, specifically including: using a template containing a sequence of user historical visited URLs sorted in chronological order to generate the first instruction in the instruction-response pair, using a template containing whether it is abnormal, the type of abnormality and the degree of abnormal risk to generate the first response in the instruction-response pair, and constructing the first instruction set with multiple first instructions and multiple first responses; based on the first instruction set, fine-tuning the instructions of the pre-trained large language model to generate the trained large language model.

[0054] Specifically, since the method proposed in this application is a generative anomaly risk prediction based on LLM, a sequence anomaly risk prediction alignment is also designed as the main task of semantic alignment optimization. In this main task, the anomaly type and risk level are considered as the main tuning indicators. Specifically, a personalized instruction (i.e., the first instruction) is constructed based on the user's current historical DPI online interaction behavior, and LLM predicts the type of anomaly and the degree of anomaly risk that may occur to the user based on the first instruction and historical behavior prompts. In this fine-tuning process, the user's historical interaction behavior obtained from the DPI is generated according to the above-mentioned template containing the user's historical visited URL sequence sorted in chronological order into a user behavior index sequence in the form of IP corresponding to the visited URLs arranged in chronological order. This user behavior index sequence in the form of IP is used as an embedded vector as the input of the above-mentioned large language model, and finally outputs a response generated according to a template containing whether it is abnormal, the type of anomaly and the degree of abnormal risk. Among them, an example of the form of an instruction-response pair in the first instruction set is shown in Table 2 below: Table 2

[0055] The above embodiment, by designing a first instruction according to a sequence of historically visited URLs of a user sorted in chronological order, and a first instruction set including a first response of abnormal risk and risk degree, performs semantic alignment optimization on the pre-trained large language model, so that the large language model can more accurately capture the matching degree between the URLs visited by the user and the abnormal risk, and output a risk prediction result that meets the specifications according to human expectations, which is conducive to the subsequent unified collection of these data and further unified processing.

[0056] In one embodiment, the preset instruction set includes a second instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; before the step 101, the step further includes: using the preset instruction set to semantically align the pre-trained large language model to obtain the trained large language model, specifically including: The second instruction in the instruction-response pair is generated by using part of the preset web page content prompts as a template; the preset web page content prompts include a website, a title and text content contained in the website, and an index corresponding to the web page; the second response in the instruction-response pair is generated by using other prompts in the preset web page content prompts except the part of the prompts as a template; the second instruction set is constructed by using multiple second instructions and multiple second responses; based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0057] Specifically, in this embodiment, one of the auxiliary tasks of semantic alignment optimization is designed: URL content description alignment. First, the LLM is instructed to generate a corresponding URL index based on one or more combinations of the URL's title / text content, and then the LLM is instructed to restore the URL's content information based on its index, which is essentially similar to the task of cross-modal semantic alignment. Among them, the form of the instruction-response pair in the second instruction set is shown in Table 3 below: Table 3

[0058] The above embodiment uses the matching relationship between the URL, the webpage content and the user behavior index sequence in the form of IP to fine-tune the parameters in the large language model, so that the text content generated by the model is more accurate.

[0059] In one embodiment, the preset instruction set includes a third instruction set; before the above step 101, it also includes: using the preset instruction set to semantically align the pre-trained large language model to obtain the trained large language model, specifically including: based on the third instruction set, fine-tuning the instructions of the pre-trained large language model to generate the trained large language model; wherein each instruction in the third instruction set is expressed in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, and URL; several third responses in the third instruction set are responses of any desired style.

[0060] Specifically, in this embodiment, the second auxiliary task of the semantic optimization task is designed: hybrid sequence prediction alignment. For the sequence abnormal behavior risk prediction alignment task, in order to further enhance the semantic alignment, the difficulty of prediction is increased by changing the representation of conditions and targets, thereby deriving different semantic representation combinations of URLs. In particular, this proposal considers the following three representation methods. (1) Replace the index of the URL with the URL title, instructing LLM to generate the expected output; (2) Replace the index of the URL with the URL text content, instructing LLM to generate the expected output; (2) Replace the index of the URL with the URL URL, instructing LLM to generate the expected output.

[0061] The above embodiment replaces the URL index with the URL title or URL text content or URL in the instruction and enables it to output abnormal risk, so as to adapt to the output of different contents and generate accurate risk prediction results, thereby improving the generalization ability of the large language model in the abnormal risk prediction task.

