Behavior detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a behavior detection method and device, equipment and a storage medium. The method comprises the following steps: acquiring click behavior data for a target object; determining a first detection result for the click behavior data based on the click behavior data through a trained generative adversarial network model; determining a second detection result for the click behavior data based on the click behavior data through a trained detection model; and determining a target detection result corresponding to the click behavior data at least based on the first detection result and the second detection result. Therefore, the problems of poor flexibility, dependence on feature selection, influence of data noise and fraud camouflage, poor model robustness, insufficient generalization ability, limitation of real-time performance and calculation efficiency and the like in click behavior detection can be solved. Meanwhile, deep features can be automatically learned, artificial feature selection dependence is reduced, robustness to noise and camouflage behaviors is enhanced, and generalization ability and real-time processing ability of the model are improved.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computer technology, and more particularly, to methods, apparatuses, devices, and storage media for behavior detection. Background Art

[0002] With the development of Internet technology, online shopping through the Internet has become a way of shopping for people. Through computer technology and algorithms, according to the user's interests, behaviors, geographic location and other information, the target object (for example, advertisements, links, etc.) can be accurately delivered to the target user to improve the click-through rate and conversion rate of the target object. After the target object is delivered, click fraud may occur, for example, the behavior of consuming the advertiser's budget or obtaining illegal income by falsely clicking on the advertisement. Therefore, how to improve the accuracy and robustness of click fraud detection is worthy of attention and urgent need. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for behavior detection is provided, including: obtaining click behavior data for a target object; determining a first detection result for the click behavior data based on the click behavior data through a trained generative adversarial network model, the first detection result indicating whether a target behavior for the target object has occurred; determining a second detection result for the click behavior data based on the click behavior data through a trained detection model, the second detection result indicating whether the target behavior for the target object has occurred, the model parameters of the detection model being obtained by aggregating multiple groups of candidate model parameters, the multiple groups of candidate model parameters being obtained by training the detection model using sample click behavior data corresponding to each of multiple devices; and determining a target detection result corresponding to the click behavior data based at least on the first detection result and the second detection result.

[0004] In a second aspect of the present disclosure, a device for behavior detection is provided, including: an acquisition module, configured to acquire click behavior data for a target object; a first determination module, configured to determine a first detection result for the click behavior data based on the click behavior data through a trained generative adversarial network model, the first detection result indicating whether a target behavior for the target object has occurred; a second determination module, configured to determine a second detection result for the click behavior data based on the click behavior data through a trained detection model, the second detection result indicating whether the target behavior for the target object has occurred, the model parameters of the detection model being obtained by aggregating multiple groups of candidate model parameters, the multiple groups of candidate model parameters being obtained by training the detection model using sample click behavior data corresponding to each of multiple devices; and a third determination module, configured to determine the target detection result corresponding to the click behavior data based at least on the first detection result and the second detection result.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, and when the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect of the present disclosure.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to perform the method according to the first aspect of the present disclosure.

[0007] In a fifth aspect of the present disclosure, a computer program product is provided, which includes computer executable instructions, wherein the computer executable instructions implement the method according to the first aspect of the present disclosure when executed by a processor.

[0008] It should be understood that the contents described in the summary of the present invention are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In the following, in conjunction with the accompanying drawings and with reference to the following detailed description, the above and other features, advantages and aspects of various implementations of the present disclosure will become more apparent. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0011] Figure 2A flowchart showing a process for behavior detection according to some embodiments of the present disclosure is shown;

[0012] Figure 3 A flowchart showing a process of data collection according to some embodiments of the present disclosure;

[0013] Figure 4 A flowchart showing a process of training a generative adversarial network model according to some embodiments of the present disclosure is shown;

[0014] Figure 5 A flowchart showing a process of training a detection model according to some embodiments of the present disclosure is shown;

[0015] Figure 6 A flowchart of a process 600 of target behavior detection according to some embodiments of the present disclosure is shown;

[0016] Figure 7 A block diagram showing an apparatus for behavior detection according to some embodiments of the present disclosure; and

[0017] Figure 8 A block diagram of an electronic device is shown in which one or more embodiments of the present disclosure may be implemented. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be noted that the acquisition, storage and application of user personal information involved in the technical solution of the present disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0020] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0021] As used herein, the term "model" can learn the association between the corresponding input and output from the training data, so that after the training is completed, the corresponding output can be generated for a given input. The generation of the model can be based on machine learning technology. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs by using multiple layers of processing units. In this article, "model" may also be referred to as "machine learning model", "machine learning network" or "network", and these terms are used interchangeably in this article.

