Risk model training method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a risk model training method and device, electronic equipment and a storage medium. The method is applied to a target agent node, and comprises the following steps: in response to an aggregation triggering operation on a target global detection model on the target agent node, determining a participating agent node in at least one associated agent node in communication connection with the target agent node; obtaining a local detection model obtained by pre-training on each participating agent node, and performing aggregation operation on each local detection model to obtain a target global detection model on the target agent node; wherein the participating agent node is an associated agent node participating in the aggregation target global detection model, and the local detection model is a model obtained by training a deep neural network model by the participating agent node based on historical user data generated on the participating agent node. According to the technical scheme of the embodiment of the invention, the transmission security of the local detection model is higher, and the stability and effectiveness of risk identification operation are improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing technology, and in particular to a risk model training method, device, electronic device and storage medium. Background Art

[0002] With the digital transformation of the banking industry, user data plays an important role in risk prediction and credit assessment applications. In the prior art, each bank branch acts as a proxy node. Each proxy node trains a local detection model for the user data generated on the proxy node, and sends the model data of the local detection model to the central server. The central server builds a global detection model based on the received model data, and distributes the global detection model to each proxy node, so that each proxy node detects data risk information through the global detection model.

[0003] However, in the process of implementing the present invention, it was found that the prior art has at least the following technical problems: the central server needs to obtain data from various models, which may easily lead to data leakage and poor data security; and when a single point failure occurs in the central server, the various proxy nodes are unable to perform risk identification normally, resulting in poor stability and effectiveness of risk identification. Summary of the invention

[0004] The embodiments of the present invention provide a risk model training method, device, electronic device and storage medium to improve the transmission security of the local detection model and achieve the purpose of improving the stability and effectiveness of the risk identification operation.

[0005] According to one aspect of the present invention, a risk model training method is provided, which is applied to a target proxy node and includes:

[0006] In response to an aggregation triggering operation on the target global detection model on the target proxy node, determining a participating proxy node from at least one associated proxy node in communication connection with the target proxy node;

[0007] Obtaining a local detection model pre-trained on each of the participating proxy nodes, performing an aggregation operation on each of the local detection models, and obtaining a target global detection model on the target proxy node;

[0008] Among them, the participating proxy node is an associated proxy node participating in the global detection model of the aggregated target, and the local detection model is a model obtained by the participating proxy node by training a deep neural network model based on the historical user data generated on the participating proxy node.

[0009] According to another aspect of the present invention, there is provided a risk model training device, which is arranged at a target proxy node, and comprises:

[0010] A participating proxy node determination module, configured to determine a participating proxy node from at least one associated proxy node in communication connection with the target proxy node in response to an aggregation trigger operation on a target global detection model on the target proxy node;

[0011] A local detection model acquisition module is used to acquire a local detection model pre-trained on each participating proxy node, perform aggregation operations on each local detection model, and obtain a target global detection model on the target proxy node;

[0012] Among them, the participating proxy node is an associated proxy node participating in the global detection model of the aggregated target, and the local detection model is a model obtained by the participating proxy node by training a deep neural network model based on the historical user data generated on the participating proxy node.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk model training method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to implement the risk model training method described in any embodiment of the present invention when executed by a processor.

[0018] The technical solution of the embodiment of the present invention responds to the aggregation trigger operation of the target global detection model on the target proxy node, determines the participating proxy node in at least one associated proxy node that is communicatively connected to the target proxy node; obtains the local detection model pre-trained on each participating proxy node, and obtains the target global detection model on the target proxy node by performing an aggregation operation on each local detection model; wherein the local detection model is a model obtained by training a deep neural network model based on the historical user data generated on the participating proxy node by the participating proxy node; since the participating proxy node is an associated proxy node participating in the aggregated target global detection model, that is, the participating proxy node originally has a communication connection with the target proxy node, the transmission security of the local detection model is higher; an aggregation operation is performed on the target proxy node to obtain the target global detection model, thereby realizing decentralization, that is, data risk identification on the proxy node can be realized without a central server, which is conducive to improving the stability and effectiveness of the risk identification operation.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a risk model training method provided according to an embodiment of the present invention;

[0022] Figure 2 is a flow chart of another risk model training method provided according to an embodiment of the present invention;

[0023] Figure 3 is a structural schematic diagram of a risk model training device provided according to an embodiment of the present invention;

[0024] Figure 4 It is a structural schematic diagram of an electronic device for implementing the risk model training method of an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "etc." and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0027] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information and network security.