[0062] In one embodiment, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; before the above step 101, it also includes: using the preset instruction set to semantically align the pre-trained large language model to obtain the trained large language model, specifically including: using a template containing user behavior or user intention to generate the fourth instruction in the instruction-response pair, using a template containing whether it is abnormal, the type of abnormality and the degree of abnormal risk to generate the fourth response in the instruction-response pair, and constructing the fourth instruction set with multiple fourth instructions and multiple fourth responses; based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0063] Specifically, in this embodiment, the third auxiliary task of the semantic optimization task is designed: prediction alignment based on user behavior intention. In the real world, users' abnormal access behaviors are often related to their own behavior intentions, and this model should have the ability to understand users' actual behaviors, thereby providing higher quality abnormal prediction results. Among them, the form of the instruction-response pair in the fourth instruction set is shown in Table 4 below: Table 4

[0064] The above-mentioned embodiment, by designing the relationship between the user's behavioral intention and the risk prediction result, enables the large model to output the prediction result desired by the user according to the user's prompt, thereby improving the adaptability of the model.

[0065] In one embodiment, the step of fine-tuning the pre-trained large language model to generate the trained large language model includes: Determine a target loss value between an output sequence of the pre-trained large language model and a true label sequence based on a preset loss function; The preset loss function L is: ; in, represents a pair of instruction-response pairs I in a batch of data and a target output Y corresponding to each data in the batch of data, is the target output The jth word in express All previous words; Adjusting the network parameters in the pre-trained large language model according to the target loss value until a training end condition is met, thereby obtaining the pre-trained large language model; The real label sequence is a sequence corresponding to the response form in the form of the command-response pair.

[0066] Specifically, this application formats the tuning task into a conditional language generation task in a sequence-to-sequence manner, and its objective function is: ; Among them, represents a command-response pair and target output in a batch of data, is the jth token, and represents the previous tokens.

[0067] The user behavior index sequence that has been vectorized and aligned is input into the large language model that has been fine-tuned by the previous step. The model generates outputs that reflect the risk of abnormal user behavior (whether it is abnormal, type of abnormal behavior, degree of risk, etc.) based on the semantically consistent and discriminative URL index sequence.

[0068] The above-mentioned embodiment continuously optimizes the model parameters by comparing the difference between the abnormal prediction results generated by the model and the actual labels, so that the model can more accurately identify potential abnormal behavior patterns from a large amount of user behavior data.

[0069] The abnormal risk assessment device for telecommunication users provided by the present invention is described below. The abnormal risk assessment device for telecommunication users described below and the abnormal risk assessment method for telecommunication users described above can be referenced to each other.

[0070] like Figure 4 As shown, a telecommunication user abnormal risk assessment device is provided, the device comprising: The data packet parsing module 401 is used to parse the network data packet to obtain user behavior data; the user behavior data includes the user identity and the website visited by the user; A URL encoding synergy vector generating module 402 is used to input the user behavior data into a latent factor model to obtain a URL encoding synergy vector output by the latent factor model and used to represent the association relationship between the user identity and the URL visited by the user; The webpage content classification module 403 is used to splice the URL visited by the user and the main elements of the corresponding webpage to obtain splicing information; input the splicing information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model; A URL index content representation vector construction module 404 is used to construct a URL index content representation vector based on the webpage content type; A collaborative embedding vector concatenation module 405 is used to concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; The abnormal risk prediction module 406 is used to input the collaborative embedding vector into the trained large language model to obtain the abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of abnormality, abnormality type and abnormal risk degree.

[0071] In one embodiment, it further includes a user behavior index sequence generating unit, which is used to: map the collaborative embedding vector into a binary sequence using a symbol function; group the binary sequence into equal intervals, and convert the grouped binary sequence into a user behavior index sequence in IP form; The above-mentioned abnormal risk prediction module 406 is further used to: input the user behavior index sequence in the IP form into the trained large language model to obtain the abnormal judgment result of the user behavior data output by the large language model.

[0072] In one embodiment, it also includes a model training unit, which is used to: fine-tune the pre-trained large language model based on the user behavior data of the sample user and the real state label corresponding to the sample user, and obtain the trained large language model after semantic alignment of the pre-trained large language model using a preset instruction set.

[0073] In one embodiment, the preset instruction set includes a first instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; the above-mentioned model training unit is further used to: A first instruction in the instruction-response pair is generated using a template containing a sequence of historically visited URLs of the user sorted in chronological order; a first response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality and the degree of abnormality risk; the first instruction set is constructed using a plurality of the first instructions and a plurality of the first responses; based on the first instruction set, the pre-trained large language model is fine-tuned by instructions to generate the trained large language model.

