Risk identification method and device

Abstract

The invention discloses a risk identification method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: in response to triggering of a preset event, analyzing the preset event to obtain a service identifier and a user identifier; determining a service behavior sequence corresponding to the user identifier from a user behavior sequence of the gateway; and inputting the service behavior sequence into a pre-constructed service risk identification model corresponding to the service identifier to obtain a risk identification result of the preset event, the service risk identification model being obtained by training a general identification model according to the service identifier. According to the embodiment, the real-time intention of the user is described by using the user behavior sequence of the gateway, the risk identification of the preset event is realized by constructing the business risk identification model obtained based on the general model training, the risk identification accuracy is improved, the general model of the embodiment has good expandability, and the user experience is improved. Risk identification of a new service can be rapidly enabled, and the purposes of reducing cost and increasing efficiency are achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for risk identification. Background Art

[0002] Business risk control (risk control) is an important part of the high-quality development of Internet trading platforms. It can stop losses on the platform by analyzing and modeling relevant features, designing corresponding risk control strategies or constructing machine learning models. Existing risk control technologies usually use static feature information of platform users, such as whether a financial account is bound, the number of orders for the same delivery address, the number of order address changes in the past 30 days, etc., and construct different risk identification models for different business scenarios (such as order business, communication business, etc.) for risk identification.

[0003] In the process of implementing the present invention, the inventors found that the prior art has the following problems:

[0004] Although the user's static feature information can reflect the user's intention, it is not sufficient, especially in real-time operations such as collecting coupons and placing orders for flash sales. Static features alone cannot reflect the user's behavioral intention in real time. Existing business risk identification technologies use different models for each segmented business scenario to achieve different identification goals. There are large barriers between these technologies, and they cannot be quickly integrated to support new businesses when faced with new businesses. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for risk identification, which determines the business behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway according to the business identifier and user identifier in the received preset event, and then inputs the business behavior sequence into the business risk identification model obtained by training the general identification model according to the business identifier to perform risk identification of the preset event. The embodiment of the present invention uses the user behavior sequence of the gateway to characterize the real-time intention of the user, and realizes the risk identification of the preset event by constructing a business risk identification model obtained by training based on the general model, thereby improving the accuracy of risk identification. The general model of the embodiment of the present invention has good scalability, which can quickly enable the risk identification of new businesses and achieve the purpose of reducing costs and increasing efficiency.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a risk identification method is provided, comprising:

[0007] In response to a preset event trigger, a service identifier and a user identifier are obtained by parsing the preset event;

[0008] Determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway;

[0009] The business behavior sequence is input into a pre-built business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, and the business risk identification model is obtained by training a general identification model according to the business identifier.

[0010] Optionally, before determining the business behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway, the method includes: parsing the request data of the gateway to obtain the service interface name in the request data, the request data having a timestamp and a gateway user identifier; and using a sliding window to obtain the user behavior sequence within a specified time interval based on the service interface name and the corresponding gateway user identifier.

[0011] Optionally, based on the service interface name and the corresponding gateway user identifier, a sliding window is used to obtain a user behavior sequence within a specified time interval, including: mapping the service interface name to an interface number according to a preset interface dictionary; based on the interface number and the corresponding gateway user identifier, a sliding window is used to count the interface numbers corresponding to the gateway users within the specified time interval in chronological order to obtain a user behavior sequence.

[0012] Optionally, before inputting the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier, the method includes: establishing a universal identification model; training the universal identification model using a gradient descent algorithm based on the acquired historical user behavior sequence and the business identifier to obtain a business risk identification model corresponding to the business identifier.

[0013] Optionally, the business behavior sequence is input into a pre-built business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, including: obtaining a feature vector of the business behavior sequence and a feature vector of the acquired user static feature information through the business risk identification model; encoding the feature vector of the business behavior sequence through a neural network constructed based on the attention mechanism in the business risk identification model to obtain an attention feature vector; and aggregating and reducing the dimension of the attention feature vector and the feature vector of the user static feature information to obtain a risk identification result of the preset event.

[0014] Optionally, the business behavior sequence includes an interface number and sequence position information of the interface number; the business risk identification model includes a pre-trained model; through the business risk identification model, a feature vector of the business behavior sequence and the acquired user static feature information is obtained, including: according to the pre-trained model, an interface feature vector dictionary is obtained; according to the business behavior sequence and the acquired user static feature information, through the interface feature vector dictionary, an interface feature vector and a sequence position feature vector, as well as a user static feature vector are determined.

[0015] Optionally, the business risk identification model includes a pre-trained model; before encoding the feature vector of the business behavior sequence through the neural network constructed based on the attention mechanism in the business risk identification model, the method also includes: obtaining an initialization vector of the neural network constructed based on the attention mechanism according to the pre-trained model, so as to encode the feature vector of the business behavior sequence based on the initialization vector.

