Methods, devices, equipment, media, and products for assessing abnormal risks of telecommunications users

Abstract

This invention provides a method, apparatus, device, medium, and product for assessing anomaly risks of telecommunications users. The method includes: parsing network data packets to obtain user behavior data; generating a URL encoding collaborative vector based on the user behavior data; concatenating the user-accessed URL and its corresponding webpage's main elements and inputting the concatenation into a webpage content classification model to obtain the webpage content type; constructing a URL index content representation vector based on the webpage content type; concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; and inputting the collaborative embedding vector into a large language model to obtain anomaly judgment results. This method can fully mine URL information and webpage content information in user behavior data. Compared with traditional statistical information that only considers user behavior data, this application also fully mines the semantic information, improving the accuracy of anomaly identification and helping to discover potential new abnormal access patterns.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, equipment, medium, and product for assessing abnormal risks of telecommunications users. Background Technology

[0002] In recent years, the forms of abnormal behaviors in telecommunications networks have become increasingly diverse, and the initiators of these behaviors use a variety of technical means, making them difficult to prevent and greatly increasing the difficulty of detecting anomalies.

[0003] Due to concerns about the security of users' personal information, it is currently impossible to directly obtain users' personal information. Therefore, the current risk assessment of abnormal behavior in telecommunications users is mainly carried out through machine learning algorithms combined with information such as user behavior data. However, these methods often only consider the statistical characteristics of user behavior, and the judgment results of abnormal behavior are not accurate enough and cannot adapt to the identification of diverse abnormal behaviors. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for assessing abnormal risks of telecommunications users, which solves the technical problem that existing methods for assessing abnormal risks of telecommunications users only consider the statistical characteristics of user behavior and cannot adapt to the identification of abnormal behaviors with diverse forms. This invention enables the mining of semantic information in user behavior, thereby accurately detecting and assessing the abnormal risks of telecommunications users' online behavior.

[0005] This invention provides a method for assessing abnormal risks of telecommunications users, comprising the following steps:

[0006] Parse network data packets to obtain user behavior data; the user behavior data includes user identification and user-accessed URLs.

[0007] The user behavior data is input into the latent factor model to obtain the URL encoding co-vector output by the latent factor model;

[0008] The user's access URL and its corresponding webpage's main elements are concatenated to obtain concatenated information; the concatenated information is then input into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model.

[0009] Based on the webpage content type, construct a URL index content representation vector;

[0010] The URL encoding collaborative vector is concatenated with the URL index content representation vector to obtain a collaborative embedding vector;

[0011] The collaborative embedding vector is input into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

[0012] According to a telecommunications user anomaly risk assessment method provided by the present invention, after concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector, the method further includes:

[0013] The cooperative embedding vector is mapped to a binary sequence using a sign function;

[0014] The binary sequence is divided into equally spaced groups, and the grouped binary sequence is converted into a user behavior index sequence in IP form;

[0015] The step of inputting the collaborative embedding vector into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data includes:

[0016] The user behavior index sequence in IP form is input into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data.

[0017] According to a method for assessing abnormal risks of telecommunications users provided by the present invention, before parsing network data packets to obtain user behavior data, the method further includes:

[0018] The pre-trained large language model is fine-tuned based on the sample user behavior index sequence and the real state label corresponding to the sample user. Then, the trained large language model is obtained by semantically aligning the fine-tuned large language model with a preset instruction set.

[0019] According to a method for detecting abnormal telecommunications user activity provided by the present invention, the preset instruction set includes a first instruction set, wherein each instruction in the preset instruction set is represented in the form of an instruction-response pair; the step of obtaining the trained large language model by semantically aligning the pre-trained large language model using the preset instruction set includes:

[0020] The first instruction in the instruction-response pair is generated using a template containing a sequence of user historical access URLs ordered chronologically. The first response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The first instruction set is constructed by multiple first instructions and multiple first responses.

[0021] Based on the first instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0022] According to a method for detecting abnormal telecommunications user activity provided by the present invention, the preset instruction set includes a second instruction set, wherein each instruction in the preset instruction set is represented in the form of an instruction-response pair; the step of obtaining the trained large language model by semantically aligning the pre-trained large language model using the preset instruction set includes:

[0023] The second instruction in the instruction-response pair is generated using a portion of the prompts in the preset webpage content prompts as a template; the preset webpage content prompts include a URL, a title and text content contained in the URL, and the index corresponding to the webpage;

[0024] The second response in the instruction-response pair is generated using the other prompts in the preset webpage content prompts, excluding the aforementioned prompts, as a template.