[0074] In one embodiment, the preset instruction set includes a second instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; the above-mentioned model training unit is further used to: The second instruction in the instruction-response pair is generated by using part of the preset web page content prompts as a template; the preset web page content prompts include a website, a title and text content contained in the website, and an index corresponding to the web page; the second response in the instruction-response pair is generated by using other prompts in the preset web page content prompts except the part of the prompts as a template; the second instruction set is constructed by using multiple second instructions and multiple second responses; based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0075] In one embodiment, the preset instruction set includes a third instruction set; and the above-mentioned model training unit is further used to: Based on the third instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model; wherein each instruction in the third instruction set is represented in the form of an instruction-response pair; the plurality of third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, and URL; the plurality of third responses in the third instruction set are responses of any desired style.

[0076] In one embodiment, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; and the above-mentioned model training unit is further used to: The fourth instruction in the instruction-response pair is generated using a template including user behavior or user intention, and the fourth response in the instruction-response pair is generated using a template including whether it is abnormal, the type of abnormality and the degree of abnormal risk, and the fourth instruction set is constructed with multiple fourth instructions and multiple fourth responses; based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0077] In one embodiment, the model training unit is further used to: The target loss value between the output sequence of the pre-trained large language model and the true label sequence is determined based on a preset loss function; the preset loss function L is: ; in, represents a pair of command-response pairs in a batch of data and the target output corresponding to each piece of data in the batch of data, is the target output The jth word in express All previous words; The network parameters in the pre-trained large language model are adjusted according to the target loss value until the training end condition is met, thereby obtaining the trained large language model; wherein the true label sequence is a sequence corresponding to the response form in the form of the instruction-response pair.

[0078] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call the logic instructions in the memory 530 to execute the telecommunications user abnormal risk assessment method, which includes: parsing network data packets to obtain user behavior data; the user behavior data includes user identity identification and user visited URLs; inputting the user behavior data into the latent factor model to obtain the URL encoding coordination vector output by the latent factor model; splicing the user visited URL and the main elements of the corresponding web page to obtain splicing information; inputting the splicing information into the trained web page content classification model to obtain the web page content type output by the trained web page content classification model; based on the web page content type, constructing a URL index content representation vector; splicing the URL encoding coordination vector with the URL index content representation vector to obtain a coordination embedding vector; inputting the coordination embedding vector into the trained large language model to obtain the abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of whether it is abnormal, the abnormal type and the abnormal risk degree.

[0079] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0080] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the telecommunications user abnormal risk assessment method provided by the above methods, which includes: parsing network data packets to obtain user behavior data; the user behavior data includes user identity identification and user visited URLs; inputting the user behavior data into a latent factor model to obtain a URL encoding synergy vector output by the latent factor model; splicing the user visited URLs and the main elements of the corresponding web pages to obtain splicing information; inputting the splicing information into a trained web content classification model to obtain the web content type output by the trained web content classification model; based on the web content type, constructing a URL index content representation vector; splicing the URL encoding synergy vector with the URL index content representation vector to obtain a synergy embedding vector; inputting the synergy embedding vector into a trained large language model to obtain an abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of whether it is abnormal, the abnormal type and the abnormal risk degree.

[0081] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute the telecommunications user abnormal risk assessment method provided by the above-mentioned methods when executed by the processor, the method comprising: parsing network data packets to obtain user behavior data; the user behavior data includes a user identity identifier and a user visited website; inputting the user behavior data into a latent factor model to obtain a website encoding coordination vector output by the latent factor model; splicing the main elements of the user visited website and its corresponding web page to obtain splicing information; inputting the splicing information into a trained web page content classification model to obtain a web page content type output by the trained web page content classification model; constructing a website index content representation vector based on the web page content type; splicing the website encoding coordination vector with the website index content representation vector to obtain a coordination embedding vector; inputting the coordination embedding vector into a trained large language model to obtain an abnormal judgment result output by the large language model; the abnormal judgment result includes at least one of whether it is abnormal, the abnormal type and the abnormal risk degree.

[0082] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0083] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for assessing abnormal risk of telecommunication users, characterized in that: include: Parse network data packets to obtain user behavior data; The user behavior data includes user identification and website addresses visited by the user; Inputting the user behavior data into a latent factor model to obtain a URL encoding synergy vector output by the latent factor model and used to represent the association relationship between the user identity identifier and the URL visited by the user; Splicing the URL visited by the user and the main elements of the corresponding web page to obtain splicing information; inputting the splicing information into the trained web page content classification model to obtain the web page content type output by the trained web page content classification model; Based on the webpage content type, construct a URL index content representation vector; Concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; The collaborative embedding vector is input into the trained large language model to obtain an abnormality judgment result for the user behavior data output by the large language model; the abnormality judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormality risk.

