Object behavior risk identification method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of big data, in particular to an object behavior risk identification method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring object behavior data of a to-be-identified object in different platforms; respectively extracting data features of the to-be-identified object in each platform from the object behavior data of each platform; respectively inputting the data features of the to-be-identified object in different platforms into the behavior risk identification model to obtain a behavior risk identification result of the to-be-identified object; the behavior risk identification model is obtained by performing model training processing based on data features of different objects on different platforms; and when the behavior risk identification result represents that the to-be-identified object is in the high-risk state, sending an early warning message to the to-be-identified object. With the adoption of the method, the potential false information aiming at cheating can be accurately identified, so that the identification accuracy and the protection effect of the false information aiming at cheating are improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a method, device, computer equipment and storage medium for identifying object behavior risks. Background Art

[0002] With the development of network technology and telecommunication technology, users are easily exposed to various types of false information for the purpose of deception. It is crucial to network security to promptly identify whether user behavior is at risk of being deceived before the user suffers a large loss or before the loss occurs.

[0003] Traditional protection technologies mainly include the following: detecting whether the website accessed by the user terminal is a fake website for the purpose of deception, detecting whether the incoming call is a fake call for the purpose of deception, and determining whether the software installed by the user is fake software for the purpose of deception.

[0004] However, traditional protection technologies are all based on analyzing and detecting relatively intuitive URLs, incoming calls, and software, and are unable to promptly detect potential false information in the form of non-URLs, incoming calls, and software that is intended to deceive. This results in low accuracy in identifying false information that is intended to deceive and poor protection effects. Summary of the invention

[0005] Based on this, it is necessary to provide an object behavior risk identification method, device, computer equipment, computer-readable storage medium and computer program product that can improve the recognition accuracy and protection effect of false information for the purpose of deception in response to the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a method for identifying behavior risks of an object. The method comprises:

[0007] Obtaining object behavior data of the object to be identified in different platforms;

[0008] Extract the data features of the object to be identified on each platform from the object behavior data on each platform;

[0009] The data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0010] When the behavior risk identification result indicates that the subject to be identified is in a high-risk state, a warning message is sent to the subject to be identified.

[0011] In one embodiment, obtaining object behavior data of an object to be identified in different platforms includes:

[0012] Obtaining the object identification of the object to be identified;

[0013] Based on the object identification, the object behavior data of the object to be identified in different platforms are obtained from the platform data stored in different platforms.

[0014] In one embodiment, data features of the object to be identified on each platform are extracted from the object behavior data on each platform, including:

[0015] For each platform, decrypt the object behavior data of the platform to obtain decrypted data;

[0016] The data features of the object to be identified on the platform are extracted from the decrypted data.

[0017] In one embodiment, the training process of the behavioral risk identification model includes:

[0018] Get the object identifiers stored in different platforms respectively;

[0019] By performing identity alignment processing on object identities stored in different platforms, identical object identities in different platforms are determined;

[0020] Use the same object identifier as a common identifier;

[0021] Obtain object behavior data corresponding to each shared identifier on different platforms;

[0022] Based on the object behavior data corresponding to each shared identifier on different platforms, the original model is iteratively optimized until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0023] In one embodiment, obtaining object behavior data corresponding to each common identifier on different platforms includes:

[0024] For each shared identifier, in response to data upload operations on different platforms, encrypted data carrying the shared identifier uploaded by different platforms are obtained; the encrypted data is obtained by encrypting the object behavior data carrying the shared identifier stored by different platforms respectively;

[0025] The encrypted data corresponding to the shared identifier on different platforms are decrypted respectively to obtain the object behavior data corresponding to the shared identifier on different platforms.

[0026] In one embodiment, based on the object behavior data corresponding to each common identifier on different platforms, the original model is iteratively optimized until the model optimization stop condition is reached, thereby obtaining a behavior risk identification model, including:

[0027] Divide the object behavior data corresponding to each shared identifier on different platforms into training samples, verification samples, and test samples;

[0028] Based on the training samples, the original model is trained to obtain multiple trained models;

[0029] Based on the verification sample, verify the recognition effect of the trained model, and determine at least one model to be optimized based on the verification result;

[0030] Based on the test samples, the model to be optimized is evaluated to obtain the evaluation results;

[0031] Based on the evaluation results, the model parameters in the model to be optimized are optimized until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0032] In a second aspect, the present application also provides a device for identifying risk of object behavior. The device comprises:

[0033] An object behavior data acquisition module is used to acquire the object behavior data of the object to be identified in different platforms;

[0034] A data feature extraction module is used to extract data features of the object to be identified on each platform from the object behavior data of each platform;

[0035] The recognition result acquisition module is used to input the data features of the object to be identified on different platforms into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0036] The warning message sending module is used to send a warning message to the object to be identified when the behavior risk identification result indicates that the object to be identified is in a high-risk state.