[0016] Optionally, the method also includes at least one of the following: using a sliding window to count the number of access requests of the user corresponding to the preset event received by the gateway within a specified time interval, and when the number of requests exceeds a preset risk threshold, identifying the user as a risky user; according to a preset single-point risk rule, determining whether the characteristic information of the user corresponding to the preset event in the request data of the gateway contains risk information, and identifying the user corresponding to the request data containing risk information as a risky user.

[0017] According to a second aspect of an embodiment of the present invention, there is provided a risk identification device, including:

[0018] A service identification acquisition module, used to parse and obtain a service identification and a user identification from a preset event in response to a preset event trigger;

[0019] A behavior sequence acquisition module, used to determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway;

[0020] The business risk identification module is used to input the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier to obtain the risk identification result of the preset event. The business risk identification model is obtained by training a general identification model based on the business identifier.

[0021] According to a third aspect of an embodiment of the present invention, there is provided an electronic device for risk identification, including:

[0022] one or more processors;

[0023] a storage device for storing one or more programs,

[0024] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0025] According to a fourth aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0026] An embodiment of the invention has the following advantages or beneficial effects: by responding to a preset event trigger, a business identifier and a user identifier are parsed from the preset event; a business behavior sequence corresponding to the user identifier is determined from the user behavior sequence of the gateway; the business behavior sequence is input into a pre-constructed business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event. The business risk identification model is a technical solution obtained by training a general identification model according to the business identifier, and the user behavior sequence of the gateway is used to characterize the user's real-time intention. According to the business risk identification model obtained by training based on the general model, the identification of business risks of the preset event is realized, and the accuracy of risk identification is improved. The general model of the embodiment of the present invention has good scalability, and can quickly enable risk identification of new businesses, thereby achieving the purpose of reducing costs and increasing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0028] Figure 1 is a schematic diagram of the main process of the risk identification method according to an embodiment of the present invention;

[0029] Figure 2 It is a schematic diagram of the principle of obtaining risk identification results through a business risk identification model in an embodiment of the present invention;

[0030] Figure 3 It is a schematic diagram of the overall principle of the method for risk identification according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of main modules of a risk identification device according to an embodiment of the present invention;

[0032] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0033] Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0034] It should be noted that in the technical solution of the present invention, the collection / collection, update, analysis, use, transmission, storage and other aspects of user personal information involved are in compliance with the provisions of relevant laws and regulations, are used for legal and reasonable purposes, are not shared, leaked or sold outside of these legal uses, and are subject to supervision and management by national regulatory authorities. Necessary measures should be taken for user personal information to selectively block the use or access to personal information data to prevent illegal access to such personal information data, ensure that persons who have access to personal information data comply with the provisions of relevant laws and regulations, and ensure the security of user personal information. In addition, once these user personal information data are no longer needed, the risks should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0035] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0036] Although the user static feature information used in existing business risk identification technologies can reflect the user's intention, it is not sufficient, especially in real-time operations such as collecting coupons and placing orders for flash sales. Static features alone cannot reflect the user's behavioral intention in real time. In addition, different models are used for each segmented business scenario to achieve different identification goals. There are large barriers between these models and specific technical means. When faced with new businesses, they cannot be quickly integrated to support new businesses and cannot meet practical applications well.

[0037] In order to solve the above problems existing in the prior art, the present invention proposes a method for risk identification, which determines the business behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway according to the business identifier and user identifier in the received preset event, and then inputs the business behavior sequence into the business risk identification model obtained by training the general identification model according to the business identifier to perform risk identification of the preset event. The embodiment of the present invention uses the user behavior sequence of the gateway to characterize the real-time intention of the user, and realizes the risk identification of the preset event by constructing a business risk identification model obtained by training based on the general model, thereby improving the accuracy of risk identification. The general model of the embodiment of the present invention has good scalability, which can quickly enable the risk identification of new businesses and achieve the purpose of reducing costs and increasing efficiency.

[0038] In the introduction to the embodiments of the present invention, the terms and their meanings are as follows:

[0039] Attention mechanism: A technique in the field of deep learning that simulates human cognitive attention, used to enhance the weight of the core context and weaken the weight of the noise part. The attention mechanism can be trained by gradient descent.

[0040] Transformer layer: A neural network built based on a multi-head self-attention mechanism, suitable for sequence feature learning;

[0041] Fully connected layer: A fully connected layer is usually used in the later layers of a deep neural network to aggregate high-level feature representations and output the probabilities of each category.

[0042] Embedding Layer: The embedding layer usually represents the first layer of a deep neural network, and its purpose is to map all index labels to dense low-dimensional vectors;

[0043] Requestline: represents the network request text, which is the instruction of the user client to request resources;

[0044] Bert: Bidirectional Encoder Representations from Transformers, a new language model developed and released by Google in late 2018, is an unsupervised fine-tuning method.