[0028] Figure 1 1 is a flow chart of a risk model training method provided according to an embodiment of the present invention. This embodiment can be applied to training a global detection model for risk identification of generated user data. The method can be performed by a risk model training device, which can be implemented in the form of hardware and / or software.

[0029] like Figure 1 As shown, the method of this embodiment may specifically include:

[0030] S110 . In response to an aggregation triggering operation on a target global detection model on a target proxy node, determining a participating proxy node from at least one associated proxy node in communication connection with the target proxy node.

[0031] It should be noted that each bank branch can serve as a proxy node. The target proxy node proposed in this embodiment can be a proxy node for which risk type identification of user data is currently to be performed. User data includes different business data generated by the user in the bank branch, such as deposit business data and withdrawal business data. The associated proxy node is a proxy node that has a business association with the target proxy node and has established a communication connection.

[0032] In a specific implementation, the target global detection model on the target proxy node can be aggregated and updated periodically to detect whether the current moment is the start moment of the period, and if so, the aggregation trigger operation is started. Alternatively, when a change in the type of service processed on the target proxy node is detected, the aggregation trigger operation is started.

[0033] In this embodiment, the associated proxy nodes that have business association with the target proxy node and have established communication connection can be determined. All the associated proxy nodes are used as participating proxy nodes; or, any preset number of associated proxy nodes are selected as participating proxy nodes. Among them, the preset number is less than the total number of associated proxy nodes. The participating proxy nodes are associated proxy nodes that participate in the global detection model of the aggregated target.

[0034] S120, obtaining a pre-trained local detection model on each participating proxy node, performing an aggregation operation on each local detection model, and obtaining a target global detection model on a target proxy node.

[0035] Among them, the local detection model is a model obtained by training the deep neural network model based on the historical user data generated on the participating agent node.

[0036] In this embodiment, a local detection model is pre-trained on each participating proxy node. Optionally, in at least one associated proxy node that is in communication connection with the target proxy node, before determining the participating proxy node, it also includes: obtaining a sample data set; wherein the sample data set includes a plurality of sample user data and a sample risk label corresponding to the sample user data; inputting each sample user data into the deep neural network model to be trained respectively, and obtaining an output risk label corresponding to the sample user data; determining the loss value of the deep neural network model to be trained based on the sample risk label and the output risk label, and correcting the model parameters of the deep neural network model to be trained based on the loss value; taking the convergence of the loss function of the deep neural network model to be trained as the training target, and training to obtain the local detection model corresponding to the target proxy node.

[0037] In this embodiment, the sample user data may be the real user data generated in the target proxy node within the historical time period, and the sample risk label is the real risk label of the sample user data. Exemplarily, the sample risk label includes labels such as abnormal account entry and abnormal account exit. In order to obtain a local detection model, each sample user data can be traversed, and the currently traversed sample user data can be input into a pre-built deep neural network model to obtain an output risk label corresponding to the sample user data. The output risk label is the result obtained by predicting the risk type of the sample user data by the deep neural network model. The output risk label is compared with the sample risk label to determine the loss value of the deep neural network model to be trained, and the adjustment value corresponding to the loss value is determined by gradient descent to correct the model parameters of the deep neural network model based on the adjustment value. The convergence of the loss function of the deep neural network model to be trained is used as the training target until the loss function of the deep neural network model obtained by the current training converges, then the traversal operation is stopped, and the deep neural network model obtained by the current training is used as the local detection model. Among them, the loss function includes a cross entropy loss function.

[0038] This embodiment trains the local detection model through a sample data set and takes the convergence of the loss function as a training goal, thereby improving the detection accuracy and effectiveness of the local detection model.

[0039] Optionally, before inputting each sample user data into the deep neural network model to be trained, it also includes: performing data preprocessing operations on the sample user data to obtain preprocessed data; encrypting the preprocessed data, and updating the sample user data based on the data obtained after the encryption processing.