[0037] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0038] Obtaining object behavior data of the object to be identified in different platforms;

[0039] Extract the data features of the object to be identified on each platform from the object behavior data on each platform;

[0040] The data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0041] When the behavior risk identification result indicates that the subject to be identified is in a high-risk state, a warning message is sent to the subject to be identified.

[0042] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0043] Obtaining object behavior data of the object to be identified in different platforms;

[0044] Extract the data features of the object to be identified on each platform from the object behavior data on each platform;

[0045] The data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0046] When the behavior risk identification result indicates that the subject to be identified is in a high-risk state, a warning message is sent to the subject to be identified.

[0047] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0048] Obtaining object behavior data of the object to be identified in different platforms;

[0049] Extract the data features of the object to be identified on each platform from the object behavior data on each platform;

[0050] The data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0051] When the behavior risk identification result indicates that the subject to be identified is in a high-risk state, a warning message is sent to the subject to be identified.

[0052] The above-mentioned object behavior risk identification method, device, computer equipment, storage medium and computer program product first obtain the object behavior data of the object to be identified in different platforms. Since the dimensions of the data stored in different platforms are quite different, it is equivalent to first obtaining more comprehensive multi-dimensional data of the object to be identified, and then extracting the data features of the object to be identified on each platform from the object behavior data of each platform, so that the data features of the object to be identified on different platforms can be combined to more accurately identify false information with the purpose of deception. Then, the data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification result of the object to be identified, wherein the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms. Finally, when the behavior risk identification result indicates that the object to be identified is in a high-risk state, an early warning message is sent to the object to be identified. In the whole process, the more comprehensive multi-dimensional data features of the object to be identified can be combined to fully and comprehensively dig into the behavior of the object to be identified in different dimensions, so as to accurately identify potential false information with the purpose of deception, thereby improving the recognition accuracy and protection effect of false information with the purpose of deception. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] FIG1 is a diagram of an application environment of an object behavior risk identification method in one embodiment;

[0054] FIG2 is a schematic diagram of a flow chart of a method for identifying object behavior risks in one embodiment;

[0055] FIG3 is a schematic flow chart of a method for identifying object behavior risks in another embodiment;

[0056] FIG4 is a structural block diagram of an object behavior risk identification device in one embodiment;

[0057] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] The object behavior risk identification method provided in the embodiment of the present application can be applied to the application environment shown in FIG. 1. The terminal 102 communicates with the server 104 through the network, and the server 104 also communicates with different platforms through the network, wherein the different platforms include but are not limited to financial platforms, social platforms, etc. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 can first communicate with different platforms to obtain the object behavior data of the object to be identified in different platforms, and then extract the data features of the object to be identified in each platform from the object behavior data of each platform. Then, the server 104 can input the data features of the object to be identified on different platforms into the behavior risk identification model, and obtain the behavior risk identification result of the object to be identified, wherein the behavior risk identification model is obtained by the server 104 based on the data features of different objects on different platforms. Finally, when the behavior risk identification result indicates that the object to be identified is in a high-risk state, the server 104 can send an early warning message to the terminal 102 used by the object to be identified. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, portable wearable devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0060] In one embodiment, as shown in FIG. 2 , a method for identifying object behavior risks is provided, and the method is applied to the server in FIG. 1 as an example for explanation, including the following steps:

[0061] Step 202: Obtain object behavior data of the object to be identified in different platforms.

[0062] Different platforms include but are not limited to financial platforms and social platforms. Object behavior data include but are not limited to: resource transfer data of objects on financial platforms and social data of objects on social platforms, where social data include but are not limited to text interaction data, voice interaction data, image interaction data, link interaction data, etc. Object behavior data are obtained in a compliant manner with the authorization of the object.

[0063] Optionally, with full authorization from all parties, the server may communicate with different platforms through the network, and obtain object behavior data of the object to be identified in different platforms from the platform data stored in different platforms.