[0022] Generally, machine learning can be roughly divided into three stages, namely the training stage, the testing stage, and the application stage (also called the inference stage). In the training stage, a given model can be trained using a large amount of training data, and the parameter values ​​are continuously updated iteratively until the model can obtain consistent inferences that meet the expected goals from the training data. Through training, the model can be considered to be able to learn the association from input to output (also called the mapping of input to output) from the training data. The parameter values ​​of the trained model are determined. In the testing stage, the test input is applied to the trained model to test whether the model can provide the correct output, thereby determining the performance of the model. In the application stage, the model can be used to process the actual input based on the parameter values ​​obtained from the training to determine the corresponding output.

[0023] In order to facilitate the understanding of the embodiments of the present disclosure, some terms involved in the embodiments of the present disclosure are first explained.

[0024] Generative Adversarial Networks (GAN) generate realistic data by training two neural networks: the generator and the discriminator, in an adversarial manner.

[0025] Federated Learning is a distributed learning method that allows multiple clients (such as different devices or servers) to collaborate to train a shared model without centralizing the data to a single center, which can effectively protect data privacy.

[0026] Generator, the task of the generator is to generate realistic data samples from random noise (usually Gaussian noise). The generator tries to generate samples similar to the real data distribution by learning the data distribution. The goal of the generator is to maximize the probability that the discriminator judges that the generated samples are real data.

[0027] Discriminator: The task of the discriminator is to distinguish between real data and generated data. It receives real data and generated data as input and outputs a probability value indicating the likelihood that the input data is real data. The goal of the discriminator is to maximize the accuracy of the discrimination of real data while minimizing the accuracy of the discrimination of generated data.

[0028] As briefly mentioned above, after the target object is delivered, click fraud may occur. Currently, the detection methods of click fraud mainly include rule-based detection, statistical feature analysis, traditional machine learning models, etc.

[0029] Rule-based detection relies on predefined rules and thresholds to identify abnormal click behaviors. For example, it detects high-frequency clicks from the same IP address in a short period of time or abnormalities in user click behavior patterns. This approach has poor flexibility and adaptability, making it difficult to deal with complex and changing fraud methods. In addition, the effectiveness of the rules depends on expert experience and can be easily bypassed by fraudsters.

[0030] Statistical feature analysis can detect abnormal patterns by analyzing the statistical features of click behavior data (e.g., click rate, click interval time distribution, etc.). However, the effectiveness of this method depends on the quality of feature selection and the accuracy of the statistical model, and is easily affected by data noise and fraudsters' disguised behavior, thereby evading detection.

[0031] Traditional machine learning models, common models may include decision trees, random forests, logistic regression, etc. These models learn the characteristics of click behavior data through training and classify them. However, the performance of these models depends on the quality of feature engineering, and the robustness and adaptability of the models are limited in the face of ever-changing fraud methods. At the same time, traditional machine learning models may be overfitted during the training process, resulting in insufficient generalization ability of the models.

[0032] Therefore, how to improve the accuracy and robustness of click fraud detection is worthy of attention and urgently needed.

[0033] In order to at least partially solve the above problems and other potential problems that may exist in traditional solutions, the present disclosure provides a solution for behavior detection. According to various embodiments of the present disclosure, first, click behavior data for a target object is obtained. Further, through a trained generative adversarial network model, based on the click behavior data, a first detection result for the click behavior data is determined, and the first detection result indicates whether the target behavior for the target object occurs. Further, through a trained detection model, based on the click behavior data, a second detection result for the click behavior data is determined, and the second detection result indicates whether the target behavior for the target object occurs. The model parameters of the detection model are obtained by aggregating multiple sets of candidate model parameters, and the multiple sets of candidate model parameters are obtained by training the detection model using sample click behavior data corresponding to each of multiple devices. Finally, based on at least the first detection result and the second detection result, the target detection result corresponding to the click behavior data is determined. In this way, the problems of poor flexibility, reliance on feature selection, influence of data noise and fraud disguise, poor robustness of the model, insufficient generalization ability, and real-time and computational efficiency limitations in click behavior detection can be solved. At the same time, it can also automatically learn deep features, reduce reliance on manual feature selection, enhance robustness to noise and camouflage behavior, and improve the generalization and real-time processing capabilities of the model.

[0034] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0035] Figure 1 1 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 As shown, environment 100 may include server 120, third party data source 130, client devices 110-1, 110-2, ..., 110-N. For ease of discussion, client devices 110-1, 110-2, ..., 110-N may be collectively or individually referred to as client device 110.

[0036] In the environment 100, various client applications, such as advertisement recommendation applications (also referred to as advertisement platforms), may be installed on the client device 110. For example, an advertisement platform may be installed on a client device 110, i.e., advertisement platforms 140-1, 140-2, ..., 140-N as shown in the figure. For ease of discussion, advertisement platforms 140-1, 140-2, ..., 140-N may also be collectively or individually referred to as advertisement platforms 140.