[0045] Mask Language Model: Mask language model randomly masks some elements in the input sequence, then builds a deep neural network to predict the masked elements, and learns the network weights through the gradient descent method. It is mainly used for initializing the network weights of downstream tasks.

[0046] Figure 1 FIG. 1 is a schematic diagram of the main process of the risk identification method according to an embodiment of the present invention. Figure 1 As shown, the risk identification method of the embodiment of the present invention includes the following steps S101 to S103.

[0047] Step S101: In response to a preset event trigger, a service identifier and a user identifier are obtained by parsing the preset event.

[0048] Specifically, users conduct trading activities through the Internet trading platform, and users can participate in various aspects of the trading activities, such as communicating with the merchant's customer service through the instant messaging interface or the live broadcast interface, sending barrage information in the live broadcast interface, and generating trading orders with the merchant. In the face of a large user base, the trading platform will conduct risk control on the main business in order to ensure the security of the platform and the quality of services, accurately identify the risk points related to the business, and deploy relevant processing strategies. Specific risk points include abnormal users, abnormal order brushing, non-compliant and malicious communication content, etc. For this reason, the trading platform pre-defines the events (preset events) corresponding to the main trading activities according to the business dimensions according to the needs of the business and scenarios, including but not limited to user access request events, order events, instant messaging events and live broadcast events in the embodiment of the present invention.

[0049] Furthermore, each preset event includes the business identifier to which the event belongs and the corresponding user identifier. When a preset event occurs, such as the generation of a transaction order, the sending of an instant chat message or a live broadcast barrage, the trading platform will be triggered to parse the received preset event to obtain the business identifier and user identifier. In addition, considering that if the trading platform is triggered to perform risk identification for each user's access request, it will bring huge processing pressure to the platform, the embodiment of the present invention preferably generates a periodic prediction mark for each user, and triggers the platform to parse and identify risks of access request events according to the prediction mark. Of course, a unified periodic prediction mark can also be set, for example, the trading platform uniformly parses and identifies risks of user access request events every half an hour.

[0050] Step S102: Determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway.

[0051] Specifically, the trading platform receives the user's request data for accessing the trading platform through the gateway, and obtains a user behavior sequence that represents the user behavior according to the order of the user's request data for accessing the trading platform, such as first requesting to log in, then requesting to browse, and then requesting to place an order. Then, based on the user identifier, the corresponding user's business behavior sequence is extracted from the user behavior sequence.

[0052] According to one embodiment of the present invention, before determining the business behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway, the method includes: parsing the request data of the gateway to obtain the service interface name in the request data, the request data having a timestamp and a gateway user identifier; and using a sliding window to obtain the user behavior sequence within a specified time interval based on the service interface name and the corresponding gateway user identifier.

[0053] Specifically, the trading platform parses the received request data, and obtains non-privacy fields such as requestline, and uses the service interface names included in the requestline, such as the login authentication interface name, the product details viewing interface name, the order placement interface name, etc., to obtain the service interface names included in each request data. The embodiments of the present invention only involve these interface names and do not include the user's privacy information. Moreover, when the user sends an access request to the trading platform, the request data has the timestamp of sending the access request and the gateway user ID of the gateway user to which it belongs. The corresponding timestamp and gateway user ID are retained during the parsing of the request data. The obtained service interface names are grouped in time sequence using a sliding window according to the gateway user dimension to obtain a user behavior sequence that characterizes the gateway user behavior.

[0054] According to another embodiment of the present invention, based on the service interface name and the corresponding gateway user identifier, a sliding window is used to obtain a user behavior sequence within a specified time interval, including: mapping the service interface name to an interface number according to a preset interface dictionary; based on the interface number and the corresponding gateway user identifier, a sliding window is used to count the interface numbers corresponding to the gateway users within the specified time interval in chronological order to obtain a user behavior sequence.

[0055] Specifically, in order to facilitate the processing of the business risk identification model, an interface dictionary can be generated in advance. The interface dictionary includes all possible service interface names and corresponding interface numbers involved in the request data received by the gateway. According to the service interface name obtained by parsing the request data of the gateway, the interface number corresponding to each service interface name is found from the interface dictionary, and the service interface name is mapped to the interface number. Preferably, the interface number of the interface dictionary in the embodiment of the present invention is an integer, so as to better meet the data type requirements of the business risk identification model and improve the calculation efficiency. Taking the gateway user as the dimension, the interface number is divided by the gateway user identifier to obtain the interface number corresponding to each gateway user. Specifically for each gateway user, according to the timestamp of the request data to which the service interface name corresponding to the mapped interface number belongs, according to the time order of the timestamp, the interface number corresponding to the gateway user in the specified time interval of the sliding window is counted. These interface numbers have a time sequence characteristic, that is, the position of the interface number is ordered, and the ordered interface number can reflect the intended behavior of the user, that is, the user behavior sequence. For example, the interface numbers of a certain user are the interface number of the authentication interface, the interface number of the search interface, the interface number of the product detail page browsing interface, the interface number of the add to cart interface, the interface number of the order interface, and the interface number of the payment interface. These interface numbers constitute the shopping behavior of the gateway user, which is the user behavior sequence.