[0025] The second instruction set is constructed by multiple second instructions and multiple second responses;

[0026] Based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0027] According to a method for detecting abnormal telecommunications user activity provided by the present invention, the preset instruction set includes a third instruction set; the step of obtaining the trained large language model by semantically aligning the pre-trained large language model using the preset instruction set includes:

[0028] Based on the third instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0029] Each instruction in the third instruction set is represented in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, or URL; several third responses in the third instruction set are responses of any desired style.

[0030] According to a method for detecting abnormal telecommunications user activity provided by the present invention, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; the step of obtaining the trained large language model by semantically aligning the pre-trained large language model using the preset instruction set includes:

[0031] The fourth instruction in the instruction-response pair is generated using a template containing user behavior or user intent, and the fourth response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The fourth instruction set is constructed by multiple fourth instructions and multiple fourth responses.

[0032] Based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0033] According to a method for detecting abnormal telecommunications user activity provided by the present invention, the step of fine-tuning the pre-trained large language model to generate the trained large language model includes:

[0034] The target loss value between the output sequence of the pre-trained large language model and the real label sequence is determined based on a preset loss function; the preset loss function L is:

[0035] ;

[0036] in, This represents a pair of instruction-response pairs in a batch of data and the target output corresponding to each piece of data in that batch. The target output The j-th word element in express All previous lexical units;

[0037] The network parameters in the pre-trained large language model are adjusted according to the target loss value until the training termination condition is met, thus obtaining the fine-tuned large language model.

[0038] The real label sequence is the sequence corresponding to the response form in the instruction-response pair.

[0039] The present invention also provides a telecommunications user anomaly risk assessment device, comprising:

[0040] The data packet parsing module is used to parse network data packets to obtain user behavior data; the user behavior data includes user identification and user accessed URLs.

[0041] The URL encoding collaborative vector generation module is used to input the user behavior data into the latent factor model to obtain the URL encoding collaborative vector output by the latent factor model.

[0042] The webpage content classification module is used to concatenate the user-accessed URL and the main elements of the corresponding webpage to obtain concatenated information; and input the concatenated information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model.

[0043] The URL index content representation vector construction module is used to construct a URL index content representation vector based on the webpage content type.

[0044] The collaborative embedding vector concatenation module is used to concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector;

[0045] An anomaly risk prediction module is used to input the collaborative embedding vector into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

[0046] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the telecommunications user anomaly risk assessment method as described above.

[0047] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the telecommunications user anomaly risk assessment method as described above.

[0048] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the telecommunications user anomaly risk assessment method as described above.

[0049] The present invention provides a method, apparatus, device, medium, and product for assessing anomaly risks of telecommunications users. This method obtains user behavior data by parsing network data packets. The user behavior data includes user identification and the URL visited by the user. The user behavior data is input into a latent factor model to obtain a URL encoding collaborative vector output by the latent factor model. The user's visited URL and its corresponding webpage's main elements are concatenated to obtain concatenated information. This concatenated information is input into a trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model. Based on the webpage content type, a URL index content representation vector is constructed. The URL encoding collaborative vector and the URL index content representation vector are concatenated to obtain a collaborative embedding vector. The collaborative embedding vector is input into a trained large language model to obtain an anomaly judgment result output by the large language model. The anomaly judgment result includes at least one of whether an anomaly is detected, the anomaly type, and the degree of anomaly risk. This method leverages the powerful generalization ability of generative models to directly generate anomaly risk assessment results based on user behavior data (including the content of URLs visited by users). It fully mines URL and webpage content information from user behavior data. Compared to traditional methods that only consider statistical information from user behavior data, this application also fully mines semantic information, improving the accuracy of anomaly identification and helping to discover potential new anomaly access patterns. Furthermore, this application constructs a URL-encoded collaborative vector representing the relationship between users and accessed addresses, and a URL index content representation vector associating user access addresses with webpage content, based on user behavior data. Concatenating these two vectors achieves compressed representation of URLs and webpage content, and enables precise input construction of a large language model. This allows for the extraction of standardized and accurate information from network data packets, resulting in accurate anomaly judgment results. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating the telecommunications user anomaly risk assessment method provided by the present invention.

[0052] Figure 2 This is a schematic diagram of the sequence of user interaction behavior data provided by the present invention.

[0053] Figure 3 This is a schematic diagram of the user behavior data processing flow of the collaborative model provided by the present invention.

[0054] Figure 4 This is a schematic diagram of the structure of the telecommunications user anomaly risk assessment device provided by the present invention.

[0055] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0057] The following is combined Figures 1-5 Specific embodiments of the present invention are described below.

[0058] Figure 1 This is a flowchart illustrating the telecommunications user anomaly risk assessment method provided by the present invention, as follows: Figure 1 As shown, the method includes the following.

