Method and system for determining Internet risk user group

Abstract

The invention relates to the technical field of Internet, in particular to a method and system for determining an Internet risk user group, and the method comprises the steps: obtaining the attribute data and behavior data of the Internet user group; acquiring equipment data used by the user group based on a fingerprint identification technology; respectively preprocessing the attribute data, the behavior data and the equipment data to obtain first attribute data, first behavior data and first equipment data; performing feature extraction on first attribute data, the first behavior data and the first equipment data to obtain first attribute feature data, first behavior feature data and first equipment feature data, and fusing the first attribute feature data, the first behavior feature data and the first equipment feature data to obtain a multi-feature data fusion vector; and constructing a risk assessment model of multi-feature data fusion, and inputting the multi-feature data fusion vector into the model for Internet user group assessment to obtain a risk user group assessment result. Through the method, the risk user can be accurately and quickly determined at low cost.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method and system for determining a group of Internet risk users. Background Art

[0002] With the development of computer and Internet technology, more and more user groups conduct various business activities such as browsing and transactions on the Internet. However, in the execution and processing of many businesses, if the background of the business requester and the requested business are not reviewed, it is likely to bring greater risks. Risky users may affect the healthy and stable development of the consumer market. Therefore, accurately and quickly identifying risky users and taking risk prevention and control measures for risky users in a timely manner can avoid economic losses and ensure the smooth operation of the consumer market. Therefore, how to accurately and quickly identify risky user groups needs to be solved urgently. Summary of the invention

[0003] The main purpose of this application is to provide a method and system for determining risky Internet user groups, aiming to accurately and quickly determine risky user groups.

[0004] In order to achieve the above invention objectives, the present application proposes a method for determining a group of Internet risk users, comprising:

[0005] Obtaining attribute data and behavior data of Internet user groups, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records;

[0006] Acquire device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type;

[0007] Preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data;

[0008] Extracting features from the first attribute data, the first behavior data, and the first device data respectively to obtain first attribute feature data, first behavior feature data, and first device feature data;

[0009] Fusing the first attribute feature data, the first behavior feature data, and the first device feature data to obtain a multi-feature data fusion vector;

[0010] A risk assessment model based on multi-feature data fusion is constructed, and the multi-feature data fusion vector is input into the multi-feature data fusion risk assessment model to perform Internet user group assessment to obtain a risk user group assessment result.

[0011] Furthermore, the risk assessment model of multi-feature data fusion is constructed, and the multi-feature data fusion vector is input into the risk assessment model of multi-feature data fusion to perform Internet risk user group assessment, and obtain the risk user group assessment result, including:

[0012] Obtain historical multi-feature fusion vectors, and mark each fusion feature vector as N / A, representing normal state and abnormal state respectively;

[0013] Dividing the historical multi-feature fusion vector set into a training set and a test set, and constructing a decision tree based on the Gini index and information gain rate of the probability distribution of the training set;

[0014] Inputting the test set into the decision tree and calculating the prediction accuracy;

[0015] When the prediction accuracy is lower than a preset threshold, the decision tree is pruned to generate a risk assessment model that integrates multiple feature data;

[0016] Obtain the current multi-feature data fusion vector, input the current multi-feature data fusion vector into the multi-feature data fusion risk assessment model for evaluation, and classify the state category according to the trained rules. The multi-feature data fusion risk assessment model outputs the current state of the user group: normal / abnormal based on the feature data concentratedly reflected by the current multi-feature data fusion vector.

[0017] Furthermore, before the step of obtaining attribute data and behavior data of an Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records, the following steps are included:

[0018] Collecting image data and voice data of a user group, and preprocessing the image data and the voice data to obtain first image data and first voice data;

[0019] Extracting features corresponding to the first image data by using facial expression analysis and gesture detection to obtain first image data after feature extraction;

[0020] Converting the first speech data into text or emotional features to obtain first language data after feature extraction;

[0021] Fusing the first image data after feature extraction and the first language data to obtain multimodal fusion data features;

[0022] Performing personal identification on the multimodal fusion data features based on a neural network model to obtain a personal identification result;

[0023] Determine whether to obtain attribute data and behavior data of the user group based on the personal identity recognition result.

[0024] Furthermore, before the step of acquiring the device data used by the user group based on the fingerprint recognition technology, wherein the device data includes the device type, operating system version, and browser type, the following steps are included:

[0025] Continuously collecting a plurality of fingerprint images, and preprocessing the plurality of fingerprint images to obtain a plurality of first fingerprint images, wherein the preprocessing includes grayscale transformation, segmentation, equalization, enhancement and refinement of the images;

[0026] Extracting features of fingerprint endpoints and forks from the plurality of first fingerprint images using the grayscale values ​​of the fingerprint feature distribution to obtain a plurality of first fingerprint feature images;

[0027] Determining whether each of the first fingerprint feature images is the same as a corresponding standard fingerprint feature image in a preset fingerprint template;

[0028] If yes, then perform an unlocking operation and obtain device data used by the user group based on fingerprint recognition technology;

[0029] If not, the unlocking operation is not performed.