[0056] In addition, the gateway receives request data from various gateway users, including normal gateway users with transaction intentions, as well as some abnormal gateway users, such as gateway users who frequently use machines to swipe orders, and gateway users who log in through other illegal clients. These users have obvious characteristics. In the process of obtaining the user behavior sequence of the gateway, these abnormal risk users can be identified in advance to avoid processing these cumbersome and large-scale risks in the business risk identification model, optimize the risk identification logic, and reduce the system processing pressure. Further, for gateway users who swipe orders, gateway users will frequently send access requests to the gateway through swiping machines in a short period of time, such as rushing to buy, etc., and a sliding window can be used to count the access requests sent by gateway users to the trading platform within a specified time interval. The embodiment of the present invention is set to be within 1 minute. The trading platform counts the number of requests received for the corresponding request data. If the number of requests sent by the gateway user is higher than the preset risk threshold, the gateway user is a risk user. For example, if the number of requests in one minute is as high as 100 times, which exceeds the preset risk threshold of 50 times, the corresponding gateway user is judged to be a risk user, and the user behavior sequence of the risk user is removed from the user behavior sequence of the gateway. Similarly, some abnormal gateway users intend to enter the trading platform through illegal clients or Trojan viruses to commit fraud or other illegal activities. According to the preset single-point risk rules, it is determined whether the characteristic information of the gateway user in the request data contains the risk information in the single-point risk rules. For example, risky users are identified based on the client version number, access timestamp, APP version and other non-privacy data included in the single request data of the gateway. The identified risky users are listed as problem users, the request data for this time is cleared, and access requests from such users are no longer accepted.

[0057] The user behavior sequence of the gateway obtained above is grouped in time sequence using a sliding window according to the dimension of the gateway user. According to the user ID parsed from the preset event, the gateway user ID that is the same as the user ID is searched from the user behavior sequence, and the behavior sequence corresponding to the gateway user ID found is used as the business behavior sequence.

[0058] Step S103: input the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, wherein the business risk identification model is obtained by training a general identification model according to the business identifier.

[0059] Specifically, the embodiment of the present invention is based on a preset universal recognition model, obtains a historical user behavior sequence according to the historical request data of the gateway, uses the historical user behavior sequence in combination with the service identifier obtained by the above analysis, determines training data with service attributes, and performs service training on the universal recognition model offline. The trained service risk recognition model is used for risk identification of preset events.

[0060] According to one embodiment of the present invention, before the business behavior sequence is input into a pre-built business risk identification model corresponding to the business identifier, the method includes: establishing a universal identification model; training the universal identification model using a gradient descent algorithm based on the acquired historical user behavior sequence and the business identifier to obtain a business risk identification model corresponding to the business identifier.

[0061] Specifically, most of the existing recognition models are suitable for processing static features, but not suitable for time series data, and have poor generalization performance. The embodiment of the present invention proposes a set of general attention mechanism deep recognition models (general recognition models) for business behavior sequences to quickly identify business risks. For the general recognition model, the training sequences corresponding to different segmented businesses are determined through historical user behavior sequences and business identifiers, and the general recognition model is trained using the gradient descent method to obtain a business risk recognition model for the corresponding business. For example, for the user access request event mentioned above, the training sequence of the user business is obtained according to the acquired historical user behavior sequence and user business identifier, and the general recognition model is trained to obtain a user risk recognition model; for another example, for the order event, the training sequence of the order business is obtained according to the acquired historical user behavior sequence and order business identifier, and the general recognition model is trained to obtain an order risk recognition model. Preferably, in order to improve the accuracy of the recognition model, the user's static feature information can be attached to train the general recognition model to obtain a more comprehensive and accurate business risk recognition model.

[0062] According to another embodiment of the present invention, the business behavior sequence is input into a pre-constructed business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, including: obtaining a feature vector of the business behavior sequence and a feature vector of the acquired user static feature information through the business risk identification model; encoding the feature vector of the business behavior sequence through a neural network constructed based on the attention mechanism in the business risk identification model to obtain an attention feature vector; and aggregating and reducing the dimension of the attention feature vector and the feature vector of the user static feature information to obtain the risk identification result of the preset event.

