Model building system and method based on relative distribution and computer program product

Abstract

The invention discloses a model building system and method based on relative distribution and a computer program product, and the method comprises the steps: carrying out the feature processing of equipment data, and obtaining equipment features; selecting basic features with stable distribution from the equipment features; respectively determining the correlation between each equipment feature distribution and the basic feature distribution, and obtaining the relative distribution stability of each equipment feature; and according to the relative distribution stability, screening out target features from other equipment features to construct a recognition model. According to the method, the relative distribution stability of the correlation between the equipment characteristic distribution and the basic characteristic distribution is reflected by taking the basic characteristic with stable distribution as a reference, and the process of comparing the equipment characteristic distribution with the basic characteristic distribution is reflected by the process of carrying out characteristic screening through the relative distribution stability; according to the method, the feature distribution condition can be depicted more meticulously, target features are screened out to construct the model, the accuracy of data hazard and risk identification is improved, and platform data security and information security are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a model building system, method and computer program product based on relative distribution. Background Art

[0002] With the popularization of smart terminals, the number of users of Internet service platforms is increasing. It is inevitable that there will be some illegal and harmful devices / risky devices that affect the data security and information security of the platform, such as data theft, fraud, overdue payments, etc.

[0003] At present, machine learning models (abbreviated as models) are mainly used to identify these devices with hazards and risks. In the process of machine learning modeling, it is usually based on the assumption that "the distribution of verification samples is similar to the distribution of training samples". This assumption is applied to risk control scenarios, that is, the current device sample distribution is similar to the historical device sample distribution. Since the device samples in risk control scenarios vary greatly over time, in order to meet the above assumption, it is necessary to screen features with small fluctuations over time to support modeling.

[0004] In the existing technology, the Population Stability Index (PSI) is mainly used to screen out features from device samples whose distribution difference between the historical training set and the current evaluation set is less than a threshold, so as to ensure that the model constructed by the historical device samples can have a good recognition effect on the current device samples. The PSI indicator measures the feature distribution based on the absolute value of the actual distribution and the expected distribution of the sample. It is a screening process based on the absolute value distribution. In the field of risk control, there is a characteristic that the customer group itself will fluctuate, that is, the current device sample distribution will gradually differ from the historical device sample distribution. Therefore, when using the PSI indicator for feature screening, the difference caused by the fluctuation of the device sample will be lost, affecting the accuracy of the feature screening, and then affecting the training effect of the data hazard model, making it difficult to effectively protect the platform data security and information security. Summary of the invention

[0005] In view of this, the main purpose of the present invention is to propose a model building system, method and computer program product based on relative distribution, in order to at least partially solve at least one of the above technical problems.

[0006] In order to solve the above technical problems, the first aspect of the present invention proposes a model construction system based on relative distribution, the system comprising: A processing module, used to perform feature processing on device data to obtain device features; the device data includes: at least one of the device location, device purchase or return record, device information, and device behavior information; A selection module, used for selecting basic features with stable distribution from the device features; A determination module, used to respectively determine the correlation between each device feature distribution and the basic feature distribution, and obtain the relative distribution stability of each device feature; A screening module, used for screening out target features from other device features according to the relative distribution stability; A building module is used to build a data hazard identification model based on the target features.

[0007] According to a preferred embodiment of the present invention, the determining module includes: A binning module is used to bin the basic features and each device feature, and count the sample proportions in each bin to obtain the actual proportions of the basic features and each device feature in each bin; The sub-determination module is used to determine the correlation between each device feature distribution and the basic feature distribution according to the actual proportion of the basic features and each device feature in each sub-box.

[0008] According to a preferred embodiment of the present invention, the selection module uses device features whose fluctuations over time are consistent with the fluctuations over time of the overall sample as basic features.

[0009] According to a preferred embodiment of the present invention, the selection module includes: Calculation module, used to calculate the PSI value of each device feature, A sub-selection module is used to select basic features with stable distribution from the equipment features according to the PSI value.

[0010] In order to solve the above technical problems, the second aspect of the present invention provides a method for building a model based on relative distribution, the method comprising: Performing feature processing on the device data to obtain device features; the device data includes: at least one of the device location, device purchase or return record, device information, and device behavior information; Selecting basic features with stable distribution from the device features; Determine the correlation between each device feature distribution and the basic feature distribution respectively, and obtain the relative distribution stability of each device feature; Filtering the target feature from other device features based on the relative distribution stability; A data hazard identification model is constructed based on the target features.