[0037] It should be understood that the advertisement platforms 140 installed on different client devices 110 may be the same or different. At the same time, the number of advertisement platforms installed on the client device 110 may also be multiple, which is not limited in the embodiment of the present disclosure.

[0038] In some embodiments of the present disclosure, the advertising platform 140 may be used to recommend advertisements to target users, and may also collect click behavior data of users on the advertisements placed by the advertising platform 140 .

[0039] In the environment 100, the server 120 may be configured to train the generative adversarial network model 160 based on sample data, and detect the user's click behavior on the advertisements placed by the advertising platform 140 through the trained generative adversarial network model 160. Alternatively, the server 120 may send the trained generative adversarial network model 160 to the client device 110, so that the client device 110 may detect the user's click behavior on the advertisements placed by the advertising platform based on the trained generative adversarial network model 160. Alternatively, the client device 110 may communicate with the server 120 (e.g., via network communication) to detect the user's click behavior on the advertisements placed by the advertising platform 140 using the generative adversarial network model 160 stored thereon.

[0040] In some embodiments, the sample data for training the generative adversarial network model 160 may be historical click behavior data stored in the server 120, or may be collected and sent to the server 120 by the client device 110, or may be click behavior data obtained from a third-party data source 130. It should be understood that the use of the sample data is authorized by the user.

[0041] In the environment 100 , the server 120 may also be configured to send the generative adversarial network model 160 to the client device 110 for training by the client device 110 .

[0042] In environment 100, server 120 may also be configured to send a pre-trained detection model 150 to client device 110, so that client device 110 trains detection model 150 respectively based on respective collected click behavior data, and after the training is completed, sends model parameters of detection model 150 to server 120, so that server 120 processes the model parameters to obtain parameters of detection model 150, thereby obtaining trained detection model 150, and sends trained detection model 150 to client device 110, so that client device 110 can detect user click behavior on advertisements placed by advertising platform 140 based on trained detection model 150.

[0043] The client device 110 may be any type of device with computing capabilities, including an electronic device or a server device. The electronic device may be any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, a personal communication system (PCS) device, a personal navigation device, a personal digital assistant (PDA), an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an e-book device, a gaming device or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server device may include, for example, a computing system / server, such as a mainframe, an edge computing node, an electronic device in a cloud environment, and the like.

[0044] The server 120 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms. The server 120 may include, for example, a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like.

[0045] The communication connection between the client device 110 and the server 120 can be established in a wired manner or a wireless manner. The communication connection may include, but is not limited to, a Bluetooth connection, a mobile network connection, a Universal Serial Bus (USB) connection, a Wireless Fidelity (WiFi) connection, etc., and the embodiments of the present disclosure are not limited in this respect.

[0046] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and does not imply any limitation on the scope of the present disclosure.

[0047] Figure 2 FIG. 2 is a flow chart showing a process 200 for behavior detection according to some embodiments of the present disclosure. Figure 2 In the embodiment, process 200 can be implemented in client device 110 alone or in combination with client device 110 and server 120. For the convenience of description, the following description will be based on the example of client device 110 executing process 200. It should be understood that similar processes can also be executed by client device 110 and server 120 together. Figure 1 The solution for behavior detection provided by the present disclosure is introduced in detail.

[0048] In block 210 , the client device 110 obtains click behavior data for a target object.

[0049] In some embodiments, click behavior data refers to data generated by a click operation on a target object. Taking the target object as an advertisement as an example, the click behavior data may include but is not limited to: click time, advertisement placement location, user ID, and advertisement ID.

[0050] In some embodiments, the click behavior data may be data collected in real time by the client device 110, or may be historical data stored locally, or may be data sent by the server 120. It should be understood that the click behavior data sent by the server 120 to the client device 110 may be collected in real time, or may be historical data stored locally.

[0051] In block 220 , the client device 110 determines a first detection result for the click behavior data based on the click behavior data by using the trained generative adversarial network model 160 .

[0052] The first detection result indicates whether the target behavior for the target object occurs. For example, the target behavior for the advertisement may be click fraud. After obtaining the click behavior data for the target object, the click behavior data may be used as the input of the generative adversarial network model 160, thereby outputting the first detection result for the click behavior data. More specifically, the click behavior data may be used as the input of the discriminator in the generative adversarial network model 160, thereby outputting the first detection result.

[0053] In some embodiments, the generative adversarial network model 160 is obtained by performing multiple rounds of alternating training based on historical click behavior data and random noise samples. One round of alternating training in the multiple rounds of alternating training includes: first, obtaining historical click behavior data and random noise samples. Further, based on the random noise samples, the generator in the generative adversarial network model is trained. Further, based on the random noise samples, forged click behavior data is generated by the trained generator. Finally, based on the historical click behavior data and the forged click behavior data, the discriminator in the generative adversarial network model is trained.

