Abnormal behavior detection method and device, equipment, medium and program product

Abstract

The invention provides an abnormal behavior detection method and device, equipment, a medium and a program product, which can be applied to the fields of big data and financial science and technology. The method comprises the steps that M initial features are coded, effective values of the M initial features are obtained, the initial features represent behavior information associated with a user, and M is larger than or equal to 1; m effective features are determined according to the effective value of each initial feature, and m is larger than or equal to 1 and smaller than or equal to M; the m effective features are classified, n to-be-detected feature sets are obtained, each to-be-detected feature set comprises at least one effective feature, and n is larger than or equal to 1; processing at least one effective feature in each to-be-detected feature set by using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; and according to the score value corresponding to each effective feature, determining an abnormal feature, the abnormal feature representing an abnormal behavior associated with the user.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data and financial technology, and more specifically to an abnormal behavior detection method, device, equipment, medium and program product. Background Art

[0002] Post-loan risk warning refers to the process of early warning of possible risks after a financial institution has issued a loan to a customer and the customer has withdrawn the money. Post-loan risk warning mainly detects the customer's behavior, for example, the customer's consumption, capital flow, account and credit abnormalities, abnormal feedback from cooperative institutions, repayment status and other information.

[0003] Among the relevant technologies, most of them collect customer behavior information manually, which makes it difficult to screen out effective information and gain in-depth understanding of customers' business and financial conditions. In addition, they have low intelligence and are difficult to achieve efficient and accurate risk warnings. Summary of the invention

[0004] In view of the above problems, the present disclosure provides an abnormal behavior detection method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, there is provided an abnormal behavior detection method, comprising: encoding M initial features to obtain effective values ​​of the M initial features, wherein the initial features represent behavior information associated with a user, M≥1; determining m effective features according to the effective value of each initial feature, 1≤m≤M; classifying the m effective features to obtain n feature sets to be detected, wherein each feature set to be detected includes at least one effective feature, n≥1; processing at least one effective feature in each feature set to be detected using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; determining an abnormal feature according to the score value corresponding to each effective feature, wherein the abnormal feature represents an abnormal behavior associated with the user.

[0006] According to an embodiment of the present disclosure, an anomaly detection algorithm is used to process the valid features of each feature set to be detected to obtain a score value corresponding to each valid feature, including: constructing a binary search tree for any feature to be detected in any feature set to be detected; performing a recursive in-order traversal on the binary search tree to determine the path length between the root node and the leaf node corresponding to the binary search tree; and obtaining a score value corresponding to each valid feature based on the path length.

[0007] According to an embodiment of the present disclosure, a scoring value corresponding to each valid feature is obtained based on the path length, including: determining a preset expected length of the path length based on the path length between the root node and the leaf node corresponding to the binary search tree; determining the scoring value corresponding to the feature to be detected based on the preset expected length and the average path length, wherein the average path length is determined based on each valid feature of the feature set to be detected.

[0008] According to an embodiment of the present disclosure, determining an abnormal feature according to a score value corresponding to each valid feature includes: when the score value meets a preset condition, determining the feature to be detected as an abnormal feature.

[0009] According to an embodiment of the present disclosure, M initial features are encoded to obtain valid values ​​of the M initial features, including: determining the total number of positive samples and the total number of negative samples corresponding to the M initial features, wherein the positive samples represent users associated with the initial features, and the negative samples represent users not associated with the initial features; for the lth initial feature, determining the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtaining the number of positive samples and the number of negative samples corresponding to the initial feature, 1≤l≤M; obtaining the valid value of the lth initial feature according to the total number of positive samples, the total number of negative samples, and the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtaining the valid values ​​of the M initial features.