[0011] According to a preferred embodiment of the present invention, respectively determining the correlation between each device feature distribution and the basic feature distribution includes: The basic features and each device feature are binned respectively, and the sample proportion in each bin is counted to obtain the actual proportion of the basic features and each device feature in each bin; The correlation between each device feature distribution and the basic feature distribution is determined according to the actual proportions of the basic features and each device feature in each bin.

[0012] According to a preferred embodiment of the present invention, device features whose fluctuations over time are consistent with the fluctuations over time of the entire sample are used as basic features.

[0013] According to a preferred embodiment of the present invention, the selecting of basic features with stable distribution from the device features comprises: Calculate the PSI value for each device characteristic, A basic feature with stable distribution is selected from the device features according to the PSI value.

[0014] In order to solve the above technical problems, the third aspect of the present invention provides an electronic device, including: Processor; and A memory storing computer executable instructions, which when executed cause the processor to perform any of the methods described above.

[0015] In order to solve the above technical problem, the fourth aspect of the present invention provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, it implements any of the methods described above.

[0016] In summary, the present invention selects basic features with stable distribution from device features, and obtains the relative distribution stability of each device feature by determining the correlation between the distribution of each device feature and the basic feature distribution; the relative distribution stability of the feature is used to replace PSI to screen out target features from other device features. Since the relative distribution stability of the feature uses the basic features with stable distribution as a reference to reflect the correlation between the device feature distribution and the basic feature distribution, it describes the relative distribution of the device feature to the basic feature. The feature screening process reflects the process of comparing the device feature distribution with the basic feature distribution, and thus can reflect the fluctuation of the device feature distribution, so that the feature distribution can be more carefully described, so as to screen out features with more stable distribution to construct a data hazard identification model, improve the accuracy of identifying data hazards and risks, and ensure platform data security and information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to make the technical problems solved by the present invention, the technical means adopted and the technical effects achieved more clearly, the specific embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, it should be noted that the drawings described below are only drawings of exemplary embodiments of the present invention, and those skilled in the art can obtain drawings of other embodiments based on these drawings without creative work.

[0018] Figure 1 It is a schematic diagram of a structural framework of a model building system based on relative distribution provided by an embodiment of the present invention; Figure 2 It is a flowchart of a relative distribution-based model building method provided by an embodiment of the present invention; Figure 3 is a schematic diagram of determining the relative distribution stability of the characteristics of the device to be screened according to an embodiment of the present invention; Figure 4 is a structural block diagram of an exemplary embodiment of an electronic device according to the present invention; Figure 5 is a schematic diagram of an embodiment of a computer readable medium of the present invention. DETAILED DESCRIPTION

[0019] Under the premise of conforming to the technical concept of the present invention, the structure, performance, effect or other characteristics described in a specific embodiment may be combined with one or more other embodiments in any appropriate manner.

[0020] In the process of introducing specific embodiments, the detailed description of the structure, performance, effect or other features is to enable those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can implement the present invention with a technical solution that does not contain the above-mentioned structure, performance, effect or other features under certain circumstances. The figures in the accompanying drawings are only an exemplary demonstration, and do not mean that the solution of the present invention must include all the contents, operations and steps in the figures, nor do they mean that they must be executed in the order shown in the figures.

[0021] refer to Figure 1 , Figure 1 The embodiment of the present invention also provides a schematic diagram of a structural framework of a model building system based on relative distribution, such as Figure 1 As shown, the system comprises: The processing module 11 is used to perform feature processing on the device data to obtain device features; the device data includes: at least one of the device location, device purchase or return record, device information, and device behavior information; A selection module 12, used for selecting basic features with stable distribution from the device features; A determination module 13, used to respectively determine the correlation between each device feature distribution and the basic feature distribution, and obtain the relative distribution stability of each device feature; A screening module 14, configured to screen out target features from other device features according to the relative distribution stability; The construction module 15 is used to construct a data hazard identification model based on the target features.

[0022] According to a preferred embodiment of the present invention, the determining module 13 includes: A binning module is used to bin the basic features and each device feature, and count the sample proportions in each bin to obtain the actual proportions of the basic features and each device feature in each bin; The sub-determination module is used to determine the correlation between each device feature distribution and the basic feature distribution according to the actual proportion of the basic features and each device feature in each sub-box.