[0040] The data preprocessing operation includes at least one of data cleaning, data denoising and feature extraction.

[0041] Specifically, the sample user data may be cleaned, and the data cleaning operation includes at least one of data deduplication, deletion of erroneous data, and filling of empty data. The cleaned data is subjected to data denoising and feature extraction processing, thereby improving the data quality, which is beneficial to improving the accuracy of model training.

[0042] Furthermore, the preprocessed data obtained after the data preprocessing operation may be encrypted, thereby improving the security of the sample user data, and the sample user data may be updated based on the encrypted data.

[0043] This embodiment improves the accuracy of model training through data preprocessing and encryption, and at the same time avoids the leakage of sample user data and improves data security.

[0044] Furthermore, each proxy node can train a local detection model corresponding to the proxy node based on the real user data of the historical time period generated on the proxy node. After the local detection model is trained, in order to improve the transmission security, noise can be added to the local detection model through differential privacy technology.

[0045] In a specific implementation, a local detection model pre-trained on each participating proxy node can be obtained. Optionally, the local detection model is a model after adding noise through differential privacy technology. Specifically, noise is added to the model parameters of the local detection model through differential privacy technology, and the model parameters after adding noise are sent to the target proxy node. Differential Privacy (DP) is a privacy protection technology that requires that after changing a record in a data set, the output of the algorithm remains almost unchanged, thereby ensuring that it is difficult for an attacker to infer the private information in the data set based on the output of the algorithm. The main advantages of differential privacy technology are: 1. It does not limit the background knowledge of malicious attackers; 2. It provides quantitative indicators to measure the privacy protection effect of the algorithm.

[0046] In order to further improve the transmission security of the local detection model, the model parameters after adding noise can be encrypted through multi-party computing encryption technology, and the encrypted model parameters can be sent to the target proxy node.

[0047] In this embodiment, federated learning can be performed based on the local detection model of each participating proxy node, and the target global detection model can be aggregated to obtain the risk detection of different participating proxy nodes and target proxy nodes. It should be noted that federated learning is a mechanism for coordinating multiple participants to jointly train models. It allows each participating proxy node to keep user data locally, breaking data silos while ensuring the participating proxy node's control over user data.

[0048] In this embodiment, the specific implementation method of performing an aggregation operation on each local detection model to obtain a target global detection model on the target proxy node includes: based on a secure aggregation algorithm, performing an aggregation operation on each local detection model to obtain a target global detection model on the target proxy node.

[0049] It should be noted that the secure aggregation algorithm is used to aggregate multiple data values ​​without leaking the input data of each party. In the federated learning environment, secure aggregation is used to aggregate model updates from different participating proxy nodes without sharing user data. In the secure aggregation protocol, each participating proxy node has a private input value, and hopes to add or otherwise aggregate these private input values, but does not want any party to know the private input values ​​of other participating proxy nodes.

[0050] In this embodiment, the model parameters corresponding to each local detection model are aggregated through a secure aggregation algorithm, and a target global detection model is constructed based on the aggregated model parameters, thereby obtaining a target global detection model that can be used for risk detection by different participating proxy nodes without sharing user data. The secure aggregation algorithm reduces the risk of gradient leakage, avoids the deployment of additional central servers, and improves the robustness of the system.

[0051] The technical solution of the embodiment of the present invention responds to the aggregation trigger operation of the target global detection model on the target proxy node, determines the participating proxy node in at least one associated proxy node that is communicatively connected to the target proxy node; obtains the local detection model pre-trained on each participating proxy node, and obtains the target global detection model on the target proxy node by performing an aggregation operation on each local detection model; wherein the local detection model is a model obtained by training a deep neural network model based on the historical user data generated on the participating proxy node by the participating proxy node; since the participating proxy node is an associated proxy node participating in the aggregated target global detection model, that is, the participating proxy node originally has a communication connection with the target proxy node, the transmission security of the local detection model is higher; an aggregation operation is performed on the target proxy node to obtain the target global detection model, thereby realizing decentralization, that is, data risk identification on the proxy node can be realized without a central server, which is conducive to improving the stability and effectiveness of the risk identification operation.