[0010] According to an embodiment of the present disclosure, the effective value of the lth initial feature is obtained according to the total number of positive samples, the total number of negative samples, the number of positive samples corresponding to the lth initial feature, and the number of negative samples, including: determining the positive sample ratio according to the total number of positive samples and the number of positive samples corresponding to the lth initial feature; determining the negative sample ratio according to the total number of negative samples and the number of negative samples corresponding to the lth initial feature; determining the sample difference and the sample ratio according to the positive sample ratio and the negative sample ratio; and obtaining the effective value of the lth initial feature according to the sample difference and the sample ratio.

[0011] According to an embodiment of the present disclosure, m valid features are classified to obtain n feature sets to be detected, including: determining the coordinates of the m valid features in a spatial coordinate system; calculating the coordinate distance between every two valid features to obtain a distance value between every two valid features; and classifying the m valid features according to the distance value between every two valid features to obtain n feature sets to be detected.

[0012] According to an embodiment of the present disclosure, m valid features are determined based on the valid value of each initial feature, including: for any initial feature, when the valid value meets a preset range, the initial feature is determined as a valid feature; and a valid feature set is determined based on the valid features.

[0013] The second aspect of the present disclosure provides an abnormal behavior detection device, including: an encoding module, used to encode M initial features to obtain effective values ​​of the M initial features, wherein the initial features represent behavior information associated with a user, M≥1; a first determination module, used to determine m effective features according to the effective value of each initial feature, 1≤m≤M; a classification module, used to classify the m effective features to obtain n feature sets to be detected, wherein each feature set to be detected includes at least one effective feature, n≥1; a processing module, used to process at least one effective feature in each feature set to be detected using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; and a second determination module, used to determine an abnormal feature according to the score value corresponding to each effective feature, wherein the abnormal feature represents an abnormal behavior associated with the user.

[0014] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0016] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0017] According to the embodiments of the present disclosure, M initial features are encoded to obtain the effective values ​​of the M initial features; m effective features M are determined according to the effective value of each initial feature; the m effective features are classified to obtain n feature sets to be detected; at least one effective feature in each feature set to be detected is processed using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; and an abnormal feature is determined according to the score value corresponding to each effective feature. Since the effective value of the initial feature is determined, the problem of low correlation between the collected behavior information and the risk warning is avoided. In addition, since the effective features are processed using an anomaly detection algorithm to determine the abnormal features, the problem of low intelligence in the prior art is avoided, and the accuracy of abnormal behavior recognition is improved, thereby improving the technical effect of the accuracy of risk warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 The application scenario diagram of the abnormal behavior detection method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown;

[0020] Figure 2 A flowchart of an abnormal behavior detection method according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 3 A schematic diagram schematically shows a method for detecting abnormal behavior according to an embodiment of the present disclosure;

[0022] Figure 4 A structural block diagram of an abnormal behavior detection device according to an embodiment of the present disclosure is schematically shown; and

[0023] Figure 5 A block diagram of an electronic device suitable for implementing an abnormal behavior detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0029] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0030] An embodiment of the present disclosure provides an abnormal behavior detection method, which encodes M initial features to obtain effective values ​​of the M initial features, wherein the initial features represent behavior information associated with a user, M≥1; determines m effective features according to the effective value of each initial feature, 1≤m≤M; classifies the m effective features to obtain n feature sets to be detected, wherein each feature set to be detected includes at least one effective feature, n≥1; processes at least one effective feature in each feature set to be detected using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; determines an abnormal feature according to the score value corresponding to each effective feature, wherein the abnormal feature represents an abnormal behavior associated with the user.

[0031] Figure 1 The application scenario diagram of the abnormal behavior detection method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0032] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0033] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0035] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0036] It should be noted that the abnormal behavior detection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the abnormal behavior detection device provided in the embodiment of the present disclosure can generally be set in the server 105. The abnormal behavior detection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the abnormal behavior detection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0038] Figure 2 The flowchart of the abnormal behavior detection method according to the embodiment of the present disclosure is schematically shown.

[0039] like Figure 2 As shown, the abnormal behavior detection method of this embodiment includes operations S210 to S250.

[0040] In operation S210, M initial features are encoded to obtain valid values ​​of the M initial features, wherein the initial features represent behavior information associated with the user, and M≥1.