[0030] Furthermore, the fusing of the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector includes:

[0031] Based on a convolutional neural network, the first attribute feature data, the first behavior feature data, and the first device feature data are converted into a first attribute feature vector, a first behavior feature vector, and a first device feature vector, respectively;

[0032] assigning weights to the first attribute feature vector, the first behavior feature vector, and the first device feature vector respectively to obtain corresponding weight coefficients;

[0033] Multiplying the first attribute feature vector, the first behavior feature vector, and the first device feature vector by their corresponding weight coefficients respectively to obtain corresponding weighted feature vectors;

[0034] The weighted feature vectors corresponding to the first attribute feature vector, the first behavior feature vector, and the first device feature vector are linearly added to obtain a multi-feature data fusion vector.

[0035] Further, the extracting features from the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data includes:

[0036] Counting the first attribute data to obtain first attribute statistical data;

[0037] Dividing the first attribute statistical data into categorical attribute data and numerical attribute data;

[0038] Performing one-hot encoding on the categorical attribute data to obtain categorical attribute encoded data;

[0039] Normalizing the numerical attribute data to obtain normalized numerical attribute data;

[0040] The first attribute feature data is obtained according to the categorized attribute coding data and the normalized numerical attribute data.

[0041] Further, the extracting features from the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data respectively includes:

[0042] Obtaining a timestamp corresponding to the first behavior data;

[0043] Sort the first behavior data according to the timestamp to obtain first behavior sorted data;

[0044] The data type of the data in the first behavior sorting data is converted, and the converted behavior sequences are spliced ​​to obtain behavior sequence embedding features.

[0045] Performing time feature encoding on the timestamp of each behavior data in the first behavior sorting data to obtain a time-aware feature;

[0046] The behavior sequence embedding feature is fused with the time perception feature to obtain first behavior feature data.

[0047] A system for determining a group of Internet risk users, characterized in that the system comprises:

[0048] The attribute data and behavior data module is used to obtain the attribute data and behavior data of Internet users, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records;

[0049] A device data module, used to obtain the device data used by the user based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type;

[0050] A preprocessing module, used to preprocess the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data;

[0051] an extraction module, used to extract features from the first attribute data, the first behavior data and the first device data respectively, to obtain first attribute feature data, first behavior feature data and first device feature data;

[0052] A multi-feature data fusion vector module, used for fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector;

[0053] The evaluation module is used to construct a risk evaluation model of multi-feature data fusion, input the multi-feature data fusion vector into the multi-feature data fusion risk evaluation model to perform Internet risk user evaluation, and obtain risk user evaluation results.

[0054] The present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above-mentioned methods for determining Internet risk user groups when executing the computer program.

[0055] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods for determining an Internet risk user group are implemented.

[0056] The present application relates to the field of Internet technology, and in particular to a method and system for determining Internet risk user groups, the method comprising: obtaining attribute data and behavior data of Internet user groups, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records; obtaining device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version and browser type; preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data; extracting features from the first attribute data, the first behavior data and the first device data respectively to obtain first attribute feature data, first behavior feature data and first device feature data; fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector; constructing a multi-feature data fusion risk assessment model, inputting the multi-feature data fusion vector into the multi-feature data fusion risk assessment model to perform Internet user group assessment, and obtaining a risk user group assessment result. Through the above method, risk users can be determined accurately and quickly at a low cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A flowchart of an embodiment of a method for determining a risky Internet user group of the present application;

[0058] Figure 2 A schematic diagram of the structure of the system for determining Internet risk user groups for this application;

[0059] Figure 3 This is a schematic block diagram of the structure of an embodiment of a computer device of the present application.

[0060] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] Reference Figure 1 , an embodiment of the present application provides a method for determining an Internet risk user group, including steps S10-S60, and each step of the method for determining an Internet risk user group is described in detail as follows.

[0063] S10, obtaining attribute data and behavior data of an Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records;

[0064] In this embodiment, in one embodiment, before the above steps, it specifically includes: collecting image data and voice data of the user group, and preprocessing the image data and the voice data to obtain first image data and first voice data; using facial expression analysis and gesture detection to extract features corresponding to the first image data to obtain first image data after feature extraction; converting the first voice data into text or emotional features to obtain first language data after feature extraction; fusing the first image data after feature extraction and the first language data to obtain multimodal fusion data features; performing personal identity recognition on the multimodal fusion data features based on a neural network model to obtain a personal identity recognition result; and determining whether to obtain attribute data and behavior data of the user group based on the personal identity recognition result.

[0065] S20, obtaining device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type;

[0066] In this embodiment, in one embodiment, before the above steps, it specifically includes: continuously collecting multiple fingerprint images, preprocessing the multiple fingerprint images to obtain multiple first fingerprint images, wherein the preprocessing includes grayscale transformation, segmentation, equalization, enhancement and refinement of the image; using the grayscale value of the fingerprint feature distribution to extract the features of the fingerprint endpoints and cross points of the multiple first fingerprint images to obtain multiple first fingerprint feature images; judging whether each of the first fingerprint feature images is the same as the corresponding standard fingerprint feature image in the preset fingerprint template; if so, performing an unlocking operation and obtaining the device data used by the user group based on the fingerprint recognition technology; if not, not performing the unlocking operation.