[0023] Exemplarily, the correlation Si between the i-th device feature distribution and the basic feature distribution is: ; Where: x i is the actual proportion of the basic features in the i-th bin, x is the average of the actual proportions of the basic features, and y i is the actual proportion of the device features in the ith bin, and y is the average of the actual proportions of the device features. According to a preferred embodiment of the present invention, the selection module 12 uses the device features whose fluctuations over time are consistent with the fluctuations over time of the overall samples as basic features.

[0024] According to a preferred embodiment of the present invention, the selection module 12 includes: Calculation module, used to calculate the PSI value of each device feature, A sub-selection module is used to select basic features with stable distribution from the equipment features according to the PSI value.

[0025] based on Figure 1 The model building system based on relative distribution, the embodiment of the present invention further provides a business risk control system, the system comprising: An acquisition module, configured to acquire a target feature of a device in response to a service request of a user device; An identification module, used for inputting the target feature into a pre-built data hazard identification model, so as to identify the data hazard identification result of the device according to the output result of the data hazard identification model, indicating the identification result that the device has a security hazard or risk; the data hazard identification model is constructed by any of the above-mentioned model construction methods; An execution module is used to execute risk control business according to the data hazard identification result.

[0026] based on Figure 1 The model building system based on relative distribution, the embodiment of the present invention also provides a model building method based on relative distribution. Figure 2 , the model building method based on relative distribution includes: S1. Perform feature processing on device data to obtain device features; In this embodiment, the device data may be any device-related data that the device user chooses to make public or anonymize. It may include at least one of: the region where the device is located, the device purchase or return record, the device information, and the device behavior information; wherein the device purchase record refers to the record of the device purchasing goods on the platform. The device return record refers to the record of whether the goods are returned on time after the device applies for the platform goods. The goods may be physical goods, virtual goods, services, etc., and the present invention does not make specific limitations. The device communication record may include the device's address book contacts, the communication records stored by the device, and other communication-related information. The device information may include: the device user's gender, age, education, fraud record, illegal and irregular records, etc. The device behavior information refers to the operation information of the device on the platform, such as browsing, visiting, collecting, clicking, etc.

[0027] The feature processing may include: data cleaning, data unification, and feature derivation. Among them: data cleaning refers to the process of discovering and correcting identifiable errors in data files and obtaining data required for the modeling process through processing. It may include: missing value processing, outlier detection and processing, etc. Data unification is to make the data format meet the needs of the model, which may include: data dimensionlessness, continuous variable discretization, discrete variable processing, etc. Feature derivation is generally a new feature generated by converting, calculating and combining the original features. It may include: basic conversion of a single variable, such as squaring, root root, log conversion, etc. of a single variable; variables are derived by adding a time dimension, such as 3 months of trading data, 6 months of trading data, etc.; multi-variable operations, such as adding two variables, multiplying them, or calculating a ratio between variables to obtain a new variable. Feature extraction is to find the most effective feature from the original feature. The purpose of this approach is to reduce data redundancy, reduce model calculations, and discover more meaningful features.

[0028] S2. Selecting basic features with stable distribution from the device features; In this embodiment, the basic feature distribution is used as a reference to determine the relative distribution stability of each device feature. Therefore, the basic features are some features with stable distribution over time, which can characterize the fluctuation of the distribution of the overall sample over time.

[0029] In one example, basic features can be selected by observing the fluctuation of the distribution of each device feature over time. For example, the device features whose fluctuation over time is consistent with the fluctuation over time of the overall sample can be used as basic features. For example, the age and gender of the device user.

[0030] In another example, basic features can be selected based on the Population Stability Index (PSI) value of each device feature, where PSI reflects the stability of the distribution of validation samples in each score segment and the distribution of modeling samples. This step may include: S21. Calculate the PSI value of each device feature, where: PSI=SUM((i-th actual proportion - i-th expected proportion)*ln(i-th actual proportion / i-th expected proportion)); where: i is a natural number, representing a bin.

[0031] The i-th expected proportion is the proportion of the i-th bin after the feature is binned on the training set. The i-th actual proportion is the proportion of the i-th bin after the feature is binned on the validation set.

[0032] S22. Selecting basic features with stable distribution from the equipment features according to the PSI value.