[0041] According to an embodiment of the present disclosure, the behavior information associated with the user may be the user's personal information, consumption habit information, historical loan and repayment information, credit information, and other information.

[0042] According to an embodiment of the present disclosure, WOE (Weight of Evidence) encoding is performed on M initial features. For example, behavioral information such as whether the user has a bad credit record, whether the user has been a blacklisted customer of a financial institution, and whether the user is over 30 years old is encoded to obtain the effective values ​​of the M initial features.

[0043] According to an embodiment of the present disclosure, the effective value of an initial feature is used to reflect the importance of the initial feature among all initial features.

[0044] In operation S220, m valid features are determined according to the valid value of each initial feature, where 1≤m≤M.

[0045] According to an embodiment of the present disclosure, based on the effective value of each initial feature, a feature with a higher correlation with post-loan risk warning is screened out from all the initial features as a valid feature.

[0046] In operation S230, the m valid features are classified to obtain n feature sets to be detected, wherein each feature set to be detected includes at least one valid feature, and n≥1.

[0047] According to an embodiment of the present disclosure, m valid features are classified, and similar or close valid features are classified into the same category. For example, "user's default record" and "user's credit report query record" are both credit information associated with the user, and the above valid features are classified into the same feature set to be detected.

[0048] In operation S240, at least one valid feature in each feature set to be detected is processed using an anomaly detection algorithm to obtain a score value corresponding to each valid feature.

[0049] According to an embodiment of the present disclosure, an anomaly detection algorithm may be an algorithm for anomaly detection of data, such as an isolation forest algorithm, wherein an isolation forest (iForest) is an algorithm specifically used for outlier detection, which is an ensemble-based method. Compared with density- or distance-based methods, such as LOF, KNN, etc., iForest does not need to calculate distance and density, so iForest has a linear time complexity (O(n)), which is very suitable for anomaly detection in big data. In addition, iForest is designed specifically for anomaly detection, while many density- or distance-based methods only have anomaly detection as a byproduct, so iForest has certain advantages in terms of accuracy.

[0050] According to an embodiment of the present disclosure, for each valid feature in each feature set to be detected, the valid feature is processed using an anomaly detection algorithm to obtain a score value for determining whether the valid feature is normal or abnormal.

[0051] In operation S250 , an abnormal feature is determined according to the score value corresponding to each valid feature, where the abnormal feature represents an abnormal behavior associated with the user.

[0052] According to an embodiment of the present disclosure, if the score value corresponding to a valid feature meets a preset condition, the valid feature is an abnormal feature, indicating that the behavior information corresponding to the valid feature has a risk and is classified as abnormal information.

[0053] According to the embodiments of the present disclosure, M initial features are encoded to obtain the effective values ​​of the M initial features; m effective features M are determined according to the effective value of each initial feature; the m effective features are classified to obtain n feature sets to be detected; at least one effective feature in each feature set to be detected is processed using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; and an abnormal feature is determined according to the score value corresponding to each effective feature. Since the effective value of the initial feature is determined, the problem of low correlation between the collected behavior information and the risk warning is avoided. In addition, since the effective features are processed using an anomaly detection algorithm to determine the abnormal features, the problem of low intelligence in the prior art is avoided, and the accuracy of abnormal behavior recognition is improved, thereby improving the technical effect of the accuracy of risk warning.

[0054] According to an embodiment of the present disclosure, an anomaly detection algorithm is used to process the valid features of each feature set to be detected to obtain a score value corresponding to each valid feature, including: constructing a binary search tree for any feature to be detected in any feature set to be detected; performing a recursive in-order traversal on the binary search tree to determine the path length between the root node and the leaf node corresponding to the binary search tree; and obtaining a score value corresponding to each valid feature based on the path length.