[0067] S30, preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data;

[0068] In this embodiment, the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records: the preprocessing process may include: processing missing values ​​for missing attribute information; converting non-numeric attribute information into numeric type, representing gender with 0 and 1, and representing region with code, etc. Behavior data includes user operation behavior in the system, such as login time, browsing history, purchase history, etc. The preprocessing process includes: performing time series processing, extracting time features such as hours, days of the week, etc. for time-related behavior data. Cleaning the data to remove outliers or erroneous data, such as data points with excessively high or low behavior frequencies in extreme cases. Device data includes device information used by users, such as operating system, device model, network information, etc. The preprocessing process may include: extracting valid feature information from original device data, such as extracting brand, model, etc. information from device model. Standardizing the data, for numerical device data, standardizing or normalizing, so that data with different features are within the same dimensional range. In one embodiment, there is a set of attribute data including age, gender and region, the first attribute data includes: age: 30, gender: 1 (representing male), region: 001 (region code), the first behavior data is login time: 2024-06-0310:30:15, for device data, the first device data includes: operating system: iOS, device model: iPhone 12, network type: WiFi.

[0069] S40, respectively extracting features from the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data;

[0070] In this embodiment, in one embodiment, the above steps specifically include: extracting features from the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data, including: counting the first attribute data to obtain first attribute statistical data; dividing the first attribute statistical data into categorical attribute data and numerical attribute data; performing unique hot encoding on the categorical attribute data to obtain categorical attribute coded data; normalizing the numerical attribute data to obtain normalized numerical attribute data; obtaining first attribute feature data according to the categorical attribute coded data and the normalized numerical attribute data

[0071] S50, respectively extracting features from the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data;

[0072] In this embodiment, in another embodiment, the above steps specifically further include: obtaining the corresponding timestamp in the first behavior data; sorting each of the first behavior data according to the timestamp to obtain first behavior sorting data; converting the data type of the data in the first behavior sorting data, and splicing the converted behavior sequence to obtain a behavior sequence embedding feature. Encoding the time feature of the timestamp of each behavior data in the first behavior sorting data to obtain a time-aware feature; fusing the behavior sequence embedding feature with the time-aware feature to obtain the first behavior feature data.

[0073] S60: construct a risk assessment model by fusion of multiple feature data, input the multiple feature data fusion vector into the risk assessment model by fusion of multiple feature data to perform Internet user group assessment, and obtain risk user group assessment results.

[0074] In this embodiment, in one embodiment, the above steps specifically include: obtaining historical multi-feature fusion vectors, and marking each fusion feature vector as two states of N / A, representing a normal state and an abnormal state respectively; dividing the historical multi-feature fusion vector set into a training set and a test set, and constructing a decision tree based on the Gini index of the probability distribution of the training set and the information gain rate; inputting the test set into the decision tree and calculating the prediction accuracy; when the prediction accuracy is lower than a preset threshold, pruning the decision tree to generate a risk assessment model of multi-feature data fusion; obtaining the current multi-feature data fusion vector, inputting the current multi-feature data fusion vector into the multi-feature data fusion risk assessment model for evaluation, and classifying the state categories according to the training rules, and the multi-feature data fusion risk assessment model outputs the current state of the user group: normal / abnormal based on the feature data reflected in the current multi-feature data fusion vector set.

[0075] In one embodiment, the risk assessment model of multi-feature data fusion is constructed, and the multi-feature data fusion vector is input into the risk assessment model of the multi-feature data fusion to evaluate the Internet risk user group, and the risk user group assessment result is obtained, including: obtaining historical multi-feature fusion vectors, and marking each fusion feature vector as two states of N / A, representing a normal state and an abnormal state respectively; dividing the historical multi-feature fusion vector set into a training set and a test set, and constructing a decision tree based on the Gini index of the probability distribution of the training set and the information gain rate; inputting the test set into the decision tree and calculating the prediction accuracy; pruning the decision tree when the prediction accuracy is lower than a preset threshold to generate a risk assessment model of multi-feature data fusion; obtaining the current multi-feature data fusion vector, inputting the current multi-feature data fusion vector into the risk assessment model of multi-feature data fusion for evaluation, and classifying the state category according to the training rules, and the multi-feature data fusion risk assessment model outputs the current state of the user group: normal / abnormal based on each feature data reflected in the current multi-feature data fusion vector set.