[0054] To further explain the training process of the generative adversarial network model 160 provided in some embodiments of the present disclosure, the following is combined with Figure 3 and Figure 4 The training process of the generative adversarial network model 160 in the embodiment of the present disclosure is introduced in detail. Figure 3 A flow chart of a process 300 for data collection according to some embodiments of the present disclosure is shown. Figure 4A flowchart of a process 400 for training a generative adversarial network model according to some embodiments of the present disclosure is shown. For example, the process 300 and the process 400 may be performed by the client device 110.

[0055] See also Figure 3 , in box 310, the client device 110 performs data collection to obtain historical click behavior data.

[0056] In some embodiments, the historical click behavior data may be data stored locally on the client device 110 , or may be data obtained from a third-party data source 150 .

[0057] In block 320, the client device 110 performs data cleaning on the historical click behavior data. In some embodiments, data cleaning may include, but is not limited to: removing missing values, duplicate data, processing abnormal values, etc. Through data cleaning, the integrity and accuracy of the data can be ensured.

[0058] In block 330, the client device 110 performs data normalization on the cleaned historical click behavior data. In some embodiments, the historical click behavior data may include numerical data and categorical data. The numerical data may be normalized and the categorical data may be encoded, thereby ensuring that the scale of the historical click behavior data is unified. It should be understood that the scale unification of the historical click behavior data refers to the scale unification of the numerical data and the scale unification of the categorical data. For the two types of data, the numerical data and the categorical data, their scales are not required to be unified.

[0059] In block 340 , the client device 110 performs feature engineering on the normalized historical click behavior data, for example, by extracting key features, generating new features, selecting features, etc.

[0060] In block 350, the client device 110 performs data enhancement on the historical click behavior data. In some embodiments, data enhancement may be performed by using methods such as data expansion and data balancing, thereby increasing the amount of data and balancing sample distribution, thereby solving the problem of data imbalance and insufficient samples.

[0061] In some embodiments, after the above-mentioned processing is performed on the historical click behavior data, the historical click behavior data can be divided into a training set, a verification set and a test set. The generative adversarial network model 160 can be trained by the training set, the generative adversarial network model 160 can be verified by the verification set, and the generative adversarial network model 160 can be tested by the test set, so as to ensure the scientificity and reliability of the model training.

[0062] After the data set is divided, the training set can be used to train the generative adversarial network model 160. Specifically, see Figure 4 In block 410, the client device 110 initializes the generative adversarial network model 160. For example, the network structure and related parameters of the generator and the discriminator are initialized, and the hyperparameters required for training the generative adversarial network model 160 are configured. The hyperparameters may include, but are not limited to, learning rate, batch size, number of training rounds, etc.

[0063] In block 420, the client device 110 prepares data. For example, the preparation process may include the client device 110 loading a training set, collecting random noise samples from a standard normal distribution, etc. It should be understood that the dimension of the random noise sample can be set as required, and the embodiment of the disclosure is not limited thereto.

[0064] For example, assuming that the dimension of the noise vector is z, the random noise sample can be expressed as: z~N(0,I), where I is the covariance matrix, and N(0,I) represents a multidimensional normal distribution with a mean of 0 and a covariance matrix that is a unit matrix.

[0065] At block 430, the client device 110 performs multiple rounds of alternating training on the generative adversarial network model 160. In some embodiments, the generative adversarial network model 160 may include a generator and a discriminator. It should be understood that in one round of training in the multiple rounds of alternating training, when training the generator, the parameters of the discriminator are fixed, and when training the discriminator, the parameters of the generator are fixed.

[0066] In some embodiments, the generator may include one or more encoders and one or more decoders. The encoder may be a neural network that maps input data (e.g., random noise samples) to distribution parameters (e.g., mean and variance) of a latent space. This latent space can be viewed as a set of all possible data points. The decoder may be another neural network that samples from the distribution of the latent space and generates new data points (e.g., forged click behavior data).

[0067] In one round of alternating training among multiple rounds of alternating training, when training the generator, the random noise sample can be used as the input of the generator to output the forged click behavior data. For example, the random noise sample z is used as the input of the generator, and the output forged click behavior data is: Where G() is the function representation of the generator, It is to forge click behavior data.

[0068] In some embodiments, when the generator generates forged click behavior data, a variational autoencoder (VAE) technology can be introduced to generate high-quality and diverse forged click behavior data.

[0069] The purpose of the generator is to generate sufficiently realistic forged click behavior data so that the discriminator cannot distinguish between the forged click behavior data and the historical click behavior data. Therefore, the generator can adopt an adversarial loss, the purpose of which is to maximize the discriminator's discrimination result on the forged click behavior data. In some embodiments, the loss function of the generator is based on the similarity between the random noise sample and the forged click behavior data and the difference between the distribution of the forged click behavior data in the latent space and the standard normal distribution.