2. The method for assessing abnormal risk of telecommunication users according to claim 1, characterized in that: After the URL encoding collaborative vector is concatenated with the URL index content representation vector to obtain a collaborative embedding vector, the method further includes: Mapping the collaborative embedding vector into a binary sequence using a sign function; Grouping the binary sequence at equal intervals, and converting the grouped binary sequence into a user behavior index sequence in IP form; The step of inputting the collaborative embedding vector into the trained large language model to obtain an abnormality judgment result output by the large language model for the user behavior data includes: The user behavior index sequence in IP form is input into the trained large language model to obtain an abnormality judgment result for the user behavior data output by the large language model.

3. The method for assessing abnormal risk of telecommunication users according to claim 1, characterized in that: Before parsing the network data packet to obtain the user behavior data, the method further includes: The pre-trained large language model is fine-tuned based on the user behavior data of the sample users and the real state labels corresponding to the sample users, and the pre-trained large language model is semantically aligned using a preset instruction set to obtain the trained large language model.

4. The abnormal risk method for telecommunication users according to claim 3, characterized in that: The preset instruction set includes a first instruction set, each instruction in the preset instruction set being represented in the form of an instruction-response pair; The method of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: Generate the first instruction in the instruction-response pair using a template including a sequence of historically visited web addresses of a user sorted in chronological order, generate the first response in the instruction-response pair using a template including whether it is abnormal, the type of abnormality, and the degree of abnormality risk, and construct the first instruction set using a plurality of the first instructions and a plurality of the first responses; Based on the first instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

5. The abnormal risk method for telecommunication users according to claim 3, characterized in that: The preset instruction set includes a second instruction set, each instruction in the preset instruction set being represented in the form of an instruction-response pair; The method of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: Using part of the preset web page content prompt as a template to generate the second instruction in the instruction-response pair; the preset web page content prompt includes a website address, a title and text content contained in the website address, and an index corresponding to the web page; Using other prompts in the preset webpage content prompts except the part of prompts as a template to generate a second response in the command-response pair; constructing the second instruction set by using a plurality of the second instructions and a plurality of the second responses; Based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

6. The abnormal risk method for telecommunication users according to claim 3, characterized in that: The preset instruction set includes a third instruction set; the method of obtaining the trained large language model by semantically aligning the pre-trained large language model using the preset instruction set includes: Based on the third instruction set, fine-tune the pre-trained large language model to generate the trained large language model; Among them, each instruction in the third instruction set is expressed in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, and URL; several third responses in the third instruction set are responses of any desired style.

7. The abnormal risk method for telecommunication users according to claim 3, characterized in that: The preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; The method of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: Generate a fourth instruction in the instruction-response pair using a template including user behavior or user intention, generate a fourth response in the instruction-response pair using a template including whether it is abnormal, the type of abnormality, and the degree of abnormal risk, and construct the fourth instruction set with multiple fourth instructions and multiple fourth responses; Based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

8. The abnormal risk method for telecommunication users according to any one of claims 4 to 7, characterized in that: The step of fine-tuning the pre-trained large language model to generate the trained large language model includes: The target loss value between the output sequence of the pre-trained large language model and the true label sequence is determined based on a preset loss function; the preset loss function L is: ； in, represents a pair of command-response pairs in a batch of data and the target output corresponding to each piece of data in the batch of data, is the target output The jth word in express All previous words; Adjusting the network parameters in the pre-trained large language model according to the target loss value until a training end condition is met, thereby obtaining the trained large language model; The real label sequence is a sequence corresponding to the response form in the form of the command-response pair.

9. A telecommunications user abnormal risk assessment device, characterized in that: include: The data packet parsing module is used to parse the network data packet to obtain user behavior data; the user behavior data includes the user identity and the website visited by the user; A website encoding synergy vector generation module, used for inputting the user behavior data into a latent factor model to obtain a website encoding synergy vector output by the latent factor model and used for representing the association relationship between the user identity identifier and the website visited by the user; The webpage content classification module is used to splice the URL visited by the user and the main elements of the corresponding webpage to obtain splicing information; input the splicing information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model; A URL index content representation vector construction module, used to construct a URL index content representation vector based on the web page content type; A collaborative embedding vector concatenation module, used for concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; The abnormal risk prediction module is used to input the collaborative embedding vector into the trained large language model to obtain the abnormal judgment result of the large language model for the user behavior data; the abnormal judgment result includes at least one of whether it is abnormal, the type of abnormality and the degree of abnormal risk.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the abnormal risk assessment method for telecommunication users according to any one of claims 1 to 8 is implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal risk assessment method for telecommunication users as claimed in any one of claims 1 to 8 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal risk assessment method for telecommunication users as claimed in any one of claims 1 to 8 is implemented.

Images