[0063] Specifically, the embodiment of the present invention is based on the above-established universal recognition model, and according to the acquired historical user behavior sequence and user service identifier, obtains the training sequence of user services for training the universal recognition model, and uses the conjugate gradient method to perform service training on the universal recognition model to obtain a service risk recognition model. The conjugate gradient method is performed along the conjugate direction, and usually converges faster than along the direction of the gradient descent method. Using the service risk recognition model obtained by service training, the service behavior sequence and the user static feature information are input into the embedding layer Embedding Layer in the service risk recognition model, and the service behavior sequence and the user static feature information are feature extracted and processed to obtain the feature vector of the service behavior sequence and the feature vector of the user static feature information. The feature vector of the service behavior sequence is input into the neural network Transformer Layer constructed based on the attention mechanism, and the input feature vector is encoded. Specifically, the attention distribution between the feature vectors of each service interface in the feature vector of the service behavior sequence is calculated, and then the attention distribution is applied to the feature vector of each service interface to obtain the attention feature vector including the sequential context feature information. Then, through the fully connected layer in the business risk identification model, the attention feature vector and the feature vector of the user's static feature information are aggregated, and multiple fully connected layers are connected to perform dimensionality reduction processing to obtain a risk identification result with an output feature dimension of two dimensions (yes or no).

[0064] The embodiment of the present invention proposes a general solution for risk identification based on gateway user behavior sequences, and constructs a lightweight business risk identification model based on the attention mechanism. It has good scalability and can quickly enable risk identification of new businesses, thereby achieving the goal of reducing costs and increasing efficiency.

[0065] According to another embodiment of the present invention, the business behavior sequence includes an interface number and sequence position information of the interface number; the business risk identification model includes a pre-trained model; through the business risk identification model, a feature vector of the business behavior sequence and the acquired user static feature information is obtained, including: according to the pre-trained model, an interface feature vector dictionary is obtained; according to the business behavior sequence and the acquired user static feature information, through the interface feature vector dictionary, an interface feature vector and a sequence position feature vector, as well as a user static feature vector are determined.

[0066] Specifically, the business behavior sequence characterizes the business behavior through the name of the service interface and the positional relationship between each service interface. The positional relationship between the service interfaces is a relatively important characteristic information. If the position or arrangement order of a service interface in the sequence is different, the behavior expressed by the entire sequence may be different. Through the above-mentioned mapping of the service interface name in the business behavior sequence, the business behavior sequence in the embodiment of the present invention is specifically expressed in the form of the interface number and the sequence position information in the sequence where the interface number is located. For example, the business behavior sequence {243, 286, 396, ..., 152} represents the interface number, and each interface number has the sequence position information of position information 243 as 1. In order to improve the speed of general recognition model training and the accuracy of risk identification results in the embodiment of the present invention, a Mask LanguageModel learning target is constructed, and the Bert model is used to pre-train the historical business behavior sequence in advance to obtain a high-quality interface feature vector dictionary; the interface feature vector dictionary is used in the Embedding Layer of the business risk identification model, and the sequence position information is encoded and converted into a high-dimensional vector to obtain the interface feature vector and sequence position feature vector corresponding to the business behavior sequence, as well as the user static feature vector corresponding to the user static feature information.

[0067] According to another embodiment of the present invention, the business risk identification model includes a pre-trained model; before encoding the feature vector of the business behavior sequence through the neural network constructed based on the attention mechanism in the business risk identification model, the method also includes: obtaining an initialization vector of the neural network constructed based on the attention mechanism according to the pre-trained model, so as to encode the feature vector of the business behavior sequence based on the initialization vector.

[0068] Specifically, in addition to providing a high-quality interface feature vector dictionary, the pre-trained model can also provide high-quality initialization vectors to the neural network Transformer Layer built based on the attention mechanism based on the extraction training results. This can encode the feature vectors of the business behavior sequence more accurately and quickly, thereby improving the accuracy and efficiency of risk identification.

[0069] Furthermore, the trading platform intercepts and processes risky businesses based on the risk identification results obtained from the business risk identification model and the formulated business risk control strategy to improve the security and stability of the trading platform.

[0070] According to another embodiment of the present invention, the method further includes at least one of the following: using a sliding window to count the number of access requests of the user corresponding to the preset event received by the gateway within a specified time interval, and identifying the user as a risky user when the number of requests exceeds a preset risk threshold; judging whether the characteristic information of the user corresponding to the preset event in the request data of the gateway contains risk information according to a preset single point risk rule, and identifying the user corresponding to the request data containing risk information as a risky user.

[0071] Specifically, the embodiments of the present invention support risk identification of preset events in various business scenarios. In addition to the risk identification of the business behavior sequence corresponding to the preset event, user risk identification can also be performed on the users of the preset event. A sliding window is used to count the number of access requests sent by the users of the preset event to the gateway within a specified time. If the number of requests exceeds the preset risk threshold, it means that the user is an abnormal transaction user, and may be a user who swipes orders through a machine. The user of the preset event is identified as a risky user, and accordingly, there is no need to perform risk identification on the preset event. Similarly, if the characteristic information of the user of the preset event contains risk information, such as the client version number, access timestamp, and APP version information contains risk information, it means that the user may be a problem user. The user of the preset event is identified as a risky user, and accordingly, there is no need to perform risk identification on the preset event.