[0055] According to an embodiment of the present disclosure, the binary search tree may be a random binary tree used in an anomaly detection algorithm, and for each node in the binary search tree, the values ​​of all nodes in its left subtree are less than or equal to the value of the node, and the values ​​of all nodes in its right subtree are greater than or equal to the value of the node. For any feature to be detected in any feature set to be detected, the anomaly detection algorithm randomly selects a split value between the maximum value and the minimum value of the feature, and divides the left subtree and the right subtree according to the split value.

[0056] According to an embodiment of the present disclosure, recursive in-order traversal is a traversal method implemented by a recursive function, which follows the order of "left-root-right" to visit nodes in a binary tree. For each node, first recursively traverse its left subtree, then visit the node itself, and finally recursively traverse its right subtree.

[0057] According to an embodiment of the present disclosure, the path length between the root node and the leaf node corresponding to the binary search tree is determined by the number of edges required to reach the node where the sample is isolated (being isolated means that the sample eventually reaches the leaf node of the tree).

[0058] According to an embodiment of the present disclosure, an anomaly detection algorithm is used to analyze the path length to determine a score value corresponding to each valid feature.

[0059] According to an embodiment of the present disclosure, a scoring value corresponding to each valid feature is obtained based on the path length, including: determining a preset expected length of the path length based on the path length between the root node and the leaf node corresponding to the binary search tree; determining the scoring value corresponding to the feature to be detected based on the preset expected length and the average path length, wherein the average path length is determined based on each valid feature of the feature set to be detected.

[0060] According to an embodiment of the present disclosure, for each feature to be detected in any feature set to be detected, the average path length is determined. , as shown in formula (1).

[0061] (1);

[0062] Among them, H() is the harmonic number, which can be approximated as ln()+0.5772156649, where n is the number of features to be detected in the feature set to be detected, and the average path length is a constant, which provides a standardized benchmark for standardizing the path length.

[0063] According to an embodiment of the present disclosure, a preset expected length E(h(x)) of the path length is determined based on the path length, which may be the expected path length of the feature x to be detected in the binary search tree corresponding to the feature set to be detected.

[0064] According to an embodiment of the present disclosure, a score value corresponding to the feature to be detected is determined according to a preset expected length and an average path length. , as shown in formula (2).

[0065] (2);

[0066] According to an embodiment of the present disclosure, determining an abnormal feature according to a score value corresponding to each valid feature includes: when the score value meets a preset condition, determining the feature to be detected as an abnormal feature.

[0067] According to the embodiments of the present disclosure, when E(h(x)) approaches c(n), s approaches 0.5, that is, when the average length of the effective feature x is close to the average path length of the tree, it is impossible to distinguish whether it is an abnormal feature. When E(h(x)) approaches 0, s approaches 1, and it is judged as an abnormal feature. When E(h(x)) approaches n-1, s approaches 0, and it is judged as a normal feature.

[0068] According to an embodiment of the present disclosure, M initial features are encoded to obtain valid values ​​of the M initial features, including: determining the total number of positive samples and the total number of negative samples corresponding to the M initial features, wherein the positive samples represent users associated with the initial features, and the negative samples represent users not associated with the initial features; for the lth initial feature, determining the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtaining the number of positive samples and the number of negative samples corresponding to the initial feature, 1≤l≤M; obtaining the valid value of the lth initial feature according to the total number of positive samples, the total number of negative samples, and the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtaining the valid values ​​of the M initial features.

[0069] According to the embodiments of the present disclosure, for any initial feature, determine the user in the historical database that includes the initial feature, and use the user as a positive sample; if not, use the user as a negative sample. For example, if an initial feature is over 30 years old, use the user over 30 years old in the database as a positive sample, and the user under 30 years old as a negative sample.

[0070] According to an embodiment of the present disclosure, the positive samples and negative samples of each initial feature are counted to obtain the number of positive samples and the number of negative samples corresponding to each initial feature, as well as the total number of positive samples and the total number of negative samples corresponding to M initial features.