[0059] Step 101: Parse network data packets to obtain user behavior data; the user behavior data includes user identity identifier and user access URL.

[0060] In TCP / IP communication, a network packet is the unit of data transmission. User behavior data refers to the interactive behavior data generated by users while browsing the internet, such as records of actions like visiting websites, API redirects, downloading apps, loading official website resources, screen sharing, and accessing bank accounts. Figure 2 As shown, Figure 2 This is a sequence diagram of user interaction behavior data, which includes user identity document (i.e., user ID) and user access URL (i.e., URL, Uniform Resource Locator).

[0061] Specifically, this application is mainly used in actual business to detect abnormal user behavior during internet access. Abnormal behavior includes actions that do not conform to regulations and affect the security of the entire network environment. First, network data packets are acquired and parsed using DPI (Deep Packet Inspection) technology to obtain user behavior data, including unstructured data such as user interaction records (e.g., website visits, app downloads). The user behavior data extracted using DPI can be represented in the data format shown in Table 1 below.

[0062] Table 1

[0063]

[0064] Step 102: Input the user behavior data into the latent factor model to obtain the URL encoding collaborative vector output by the latent factor model.

[0065] Among them, URL-encoded collaborative vectors refer to coded data obtained by fusing multimodal data such as URLs and user identifiers, and are generally used in the feature extraction process. Latent Factor Model (LDM) is a common data dimensionality reduction technique that can represent high-dimensional data as factor decompositions in a low-dimensional feature space.

[0066] In step 102, based on the aforementioned user behavior data, a collaborative model is first used to construct the interaction relationship between the user (User ID) and the URL visited by the user. The collaborative model is as follows: Figure 3 As shown, for the user behavior data in Table 1 above, the interaction record of user 1 accessing URL 2 appears in DPI, so a directed connection is made between user 1 and URL 2. Then, the above interaction relationship table is analyzed using the traditional latent factor model to obtain the vector representation of the relationship between user ID and URL, and the URL is used to encode the collaborative vector. Step 102 can be described by the following expression:

[0067] ;

[0068] in, Indicates A collaborative model with parameters; It is a d-dimensional embedding vector of URL encoding coordination information (i.e., URL encoding coordination vector).

[0069] Step 103: Concatenate the user-accessed URL and the main elements of the corresponding webpage to obtain concatenated information; input the concatenated information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model.

[0070] Among them, webpage content type refers to the classification of webpage content corresponding to the URL accessed by the user, such as conference, personal information, customer service, etc.

[0071] Specifically, the URL string, title, and description (i.e., the text content of the HTML page source code tags, i.e., the main elements of the page) are concatenated to obtain the concatenated information. This concatenated information is then input into a trained webpage content classification model to obtain the webpage content type. The trained webpage content classification model is based on a BERT-based model (including but not limited to BERT, RoBERTa, XLM-RoBERTa, etc.), and the URL content classification labels are obtained by fine-tuning the parameters of the BERT-based model. The main function of the BERT model is to learn language representations, understand the contextual information of language, and generate high-quality language representations.

[0072] Step 104: Based on the webpage content type, construct a URL index content representation vector.

[0073] Specifically, the BERT model can generate a text representation of a URL based on the user's accessed URL string, title, and description. This text representation can be in vector form, thus obtaining the embedding vector with the [CLS] tag. That is, the URL index content representation vector The [CLS] tag is an abbreviation for "Classification" and is used to indicate the main idea or central theme of a sentence.

[0074] Step 105, the URL encoding cooperative vector With the URL index content representation vector Concatenate the vectors to obtain the collaborative embedding vectors. .

[0075] Specifically, the two types of vector representations mentioned above are concatenated to obtain a collaborative embedding vector. .

[0076] Step 106, the collaborative embedding vector The data is input into a trained large language model to obtain an anomaly judgment result for the user behavior data output by the large language model; the anomaly judgment result includes at least one of whether it is abnormal, the type of anomaly, and the degree of anomaly risk.

[0077] Specifically, the aforementioned collaborative embedding vectors The input is fed into a trained Large Language Model (LLM) to obtain the anomaly judgment result output by the LLM, such as "There is an abnormal risk, the type of abnormal risk is financial behavior, and the level of risk is high". Since LLMs are generally trained on a large amount of training data, to perform specific tasks, they only need to be fine-tuned using a dataset specific to that domain. Therefore, the LLM used in this application, capable of performing specific tasks, is obtained by fine-tuning the model parameters of an existing LLM based on the sample user behavior index sequence of sample users and the corresponding real state labels of these sample users (including at least one of whether it is abnormal, the type of abnormality, and the level of abnormal risk). Furthermore, since LLMs are generally generative models, meaning they can generate innovative text based on known information but may generate text that does not conform to human preferences, the fine-tuned LLM also performs semantic alignment on a preset instruction set to align with expressions of human preferences, ensuring that it can output standardized judgment results according to preset prompts.