[0076] In this embodiment, a historical multi-feature fusion vector is obtained. In one embodiment, there are 1000 historical multi-feature fusion vectors, each vector contains 10 features, so there are 10000 features in total. Each feature vector is marked as normal (N) or abnormal (A) state. The 10000 features are divided into a training set and a test set, 80% of the data is used for training, and 20% of the data is used for testing. Therefore, the training set has 800 samples and the test set has 200 samples. The Gini index and information gain rate of the probability distribution of the training set are used to construct a decision tree. The depth and number of nodes of the decision tree are determined according to the characteristics of the training data. In this embodiment, a decision tree with a depth of 5 is constructed. The test set is input into the decision tree, and the prediction accuracy is calculated. In this embodiment, the prediction accuracy is 85%. If the prediction accuracy is lower than the preset threshold, the preset threshold is 90% in this embodiment, the decision tree is pruned to improve the generalization ability of the model. The pruned decision tree is the risk assessment model of multi-feature data fusion. Get the current multi-feature data fusion vector: Input the current multi-feature data fusion vector into the risk assessment model for evaluation and classification. According to the rules of model training, the user group is divided into normal and abnormal states. When the user group is in an abnormal state, it is a risk user.

[0077] In one embodiment, before the step of obtaining attribute data and behavior data of an Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records, the method includes: collecting image data and voice data of the user group, and preprocessing the image data and the voice data to obtain first image data and first voice data; extracting features corresponding to the first image data by facial expression analysis and gesture detection to obtain first image data after feature extraction; converting the first voice data into text or emotional features to obtain first language data after feature extraction; fusing the first image data after feature extraction with the first language data to obtain multimodal fusion data features; performing personal identity recognition on the multimodal fusion data features based on a neural network model to obtain a personal identity recognition result; and determining whether to obtain the attribute data and behavior data of the user group according to the personal identity recognition result.

[0078] In this embodiment, in one embodiment, image data and voice data of 100,000 Internet users were collected, the image data was denoised and size-standardized, and the voice data was denoised and converted into a standardized audio format. Facial expression analysis of the image data extracted facial expression features of 100,000 users. Gesture detection extracted gesture features of 100,000 users. The voice data was converted into text, and text features of 100,000 users were obtained. Facial expression features, gesture features, and text features were fused to form multimodal fusion data features. The neural network model was used to successfully identify 90% of the user identities, and the identity information of 90,000 users was obtained. Based on the results of personal identity recognition, it was decided to obtain the attributes and behavior data of 80,000 user groups.

[0079] In one embodiment, before the step of obtaining the device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type, the step includes: continuously collecting multiple fingerprint images, preprocessing the multiple fingerprint images, and obtaining multiple first fingerprint images, wherein the preprocessing includes grayscale transformation, segmentation, equalization, enhancement, and refinement of the images; performing feature extraction of fingerprint endpoints and cross points on the multiple first fingerprint images using the grayscale values ​​of the fingerprint feature distribution to obtain multiple first fingerprint feature images; determining whether each of the first fingerprint feature images is the same as the corresponding standard fingerprint feature image in a preset fingerprint template; if so, performing an unlocking operation and obtaining the device data used by the user group based on fingerprint recognition technology; if not, not performing an unlocking operation.

[0080] In this embodiment, specifically, in one embodiment, multiple fingerprint images are collected continuously: fingerprint images of 10 different users are collected, and each user provides 3 fingerprint images, for a total of 30 fingerprint images. The 30 fingerprint images are preprocessed, including grayscale transformation, segmentation, equalization, enhancement and refinement processing. The features of the fingerprint endpoints and forks are extracted from each preprocessed fingerprint image, and the corresponding first fingerprint feature image is obtained from each fingerprint image, for a total of 30 first fingerprint feature images. The 30 first fingerprint feature images are compared with a preset standard fingerprint template. In this embodiment, 20 first fingerprint feature images match the preset fingerprint template, and the other 10 do not match. For the 20 matching fingerprint images, an unlocking operation is performed to allow the user to access the device. After the successful unlocking based on the fingerprint recognition technology, the device data of the 20 users is obtained. The device data includes information such as device type, operating system version, browser type, etc. For the 10 unmatched fingerprint images, the unlocking operation is not performed, and the user cannot access the device or obtain device data.

[0081] In one embodiment, the first attribute feature data, the first behavior feature data and the first device feature data are fused to obtain a multi-feature data fusion vector, including: based on a convolutional neural network, the first attribute feature data, the first behavior feature data and the first device feature data are respectively converted into a first attribute feature vector, a first behavior feature vector and a first device feature vector; weights are respectively assigned to the first attribute feature vector, the first behavior feature vector and the first device feature vector to obtain corresponding weight coefficients; the first attribute feature vector, the first behavior feature vector and the first device feature vector are respectively multiplied by their corresponding weight coefficients to obtain corresponding weighted feature vectors; and the weighted feature vectors corresponding to the first attribute feature vector, the first behavior feature vector and the first device feature vector are linearly added to obtain a multi-feature data fusion vector.