[0072] The embodiment of the present invention mainly describes a method for risk identification based on the business dimension. By training a general identification model, business risk identification models for different businesses are obtained, and corresponding business risk identification models are used according to business risk control scenarios. It can be understood that for preset events, the risk identification of user access requests for preset events can also be performed first. If the user is not a risk user mentioned above, the risk identification of the order business initiated by the user is then performed, as well as the risk identification of related operations (instant messaging chat content, live broadcast barrage content, etc.) during the transaction process, to form a layer-by-layer identification mechanism for business risks, so as to eliminate risky users as early as possible and avoid subsequent identification of each operation of risky users. Of course, different business scenarios have different risk identification mechanisms and goals. The risk identification method proposed in the embodiment of the present invention can combine and expand the application of various specific business risk identification models according to the scenario, and the embodiment of the present invention does not make specific limitations.

[0073] Figure 2It is a schematic diagram of the principle of obtaining risk identification results through a business risk identification model in an embodiment of the present invention. The pre-trained model in the business risk identification model provides a high-quality interface feature vector dictionary for the generation of feature vectors, and also provides an initialization vector for the transformer layer; the user static feature information and each service interface in the business behavior sequence are input into the embedding layer through the business risk identification model, and the Embedding Layer encodes the sequence position information according to the interface feature vector dictionary provided by the pre-trained model to obtain the user static feature vector, the interface feature vector and the sequence position feature vector. The transformer layer encodes the feature vector of the business behavior sequence including the interface feature vector and the sequence position feature vector according to the initialization vector provided by the pre-trained model to obtain the attention feature vector; finally, the attention feature vector and the feature vector of the user static feature information are converged, and a multi-layer fully connected layer is constructed to reduce the dimension of the feature vector from the input 8192 dimensions to 1024 dimensions, and then through three layers of fully connected layers, a two-dimensional recognition result of whether the preset event has risks is finally output.

[0074] Figure 3It is a schematic diagram of the overall principle of the risk identification method of the embodiment of the present invention. The embodiment of the present invention applies the identification of risky users to the processing of the user behavior sequence of the gateway, so as to eliminate the risky users among the gateway users when processing the user behavior sequence of the gateway, and avoid the downstream processing of these valueless and abnormal user behavior sequences. The Internet trading platform gateway parses the request data according to the received request data event stream, and obtains the service interface name in the request data; establishes an anti-brushing mechanism, and uses the anti-brushing window of the sliding window to count the number of access requests of the gateway user received by the gateway within the specified time interval, identifies the risky user whose request number exceeds the preset risk threshold, and eliminates the risky user of swiping; uses the single point risk rule to build a single point risk identification model, which is used to identify the risk of non-privacy data such as the client version number, access timestamp, APP version, etc. included in each single request data of the gateway, and then identifies the risky user; maps the service interface name that does not include the risky user after parsing to the interface number through the interface dictionary, and uses the sliding window to count the interface number corresponding to the gateway user within the specified time interval to obtain the user behavior sequence. In the embodiment of the present invention, four types of preset events are set, namely user access request events, order events, instant messaging events and live broadcast events. For user access request events, timed triggering is adopted, and other events are triggered by operation actions. For example, generating an order triggers an order event, sending a communication chat message triggers an instant messaging event, and sending a live broadcast barrage triggers a live broadcast event. According to the user identifier of these preset events, the business behavior sequence corresponding to the user identifier is obtained from the user behavior sequence of the gateway, and these business behavior sequences are input into the business risk identification model corresponding to the business identifier. Specifically, the business behavior sequence triggered by the user access request event is input into the user identification model to obtain the identification result of whether the user is a risky user; the business behavior sequence triggered by the order event is input into the order identification model to obtain the identification result of whether the order is a malicious risk order; instant messaging events and live broadcast events both correspond to content risk identification, and a content scenario unified model can be used to identify the risks of instant messaging and live broadcast, and finally the risk identification results of each preset event are obtained.

[0075] Through the above-mentioned method for risk identification of preset events, it can be seen that the lightweight business risk identification module obtained based on the general identification model training provided in the embodiment of the present invention can be flexibly expanded as needed, and can better meet the risk identification of new businesses and new scenarios. Moreover, the gateway-based user behavior sequence can accurately show the user's behavioral intention in real time, and combined with the user's static feature information, the accuracy of risk identification is improved.