[0064] Step 204 , extracting data features of the object to be identified on each platform from the object behavior data on each platform.

[0065] Optionally, the server can extract the data features of the object to be identified on each platform from the object behavior data of each platform based on the feature extraction algorithm according to the feature extraction rules set for each platform. Different platforms correspond to different feature extraction rules, and the feature extraction rules set for the platform can be flexibly configured in combination with the platform type. Feature extraction algorithms include but are not limited to: Bag of Words, TF-IDF, Words2Vec, Document2Vec, etc.

[0066] Step 206, the data features of the object to be identified on different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification result of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms.

[0067] Among them, the behavioral risk identification results can specifically represent: whether the object to be identified has been exposed to potential false information for the purpose of deception, and the probability that the object to be identified has been deceived by false information for the purpose of deception.

[0068] Optionally, after extracting the data features of the object to be identified on each platform from the object behavior data of each platform, the server can call a pre-trained behavioral risk identification model, and input the data features of the object to be identified on different platforms into the behavioral risk identification model respectively to obtain the behavioral risk identification results of the object to be identified.

[0069] Step 208: When the behavior risk identification result indicates that the object to be identified is in a high-risk state, a warning message is sent to the object to be identified.

[0070] Among them, if the behavioral risk identification model calculates that the object to be identified has been exposed to potential false information for the purpose of deception, and the probability of the object to be identified being deceived by the false information for the purpose of deception is high, the behavioral risk identification result will output a behavioral risk identification result that indicates that the object to be identified is in a high-risk state.

[0071] Optionally, when the behavior risk identification result indicates that the object to be identified is in a high-risk state, the server may determine that the object to be identified is at risk of being deceived by false information intended for deception, and send a warning message to the object to be identified.

[0072] In the above-mentioned object behavior risk identification method, the object behavior data of the object to be identified in different platforms is first obtained. Since the dimensions of the data stored in different platforms are quite different, it is equivalent to first obtaining more comprehensive multi-dimensional data of the object to be identified, and then extracting the data features of the object to be identified in each platform from the object behavior data of each platform, so that the data features of the object to be identified in different platforms can be combined to more accurately identify false information with the purpose of deception. Then, the data features of the object to be identified in different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification result of the object to be identified, wherein the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms. Finally, when the behavior risk identification result indicates that the object to be identified is in a high-risk state, an early warning message is sent to the object to be identified. In the whole process, the more comprehensive multi-dimensional data features of the object to be identified can be combined to fully and comprehensively dig into the behavior of the object to be identified in different dimensions, so as to accurately identify potential false information with the purpose of deception, thereby improving the recognition accuracy and protection effect of false information with the purpose of deception.

[0073] In one embodiment, obtaining object behavior data of an object to be identified in different platforms includes:

[0074] Obtaining the object identification of the object to be identified;

[0075] Based on the object identification, the object behavior data of the object to be identified in different platforms are obtained from the platform data stored in different platforms.

[0076] The object identifier can be specifically the ID number of the object. Each object has its own unique object identifier. Each platform stores the object behavior data of the object according to the object identifier of the object. To ensure data security, the object behavior data is encrypted by the platform.

[0077] Optionally, the server can obtain the object identification of the object to be identified with the authorization of the object to be identified, and obtain the object behavior data of the object to be identified in different platforms from the platform data stored in different platforms based on the object identification by communicating with different platforms.

[0078] Exemplarily, the server can send the object identification of the object to be identified to different platforms. Each platform will perform data indexing on the platform data stored by each platform according to the received object identification, and obtain the object behavior data of the object to be identified in the platform data stored by each platform. Furthermore, each platform can respectively send the object behavior data retrieved by each platform to the server. The server can obtain the object behavior data of the object to be identified in different platforms based on the data fed back by different platforms.

[0079] For example, different platforms can encrypt the object behavior data indexed by the object identifier of the object to be identified, and then send the encrypted data to the server. The encryption processing methods include but are not limited to: RSA (asymmetric encryption algorithm), AES (symmetric encryption algorithm), MD5 (message digest algorithm version 5), etc.

[0080] In this embodiment, since the data dimensions stored in different platforms are quite different, obtaining the object behavior data of the object to be identified in different platforms is equivalent to obtaining more comprehensive multi-dimensional data of the object to be identified, so that the more comprehensive multi-dimensional data features of the object to be identified can be combined in the future to fully and comprehensively explore the behavior of the object to be identified in different dimensions, so as to accurately identify whether the object to be identified has been exposed to potential false information for the purpose of deception, thereby improving the recognition accuracy and protection effect of false information for the purpose of deception.