[0070] For example, the loss function of the generator can be expressed as follows:

[0071]

[0072] Wherein, z is a random noise sample, D() is the function representation of the discriminator, G(z) is the forged click behavior data, and D(G(z)) is the discriminator's judgment result on the forged click behavior data, that is, the probability that the forged click behavior data is the real click behavior data.

[0073] During training, a back-propagation algorithm (e.g., stochastic gradient descent) can be used to minimize the generator’s loss function and thus update the generated parameters.

[0074] Specifically, the gradient of the generator loss is calculated by the following formula:

[0075]

[0076] Next, update the generated parameters using the following formula:

[0077]

[0078] Among them, θ G is the generated parameter, α is the learning rate, is the gradient of the loss function with respect to the generator parameters.

[0079] In one round of alternating training among multiple rounds of alternating training, when training the discriminator, the historical click behavior data and the forged click behavior data can be used as inputs of the discriminator, and the probability that the forged click behavior data is the real click behavior data (for example, the historical click behavior data) can be output.

[0080] For example, assuming that the historical click behavior data is x, the forged click behavior data generated by the generator is but:

[0081] x~p data (x)

[0082] tildex=G(z),z~p z (x)

[0083] Among them, p data (x) is a probability distribution, p z (x) is a known distribution.

[0084] The discriminator can be expressed as follows:

[0085] D(x)=σ(W3·LeakyReLU(W2·LeakyReLU(W1·x+b1)+b2)+b3)

[0086] Among them, x is the input data (ad click data); W1, W2, W3 are weight matrices, corresponding to the weights of each layer of the discriminator; b1, b2, b3 are bias vectors, corresponding to the bias of each layer of the discriminator; σ() is the activation function, and LeakyReLU() is the activation function.

[0087] The purpose of the discriminator is to distinguish historical click behavior data from forged click behavior data. Therefore, the loss function of the discriminator can be expressed as follows:

[0088] L D =L real +L fake

[0089]

[0090]

[0091] Among them, x~p data (x) is the historical click behavior data.

[0092] During training, the back propagation algorithm can be used to calculate the gradient of the loss function to the discriminator parameters, and the discriminator parameters can be updated using the following formula:

[0093]

[0094] Among them, θ D are the parameters of the discriminator (including weights and biases), α is the learning rate, is the gradient of the loss function with respect to the discriminator parameters.

[0095] The gradient of the loss function to the discriminator parameters can be calculated using the following formula:

[0096]

[0097] By performing multiple rounds of alternating training on the generator and the discriminator respectively in the above manner, the training of the generative adversarial network model 160 can be realized.

[0098] At block 440 , the client device 110 evaluates the training effect. In some embodiments, the client device 110 may use a validation set and / or a test set to evaluate the effect of the generative adversarial network model 160 .

[0099] In some embodiments, the evaluation of the training effect may include an evaluation of the generator and an evaluation of the discriminator. For example, the quality and diversity of the forged click behavior data generated by the generator are evaluated. For example, the discriminator is evaluated for its ability to distinguish between historical click behavior data and forged behavior data. In some embodiments, if the evaluation effect meets expectations, the training is completed. If the evaluation effect does not meet expectations, the model or the training algorithm needs to be adjusted.

[0100] Continue to see Figure 2 In block 230, the client device 110 determines a second detection result for the click behavior data based on the click behavior data by using the trained detection model 150. The second detection result indicates whether the target behavior for the target object occurs.

[0101] The model parameters of the detection model 159 are obtained based on the aggregation processing of multiple groups of candidate model parameters, and the multiple groups of candidate model parameters are obtained by training the detection model 150 using the sample click behavior data corresponding to multiple devices (for example, the client device 110).

[0102] When the advertising platforms 140 installed in different client devices 110 are different, due to the user privacy protection requirements of the advertising platform 140, the data of the advertising platform 140 cannot be concentrated on one device. Therefore, the detection model 150 can be trained using the data distributed on different client devices 110.

[0103] Specifically, see Figure 5 , Figure 5 A flowchart of a process 500 for training a detection model according to some embodiments of the present disclosure is shown. For example, the process 500 may be performed by the client device 110. In some embodiments, the process 500 may be implemented by way of federated learning.

[0104] Specifically, in block 510, the client device 110 performs data localization. For example, different client devices 110 locally collect respective click behavior data and store the collected click behavior data locally.

[0105] In box 520, the client device 110 performs local model training. In some embodiments, the client device 110 may train the model in a federated learning manner. For example, a global model may be created and initialized in the server 120, and the initial parameters of the global model may be randomly set or based on pre-training, which is not limited in the embodiments of the present disclosure. The server 120 sends the global model to each client device 110, and each client device 110 trains the global model based on the locally stored click behavior data.