[0071] According to an embodiment of the present disclosure, for the lth initial feature, an effective value calculation is performed based on the total number of positive samples, the total number of negative samples, the number of positive samples and the number of negative samples corresponding to the lth initial feature to obtain the effective value of the lth initial feature and the effective values ​​of the M initial features.

[0072] According to an embodiment of the present disclosure, the effective value of the lth initial feature is obtained according to the total number of positive samples, the total number of negative samples, the number of positive samples corresponding to the lth initial feature, and the number of negative samples, including: determining the positive sample ratio according to the total number of positive samples and the number of positive samples corresponding to the lth initial feature; determining the negative sample ratio according to the total number of negative samples and the number of negative samples corresponding to the lth initial feature; determining the sample difference and the sample ratio according to the positive sample ratio and the negative sample ratio; and obtaining the effective value of the lth initial feature according to the sample difference and the sample ratio.

[0073] According to an embodiment of the present disclosure, the positive sample ratio may be the ratio of the number of positive samples corresponding to the lth initial feature to the total number of positive samples.

[0074] According to an embodiment of the present disclosure, the negative sample ratio may be the ratio of the number of negative samples corresponding to the lth initial feature to the total number of negative samples.

[0075] According to an embodiment of the present disclosure, the sample ratio may be as shown in formula (3).

[0076] (3);

[0077] in, is the positive sample ratio, is the negative sample ratio, is the number of positive samples, is the total number of positive samples, is the number of negative samples, is the total number of negative samples.

[0078] According to an embodiment of the present disclosure, the sample difference value may be .

[0079] According to an embodiment of the present disclosure, the effective value of the lth initial feature is obtained according to the sample difference and the sample ratio, which can be shown as formula (4).

[0080] (4);

[0081] According to an embodiment of the present disclosure, m valid features are determined based on the valid value of each initial feature, including: for any initial feature, when the valid value meets a preset range, the initial feature is determined as a valid feature; and a valid feature set is determined based on the valid features.

[0082] According to the embodiments of the present disclosure, the corresponding relationship between different valid values ​​and their meanings is shown in Table (1).

[0083]

[0084] According to an embodiment of the present disclosure, initial features whose effective values ​​are between 0.1 (inclusive) and 0.5 are screened according to the calculation results and determined as effective features, and a valid feature set is further determined.

[0085] According to the embodiments of the present disclosure, some of the most effective features are selected from the initial features to reduce the dimension of the data set, and effective features with strong predictive capabilities are selected.

[0086] According to an embodiment of the present disclosure, m valid features are classified to obtain n feature sets to be detected, including: determining the coordinates of the m valid features in a spatial coordinate system; calculating the coordinate distance between every two valid features to obtain a distance value between every two valid features; and classifying the m valid features according to the distance value between every two valid features to obtain n feature sets to be detected.

[0087] According to an embodiment of the present disclosure, the coordinate distance calculation may be a Euclidean distance calculation, as specifically shown in formula (5).

[0088] (5);

[0089] in, is the coordinate of the x-th effective feature in the n-dimensional space coordinate system, is the coordinate of the yth valid feature in the n-dimensional space coordinate system.

[0090] According to an embodiment of the present disclosure, based on the distance value between every two valid features, K points with the smallest distance value are divided into a feature set to be detected, wherein the value of K is cross-validated to select the optimal K value.

[0091] According to the embodiments of the present disclosure, by classifying effective features, similar effective features are grouped into the same feature set to be detected, so as to effectively solve the swamping and masking problems of the isolation forest algorithm caused by excessive data volume, wherein swamping refers to the incorrect prediction of normal features as abnormalities. When normal features are very close to abnormal features, the number of splits required to isolate the abnormalities will increase, making it more difficult to distinguish abnormal features from normal features. Masking refers to the presence of a large number of abnormal points that hide their true colors. When the abnormal clusters are relatively large and dense, more splits are also required to isolate them. The above two situations make it more difficult to isolate abnormal points.

[0092] Figure 3 A schematic diagram of an abnormal behavior detection method according to an embodiment of the present disclosure is schematically shown.