[0033] S3, respectively determining the correlation between each device feature distribution and the basic feature distribution, and obtaining the relative distribution stability of each device feature; Exemplarily, this step may include: S31, binning the basic features and each device feature, and counting the sample proportions in each bin to obtain the actual proportions of the basic features and each device feature in each bin; In this embodiment, all samples of each device feature may be binned, or training samples of each device feature may be binned.

[0034] Preferably, in order to reduce the amount of calculation and focus on the distribution of actual device features, only the samples of each device feature in the validation set can be binned. Figure 3 In the validation set, the basic features and the features of a device to be screened are divided into equal frequency bins with an interval of 10, and the following can be obtained: Figure 3 The actual proportion of the basic features in the second column in each bin, and the actual proportion of the device features to be screened in each bin in the fourth column.

[0035] S32: Determine the correlation between each device feature distribution and the basic feature distribution according to the actual proportions of the basic features and each device feature in each sub-box.

[0036] In this embodiment, the correlation between the distribution of each device feature and the basic feature distribution can be obtained by processing the actual proportions of the basic features and each device feature in each bin.

[0037] Exemplarily, the correlation Si between the i-th device feature distribution and the basic feature distribution is: ; Where: x i is the actual proportion of the basic features in the i-th bin, x is the average of the actual proportions of the basic features, and y i is the actual proportion of the device features in the i-th bin, and y is the average value of the actual proportion of the device features.

[0038] Through the above calculation, we can get Figure 3 The relative distribution stability of the characteristics of the devices to be screened is 0.93.

[0039] S4, selecting a target feature from other device features according to the relative distribution stability; In this embodiment, a threshold may be preset, and a device feature whose relative distribution stability is greater than the threshold is used as a target feature.

[0040] Preferably, the threshold is 0.8, then Figure 3 The features to be screened in are the target features.

[0041] Further, in order to verify the advantages of the relative distribution stability of the device features in the present invention over PSI in feature screening, Figure 3 In the training set, the basic features and the features of the device to be screened are divided into equal frequency bins with an interval of 10, and the following is obtained: Figure 3 The expected proportion of the basic features in the first column in each bin, and the expected proportion of the device features to be screened in the third column in each bin, and then the PSI of the device features to be screened is calculated to be 0.1182. By comparing the relative distribution stability of the device features in the present invention with the feature PSI to determine whether the device features to be screened are the target features, it can be seen that: if only the absolute value screening of the device features to be screened PSI>0.1 is considered, the device features to be screened are judged to be unstable features. However, by observing the process of calculating PSI, the basic features are shifting toward the small box, which serves as evidence that the overall sample is shifting toward the better. At the same time, the features to be screened are also shifting toward the small box, but they are more sensitive and the magnitude of the shift is larger. It is believed that the features to be screened are also depicting the fluctuations of the overall sample, and the relative distribution stability of the device features to be screened is 0.93, indicating that the device features to be screened can effectively depict the shift and fluctuation of the overall sample. Therefore, Figure 3 The characteristics to be screened are consistent with the fluctuation of the overall sample and should be used as target characteristics.

[0042] S5. Construct a data hazard identification model based on the target features.

[0043] Exemplarily, all the target features that can be screened can be input into a preset model for training to obtain a data hazard identification model. The preset model can be a Lightgbm model, an XGBoost model, etc.

[0044] based on Figure 2 The model building method based on relative distribution, the embodiment of the present invention also provides a business risk control method, the method comprising: S101, in response to a service request of a user device, obtaining target device characteristics of the user; S103, inputting the target device characteristics into a pre-built data hazard identification model to identify the data hazard identification result of the device according to the output result of the data hazard identification model; the data hazard identification model is constructed by any of the above-mentioned model construction methods; S103: Execute risk control services according to the data hazard identification results.

[0045] Those skilled in the art will appreciate that the modules in the above device embodiments may be distributed in the device as described, or may be changed accordingly and distributed in one or more devices different from the above embodiments. The modules in the above embodiments may be combined into one module, or may be further split into multiple submodules.

[0046] The electronic device embodiment of the present invention is described below, and the electronic device can be regarded as a physical implementation of the method and device embodiments of the present invention described above. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0047] Figure 4 is a structural block diagram of an exemplary embodiment of an electronic device according to the present invention. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0048] like Figure 4 As shown, the electronic device 400 of this exemplary embodiment is in the form of a general data processing device. The components of the electronic device 400 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, a bus 430 connecting different electronic device components (including the storage unit 420 and the processing unit 410), a display unit 440, etc.