[0082] In this embodiment, specifically, in one embodiment, each feature data is converted into a feature vector by means of a convolutional neural network or the like. These feature vectors capture the key information of each feature and assign a weight coefficient to each feature vector. These coefficients are usually predefined or learned through training data. Each feature vector is multiplied by its corresponding weight coefficient to obtain a weighted feature vector, and the weighted feature vectors are linearly added to obtain a multi-feature data fusion vector. Specifically, the first attribute feature data is [1.2, 0.8, 1.5, 1.0], the first behavior feature data is [0.5, 0.7, 0.3, 0.9], and the first device feature data is [0.3, 0.6, 0.4, 0.8]. Based on the convolutional neural network, each set of data is converted into a feature vector. The converted feature vectors are: the first attribute feature vector is [0.6, 0.8, 0.7, 0.9], the first behavior feature vector is [0.4, 0.5, 0.3, 0.6], and the first device feature vector is [0.3, 0.7, 0.5, 0.8]. Each feature vector is assigned a corresponding weight coefficient, the weight coefficient of the first attribute feature vector is 0.4, the weight coefficient of the first behavior feature vector is 0.3, and the weight coefficient of the first device feature vector is 0.3. Each feature vector is multiplied by its corresponding weight coefficient to obtain a weighted feature vector. The weighted feature vector of the first attribute is [0.6*0.4, 0.8*0.4, 0.7*0.4, 0.9*0.4]=[0.24, 0.32, 0.28, 0.36], the weighted feature vector of the first behavior is [0.4*0.3, 0.5*0.3, 0.3*0.3, 0.6*0.3]=[0.12, 0.15, 0.09, 0.18], and the weighted feature vector of the first device is [0.3*0.3, 0.7*0.3, 0.5*0.3, 0.8*0.3]=[0.09, 0.21, 0.15, 0.24]. The weighted feature vectors are linearly added to obtain the multi-feature data fusion vector, [0.24+0.12+0.09, 0.32+0.15+0.21, 0.28+0.09+0.15, 0.36+0.18+0.24] = [0.45, 0.68, 0.52, 0.78]. In this way, a multi-feature data fusion vector is obtained, in which each dimension represents the comprehensive information of different features.

[0083] In one embodiment, the feature extraction of the first attribute data, the first behavior data and the first device data to obtain first attribute feature data, first behavior feature data and first device feature data includes: counting the first attribute data to obtain first attribute statistical data; dividing the first attribute statistical data into categorical attribute data and numerical attribute data; performing one-hot encoding on the categorical attribute data to obtain categorical attribute coded data; normalizing the numerical attribute data to obtain normalized numerical attribute data; and obtaining first attribute feature data based on the categorical attribute coded data and the normalized numerical attribute data.

[0084] In this embodiment, in one embodiment, we have a set of user data, including the following attribute data: age, gender, geographic location, occupation, and a set of user behavior data, including: browsing history, clicked links, transaction records; statistics of the first attribute data: statistics of age, gender, geographic location and occupation are performed to obtain respective statistical data, such as average, maximum, minimum, etc. The statistical data is divided into categorical attribute data and numerical attribute data: in one embodiment, age is a numerical attribute, gender, geographic location and occupation are categorical attributes, gender, geographic location and occupation are uniquely encoded, converted into binary form, age is normalized, scaled to the range of 0 to 1, and the uniquely encoded categorical attribute data and the normalized numerical attribute data are combined to obtain the first attribute feature data. Through this example, you can see how to extract features based on different attribute data and use them for training and prediction of machine learning models.

[0085] In one embodiment, the feature extraction of the first attribute data, the first behavior data and the first device data respectively to obtain the first attribute feature data, the first behavior feature data and the first device feature data includes: obtaining the corresponding timestamp in the first behavior data; sorting each of the first behavior data according to the timestamp to obtain the first behavior sorting data; converting the data type of the data in the first behavior sorting data, and splicing the converted behavior sequence to obtain the behavior sequence embedded feature. Performing time feature encoding on the timestamp of each behavior data in the first behavior sorting data to obtain the time-aware feature; fusing the behavior sequence embedded feature with the time-aware feature to obtain the first behavior feature data.

[0086] In this embodiment, in one embodiment, a series of user behavior data is obtained, including browsing history, clicked links, and transaction records, and each record has a timestamp indicating the time when the user performed the behavior. We sort the user behavior data according to the timestamp for subsequent feature extraction and analysis. The sorted user behavior data is converted into data type, and the text data is converted into a vector representation. Then, we splice the converted behavior sequences together to form a behavior sequence embedding feature, and perform time feature encoding on the timestamps in the behavior data, which may include extracting time units such as hours, minutes, and seconds, or converting the timestamps into time differences relative to a certain reference time. The behavior sequence embedding feature is fused with the time perception feature to obtain the first behavior feature data. Specifically, user behavior data: browsing history: [product A, product B, product C], clicked links: [link X, link Y], transaction records: [order 1, order 2], specifically, their timestamps are: browsing history timestamp: [10:00, 10:15, 10:30], clicked link timestamp: [10:05, 10:20], transaction record timestamp: [10:35, 10:45]. These behavior data are sorted by timestamp, and then data type conversion and splicing are performed to form behavior sequence embedding features. Then the timestamp is encoded with time features, including extracting information such as hours and minutes. Finally, we merge the behavior sequence embedding features with the time-aware features to obtain the first behavior feature data, which can better describe the user's behavior and the time characteristics of the behavior.