[0078] The above embodiments obtain user behavior data by parsing network data packets. The user behavior data includes user identification and the URLs visited by the user. The user behavior data is input into a latent factor model to obtain a URL encoding co-vector output by the latent factor model. The URLs visited by the user and the main elements of their corresponding web pages are concatenated to obtain concatenated information. This concatenated information is input into a trained web page content classification model to obtain the web page content type output by the trained web page content classification model. Based on the web page content type, a URL index content representation vector is constructed. The URL encoding co-vector and the URL index content representation vector are concatenated to obtain a co-embedding vector. The co-embedding vector is input into a trained large language model to obtain an anomaly judgment result output by the large language model. The anomaly judgment result includes at least one of whether it is an anomaly, the anomaly type, and the anomaly risk level. This method utilizes the powerful generalization ability of generative models to directly generate anomaly risk assessment results based on user behavior data (including the content of the URLs visited by the user). It fully mines the URL information and web page content information in the user behavior data. Compared with traditional statistical information that only considers user behavior data, this application also fully mines the semantic information, improving the accuracy of anomaly identification and helping to discover potential new anomaly access patterns. Furthermore, this application constructs a URL-encoded collaborative vector representing the relationship between users and access addresses based on user behavior data, as well as a URL index content representation vector associating user access addresses with webpage content. This achieves accurate input construction for large language models, enabling the extraction of standardized and precise information from network data packets, avoiding cumbersome feature engineering and traditional classification algorithm steps, thereby outputting accurate anomaly detection results. Moreover, this approach abandons the practice of directly using the original URL or ID as input, instead employing a compressed vector-based method to construct the index. This method not only solves the problem that large models are not adept at handling long sequence inputs but also ensures that the index can capture the potential semantic relationships between user access information.

[0079] In one embodiment, after step 105 above, this application further uses a fully connected layer to embed the collaborative embedding vector. The data is mapped to a suitable space so that it can be subsequently converted into a binary sequence. Specifically, after step 105 above, the following steps (1)-(2) are also included:

[0080] (1) Using a symbolic function to embed the cooperative embedding vector Mapped to a binary sequence;

[0081] ;

[0082] in, The binary representation of URL encoding collaboration information. , For the weights and biases of the fully connected layer, For activation function, It is a symbolic function.

[0083] (2) The binary sequence is divided into equally spaced groups, and the grouped data sequence is converted into a user behavior index sequence in IP form.

[0084] Specifically, at this point, we have converted the URL embedding vector into a binary representation, which can be directly input into an LLM (Large Language Model). However, the binary sequence is quite long, which is not conducive to processing large models. Therefore, this proposal considers further compressing the binary sequence and constructing a compression function. .

[0085] ;

[0086] Specifically, we group the binary sequence into 8-bit groups, convert it from binary to decimal, and use "." as the separator. For example, "10101100 / 00010000 / 11111110 / 00000011" can be compressed to "172.16.254.3". Since the original training corpus of the large language model contains a large amount of IP information, the method in this application can preserve the converted vector. (i.e., user behavior index sequence in IP form) Semantic features can be understood by LLM.

[0087] Step 106 above includes: inputting the user behavior index sequence in the form of IP into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

[0088] Specifically, the user behavior index sequence in the form of the above IP, such as "172.16.254.3", is input into the trained Large Language Model (LLM) to obtain the anomaly judgment result output by the Large Language Model, such as "There is an abnormal risk, the type of abnormal risk is financial management behavior, and the risk level is high".

[0089] The above embodiments concatenate and compress the URL encoding co-vector and the URL index content representation vector to generate a user behavior index sequence in IP form. This achieves a compressed representation of URLs and webpage content, enabling the input data of the large language model to adapt to the existing large language model's IP address parsing capabilities. The existing pre-trained large language model can be used directly without excessive training and annotation, improving the recognition accuracy of the large language model for user behavior data and increasing the development efficiency of the large language model for this specific task.

[0090] In one embodiment, before step 101, the method further includes: fine-tuning the pre-trained large language model based on the user behavior data of the sample users and the real state labels corresponding to the sample users, and obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set.

[0091] This application also designs a series of task-specific fine-tuning processes, including but not limited to autoregressive generation tasks, semantic similarity tasks, and user intent-based prediction tasks, to enhance LLM's ability to understand anomalous risk signals. By adding semantic alignment tasks to the fine-tuning process, the model is encouraged to better match the linguistic semantics captured in user behavior data with actual anomalous behavior patterns, thereby improving the model's accuracy in identifying user anomalous behavior risks.