[0106] In some embodiments, before training the global model, the client device 110 may pre-process the locally stored click behavior data. For example, the pre-processing may include but is not limited to: data cleaning, data normalization, feature extraction, etc.

[0107] In block 530, the client device 110 updates the model parameters. For example, the client device 110 may update the parameters of the global model based on the local training results. For example, the weights of the global model may be updated, or new features or patterns may be learned.

[0108] In block 540, the client device 110 sends the model parameters to the server 120, so that the server 120 performs aggregation processing (e.g., federated averaging) on ​​the received multiple sets of model parameters, and uses the aggregated model parameters as parameters of the global model, thereby obtaining the detection model 150. In this way, compared to the client device 110 sending the locally trained global model to the server 120, only sending the updated model parameters to the server 120 can reduce the communication cost.

[0109] In some embodiments, after obtaining the detection model 150, the server 120 may further optimize the detection model 150, for example, by adjusting the learning rate, processing data heterogeneity, and so on.

[0110] In box 550 , the client device 110 receives the detection model 150 sent by the server, so that the client device 110 can detect the click behavior data based on the detection model 150 .

[0111] In some embodiments, the trained detection model 150 may be regularly evaluated for performance, or may be validated. For example, a cross-validation method may be used, or the detection model 150 may be directly validated using data, thereby ensuring the generalization ability of the detection model 150.

[0112] Continue to see Figure 2In block 240, the client device 110 determines a target detection result corresponding to the click behavior data based at least on the first detection result and the second detection result. The target detection result indicates whether a target behavior for a target object occurs.

[0113] When the target detection result indicates whether the target behavior for the target object has occurred, if the first detection result indicates that the target behavior has occurred or the second detection result indicates that the target behavior has occurred, it is determined that the target detection result (final result) indicates that the target behavior for the target object has occurred. Only when the first detection result and the second detection result simultaneously indicate that the target behavior has not occurred, can it be determined that the target detection result (final result) indicates that the target behavior for the target object has not occurred.

[0114] In some embodiments, the target detection result is also determined based on media data for a target user, where the target user is a user who uses a target device to perform a click operation corresponding to the click behavior data, and the media data is media data collected by the target device during the click operation. The media data can be used to assist the target detection result in making a judgment.

[0115] For example, the target detection result indicates that the target behavior for the target object occurs, but the media data for the user collected by the client device 110 during the user's click operation on the target object may not be accurate. Online Anomaly Detection (OAD) can be used for further judgment.

[0116] In some embodiments, the media data may include video data, audio data, pictures, etc. For example, the client device 110 may collect the user's video data and audio data in real time using a camera, microphone, etc. installed on the client device 110. For another example, the client device 110 may obtain the video data, audio data, pictures, etc. for the user stored locally.

[0117] In some embodiments, the client device 110 may determine a processing method based on the target detection result, and process the click behavior data or the target object based on the processing method.

[0118] In some embodiments, when the target detection result indicates that a target behavior for a target object occurs, the processing method may include at least one of the following: shielding click behavior data, adjusting the delivery strategy of the target object, or recording click behavior data.

[0119] In some embodiments, the client device 110 issues an alarm message in response to determining that the target detection result indicates that the target behavior has occurred.

[0120] To further explain the solutions for behavior detection provided in some embodiments of the present disclosure. Figure 6 The process for behavior detection in the embodiments of the present disclosure is introduced in detail. Figure 6 FIG. 6 is a flowchart of a process 600 of target behavior detection according to some embodiments of the present disclosure. For example, the process 600 may be performed by the client device 110 .

[0121] At block 610 , the client device 110 collects click behavior data.

[0122] In some embodiments, the client device 110 may collect click behavior data in real time. For example, when the client device 110 collects click behavior data in real time, Apache Kafka may be used as a data platform to achieve real-time collection and transmission of click behavior data. Specifically, a Kafka producer may be configured to send the click behavior data to a Kafka topic, a Kafka consumer may be used to read the click behavior data from the Kafka topic, and the click behavior data may be transmitted to the client device 110.

[0123] In some embodiments, the client device 110 may pre-process the collected click behavior data. It should be understood that the pre-processing method may adopt the above-mentioned pre-processing method, which will not be described in detail here.

[0124] In block 620 , the client device 110 detects the click behavior data based on the trained generative adversarial network model 160 and the trained detection model 150 .

[0125] For example, the click behavior data may be used as an input to a discriminator in a trained generative adversarial network model 160 and / or a trained detection model 150 , thereby outputting a probability that the click behavior data is a target behavior.

[0126] In some embodiments, a stream processing framework such as Apache Flink may be used to implement the detection of click behavior data processing.

[0127] In block 630 , the client device 110 provides feedback and alarms based on the detection results.