[0087] Reference Figure 2 The present application provides a system for determining a group of Internet risk users, the system comprising:

[0088] The attribute data and behavior data module 10 is used to obtain the attribute data and behavior data of the Internet user, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records;

[0089] The device data module 20 is used to obtain the device data used by the user based on the fingerprint recognition technology, wherein the device data includes the device type, operating system version, and browser type;

[0090] A preprocessing module 30, used to preprocess the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data;

[0091] An extraction module 40, configured to extract features from the first attribute data, the first behavior data, and the first device data, respectively, to obtain first attribute feature data, first behavior feature data, and first device feature data;

[0092] A multi-feature data fusion vector module 50, configured to fuse the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector;

[0093] The evaluation module 60 is used to construct a risk evaluation model of multi-feature data fusion, input the multi-feature data fusion vector into the multi-feature data fusion risk evaluation model to perform Internet risk user evaluation, and obtain risk user evaluation results.

[0094] As described above, it can be understood that the various components of the system for determining Internet risk user groups proposed in this application can realize the functions of any of the methods for determining Internet risk user groups described above.

[0095] In one embodiment, the evaluation module 60 further comprises executing:

[0096] Obtain historical multi-feature fusion vectors, and mark each fusion feature vector as N / A, representing normal state and abnormal state respectively;

[0097] Dividing the historical multi-feature fusion vector set into a training set and a test set, and constructing a decision tree based on the Gini index and information gain rate of the probability distribution of the training set;

[0098] Inputting the test set into the decision tree and calculating the prediction accuracy;

[0099] When the prediction accuracy is lower than a preset threshold, the decision tree is pruned to generate a risk assessment model that integrates multiple feature data;

[0100] Obtain the current multi-feature data fusion vector, input the current multi-feature data fusion vector into the multi-feature data fusion risk assessment model for evaluation, and classify the state category according to the trained rules. The multi-feature data fusion risk assessment model outputs the current state of the user group: normal / abnormal based on the feature data concentratedly reflected by the current multi-feature data fusion vector.

[0101] In one embodiment, the attribute data and behavior data module 10 further includes executing:

[0102] Collecting image data and voice data of a user group, and preprocessing the image data and the voice data to obtain first image data and first voice data;

[0103] Extracting features corresponding to the first image data by using facial expression analysis and gesture detection to obtain first image data after feature extraction;

[0104] Converting the first speech data into text or emotional features to obtain first language data after feature extraction;

[0105] Fusing the first image data after feature extraction and the first language data to obtain multimodal fusion data features;

[0106] Performing personal identification on the multimodal fusion data features based on a neural network model to obtain a personal identification result;

[0107] Determine whether to obtain attribute data and behavior data of the user group based on the personal identity recognition result.

[0108] In one embodiment, the device data module 20 further includes executing:

[0109] Continuously collecting a plurality of fingerprint images, and preprocessing the plurality of fingerprint images to obtain a plurality of first fingerprint images, wherein the preprocessing includes grayscale transformation, segmentation, equalization, enhancement and refinement of the images;

[0110] Extracting features of fingerprint endpoints and forks from the plurality of first fingerprint images using the grayscale values ​​of the fingerprint feature distribution to obtain a plurality of first fingerprint feature images;

[0111] Determining whether each of the first fingerprint feature images is the same as a corresponding standard fingerprint feature image in a preset fingerprint template;

[0112] If yes, then perform an unlocking operation and obtain device data used by the user group based on fingerprint recognition technology;

[0113] If not, the unlocking operation is not performed.

[0114] In one embodiment, the multi-feature data fusion vector module 50 further includes executing:

[0115] Based on a convolutional neural network, the first attribute feature data, the first behavior feature data, and the first device feature data are converted into a first attribute feature vector, a first behavior feature vector, and a first device feature vector, respectively;

[0116] assigning weights to the first attribute feature vector, the first behavior feature vector, and the first device feature vector respectively to obtain corresponding weight coefficients;

[0117] Multiplying the first attribute feature vector, the first behavior feature vector, and the first device feature vector by their corresponding weight coefficients respectively to obtain corresponding weighted feature vectors;

[0118] The weighted feature vectors corresponding to the first attribute feature vector, the first behavior feature vector, and the first device feature vector are linearly added to obtain a multi-feature data fusion vector.

[0119] In one embodiment, the extraction module 40 further comprises executing:

[0120] Counting the first attribute data to obtain first attribute statistical data;

[0121] Dividing the first attribute statistical data into categorical attribute data and numerical attribute data;

[0122] Performing one-hot encoding on the categorical attribute data to obtain categorical attribute encoded data;

[0123] Normalizing the numerical attribute data to obtain normalized numerical attribute data;

[0124] The first attribute feature data is obtained according to the categorized attribute coding data and the normalized numerical attribute data.