[0092] In one embodiment, the aforementioned preset instruction set includes a first instruction set, where each instruction in the preset instruction set is represented in the form of an instruction-response pair. Before step 101, the method further includes: semantically aligning the pre-trained large language model using the preset instruction set to obtain the trained large language model. Specifically, this includes: generating a first instruction in the instruction-response pair using a template containing a sequence of user historical access URLs ordered chronologically; generating a first response in the instruction-response pair using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk; constructing the first instruction set using multiple first instructions and multiple first responses; and fine-tuning the pre-trained large language model based on the first instruction set to generate the trained large language model.

[0093] Specifically, since the method proposed in this application is based on LLM-based generative anomaly risk prediction, a sequence anomaly risk prediction alignment is designed as the main task of semantic alignment optimization. In this main task, anomaly type and risk level are considered as the main optimization indicators. Specifically, a personalized instruction (i.e., the first instruction) is constructed based on the user's current historical DPI online interaction behavior. The LLM predicts the possible anomaly type and anomaly risk level of the user based on the first instruction and historical behavior prompts. In this fine-tuning process, the user's historical interaction behavior obtained from the DPI is generated into a user behavior index sequence in IP form, which is arranged in chronological order, according to the template containing the user's historical access URL sequence. This IP form user behavior index sequence is used as an embedded vector as the input of the large language model, and the final output is a response generated according to the template containing whether it is an anomaly, the anomaly type, and the anomaly risk level. An example of the form of an instruction-response pair in the first instruction set is shown in Table 2 below:

[0094] Table 2

[0095]

[0096] The above embodiments, by designing a first instruction that sorts the user's historical access URLs in chronological order, and a first instruction set that includes anomaly risk and risk level, perform semantic alignment optimization on the pre-trained large language model. This enables the large language model to more accurately capture the matching degree between the user's access URLs and the anomaly risk, and output risk prediction results that conform to human expectations. This is beneficial for the subsequent unified collection and further unified processing of these data.

[0097] In one embodiment, the aforementioned preset instruction set includes a second instruction set, and each instruction in the aforementioned preset instruction set is represented in the form of an instruction-response pair; before step 101, the method further includes: semantically aligning the pre-trained large language model using the preset instruction set to obtain the trained large language model, specifically including:

[0098] The second instruction in the instruction-response pair is generated using a portion of the prompts in the preset webpage content prompts as templates; the preset webpage content prompts include a URL, a title and text content contained in the URL, and the index corresponding to the webpage; the second response in the instruction-response pair is generated using the other prompts in the preset webpage content prompts excluding the aforementioned portion as templates; a second instruction set is constructed using multiple second instructions and multiple second responses; based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0099] Specifically, in this embodiment, one of the auxiliary tasks for semantic alignment optimization is designed: URL content description alignment. First, the LLM is instructed to generate a corresponding URL index based on one or more combinations of the URL's title / text content. Then, the LLM is instructed to recover the URL's content information based on its index, essentially similar to a cross-modal semantic alignment task. Examples of the instruction-response pair formats in the second instruction set are shown in Table 3 below:

[0100] Table 3

[0101]

[0102] The above embodiments fine-tune the parameters in the large language model by utilizing the matching relationship between URLs, webpage content, and user behavior index sequences in the form of IP addresses, making the generated text content more accurate.

[0103] In one embodiment, the preset instruction set includes a third instruction set; prior to step 101, the method further includes: semantically aligning the pre-trained large language model using the preset instruction set to obtain the trained large language model, specifically including: fine-tuning the pre-trained large language model based on the third instruction set to generate the trained large language model; wherein, each instruction in the third instruction set is represented in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of URL title, URL text content, or URL; several third responses in the third instruction set are responses of any desired style.

[0104] Specifically, in this embodiment, a second auxiliary task for the semantic optimization task is designed: hybrid sequence prediction alignment. For the sequence abnormal behavior risk prediction alignment task, to further enhance semantic alignment, the difficulty of prediction is increased by changing the representation of the conditions and the target, thereby deriving different semantic representation combinations of the URL. In particular, this proposal considers the following three representation methods: (1) replacing the URL index with the URL title, instructing the LLM to generate the desired output; (2) replacing the URL index with the URL text content, instructing the LLM to generate the desired output; (3) replacing the URL index with the URL URL, instructing the LLM to generate the desired output.

[0105] The above embodiments, by replacing the URL index with the URL title, URL text content, or URL in the instructions, and making it output abnormal risks, adapt to different content outputs and generate accurate risk prediction results, thereby improving the generalization ability of the large language model in abnormal risk prediction tasks.