[0081] In one embodiment, data features of the object to be identified on each platform are extracted from the object behavior data on each platform, including:

[0082] For each platform, decrypt the object behavior data of the platform to obtain decrypted data;

[0083] The data features of the object to be identified on the platform are extracted from the decrypted data.

[0084] Optionally, for each platform, the server can determine the decryption processing method corresponding to the encryption processing method used by the platform according to the encryption processing method used by the platform, and based on the determined decryption processing method, decrypt the object behavior data of the platform to obtain the decrypted data corresponding to the object to be identified on the platform. Furthermore, the server can extract the data features of the object to be identified on the platform from the decrypted data based on the feature extraction algorithm according to the feature extraction rules set for the platform.

[0085] For example, taking a financial platform as an example, the server can extract features of the resource transfer data of the object to be identified on the financial platform based on the feature extraction algorithm according to the feature extraction rules set for the financial platform, and obtain the data features of the object to be identified on the financial platform. The data features of the object to be identified on the financial platform include but are not limited to: the fluctuation trend of the amount of resource transfer of the object to be identified within a preset time, and the total amount and frequency of resource transfer to the same object in a short period of time.

[0086] Exemplarily, taking a social platform as an example, the server can extract features of the social data of the object to be identified on the social platform based on the feature extraction algorithm according to the feature extraction rules set for the social platform, and obtain the data features of the object to be identified on the social platform. The data features of the object to be identified on the social platform include but are not limited to: keywords in the text interaction data between the object to be identified and other objects, keywords in the voice interaction data, key images in the image interaction data, key web page features in the link interaction data, and key installation packages in the file interaction data. Among them, keywords, key images, key web page features, and key installation packages represent: words, pictures, web page features, or installation packages are associated with false information for the purpose of deception.

[0087] In this embodiment, by performing feature extraction on the decrypted data obtained through the decryption process, data features of the object to be identified on different platforms are obtained, thereby achieving streamlined processing of the data so that the behavioral risk identification results of the object to be identified can be quickly analyzed based on the extracted data features.

[0088] In one embodiment, the training process of the behavioral risk identification model includes:

[0089] Get the object identifiers stored in different platforms respectively;

[0090] By performing identity alignment processing on object identities stored in different platforms, identical object identities in different platforms are determined;

[0091] Use the same object identifier as a common identifier;

[0092] Obtain object behavior data corresponding to each shared identifier on different platforms;

[0093] Based on the object behavior data corresponding to each shared identifier on different platforms, the original model is iteratively optimized until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0094] Specifically, the identification alignment process may be: comparing the object identifications of objects in different platforms to determine the same object identifications in different platforms. The model optimization stop condition may be flexibly configured according to actual needs. Specifically, the original model may be: a model built based on machine learning, which may identify whether the object has been exposed to false information for the purpose of deception based on the object behavior data, and predict the probability of the object being deceived by the false information.

[0095] Optionally, the server can communicate with different platforms to obtain the object identifiers stored in different platforms respectively, and align the object identifiers stored in different platforms to determine the same object identifiers in different platforms, and use the same object identifiers as shared identifiers. Furthermore, the server can send the shared identifiers to different platforms respectively, and the platforms will index the platform data stored in each platform based on the shared identifiers, and encrypt the indexed data and send it to the server, so that the server can obtain the encrypted data corresponding to each shared identifier on different platforms. Then, the server can decrypt the obtained encrypted data to obtain the object behavior data corresponding to each shared identifier on different platforms, and then iteratively optimize the original model based on the object behavior data corresponding to each shared identifier on different platforms until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0096] For example, objects (users) on different platforms are not completely overlapped, and the object has fewer feature dimensions on a single platform. Therefore, in order for the behavioral risk identification model to accurately identify whether the object has been exposed to false information and accurately predict the probability of the object being deceived by false information, it is necessary to iteratively optimize the original model by integrating the features of the object on multiple platforms. In order to avoid information leakage between different platforms, the server only performs identity alignment processing on the object identifiers of objects on different platforms to determine the same object identifiers on different platforms, that is, to determine the objects that overlap on different platforms.

[0097] Exemplarily, the server may construct a common object list for common objects represented by common identifiers in different platforms, and summarize object behavior data of each common object in the common object list on different platforms into the common object list.