[0125] In one embodiment, the extraction module 40 further comprises executing:

[0126] Obtaining a timestamp corresponding to the first behavior data;

[0127] Sort the first behavior data according to the timestamp to obtain first behavior sorted data;

[0128] The data type of the data in the first behavior sorting data is converted, and the converted behavior sequences are spliced ​​to obtain behavior sequence embedding features.

[0129] Performing time feature encoding on the timestamp of each behavior data in the first behavior sorting data to obtain a time-aware feature;

[0130] The behavior sequence embedding feature is fused with the time perception feature to obtain the first behavior feature data

[0131] Reference Figure 3 In an embodiment of the present application, a computer device is also provided, the internal structure of which can be as follows: Figure 3As shown. The computer device includes a processor, a memory, a network interface, a display device and an input device connected through a system bus. Among them, the network interface of the computer device is used to communicate with an external terminal through a network connection. The display device of the computer device is used to display an interactive page. The input device of the computer device is used to receive user input. The processor designed for the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium. The non-volatile storage medium stores an operating system, a computer program and a database. The database of the computer device is used to store raw data. When the computer program is executed by the processor, a method for determining an Internet risk user group is implemented.

[0132] The above-mentioned processor executes the above-mentioned method for determining the Internet risk user group, and the method includes: the present application relates to the field of Internet technology, and in particular to a method and system for determining the Internet risk user group, and the method includes: obtaining attribute data and behavior data of the Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records; obtaining device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type; preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data; extracting features from the first attribute data, the first behavior data and the first device data respectively to obtain first attribute feature data, first behavior feature data and first device feature data; fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector; constructing a multi-feature data fusion risk assessment model, and inputting the multi-feature data fusion vector into the multi-feature data fusion risk assessment model to perform Internet user group assessment to obtain a risk user group assessment result. Through the above method, risky users can be identified accurately and quickly at a low cost.

[0133] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by the processor, a method for determining an Internet risk user group is implemented. The present application relates to the field of Internet technology, and in particular to a method and system for determining an Internet risk user group. The method comprises: obtaining attribute data and behavior data of an Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records; obtaining device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version and browser type; and respectively The attribute data, the behavior data and the device data are preprocessed to obtain first attribute data, first behavior data and first device data; feature extraction is performed on the first attribute data, the first behavior data and the first device data respectively to obtain first attribute feature data, first behavior feature data and first device feature data; the first attribute feature data, the first behavior feature data and the first device feature data are fused to obtain a multi-feature data fusion vector; a multi-feature data fusion risk assessment model is constructed, and the multi-feature data fusion vector is input into the multi-feature data fusion risk assessment model to perform Internet user group assessment to obtain a risk user group assessment result.

[0134] The computer-readable storage medium provides a method for determining an Internet risk user group. The present application relates to the field of Internet technology, and in particular to a method and system for determining an Internet risk user group. The method comprises: obtaining attribute data and behavior data of an Internet user group, wherein the attribute data comprises age, gender, geographic location and occupation, and the behavior data comprises browsing history, clicked links and transaction records; obtaining device data used by the user group based on fingerprint recognition technology, wherein the device data comprises device type, operating system version and browser type; preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data; extracting features of the first attribute data, the first behavior data and the first device data respectively to obtain first attribute feature data, first behavior feature data and first device feature data; fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector; constructing a multi-feature data fusion risk assessment model, and inputting the multi-feature data fusion vector into the multi-feature data fusion risk assessment model to perform Internet user group assessment to obtain a risk user group assessment result. Through the above method, risk users can be determined accurately and quickly at a low cost.

[0135] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0136] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, device, article or method including the element.

[0137] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for determining a group of Internet risk users, characterized in that: The method comprises: Obtaining attribute data and behavior data of Internet user groups, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records; Acquire device data used by the user group based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type; Preprocessing the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data; Extracting features from the first attribute data, the first behavior data, and the first device data respectively to obtain first attribute feature data, first behavior feature data, and first device feature data; Fusing the first attribute feature data, the first behavior feature data, and the first device feature data to obtain a multi-feature data fusion vector; A risk assessment model based on multi-feature data fusion is constructed, and the multi-feature data fusion vector is input into the multi-feature data fusion risk assessment model to perform Internet user group assessment to obtain a risk user group assessment result.

2. The method for determining Internet risk user groups according to claim 1, characterized in that: The risk assessment model of multi-feature data fusion is constructed, and the multi-feature data fusion vector is input into the risk assessment model of multi-feature data fusion to perform Internet risk user group assessment, and obtain the risk user group assessment result, including: Obtain historical multi-feature fusion vectors, and mark each fusion feature vector as N / A, representing normal state and abnormal state respectively; Dividing the historical multi-feature fusion vector set into a training set and a test set, and constructing a decision tree based on the Gini index and information gain rate of the probability distribution of the training set; Inputting the test set into the decision tree and calculating the prediction accuracy; When the prediction accuracy is lower than a preset threshold, the decision tree is pruned to generate a risk assessment model that integrates multiple feature data; Obtain the current multi-feature data fusion vector, input the current multi-feature data fusion vector into the multi-feature data fusion risk assessment model for evaluation, and classify the state category according to the trained rules. The multi-feature data fusion risk assessment model outputs the current state of the user group: normal / abnormal based on the feature data concentratedly reflected by the current multi-feature data fusion vector.