[0128] For example, when the detection result indicates that a target behavior for a target object occurs, the feedback and processing methods may include at least one of the following: shielding click behavior data, adjusting the delivery strategy of the target object, or recording click behavior data.

[0129] For example, when the detection result indicates that the target behavior for the target object has not occurred, the feedback and processing method may include: storing the detection result in a database to facilitate subsequent analysis and processing.

[0130] In some embodiments, a message queue may be used to implement asynchronous feedback and processing, thereby ensuring the efficiency and stability of the system.

[0131] In some embodiments, the client device 110 may also monitor the detection process to ensure the stability and efficiency of the system. In some embodiments, the detection process may be monitored by setting monitoring indicators, such as data processing delay, detection accuracy, device load, etc.

[0132] In some embodiments, the client device 110 may also issue an alarm message in response to determining that the target detection result indicates that the target behavior has occurred. For example, the client device 110 may use Prometheus to collect monitoring data and visualize and alarm through Grafana. For example, the client device 110 may also issue an alarm in the event of an abnormal operating state.

[0133] In summary, the solution for behavior detection proposed in the present disclosure can detect click behavior data through a generative adversarial network model. When the advertising platform does not share data, the detection model can be used to assist the generative adversarial network model in detecting click behavior data, or the generative adversarial network model and the detection model can be used together to detect click behavior data, thereby solving the problems of poor flexibility, reliance on feature selection, influence of data noise and fraud disguise, poor model robustness, insufficient generalization ability, and real-time and computational efficiency limitations in click behavior detection. At the same time, it is also possible to automatically learn deep features, reduce reliance on manual feature selection, enhance robustness to noise and disguised behavior, and improve the generalization ability and real-time processing capability of the model.

[0134] Figure 7 A block diagram of an apparatus 700 for behavior detection according to some embodiments of the present disclosure is shown. The apparatus 700 may be implemented in the client device 110. Each module / component in the apparatus 700 may be implemented by hardware, software, firmware, or any combination thereof.

[0135] The device 700 includes an acquisition module 710, which is configured to acquire click behavior data for a target object. The device 700 also includes a first determination module 720, which is configured to determine a first detection result for the click behavior data based on the click behavior data through a trained generative adversarial network model, and the first detection result indicates whether the target behavior for the target object occurs. The device 700 also includes a second determination module 730, which is configured to determine a second detection result for the click behavior data based on the click behavior data through a trained detection model, and the second detection result indicates whether the target behavior for the target object occurs. The model parameters of the detection model are obtained by aggregating multiple sets of candidate model parameters, and the multiple sets of candidate model parameters are obtained by training the detection model using sample click behavior data corresponding to each of multiple devices. The device 700 also includes a third determination module 740, which is configured to determine the target detection result corresponding to the click behavior data based on at least the first detection result and the second detection result.

[0136] In some embodiments, the detection model is trained as follows: a pre-trained detection model is sent to multiple devices, so that the multiple devices train the pre-trained detection model based on their respective corresponding sample click behavior data; multiple sets of candidate model parameters are received from multiple devices; and the multiple sets of candidate model parameters are aggregated to obtain model parameters of the detection model.

[0137] In some embodiments, the generative adversarial network model is obtained by performing multiple rounds of alternating training based on historical click behavior data and random noise samples; wherein one round of alternating training includes: obtaining historical click behavior data and random noise samples; training the generator in the generative adversarial network model based on the random noise samples; generating forged click behavior data based on the random noise samples through the trained generator; and training the discriminator in the generative adversarial network model based on the historical click behavior data and the forged click behavior data.

[0138] In some embodiments, in multiple rounds of alternating training, the generator is trained based on a loss function, which is based on the similarity between random noise samples and forged click behavior data and the difference between the distribution of forged click behavior data in the latent space and the standard normal distribution.

[0139] In some embodiments, the target detection result is also determined based on media data for the target user, where the target user is a user who uses a target device to perform a click operation corresponding to the click behavior data, and the media data is media data collected by the target device during the click operation.

[0140] In some embodiments, the device 700 also includes a processing module, which is configured to determine a processing method based on the target detection result; based on the processing method, process the click behavior data or the target object.

[0141] In some embodiments, when the target detection result indicates that a target behavior for a target object occurs, the processing method includes at least one of the following: shielding click behavior data, adjusting the delivery strategy of the target object, or recording click behavior data.

[0142] In some embodiments, the apparatus 700 further includes an alarm module configured to issue an alarm message in response to determining that the target detection result indicates that the target behavior occurs.

[0143] The units included in the device 700 can be implemented in various ways, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more units can be implemented using software and / or firmware, such as machine executable instructions stored on a storage medium. In addition to or as an alternative to machine executable instructions, some or all of the units in the device 700 can be implemented at least in part by one or more hardware logic components. As an example and not limitation, exemplary types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0144] Figure 8 8 is a block diagram of an electronic device 800 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 8 The electronic device 800 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Figure 8 The electronic device 800 shown can be used to implement Figure 1 The client device 110.