[0093] The abnormal behavior detection method of the disclosed embodiment is as follows: Figure 3 As shown, operation S310 is performed to obtain the effective value of the lth initial feature according to the total number of positive samples, the total number of negative samples, the number of positive samples corresponding to the lth initial feature, and the number of negative samples, and the effective values ​​of the M initial features. Operation S320 is performed to determine m effective features according to the effective value of each initial feature. Operation S330 is performed to calculate the coordinate distance between every two effective features to obtain the distance value between every two effective features. Coordinate distance calculation is performed between every two effective features to obtain the distance value between every two effective features. Operation S340 is performed to classify the m effective features according to the distance value between every two effective features to obtain n feature sets to be detected. Operation S350 is performed to construct a binary search tree for any feature to be detected in any feature set to be detected, and determine the path length between the root node and the leaf node corresponding to the binary search tree. Operation S360 is performed to obtain the score value corresponding to each effective feature according to the path length. Execute operation S370 to determine whether the score value meets the preset conditions. If so, execute operation S380 to determine the feature to be detected as an abnormal feature; if not, execute operation S390 to determine the feature to be detected as a normal feature / unable to be determined.

[0094] Based on the above abnormal behavior detection method, the present disclosure also provides an abnormal behavior detection device. Figure 4 The device is described in detail.

[0095] Figure 4 The structure block diagram of the abnormal behavior detection device according to the embodiment of the present disclosure is schematically shown.

[0096] like Figure 4 As shown, the abnormal behavior detection device 400 of this embodiment includes an encoding module 410 , a first determination module 420 , a classification module 430 , a processing module 440 and a second determination module 450 .

[0097] The encoding module 410 is used to encode the M initial features to obtain effective values ​​of the M initial features, wherein the initial features represent the behavior information associated with the user, and M≥1. In one embodiment, the encoding module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0098] The first determination module 420 is used to determine m effective features according to the effective value of each initial feature, 1≤m≤M. In one embodiment, the first determination module 420 can be used to perform the operation S220 described above, which will not be described in detail here.

[0099] The classification module 430 is used to classify the m valid features to obtain n feature sets to be detected, wherein each feature set to be detected includes at least one valid feature, and n≥1. In one embodiment, the classification module 430 can be used to perform the operation S230 described above, which will not be described in detail here.

[0100] The processing module 440 is used to process at least one valid feature in each feature set to be detected using an anomaly detection algorithm to obtain a score value corresponding to each valid feature. In one embodiment, the processing module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0101] The second determination module 450 is used to determine an abnormal feature according to the score value corresponding to each valid feature, wherein the abnormal feature represents an abnormal behavior associated with the user. In one embodiment, the second determination module 450 can be used to perform the operation S250 described above, which will not be described in detail here.

[0102] According to the embodiments of the present disclosure, M initial features are encoded to obtain the effective values ​​of the M initial features; m effective features M are determined according to the effective value of each initial feature; the m effective features are classified to obtain n feature sets to be detected; at least one effective feature in each feature set to be detected is processed using an anomaly detection algorithm to obtain a score value corresponding to each effective feature; and an abnormal feature is determined according to the score value corresponding to each effective feature. Since the effective value of the initial feature is determined, the problem of low correlation between the collected behavior information and the risk warning is avoided. In addition, since the effective features are processed using an anomaly detection algorithm to determine the abnormal features, the problem of low intelligence in the prior art is avoided, and the accuracy of abnormal behavior recognition is improved, thereby improving the technical effect of the accuracy of risk warning.

[0103] According to an embodiment of the present disclosure, any multiple modules of the encoding module 410, the first determination module 420, the classification module 430, the processing module 440, and the second determination module 450 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the encoding module 410, the first determination module 420, the classification module 430, the processing module 440, and the second determination module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the encoding module 410, the first determination module 420, the classification module 430, the processing module 440 and the second determination module 450 may be at least partially implemented as a computer program module, which may perform a corresponding function when executed.