[0049] The storage unit 420 stores a computer-readable program, which may be a source program or a code of a read-only program. The program may be executed by the processing unit 410, so that the processing unit 410 performs the steps of various embodiments of the present invention. For example, the processing unit 410 may perform the following steps: Figure 2 Steps shown.

[0050] Bus 430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0051] The electronic device 400 may also communicate with one or more external devices 100 (e.g., keyboard, display, network device, Bluetooth device, etc.) so that a user can interact with the electronic device 400 via these external devices 100, and / or the electronic device 400 can communicate with one or more other data processing devices (e.g., router, modem, etc.). Such communication may be performed through an input / output (I / O) interface 450, and may also be performed through a network adapter 460 with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network. The network adapter 460 may communicate with other modules of the electronic device 400 through a bus 430.

[0052] Figure 5 Schematic diagram of a computer readable medium embodiment of the present invention. Figure 5 As shown, the computer program can be stored on one or more computer-readable media. The computer-readable medium can be a readable signal medium or a readable storage medium. When the computer program is executed by one or more data processing devices, the computer-readable medium can implement the above method of the present invention, namely: feature processing is performed on the device data to obtain device features; the device data includes: at least one of the device location, device purchase or return records, device information, and device behavior information; basic features with stable distribution are selected from the device features; the correlation between each device feature distribution and the basic feature distribution is determined respectively to obtain the relative distribution stability of each device feature; the target feature is selected from other device features according to the relative distribution stability; and a data hazard identification model is constructed based on the target feature.

[0053] In summary, the present invention can be implemented by a method, apparatus, system, electronic device or computer-readable medium that executes a computer program. In practice, a general-purpose data processing device such as a microprocessor or a digital signal processor (DSP) can be used to implement some or all of the functions of the present invention.

[0054] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A model building system based on relative distribution, characterized in that: The system comprises: A processing module, used to perform feature processing on device data to obtain device features; the device data includes: at least one of the device location, device purchase or return record, device information, and device behavior information; A selection module, used for selecting basic features with stable distribution from the device features; A determination module, used to respectively determine the correlation between each device feature distribution and the basic feature distribution, and obtain the relative distribution stability of each device feature; A screening module, used for screening out target features from other device features according to the relative distribution stability; A building module is used to build a data hazard identification model based on the target features.

2. The system according to claim 1, characterized in that The determination module comprises: A binning module is used to bin the basic features and each device feature, and count the sample proportions in each bin to obtain the actual proportions of the basic features and each device feature in each bin; The sub-determination module is used to determine the correlation between each device feature distribution and the basic feature distribution according to the actual proportion of the basic features and each device feature in each sub-box.

3. The system according to claim 1, characterized in that The selection module uses the device features whose fluctuations over time are consistent with the fluctuations over time of the overall samples as basic features.

4. The system according to claim 1, characterized in that The selection module includes: Calculation module, used to calculate the PSI value of each device feature, A sub-selection module is used to select basic features with stable distribution from the equipment features according to the PSI value.

5. A method for constructing a model based on relative distribution, characterized in that: The method comprises: Performing feature processing on the device data to obtain device features; the device data includes: at least one of the device location, device purchase or return record, device information, and device behavior information; Selecting basic features with stable distribution from the device features; Determine the correlation between each device feature distribution and the basic feature distribution respectively, and obtain the relative distribution stability of each device feature; Filtering the target feature from other device features based on the relative distribution stability; A data hazard identification model is constructed based on the target features.

6. The method according to claim 5, characterized in that The respectively determining the correlation between each device feature distribution and the basic feature distribution comprises: The basic features and each device feature are binned respectively, and the sample proportion in each bin is counted to obtain the actual proportion of the basic features and each device feature in each bin; The correlation between each device feature distribution and the basic feature distribution is determined according to the actual proportions of the basic features and each device feature in each bin.

7. The method according to claim 5, characterized in that The device features whose fluctuations over time are consistent with the fluctuations over time of the overall sample are taken as basic features.

8. The method according to claim 5, characterized in that The step of selecting basic features with stable distribution from the device features includes: Calculate the PSI value for each device characteristic, A basic feature with stable distribution is selected from the device features according to the PSI value.

9. An electronic device, comprising: processor; as well as A memory storing computer executable instructions which, when executed, cause the processor to perform a method according to any one of claims 5 to 8.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 5 to 8 is implemented.

Images