[0106] In one embodiment, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; before step 101 above, the method further includes: semantically aligning the pre-trained large language model with the preset instruction set to obtain the trained large language model, specifically including: generating a fourth instruction in the instruction-response pair using a template containing user behavior or user intent, generating a fourth response in the instruction-response pair using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk, constructing the fourth instruction set with multiple fourth instructions and multiple fourth responses; and fine-tuning the pre-trained large language model based on the fourth instruction set to generate the trained large language model.

[0107] Specifically, in this embodiment, a third auxiliary task for semantic optimization is designed: prediction alignment based on user behavioral intent. In the real world, abnormal user access behavior is often related to their own behavioral intent, and this model should have the ability to understand the user's actual behavior, thereby providing higher quality anomaly prediction results. Examples of the instruction-response pair forms in the fourth instruction set are shown in Table 4 below:

[0108] Table 4

[0109]

[0110] The above embodiments, by designing the relationship between user behavior intent and risk prediction results, enable the large model to output the prediction results desired by the user based on user prompts, thereby improving the model's adaptability.

[0111] In one embodiment, the above-mentioned fine-tuning of the pre-trained large language model to generate the trained large language model includes:

[0112] The target loss value between the output sequence of the pre-trained large language model and the real label sequence is determined based on a preset loss function.

[0113] The preset loss function L is:

[0114] ;

[0115] in, This represents a pair of instruction-response pairs I in a batch of data and the target output Y corresponding to each data item in that batch of data. The target output The j-th word element in express All previous lexical units;

[0116] The network parameters in the pre-trained large language model are adjusted according to the target loss value until the training termination condition is met, thus obtaining the trained large language model.

[0117] The real label sequence is the sequence corresponding to the response form in the instruction-response pair.

[0118] Specifically, this application formats the tuning task into a conditional language generation task in a sequence-to-sequence manner, and its objective function is:

[0119] ;

[0120] Here, represents an instruction-response pair and target output in a batch of data, is the j-th token, and represents the previous tokens.

[0121] The user behavior index sequence, after vectorization and alignment optimization, is input into the large language model that has been fine-tuned by the previous step. The model generates outputs reflecting the risk of abnormal user behavior (whether it is abnormal, the type of abnormal behavior, the degree of risk, etc.) based on the semantically consistent and discriminative URL index sequence.

[0122] The above embodiments continuously optimize model parameters by comparing the differences between the anomaly prediction results generated by the model and the actual labels, enabling the model to more accurately identify potential abnormal behavior patterns from a large amount of user behavior data.

[0123] The following describes the telecommunications user anomaly risk assessment device provided by the present invention. The telecommunications user anomaly risk assessment device described below can be referred to in correspondence with the telecommunications user anomaly risk assessment method described above.

[0124] like Figure 4 As shown, a telecommunications user anomaly risk assessment device is provided, the device comprising:

[0125] The data packet parsing module 401 is used to parse network data packets to obtain user behavior data; the user behavior data includes user identification and user accessed URLs.

[0126] The URL encoding collaborative vector generation module 402 is used to input the user behavior data into the latent factor model to obtain the URL encoding collaborative vector output by the latent factor model, which represents the association between the user identity and the URL accessed by the user.

[0127] The webpage content classification module 403 is used to concatenate the user-accessed URL and the main elements of the corresponding webpage to obtain concatenated information; and input the concatenated information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model.

[0128] The URL index content representation vector construction module 404 is used to construct a URL index content representation vector based on the webpage content type.

[0129] The collaborative embedding vector concatenation module 405 is used to concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector;

[0130] Anomaly risk prediction module 406 is used to input the collaborative embedding vector into the trained large language model to obtain the anomaly judgment result output by the large language model; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

[0131] In one embodiment, the system further includes a user behavior index sequence generation unit, configured to: map the cooperative embedding vector into a binary sequence using a symbolic function; group the binary sequence into equally spaced groups; and convert the grouped binary sequences into a user behavior index sequence in IP form.

[0132] The aforementioned abnormal risk prediction module 406 is further configured to: input the user behavior index sequence in IP form into the trained large language model to obtain the abnormal judgment result of the large language model for the user behavior data.

[0133] In one embodiment, the system further includes a model training unit, configured to: fine-tune a pre-trained large language model based on user behavior data of sample users and the real state labels corresponding to the sample users; and obtain the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set.