[0104] According to an embodiment of the present disclosure, the processing module 440 includes a construction submodule, a traversal submodule and a first obtaining submodule.

[0105] The construction submodule is used to construct a binary search tree for any feature to be detected in any feature set to be detected.

[0106] The traversal submodule is used to perform a recursive in-order traversal on the binary search tree and determine the path length between the root node and the leaf node corresponding to the binary search tree.

[0107] The first submodule is used to obtain a score value corresponding to each valid feature according to the path length.

[0108] According to an embodiment of the present disclosure, the obtaining submodule includes a first determining unit and a second determining unit.

[0109] The first determining unit is used to determine a preset expected length of the path length according to the path length between the root node and the leaf node corresponding to the binary search tree.

[0110] The second determination unit is used to determine the score value corresponding to the feature to be detected according to a preset expected length and an average path length, wherein the average path length is determined based on each valid feature of the feature set to be detected.

[0111] According to an embodiment of the present disclosure, the second determination module 450 includes a first determination submodule.

[0112] The first determination submodule is used to determine the feature to be detected as an abnormal feature when the score value meets a preset condition.

[0113] According to an embodiment of the present disclosure, the encoding module 410 includes a second determining submodule, a third determining submodule and a second obtaining submodule.

[0114] The second determination submodule is used to determine the total number of positive samples and the total number of negative samples corresponding to the M initial features, wherein the positive samples represent users associated with the initial features, and the negative samples represent users not associated with the initial features.

[0115] The third determination submodule is used to determine the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtain M numbers of positive samples and negative samples corresponding to the initial feature, 1≤l≤M.

[0116] The second obtaining submodule is used to obtain the effective value of the lth initial feature according to the total number of positive samples, the total number of negative samples, the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtain the effective values ​​of M initial features.

[0117] According to an embodiment of the present disclosure, the second obtaining submodule includes a third determining unit, a fourth determining unit, a fifth determining unit and an obtaining unit.

[0118] The third determining unit is used to determine the positive sample ratio according to the total number of positive samples and the number of positive samples corresponding to the lth initial feature.

[0119] The fourth determining unit is used to determine the negative sample ratio according to the total number of negative samples and the number of negative samples corresponding to the lth initial feature.

[0120] The fifth determining unit is used to determine the sample difference and the sample ratio according to the positive sample ratio and the negative sample ratio.

[0121] The obtaining unit is used to obtain the effective value of the lth initial feature according to the sample difference and the sample ratio.

[0122] According to an embodiment of the present disclosure, the classification module 430 includes a fourth determination submodule, a third acquisition submodule and a classification submodule.

[0123] The fourth determination submodule is used to determine the coordinates of m valid features in the spatial coordinate system.

[0124] The third submodule is used to calculate the coordinate distance between every two valid features to obtain the distance value between every two valid features.

[0125] The classification submodule is used to classify m valid features according to the distance value between every two valid features to obtain n feature sets to be detected.

[0126] According to an embodiment of the present disclosure, the first determination module 420 includes a fifth determination submodule and a sixth determination submodule.

[0127] The fifth determination submodule is used to determine, for any initial feature, the initial feature as a valid feature when the valid value meets a preset range.

[0128] The sixth determination submodule is used to determine a valid feature set according to the valid features.

[0129] Figure 5 A block diagram of an electronic device suitable for implementing an abnormal behavior detection method according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0131] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0132] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0133] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0134] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0135] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the abnormal behavior detection method provided by the embodiment of the present disclosure.

[0136] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0137] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0138] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0139] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0140] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0141] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0142] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for detecting abnormal behavior, characterized in that: The method comprises: Encoding M initial features to obtain M valid values ​​of the initial features, wherein the initial features represent behavior information associated with the user, and M≥1; According to the effective value of each of the initial features, m effective features are determined, 1≤m≤M; Classifying the m valid features to obtain n feature sets to be detected, wherein each of the feature sets to be detected includes at least one valid feature, and n≥1; Using an anomaly detection algorithm to process at least one of the valid features in each of the feature sets to be detected, to obtain a score value corresponding to each of the valid features; An abnormal feature is determined according to a score value corresponding to each of the valid features, where the abnormal feature represents an abnormal behavior associated with the user.