[0052] Figure 2 is a flowchart of another risk model training method provided according to an embodiment of the present invention. Based on the above embodiment, the method of determining the participating proxy nodes in this embodiment includes: determining the participating proxy nodes in at least one associated proxy node based on the communication connection information of the target proxy node and the pre-built Markov process model. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here. Figure 2 As shown, the method includes:

[0053] S210: In response to an aggregation trigger operation on a target global detection model on a target proxy node, a participating proxy node is determined in at least one associated proxy node based on communication connection information of the target proxy node and a pre-built Markov process model.

[0054] The Markov process model is used to reflect the connection state change information of different proxy nodes. The connection state change information is the probability that the proxy node changes from the current connection state to the target connection state at a future moment, and the target connection state includes the communication connection state and the non-connection state. The communication connection information is the information of the associated proxy node with which the target proxy node has established a communication connection at the current moment.

[0055] In a specific implementation, based on the communication connection information, the associated proxy node currently establishing a communication connection with the target proxy node is determined. For each associated proxy node, based on the Markov process model, the probability that the associated proxy node is still in communication connection with the target proxy node at a future moment is determined. Based on the obtained probability, a group of associated proxy nodes are randomly selected as participating proxy nodes.

[0056] In this embodiment, the participating proxy nodes are determined through the Markov process model, and the aggregation operation of the local detection model is implemented without leaking the original user data of any proxy node, thereby improving the robustness and prediction accuracy of the model.

[0057] S220, obtaining a pre-trained local detection model on each participating proxy node, performing an aggregation operation on each local detection model, and obtaining a target global detection model on the target proxy node.

[0058] In this embodiment, after performing an aggregation operation on each local detection model to obtain a target global detection model on the target proxy node, it also includes: when receiving data to be detected, inputting the data to be detected into the target global detection model; based on the output result of the target global detection model, determining the risk type existing in the data to be detected.

[0059] The data to be detected is user data of the risk type to be detected. Exemplarily, the data to be detected may be newly added data on the target proxy node. For example, the data to be detected is business transaction data newly added this week.

[0060] In this embodiment, when the data to be detected is received, the data to be detected can be input into the target global detection model, and the type indicated in the output result of the target global detection model can be used as the risk type existing in the data to be detected.

[0061] It should be noted that the risk model training system used to execute the risk model training method can be periodically tested to evaluate the performance of the risk model training system when facing different attack scenarios, and adjustments and optimizations can be made based on the test results.

[0062] In this embodiment, for different risk types, an early warning method corresponding to the risk type is set. After detecting the risk type of the data to be detected, early warning information can be generated according to the early warning method corresponding to the risk type, and the early warning information can be sent to the business terminal to prompt the risk situation of the data to be detected, so as to facilitate the adoption of corresponding risk control measures.

[0063] This embodiment determines the risk type of the data to be detected by aggregating the target global detection model to improve the security of user data; and, performs risk warning according to a preset warning method to facilitate timely risk management and control.

[0064] Figure 3 1 is a schematic diagram of the structure of a risk model training device provided according to an embodiment of the present invention, and the device is used to execute the risk model training method provided by any of the above embodiments. The device and the risk model training method of the above embodiments belong to the same inventive concept, and the details not described in detail in the embodiment of the risk model training device can refer to the embodiment of the above risk model training method. Figure 3 As shown, the device is set at the target proxy node and includes:

[0065] A participating proxy node determination module 10 is used to determine a participating proxy node from at least one associated proxy node in communication connection with the target proxy node in response to an aggregation trigger operation on a target global detection model on a target proxy node;

[0066] The local detection model acquisition module 11 is used to obtain the local detection model pre-trained on each participating proxy node, perform aggregation operation on each local detection model, and obtain the target global detection model on the target proxy node;

[0067] Among them, the participating proxy nodes are associated proxy nodes participating in the global detection model of the aggregated target, and the local detection model is a model obtained by training the deep neural network model based on the historical user data generated on the participating proxy nodes.