[0076] Figure 4 FIG. 1 is a schematic diagram of the main modules of the risk identification device according to an embodiment of the present invention. Figure 4As shown, the risk identification device 400 mainly includes a business identification acquisition module 401 , a behavior sequence acquisition module 402 and a business risk identification module 403 .

[0077] The service identification acquisition module 401 is used to parse the service identification and user identification from the preset event in response to the preset event trigger;

[0078] A behavior sequence acquisition module 402 determines a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway;

[0079] The business risk identification module 403 is used to input the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier to obtain the risk identification result of the preset event. The business risk identification model is obtained by training a general identification model according to the business identifier.

[0080] According to one embodiment of the present invention, the risk identification device 400 also includes a user behavior sequence acquisition module (not shown in the figure), which is used to: before determining the business behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway, obtain the service interface name in the request data by parsing the request data of the gateway, and the request data has a timestamp and a gateway user identifier; according to the service interface name and the corresponding gateway user identifier, use a sliding window to obtain the user behavior sequence within a specified time interval.

[0081] According to another embodiment of the present invention, the user behavior sequence acquisition module (not shown in the figure) is also used to: map the service interface name to an interface number according to a preset interface dictionary; and based on the interface number and the corresponding gateway user identifier, use a sliding window to count the interface numbers corresponding to the gateway users in a specified time interval in chronological order to obtain a user behavior sequence.

[0082] According to another embodiment of the present invention, the risk identification device 400 also includes a business risk identification model acquisition module (not shown in the figure), which is used to: establish a general identification model before inputting the business behavior sequence into a pre-built business risk identification model; train the general identification model using a gradient descent algorithm based on the acquired historical user behavior sequence and the business identifier to obtain a business risk identification model corresponding to the business identifier.

[0083] According to another embodiment of the present invention, the business risk identification module 403 is further used to: obtain the feature vector of the business behavior sequence and the feature vector of the acquired user static feature information through the business risk identification model; encode the feature vector of the business behavior sequence through a neural network constructed based on the attention mechanism in the business risk identification model to obtain an attention feature vector; and aggregate and reduce the dimension of the attention feature vector and the feature vector of the user static feature information to obtain a risk identification result of the preset event.

[0084] According to another embodiment of the present invention, the business behavior sequence includes an interface number and sequence position information of the interface number; the business risk identification model includes a pre-trained model; the business risk identification module 403 is also used to: obtain an interface feature vector dictionary based on the pre-trained model; determine the interface feature vector and the sequence position feature vector, as well as the user static feature vector through the interface feature vector dictionary based on the business behavior sequence and the acquired user static feature information.

[0085] According to another embodiment of the present invention, the business risk identification model includes a pre-trained model; the business risk identification module 403 is also used to: before encoding the feature vector of the business behavior sequence through the neural network constructed based on the attention mechanism in the business risk identification model, obtain the initialization vector of the neural network constructed based on the attention mechanism according to the pre-trained model, so as to encode the feature vector of the business behavior sequence based on the initialization vector.

[0086] According to another embodiment of the present invention, the risk identification device 400 also includes a first risk user identification module (not shown in the figure) and / or a second risk user identification module (not shown in the figure), the first risk user identification module (not shown in the figure) is used to: use a sliding window to count the number of access requests of the user corresponding to the preset event received by the gateway within a specified time interval, and when the number of requests exceeds a preset risk threshold, identify the user as a risk user; the second risk user identification module (not shown in the figure) is used to: determine whether the characteristic information of the user corresponding to the preset event in the request data of the gateway contains risk information according to a preset single point risk rule, and identify the user corresponding to the request data with risk information as a risk user.

[0087] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention can be applied.

[0088] like Figure 5As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0089] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications, such as risk identification applications, etc., can be installed on terminal devices 501, 502, 503 (only as an example).

[0090] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0091] The server 505 may be a server that provides various services, such as a background management server that provides support for risk identification performed by users using terminal devices 501, 502, and 503 (for example only). The background management server may respond to a preset event trigger, parse the preset event to obtain a service identifier and a user identifier; determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway; input the service behavior sequence into a pre-built service risk identification model corresponding to the service identifier, obtain a risk identification result of the preset event, and the service risk identification model is obtained by training a general identification model according to the service identifier, and feed back the processing result (such as an identification result, etc. - for example only) to the terminal device.

[0092] It should be noted that the risk identification method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the risk identification device is generally set in the server 505 .

[0093] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0094] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 6 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0095] like Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0096] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0097] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0098] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0099] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0100] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor including: a service identification acquisition module, a behavior sequence acquisition module and a service risk identification module.

[0101] Among them, the names of these modules do not constitute a limitation on the modules themselves in some cases. For example, the service identification acquisition module can also be described as "a module used to respond to a preset event trigger and parse the service identification and user identification from the preset event."