2. The method according to claim 1, characterized in that The using of anomaly detection algorithm to process the effective features of each of the feature sets to be detected to obtain a score value corresponding to each of the effective features includes: For any feature to be detected in any of the feature sets to be detected, construct a binary search tree; Performing a recursive in-order traversal on the binary search tree to determine the path length between the root node and the leaf node corresponding to the binary search tree; A score value corresponding to each of the valid features is obtained according to the path length.

3. The method according to claim 2, characterized in that The step of obtaining a score value corresponding to each of the valid features according to the path length includes: Determine a preset expected length of the path length according to the path length between the root node and the leaf node corresponding to the binary search tree; A score value corresponding to the feature to be detected is determined according to the preset expected length and the average path length, wherein the average path length is determined based on each of the valid features in the feature set to be detected.

4. The method according to claim 1, characterized in that The step of determining the abnormal feature according to the score value corresponding to each of the valid features comprises: When the score value meets a preset condition, the feature to be detected is determined as the abnormal feature.

5. The method according to claim 1, characterized in that The encoding of the M initial features to obtain the valid values ​​of the M initial features includes: Determine the total number of positive samples and the total number of negative samples corresponding to the M initial features, wherein the positive samples represent users associated with the initial features, and the negative samples represent users not associated with the initial features; For the lth initial feature, determine the number of positive samples and the number of negative samples corresponding to the lth initial feature, and obtain M numbers of positive samples and negative samples corresponding to the initial feature, 1≤l≤M; According to the total number of positive samples, the total number of negative samples, the number of positive samples and the number of negative samples corresponding to the lth initial feature, the effective value of the lth initial feature is obtained, and the effective values ​​of the M initial features are obtained.

6. The method according to claim 5, characterized in that The obtaining the effective value of the lth initial feature according to the total number of positive samples, the total number of negative samples, the number of positive samples and the number of negative samples corresponding to the lth initial feature comprises: Determining a positive sample ratio according to the total number of positive samples and the number of positive samples corresponding to the lth initial feature; Determining a negative sample ratio according to the total number of negative samples and the number of negative samples corresponding to the lth initial feature; Determining a sample difference and a sample ratio according to the positive sample ratio and the negative sample ratio; The effective value of the lth initial feature is obtained according to the sample difference and the sample ratio.

7. The method according to claim 1, characterized in that The m valid features are classified to obtain n feature sets to be detected, including: Determine the coordinates of the m valid features in the spatial coordinate system; Calculating the coordinate distance between every two of the valid features to obtain a distance value between every two of the valid features; According to the distance value between every two of the valid features, the m valid features are classified to obtain n feature sets to be detected.

8. The method according to claim 1, characterized in that Determining m valid features according to the valid value of each of the initial features comprises: For any of the initial features, when the valid value satisfies a preset range, determining the initial feature as the valid feature; The valid feature set is determined according to the valid features.

9. An abnormal behavior detection device, characterized in that: The device comprises: An encoding module, used for encoding M initial features to obtain effective values ​​of the M initial features, wherein the initial features represent behavior information associated with the user, and M≥1; A first determination module is used to determine m effective features according to the effective value of each of the initial features, 1≤m≤M; A classification module, used for classifying the m valid features to obtain n feature sets to be detected, wherein each of the feature sets to be detected includes at least one valid feature, and n≥1; a processing module, configured to process at least one of the valid features in each of the feature sets to be detected using an anomaly detection algorithm to obtain a score value corresponding to each of the valid features; and The second determination module is used to determine an abnormal feature according to the score value corresponding to each of the valid features, wherein the abnormal feature represents an abnormal behavior associated with the user.

10. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images