[0098] In this embodiment, the object identifiers of different platforms can be aligned to determine the same objects in different platforms, so that the original model can be iteratively optimized based on the multi-dimensional data of the same objects on different platforms to ensure that the final behavioral risk identification model can accurately identify whether the object is exposed to potential false information for the purpose of deception and accurately predict the probability of the object being deceived by the false information, thereby improving the recognition accuracy and protection effect of false information for the purpose of deception.

[0099] In one embodiment, obtaining object behavior data corresponding to each common identifier on different platforms includes:

[0100] For each shared identifier, in response to data upload operations on different platforms, encrypted data carrying the shared identifier uploaded by different platforms are obtained; the encrypted data is obtained by encrypting the object behavior data carrying the shared identifier stored by different platforms respectively;

[0101] The encrypted data corresponding to the shared identifier on different platforms are decrypted respectively to obtain the object behavior data corresponding to the shared identifier on different platforms.

[0102] Optionally, for each shared identifier, the server can respond to data upload operations on different platforms, obtain encrypted data carrying the shared identifier uploaded by different platforms, identify the encryption processing methods performed on different platforms, determine the decryption processing methods corresponding to different platforms, and then, based on the determined decryption processing methods, decrypt the encrypted data corresponding to the shared identifier on different platforms respectively to obtain the object behavior data corresponding to the shared identifier on different platforms.

[0103] In this embodiment, before uploading data, different platforms first encrypt the object behavior data corresponding to the shared identifier, which can ensure data security and avoid information leakage.

[0104] In one embodiment, based on the object behavior data corresponding to each common identifier on different platforms, the original model is iteratively optimized until the model optimization stop condition is reached, thereby obtaining a behavior risk identification model, including:

[0105] Divide the object behavior data corresponding to each shared identifier on different platforms into training samples, verification samples, and test samples;

[0106] Based on the training samples, the original model is trained to obtain multiple trained models;

[0107] Based on the verification sample, verify the recognition effect of the trained model, and determine at least one model to be optimized based on the verification result;

[0108] Based on the test samples, the model to be optimized is evaluated to obtain the evaluation results;

[0109] Based on the evaluation results, the model parameters in the model to be optimized are optimized until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0110] Each shared identifier represents a shared object, and a shared object represents an overlapping object in different platforms.

[0111] Optionally, the server can determine the common objects based on the common identifiers and construct a list of common objects. After aggregating the object behavior data of each common object on different platforms into the list of common objects, the server can divide the common identifiers corresponding to each common object in the list of common objects according to a preset ratio.

[0112] Optionally, the server can divide the object behavior data corresponding to each common object on different platforms into training samples, verification samples and test samples according to a preset division ratio, and input the training samples, verification samples and test samples into the logistic regression algorithm. Then, based on the training samples, the original model is trained, and after the number of training times reaches the preset number of training times, multiple trained models are obtained, and then based on the verification samples, the recognition effect of the trained model is verified, and based on the verification results, at least one model to be optimized is determined, for example, a trained model with a higher recognition accuracy is determined as the model to be optimized. Furthermore, the server can evaluate the model to be optimized based on the test sample to obtain an evaluation result, and finally, optimize the model parameters in the model to be optimized based on the evaluation result until the model optimization stop condition is reached to obtain a behavioral risk identification model.

[0113] In this embodiment, by combining the multi-dimensional data training models of multiple common objects on different platforms, the trained behavioral risk identification model can accurately identify potential false information with the purpose of deception, and accurately predict the probability of the object being deceived, thereby improving the recognition accuracy and protection effect of false information with the purpose of deception.

[0114] In one embodiment, as shown in FIG3 , a flow chart of another object behavior risk identification method is provided, which mainly includes the following processes:

[0115] Step 302, respectively obtaining object identifiers stored in different platforms, and performing identifier alignment processing on the object identifiers stored in different platforms to determine the same object identifiers in different platforms;

[0116] Step 304: using the same object identifier as a shared identifier, and for each shared identifier, in response to data upload operations on different platforms, obtaining encrypted data carrying the shared identifier uploaded by different platforms; the encrypted data is obtained by encrypting the object behavior data carrying the shared identifier stored by different platforms respectively;

[0117] Step 306, decrypting the encrypted data corresponding to the shared identifier on different platforms respectively to obtain the object behavior data corresponding to the shared identifier on different platforms;