[0145] like Figure 8 As shown, the electronic device 800 is in the form of a general electronic device. The components of the electronic device 800 may include, but are not limited to, one or more processors or processing units 810, a memory 820, a storage device 830, one or more communication units 840, one or more input devices 850, and one or more output devices 860. The processing unit 810 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 820. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 800.

[0146] The electronic device 800 typically includes a plurality of computer storage media. Such media may be any available media accessible to the electronic device 800, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 820 may be a volatile memory (e.g., a register, a cache, a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 830 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data (e.g., training data for training) and may be accessed within the electronic device 800.

[0147] The electronic device 800 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 8 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 820 may include a computer program product 825 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0148] The communication unit 840 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 800 can be implemented with a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 800 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0149] The input device 850 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 860 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 800 may also communicate with one or more external devices (not shown) through the communication unit 840 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 800, or communicate with any device that allows the electronic device 800 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0150] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which one or more computer instructions are stored, wherein the one or more computer instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0151] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0152] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0153] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0154] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0155] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the marketplace, or to enable other persons of ordinary skill in the art to understand the implementations disclosed herein.

Claims

1. A method for behavior detection, comprising: Obtain click behavior data for target objects; Determine, by means of a trained generative adversarial network model, a first detection result for the click behavior data based on the click behavior data, wherein the first detection result indicates whether a target behavior for the target object occurs; Determining, by means of a trained detection model, a second detection result for the click behavior data based on the click behavior data, the second detection result indicating whether the target behavior for the target object occurs, wherein the model parameters of the detection model are obtained by aggregating multiple sets of candidate model parameters, wherein the multiple sets of candidate model parameters are obtained by training the detection model using sample click behavior data corresponding to each of multiple devices; as well as Based at least on the first detection result and the second detection result, a target detection result corresponding to the click behavior data is determined.

2. The method according to claim 1, wherein the detection model is trained as follows: Sending the pre-trained detection model to the multiple devices, so that the multiple devices train the pre-trained detection model based on the sample click behavior data corresponding to each device; Receiving the multiple groups of candidate model parameters sent by the multiple devices; as well as Aggregate the multiple groups of candidate model parameters to obtain the model parameters of the detection model.

3. The method according to claim 1, wherein the generative adversarial network model is obtained by performing multiple rounds of alternating training based on historical click behavior data and random noise samples; One round of alternating training among the multiple rounds of alternating training comprises: Obtaining historical click behavior data and the random noise sample; Based on the random noise samples, training a generator in the generative adversarial network model; Generate forged click behavior data based on the random noise sample by the trained generator; and Based on the historical click behavior data and the forged click behavior data, a discriminator in the generative adversarial network model is trained.

4. The method according to claim 3, wherein in the multiple rounds of alternating training, the generator is trained based on a loss function, and the loss function is based on the similarity between the random noise sample and the forged click behavior data and the difference between the distribution of the forged click behavior data in the latent space and the standard normal distribution.

5. According to the method of claim 1, the target detection result is also determined based on media data for a target user, the target user is a user who uses a target device to perform a click operation corresponding to the click behavior data, and wherein the media data is media data collected by the target device during the click operation.

6. The method according to claim 1, further comprising: Determine a processing method based on the target detection result; Based on the processing method, the click behavior data or the target object is processed.

7. The method according to claim 6, wherein when the target detection result indicates that the target behavior for the target object occurs, the processing method includes at least one of the following: Shield the click behavior data. Adjust the delivery strategy for the target object, or The click behavior data is recorded.

8. The method according to claim 1, further comprising: In response to determining that the target detection result indicates that the target behavior occurs, an alarm message is issued.

9. A device for behavior detection, comprising: An acquisition module, configured to acquire click behavior data for a target object; A first determination module is configured to determine a first detection result for the click behavior data based on the click behavior data through a trained generative adversarial network model, wherein the first detection result indicates whether a target behavior for the target object occurs; a second determination module configured to determine, through a trained detection model and based on the click behavior data, a second detection result for the click behavior data, wherein the second detection result indicates whether the target behavior for the target object occurs, and a model parameter of the detection model is obtained by aggregating a plurality of sets of candidate model parameters, wherein the plurality of sets of candidate model parameters are obtained by training the detection model using sample click behavior data corresponding to each of a plurality of devices; as well as The third determination module is configured to determine the target detection result corresponding to the click behavior data based at least on the first detection result and the second detection result.

10. An electronic device, comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 8 when executed by the at least one processing unit.

11. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 8.

12. A computer program product comprising computer executable instructions, wherein the computer executable instructions, when executed by a processor, implement the method according to any one of claims 1 to 8.

Images