[0102] On the other hand, the present invention also provides a computer-readable medium, which may be included in the device described in the embodiment; or may exist independently without being assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by a device, the device includes: responding to a preset event trigger, parsing a service identifier and a user identifier from the preset event; determining a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway; inputting the service behavior sequence into a pre-built service risk identification model corresponding to the service identifier, and obtaining a risk identification result of the preset event, wherein the service risk identification model is obtained by training a general identification model according to the service identifier.

[0103] According to the technical solution of the embodiment of the present invention, it has the following advantages or beneficial effects: by responding to the preset event trigger, the business identifier and the user identifier are parsed from the preset event; the business behavior sequence corresponding to the user identifier is determined from the user behavior sequence of the gateway; the business behavior sequence is input into a pre-constructed business risk identification model corresponding to the business identifier to obtain the risk identification result of the preset event. The business risk identification model is a technical solution obtained by training a general identification model according to the business identifier, and the user behavior sequence of the gateway is used to characterize the user's real-time intention. According to the business risk identification model obtained by training based on the general model, the identification of the business risk of the preset event is realized, and the accuracy of risk identification is improved. The general model of the embodiment of the present invention has good scalability, which can quickly enable the risk identification of new businesses, thereby achieving the purpose of reducing costs and increasing efficiency.

[0104] The specific implementation methods described herein do not constitute limitations on the scope of protection of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A method for risk identification, characterized in that: include: In response to a preset event trigger, a service identifier and a user identifier are obtained by parsing the preset event; Determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway; The business behavior sequence is input into a pre-built business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, and the business risk identification model is obtained by training a general identification model according to the business identifier.

2. The method according to claim 1, characterized in that Before determining the service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway, the method includes: By parsing the request data of the gateway, the service interface name in the request data is obtained, and the request data has a timestamp and a gateway user identifier; According to the service interface name and the corresponding gateway user identifier, a sliding window is used to obtain a user behavior sequence within a specified time interval.

3. The method according to claim 2, characterized in that According to the service interface name and the corresponding gateway user identifier, a sliding window is used to obtain a user behavior sequence within a specified time interval, including: Mapping the service interface name to an interface number according to a preset interface dictionary; According to the interface numbers and the corresponding gateway user identifiers, a sliding window is used to count the interface numbers corresponding to the gateway users within a specified time interval in chronological order to obtain a user behavior sequence.

4. The method according to claim 1, characterized in that Before inputting the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier, the method includes: establishing a universal identification model; training the universal identification model using a gradient descent algorithm based on the acquired historical user behavior sequence and the business identifier to obtain a business risk identification model corresponding to the business identifier.

5. The method according to claim 1, characterized in that Inputting the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier to obtain a risk identification result of the preset event, including: Through the business risk identification model, the feature vector of the business behavior sequence and the feature vector of the acquired user static feature information are obtained; the feature vector of the business behavior sequence is encoded through a neural network constructed based on the attention mechanism in the business risk identification model to obtain an attention feature vector; the attention feature vector and the feature vector of the user static feature information are converged and dimensionally reduced to obtain a risk identification result of the preset event.

6. The method according to claim 5, characterized in that The business behavior sequence includes an interface number and sequence position information of the interface number; the business risk identification model includes a pre-trained model; The business risk identification model is used to obtain a feature vector of the business behavior sequence and the acquired user static feature information, including: According to the pre-trained model, an interface feature vector dictionary is obtained; according to the business behavior sequence and the acquired user static feature information, the interface feature vector and the sequence position feature vector, as well as the user static feature vector are determined through the interface feature vector dictionary.

7. The method according to claim 5, characterized in that The business risk identification model includes a pre-training model; Before encoding the feature vector of the business behavior sequence through the neural network constructed based on the attention mechanism in the business risk identification model, the method further includes: According to the pre-training model, an initialization vector of the neural network constructed based on the attention mechanism is obtained, so as to encode the feature vector of the business behavior sequence based on the initialization vector.

8. The method according to claim 1, characterized in that The method further comprises at least one of the following: Using a sliding window to count the number of access requests of the user corresponding to the preset event received by the gateway within a specified time interval, and if the number of requests exceeds a preset risk threshold, identifying the user as a risky user; According to the preset single point risk rule, it is determined whether the characteristic information of the user corresponding to the preset event in the request data of the gateway contains risk information, and the user corresponding to the request data containing risk information is identified as a risky user.

9. A risk identification device, characterized in that: include: A service identification acquisition module, used to parse and obtain a service identification and a user identification from a preset event in response to a preset event trigger; A behavior sequence acquisition module, used to determine a service behavior sequence corresponding to the user identifier from the user behavior sequence of the gateway; The business risk identification module is used to input the business behavior sequence into a pre-built business risk identification model corresponding to the business identifier to obtain the risk identification result of the preset event. The business risk identification model is obtained by training a general identification model based on the business identifier.

10. A mobile electronic device terminal, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images