[0118] Step 308, dividing the object behavior data corresponding to each shared identifier on different platforms into training samples, verification samples, and test samples;

[0119] Step 310, training the original model based on the training samples to obtain multiple trained models;

[0120] Step 312, verifying the recognition effect of the trained model based on the verification sample, and determining at least one model to be optimized based on the obtained verification result;

[0121] Step 314, based on the test sample, the model to be optimized is evaluated to obtain an evaluation result;

[0122] Step 316, optimizing the model parameters in the model to be optimized based on the evaluation results until the model optimization stop condition is reached, thereby obtaining a behavior risk identification model;

[0123] Step 318, obtaining an object identifier of the object to be identified, and based on the object identifier, obtaining object behavior data of the object to be identified in different platforms from platform data stored on different platforms;

[0124] Step 320, for each platform, decrypt the object behavior data of the platform to obtain decrypted data, and extract data features of the object to be identified on the platform from the decrypted data;

[0125] Step 322, inputting the data features of the object to be identified on different platforms into the behavior risk identification model respectively, and obtaining the behavior risk identification result of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0126] Step 324: When the behavior risk identification result indicates that the subject to be identified is in a high-risk state, a warning message is sent to the subject to be identified.

[0127] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0128] Based on the same inventive concept, the embodiment of the present application also provides an object behavior risk identification device for implementing the object behavior risk identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more object behavior risk identification device embodiments provided below can refer to the limitations of the object behavior risk identification method above, and will not be repeated here.

[0129] In one embodiment, as shown in FIG. 4 , an object behavior risk identification device is provided, including: an object behavior data acquisition module 402, a data feature extraction module 404, an identification result acquisition module 406 and an early warning message sending module 408, wherein:

[0130] An object behavior data acquisition module is used to acquire the object behavior data of the object to be identified in different platforms;

[0131] A data feature extraction module is used to extract data features of the object to be identified on each platform from the object behavior data of each platform;

[0132] The recognition result acquisition module is used to input the data features of the object to be identified on different platforms into the behavior risk identification model to obtain the behavior risk identification results of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms;

[0133] The warning message sending module is used to send a warning message to the object to be identified when the behavior risk identification result indicates that the object to be identified is in a high-risk state.

[0134] In the above-mentioned object behavior risk identification device, the object behavior data of the object to be identified in different platforms is first obtained. Since the dimensions of the data stored in different platforms are quite different, it is equivalent to first obtaining more comprehensive multi-dimensional data of the object to be identified, and then extracting the data features of the object to be identified in each platform from the object behavior data of each platform, so that the data features of the object to be identified in different platforms can be combined to more accurately identify false information with the purpose of deception. Then, the data features of the object to be identified in different platforms are respectively input into the behavior risk identification model to obtain the behavior risk identification result of the object to be identified, wherein the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms. Finally, when the behavior risk identification result indicates that the object to be identified is in a high-risk state, an early warning message is sent to the object to be identified. In the whole process, the more comprehensive multi-dimensional data features of the object to be identified can be combined to fully and comprehensively dig into the behavior of the object to be identified in different dimensions, so as to accurately identify potential false information with the purpose of deception, thereby improving the recognition accuracy and protection effect of false information with the purpose of deception.

[0135] In one of the embodiments, the object behavior data acquisition module is further used to acquire the object identification of the object to be identified; based on the object identification, the object behavior data of the object to be identified in different platforms are acquired from the platform data stored in different platforms.

[0136] In one of the embodiments, the data feature extraction module is further used to decrypt the object behavior data of each platform to obtain decrypted data; and extract the data features of the object to be identified on the platform from the decrypted data.

[0137] In one of the embodiments, the object behavior risk identification device also includes a training module for a behavior risk identification model, and the training module for the risk identification model is used to respectively obtain object identifiers stored in different platforms; determine the same object identifiers in different platforms by performing identifier alignment processing on the object identifiers stored in different platforms; use the same object identifiers as common identifiers; obtain the object behavior data corresponding to each common identifier on different platforms; and iteratively optimize the original model based on the object behavior data corresponding to each common identifier on different platforms until the model optimization stop condition is reached to obtain a behavior risk identification model.