[0134] In one embodiment, the preset instruction set includes a first instruction set, wherein each instruction in the preset instruction set is represented in the form of an instruction-response pair; the aforementioned model training unit is further configured to:

[0135] The first instruction in the instruction-response pair is generated using a template containing a sequence of user historical access URLs ordered chronologically. The first response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The first instruction set is constructed using multiple first instructions and multiple first responses. Based on the first instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0136] In one embodiment, the preset instruction set includes a second instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; the above-mentioned model training unit is further used for:

[0137] The second instruction in the instruction-response pair is generated using a portion of the prompts in the preset webpage content prompts as templates; the preset webpage content prompts include a URL, a title and text content contained in the URL, and the index corresponding to the webpage; the second response in the instruction-response pair is generated using the other prompts in the preset webpage content prompts excluding the aforementioned portion as templates; a second instruction set is constructed using multiple second instructions and multiple second responses; based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0138] In one embodiment, the preset instruction set includes a third instruction set; the aforementioned model training unit is further configured to:

[0139] Based on the third instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model; wherein, each instruction in the third instruction set is represented in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, or URL; several third responses in the third instruction set are responses of any desired style.

[0140] In one embodiment, the preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; the aforementioned model training unit is further configured to:

[0141] The fourth instruction in the instruction-response pair is generated using a template containing user behavior or user intent, and the fourth response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The fourth instruction set is constructed by multiple fourth instructions and multiple fourth responses. Based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

[0142] In one embodiment, the model training unit is further configured to:

[0143] The target loss value between the output sequence of the pre-trained large language model and the real label sequence is determined based on a preset loss function; the preset loss function L is:

[0144] ;

[0145] in, This represents a pair of instruction-response pairs in a batch of data and the target output corresponding to each piece of data in that batch. The target output The j-th word element in express All previous lexical units;

[0146] The network parameters in the pre-trained large language model are adjusted according to the target loss value until the training termination condition is met, thus obtaining the trained large language model; wherein, the real label sequence is a sequence corresponding to the response form in the instruction-response pair form.

[0147] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can call logical instructions in the memory 530 to execute a telecommunications user anomaly risk assessment method. This method includes: parsing network data packets to obtain user behavior data; the user behavior data includes user identification and the URL accessed by the user; inputting the user behavior data into a latent factor model to obtain a URL encoding co-vector output by the latent factor model; concatenating the user's accessed URL and the main elements of its corresponding webpage to obtain concatenated information; inputting the concatenated information into a trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model; constructing a URL index content representation vector based on the webpage content type; concatenating the URL encoding co-vector with the URL index content representation vector to obtain a co-embedding vector; and inputting the co-embedding vector into a trained large language model to obtain an anomaly judgment result output by the large language model. The anomaly judgment result includes at least one of whether it is anomaly, anomaly type, and anomaly risk level.

[0148] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the telecommunications user anomaly risk assessment method provided by the above methods. The method includes: parsing network data packets to obtain user behavior data; the user behavior data includes user identification and user access URLs; inputting the user behavior data into a latent factor model to obtain a URL encoding collaborative vector output by the latent factor model; concatenating the user access URL and the main elements of the corresponding webpage to obtain concatenated information; inputting the concatenated information into a trained webpage content classification model to obtain a webpage content type output by the trained webpage content classification model; constructing a URL index content representation vector based on the webpage content type; concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; inputting the collaborative embedding vector into a trained large language model to obtain an anomaly judgment result output by the large language model; the anomaly judgment result includes at least one of whether it is anomaly, anomaly type, and anomaly risk level.

[0150] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the telecommunications user anomaly risk assessment method provided by the above methods. The method includes: parsing network data packets to obtain user behavior data; the user behavior data includes user identification and user access URLs; inputting the user behavior data into a latent factor model to obtain a URL encoding collaborative vector output by the latent factor model; concatenating the user access URL and the main elements of the corresponding webpage to obtain concatenated information; inputting the concatenated information into a trained webpage content classification model to obtain a webpage content type output by the trained webpage content classification model; constructing a URL index content representation vector based on the webpage content type; concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; inputting the collaborative embedding vector into a trained large language model to obtain an anomaly judgment result output by the large language model; the anomaly judgment result includes at least one of whether it is anomaly, anomaly type, and anomaly risk level.

[0151] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for assessing abnormal risks of telecommunications users, characterized in that, include: Parse network data packets to obtain user behavior data; The user behavior data includes user identification and the URLs visited by the user; The user behavior data is input into the latent factor model to obtain a URL encoding co-vector output by the latent factor model, which represents the association between the user's identity and the URL accessed by the user. The user's access URL and its corresponding webpage's main elements are concatenated to obtain concatenated information; the concatenated information is then input into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model. Based on the webpage content type, construct a URL index content representation vector; The URL encoding collaborative vector is concatenated with the URL index content representation vector to obtain a collaborative embedding vector; The collaborative embedding vector is input into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

2. The method for assessing abnormal risks of telecommunications users according to claim 1, characterized in that, After concatenating the URL encoding collaborative vector with the URL index content representation vector to obtain the collaborative embedding vector, the method further includes: The cooperative embedding vector is mapped to a binary sequence using a symbolic function; The binary sequence is divided into equally spaced groups, and the grouped binary sequence is converted into a user behavior index sequence in IP form; The step of inputting the collaborative embedding vector into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data includes: The user behavior index sequence in IP form is input into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data.