[0068] On the basis of any optional technical solution in the embodiment of the present invention, optionally, the participating proxy node determination module 10 includes:

[0069] A participating proxy node determination unit, configured to determine a participating proxy node from at least one associated proxy node based on the communication connection information of the target proxy node and a pre-built Markov process model;

[0070] Among them, the Markov process model is used to reflect the connection state change information of different proxy nodes.

[0071] Based on any optional technical solution in the embodiment of the present invention, optionally, the local detection model acquisition module 11 includes:

[0072] The aggregation unit is used to perform aggregation operations on each local detection model based on a security aggregation algorithm to obtain a target global detection model on a target proxy node.

[0073] Based on any optional technical solution in the embodiments of the present invention, optionally, the method further includes:

[0074] A first data input module is used for, after performing an aggregation operation on each local detection model to obtain a target global detection model on a target proxy node, inputting the data to be detected into the target global detection model when receiving the data to be detected;

[0075] The risk type determination module is used to determine the risk type existing in the data to be detected based on the output results of the target global detection model.

[0076] Based on any optional technical solution in the embodiments of the present invention, optionally, the method further includes:

[0077] A data set acquisition module, used to acquire a sample data set before determining a participating proxy node in at least one associated proxy node that is in communication connection with the target proxy node; wherein the sample data set includes a plurality of sample user data and a sample risk label corresponding to the sample user data;

[0078] The second data input module is used to input each sample user data into the deep neural network model to be trained to obtain an output risk label corresponding to the sample user data;

[0079] A parameter correction module, used to determine the loss value of the deep neural network model to be trained based on the sample risk label and the output risk label, so as to correct the model parameters of the deep neural network model to be trained based on the loss value;

[0080] The model training module is used to take the convergence of the loss function of the deep neural network model to be trained as the training goal, and train to obtain the local detection model corresponding to the target proxy node.

[0081] Based on any optional technical solution in the embodiments of the present invention, optionally, the method further includes:

[0082] A data preprocessing module, used for performing a data preprocessing operation on the sample user data to obtain preprocessed data before each sample user data is respectively input into the deep neural network model to be trained; wherein the data preprocessing operation includes at least one operation of data cleaning, data denoising and feature extraction;

[0083] The encryption processing module is used to encrypt the pre-processed data and update the sample user data based on the data obtained after the encryption processing.

[0084] Based on any optional technical solution in the embodiments of the present invention, optionally, the local detection model is a model after adding noise through differential privacy technology.

[0085] The technical solution of the embodiment of the present invention responds to the aggregation trigger operation of the target global detection model on the target proxy node, determines the participating proxy node in at least one associated proxy node that is communicatively connected to the target proxy node; obtains the local detection model pre-trained on each participating proxy node, and obtains the target global detection model on the target proxy node by performing an aggregation operation on each local detection model; wherein the local detection model is a model obtained by training a deep neural network model based on the historical user data generated on the participating proxy node by the participating proxy node; since the participating proxy node is an associated proxy node participating in the aggregated target global detection model, that is, the participating proxy node originally has a communication connection with the target proxy node, the transmission security of the local detection model is higher; an aggregation operation is performed on the target proxy node to obtain the target global detection model, thereby realizing decentralization, that is, data risk identification on the proxy node can be realized without a central server, which is conducive to improving the stability and effectiveness of the risk identification operation.

[0086] It is worth noting that in the embodiment of the above-mentioned risk model training device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0087] Figure 4 Schematic diagram of the structure of an electronic device for implementing the risk model training method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0088] like Figure 4As shown, the electronic device 20 includes at least one processor 21, and a memory connected to the at least one processor 21, such as a read-only memory (ROM) 22, a random access memory (RAM) 23, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 21 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 22 or the computer program loaded from the storage unit 28 to the random access memory (RAM) 23. In RAM23, various programs and data required for the operation of the electronic device 20 can also be stored. The processor 21, ROM22 and RAM23 are connected to each other through a bus 24. An input / output (I / O) interface 25 is also connected to the bus 24.