[0138] In one of the embodiments, the object behavior risk identification device also includes a shared identification processing module, which is used to obtain encrypted data carrying the shared identification uploaded by different platforms for each shared identification in response to data upload operations on different platforms; the encrypted data is obtained by encrypting the object behavior data carrying the shared identification stored by different platforms respectively; the encrypted data corresponding to the shared identification on different platforms are decrypted respectively to obtain the object behavior data corresponding to the shared identification on different platforms.

[0139] In one of the embodiments, the object behavior risk identification device also includes a model iteration module, which is used to divide the object behavior data corresponding to each common identifier on different platforms into training samples, verification samples and test samples; based on the training samples, the original model is trained to obtain multiple trained models; based on the verification samples, the recognition effect of the trained model is verified, and based on the verification results, at least one model to be optimized is determined; based on the test samples, the model to be optimized is evaluated to obtain an evaluation result; based on the evaluation result, the model parameters in the model to be optimized are optimized until the model optimization stop condition is reached to obtain a behavior risk identification model.

[0140] Each module in the above-mentioned object behavior risk identification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0141] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store object behavior risk identification data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an object behavior risk identification method is implemented.

[0142] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0143] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0144] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0145] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0146] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0147] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0148] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0149] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying object behavior risk, characterized in that: The method comprises: Obtaining object behavior data of the object to be identified in different platforms; Extracting data features of the object to be identified on each of the platforms from the object behavior data on each of the platforms; Inputting the data features of the object to be identified on different platforms into a behavior risk identification model respectively to obtain a behavior risk identification result of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms; When the behavior risk identification result indicates that the object to be identified is in a high-risk state, a warning message is sent to the object to be identified.

2. The method according to claim 1, characterized in that The obtaining of the object behavior data of the object to be identified in different platforms includes: Obtaining an object identifier of the object to be identified; Based on the object identifier, object behavior data of the object to be identified in different platforms are respectively obtained from platform data stored in different platforms.

3. The method according to claim 1, characterized in that The step of extracting data features of the object to be identified on each platform from the object behavior data on each platform includes: For each of the platforms, decrypting the object behavior data of the platform to obtain decrypted data; The data features of the object to be identified on the platform are extracted from the decrypted data.

4. The method according to claim 1, characterized in that: The training process of the behavior risk identification model includes: Get the object identifiers stored in different platforms respectively; By performing identity alignment processing on object identities stored in different platforms, identical object identities in different platforms are determined; Using the same object identifier as a shared identifier; Obtaining object behavior data corresponding to each of the shared identifiers on different platforms; Based on the object behavior data corresponding to each of the shared identifiers on different platforms, the original model is iteratively optimized until the model optimization stop condition is reached, thereby obtaining a behavior risk identification model.

5. The method according to claim 4, characterized in that The obtaining of the object behavior data corresponding to each of the shared identifiers on different platforms includes: For each of the shared identifiers, in response to data upload operations of different platforms, encrypted data carrying the shared identifier uploaded by different platforms are obtained; the encrypted data is obtained by encrypting the object behavior data carrying the shared identifier stored by different platforms respectively; The encrypted data corresponding to the shared identifier on different platforms are decrypted respectively to obtain the object behavior data corresponding to the shared identifier on different platforms.

6. The method according to claim 4, characterized in that The method of iteratively optimizing the original model based on the object behavior data corresponding to each of the shared identifiers on different platforms until the model optimization stop condition is reached to obtain a behavior risk identification model includes: Dividing the object behavior data corresponding to each of the shared identifiers on different platforms into training samples, verification samples, and test samples; Based on the training samples, training the original model to obtain multiple trained models; Based on the verification sample, verify the recognition effect of the trained model, and based on the obtained verification result, determine at least one model to be optimized; Based on the test sample, the model to be optimized is evaluated to obtain an evaluation result; The model parameters in the model to be optimized are optimized based on the evaluation results until the model optimization stop condition is reached to obtain a behavior risk identification model.

7. A device for identifying risk of object behavior, characterized in that: The device comprises: An object behavior data acquisition module is used to acquire the object behavior data of the object to be identified in different platforms; A data feature extraction module, used to extract data features of the object to be identified on each of the platforms from the object behavior data of each of the platforms; An identification result acquisition module is used to input the data features of the object to be identified on different platforms into a behavior risk identification model to obtain the behavior risk identification result of the object to be identified; the behavior risk identification model is obtained by model training based on the data features of different objects on different platforms; The warning message sending module is used to send a warning message to the object to be identified when the behavior risk identification result indicates that the object to be identified is in a high-risk state.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images