3. The method for assessing abnormal risks of telecommunications users according to claim 1, characterized in that, Before parsing network data packets to obtain user behavior data, the process also includes: The pre-trained large language model is fine-tuned based on the user behavior data of the sample users and the real state labels corresponding to the sample users. Then, the pre-trained large language model is semantically aligned using a preset instruction set to obtain the trained large language model.

4. The method for detecting abnormal telecommunications user risks according to claim 3, characterized in that, The preset instruction set includes a first instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; The step of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: The first instruction in the instruction-response pair is generated using a template containing a sequence of user historical access URLs ordered chronologically. The first response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The first instruction set is constructed by multiple first instructions and multiple first responses. Based on the first instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

5. The method for detecting abnormal telecommunications user risks according to claim 3, characterized in that, The preset instruction set includes a second instruction set, and each instruction in the preset instruction set is represented in the form of an instruction-response pair; The step of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: The second instruction in the instruction-response pair is generated using a portion of the prompts in the preset webpage content prompts as a template; the preset webpage content prompts include a URL, a title and text content contained in the URL, and the index corresponding to the webpage; The second response in the instruction-response pair is generated using the other prompts in the preset webpage content prompts, excluding the aforementioned prompts, as a template. The second instruction set is constructed by multiple second instructions and multiple second responses; Based on the second instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

6. The method for detecting abnormal risks of telecommunications users according to claim 3, characterized in that, The preset instruction set includes a third instruction set; the step of semantically aligning the pre-trained large language model using the preset instruction set to obtain the trained large language model includes: Based on the third instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model. Each instruction in the third instruction set is represented in the form of an instruction-response pair; several third instructions in the third instruction set are obtained by replacing the URL index with any one of the URL title, URL text content, or URL; several third responses in the third instruction set are responses of any desired style.

7. The method for detecting abnormal telecommunications user risks according to claim 3, characterized in that, The preset instruction set includes a fourth instruction set; each instruction in the preset instruction set is represented in the form of an instruction-response pair; The step of obtaining the trained large language model by semantically aligning the pre-trained large language model using a preset instruction set includes: The fourth instruction in the instruction-response pair is generated using a template containing user behavior or user intent, and the fourth response in the instruction-response pair is generated using a template containing whether it is abnormal, the type of abnormality, and the degree of abnormality risk. The fourth instruction set is constructed by multiple fourth instructions and multiple fourth responses. Based on the fourth instruction set, the pre-trained large language model is fine-tuned to generate the trained large language model.

8. The method for detecting abnormal telecommunications user activity according to any one of claims 4 to 7, characterized in that, The step of fine-tuning the pre-trained large language model to generate the trained large language model includes: The target loss value between the output sequence of the pre-trained large-scale language model and the real label sequence is determined based on a preset loss function; the preset loss function L is: ； in, This represents a pair of instruction-response pairs in a batch of data and the target output corresponding to each piece of data in that batch. The target output The j-th word element in express All previous lexical units; The network parameters in the pre-trained large language model are adjusted according to the target loss value until the training termination condition is met, thus obtaining the trained large language model. The real label sequence is the sequence corresponding to the response form in the instruction-response pair.

9. A telecommunications user anomaly risk assessment device, characterized in that, include: The data packet parsing module is used to parse network data packets to obtain user behavior data; the user behavior data includes user identification and user accessed URLs. The URL encoding collaborative vector generation module is used to input the user behavior data into the latent factor model to obtain the URL encoding collaborative vector output by the latent factor model, which represents the association between the user's identity and the URL accessed by the user. The webpage content classification module is used to concatenate the user-accessed URL and the main elements of the corresponding webpage to obtain concatenated information; and input the concatenated information into the trained webpage content classification model to obtain the webpage content type output by the trained webpage content classification model. The URL index content representation vector construction module is used to construct a URL index content representation vector based on the webpage content type. The collaborative embedding vector concatenation module is used to concatenate the URL encoding collaborative vector with the URL index content representation vector to obtain a collaborative embedding vector; An anomaly risk prediction module is used to input the collaborative embedding vector into the trained large language model to obtain the anomaly judgment result of the large language model for the user behavior data; the anomaly judgment result includes at least one of whether it is abnormal, anomaly type, and anomaly risk level.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the telecommunications user anomaly risk assessment method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the telecommunications user anomaly risk assessment method as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the telecommunications user anomaly risk assessment method as described in any one of claims 1 to 8.

Images