3. The method for determining Internet risk user groups according to claim 1, characterized in that: Before the step of obtaining attribute data and behavior data of an Internet user group, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records, the following steps are included: Collecting image data and voice data of a user group, and preprocessing the image data and the voice data to obtain first image data and first voice data; Extracting features corresponding to the first image data by using facial expression analysis and gesture detection to obtain first image data after feature extraction; Converting the first speech data into text or emotional features to obtain first language data after feature extraction; Fusing the first image data after feature extraction with the first language data to obtain multimodal fusion data features; Performing personal identification on the multimodal fusion data features based on a neural network model to obtain a personal identification result; Determine whether to obtain attribute data and behavior data of the user group based on the personal identity recognition result.

4. The method for determining Internet risk user groups according to claim 1, characterized in that: Before the step of acquiring the device data used by the user group based on the fingerprint recognition technology, wherein the device data includes the device type, the operating system version, and the browser type, the following steps are included: Continuously collecting a plurality of fingerprint images, and preprocessing the plurality of fingerprint images to obtain a plurality of first fingerprint images, wherein the preprocessing includes grayscale transformation, segmentation, equalization, enhancement and refinement of the images; Extracting features of fingerprint endpoints and forks from the plurality of first fingerprint images using grayscale values ​​of fingerprint feature distribution to obtain a plurality of first fingerprint feature images; Determining whether each of the first fingerprint feature images is the same as a corresponding standard fingerprint feature image in a preset fingerprint template; If yes, then perform an unlocking operation and obtain device data used by the user group based on fingerprint recognition technology; If not, the unlocking operation is not performed.

5. The method for determining Internet risk user groups according to claim 1, characterized in that: The fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector includes: Based on a convolutional neural network, the first attribute feature data, the first behavior feature data, and the first device feature data are converted into a first attribute feature vector, a first behavior feature vector, and a first device feature vector, respectively; assigning weights to the first attribute feature vector, the first behavior feature vector, and the first device feature vector respectively to obtain corresponding weight coefficients; Multiplying the first attribute feature vector, the first behavior feature vector, and the first device feature vector by their corresponding weight coefficients respectively to obtain corresponding weighted feature vectors; The weighted feature vectors corresponding to the first attribute feature vector, the first behavior feature vector, and the first device feature vector are linearly added to obtain a multi-feature data fusion vector.

6. The method for determining Internet risk user groups according to claim 1, characterized in that: The extracting features of the first attribute data, the first behavior data, and the first device data to obtain first attribute feature data, first behavior feature data, and first device feature data includes: Counting the first attribute data to obtain first attribute statistical data; Dividing the first attribute statistical data into categorical attribute data and numerical attribute data; Performing one-hot encoding on the categorical attribute data to obtain categorical attribute encoded data; Normalizing the numerical attribute data to obtain normalized numerical attribute data; The first attribute feature data is obtained according to the categorized attribute coding data and the normalized numerical attribute data.

7. The method for determining Internet risk user groups according to claim 1, characterized in that: The extracting features of the first attribute data, the first behavior data and the first device data respectively to obtain first attribute feature data, first behavior feature data and first device feature data also includes: Obtaining a timestamp corresponding to the first behavior data; Sort the first behavior data according to the timestamp to obtain first behavior sorted data; The data type of the data in the first behavior sorting data is converted, and the converted behavior sequences are spliced ​​to obtain behavior sequence embedding features. Performing time feature encoding on the timestamp of each behavior data in the first behavior sorting data to obtain a time-aware feature; The behavior sequence embedding feature is fused with the time perception feature to obtain first behavior feature data.

8. A system for determining Internet risk user groups, characterized in that: The system comprises: The attribute data and behavior data module is used to obtain the attribute data and behavior data of Internet users, wherein the attribute data includes age, gender, geographic location and occupation, and the behavior data includes browsing history, clicked links and transaction records; A device data module, used to obtain the device data used by the user based on fingerprint recognition technology, wherein the device data includes device type, operating system version, and browser type; A preprocessing module, used to preprocess the attribute data, the behavior data and the device data respectively to obtain first attribute data, first behavior data and first device data; an extraction module, used to extract features from the first attribute data, the first behavior data and the first device data respectively, to obtain first attribute feature data, first behavior feature data and first device feature data; A multi-feature data fusion vector module, used for fusing the first attribute feature data, the first behavior feature data and the first device feature data to obtain a multi-feature data fusion vector; The evaluation module is used to construct a risk evaluation model of multi-feature data fusion, input the multi-feature data fusion vector into the multi-feature data fusion risk evaluation model to perform Internet risk user evaluation, and obtain risk user evaluation results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for determining the Internet risk user group described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for determining the Internet risk user group according to any one of claims 1 to 7 are implemented.

Images