[0089] A number of components in the electronic device 20 are connected to the I / O interface 25, including: an input unit 26, such as a keyboard, a mouse, etc.; an output unit 27, such as various types of displays, speakers, etc.; a storage unit 28, such as a disk, an optical disk, etc.; and a communication unit 29, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 29 allows the electronic device 20 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0090] The processor 21 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 21 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 21 executes the various methods and processes described above, such as the risk model training method.

[0091] In some embodiments, the risk model training method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 28. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 20 via the ROM 22 and / or the communication unit 29. When the computer program is loaded into the RAM 23 and executed by the processor 21, one or more steps of the risk model training method described above may be performed. Alternatively, in other embodiments, the processor 21 may be configured to execute the risk model training method in any other appropriate manner (e.g., by means of firmware).

[0092] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0093] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0094] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0095] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0096] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0097] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0098] This embodiment also provides a computer program product, including a computer program, which, when executed by a processor, implements the risk model training method provided in any embodiment of the present application.

[0099] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A risk model training method, characterized in that: Applied to the target proxy node, including: In response to an aggregation triggering operation on the target global detection model on the target proxy node, determining a participating proxy node from at least one associated proxy node in communication connection with the target proxy node; Obtaining a local detection model pre-trained on each of the participating proxy nodes, performing an aggregation operation on each of the local detection models, and obtaining a target global detection model on the target proxy node; Among them, the participating proxy node is an associated proxy node participating in the global detection model of the aggregated target, and the local detection model is a model obtained by the participating proxy node by training a deep neural network model based on the historical user data generated on the participating proxy node.

2. The method according to claim 1, characterized in that: The step of determining a participating proxy node from at least one associated proxy node in communication connection with the target proxy node comprises: Based on the communication connection information of the target proxy node and the pre-built Markov process model, determining the participating proxy node in at least one of the associated proxy nodes; The Markov process model is used to reflect the connection status change information of different proxy nodes.

3. The method according to claim 1, characterized in that The aggregating operation is performed on each of the local detection models to obtain a target global detection model on the target proxy node, including: Based on the security aggregation algorithm, an aggregation operation is performed on each of the local detection models to obtain a target global detection model on the target proxy node.

4. The method according to claim 1, characterized in that: After performing the aggregation operation on each of the local detection models to obtain the target global detection model on the target proxy node, the method further includes: When receiving the data to be detected, inputting the data to be detected into the target global detection model; Based on the output result of the target global detection model, the risk type existing in the data to be detected is determined.

5. The method according to claim 1, characterized in that Before determining a participating proxy node among at least one associated proxy node in communication connection with the target proxy node, the method further includes: Acquire a sample data set; wherein the sample data set includes a plurality of sample user data and a sample risk label corresponding to the sample user data; Inputting each of the sample user data into the deep neural network model to be trained to obtain an output risk label corresponding to the sample user data; Determine a loss value of the deep neural network model to be trained based on the sample risk label and the output risk label, so as to modify a model parameter of the deep neural network model to be trained based on the loss value; The convergence of the loss function of the deep neural network model to be trained is used as a training goal, and a local detection model corresponding to the target proxy node is obtained through training.

6. The method according to claim 5, characterized in that Before inputting each of the sample user data into the deep neural network model to be trained, the method further includes: Performing a data preprocessing operation on the sample user data to obtain preprocessed data; wherein the data preprocessing operation includes at least one of data cleaning, data denoising and feature extraction; The pre-processed data is encrypted, and the sample user data is updated based on the encrypted data.

7. The method according to claim 1, characterized in that The local detection model is a model after adding noise through differential privacy technology.

8. A risk model training device, characterized in that: Set on the target proxy node, including: A participating proxy node determination module, configured to determine a participating proxy node from at least one associated proxy node in communication connection with the target proxy node in response to an aggregation trigger operation on a target global detection model on the target proxy node; A local detection model acquisition module is used to acquire a local detection model pre-trained on each participating proxy node, perform aggregation operations on each local detection model, and obtain a target global detection model on the target proxy node; Among them, the participating proxy node is an associated proxy node participating in the global detection model of the aggregated target, and the local detection model is a model obtained by the participating proxy node by training a deep neural network model based on the historical user data generated on the participating proxy node.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk model training method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the risk model training method described in any one of claims 1 to 7 when executed.

Images