Network fraud risk detection method and device, equipment and storage medium

Abstract

The invention discloses a network fraud risk detection method and device, equipment and a storage medium, and relates to the field of artificial intelligence, and the method comprises the steps: obtaining target network data from a target network data source, and processing the target network data to obtain first target data; dividing the first target data to obtain a first target training set and a first target test set so as to finely adjust the pre-training large model to obtain a target large model; processing the first target data by utilizing a target large model and a natural language processing tool to obtain second target data, and constructing a second target training set and a second target test set to train the target machine learning model and the target deep learning model to obtain the trained target machine learning model and the trained target deep learning model, and performing model fusion to obtain a target network fraud risk detection model. And performing network fraud risk detection by using the target network fraud risk detection model. According to the invention, detection, identification and early warning of network fraud risks are realized.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to a network fraud risk detection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, there are widespread risks of online fraud in many fields such as finance, e-commerce, and insurance, including but not limited to phishing, false advertising, financial fraud, and identity theft, which have caused huge losses to society and the economy. Traditional online fraud risk detection methods mainly rely on rule engines and data analysis technologies to identify and prevent online fraud risks through predefined rules and data statistical models. However, with the continuous upgrading and complexity of fraud methods, traditional online fraud risk detection methods have gradually exposed their limitations, and often seem to be unable to cope with increasingly complex and diverse fraud methods. Existing online fraud risk detection is mainly based on predefined rules and models, through machine learning and data mining methods, using big data analysis platforms to perform basic processing and analysis of text data to extract information related to online fraud risks. Rule-based methods require experts to continuously update and maintain the rule base. When faced with new and complex fraud methods, the coverage and real-time performance of the rules are limited. Traditional machine learning models lack generalization capabilities when faced with new fraud methods and are prone to false positives and false negatives. Traditional NLP (Natural Language Processing) methods lack a deep understanding of the context when processing text data, making it difficult to accurately extract information related to online fraud risks.

[0003] To sum up, how to improve the ability to detect, identify and warn of online fraud risks is an urgent problem that needs to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a network fraud risk detection method, device, equipment and storage medium, which can improve the ability to detect, identify and warn of network fraud risks. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for detecting network fraud risks, comprising:

[0006] Acquire target network data containing network fraud risk information from a target network data source, and process the target network data to obtain first target data;

[0007] Dividing the first target data to obtain a first target training set and a first target test set, and using the first target training set and the first target test set to fine-tune the pre-trained large model to obtain a target large model;

[0008] Processing the first target data using the target macro model and a natural language processing tool to obtain second target data, and constructing a second target training set and a second target test set based on the second target data;

[0009] The target machine learning model and the target deep learning model are trained using the second target training set and the second target test set to obtain the trained target machine learning model and the target deep learning model, and all the target machine learning models and all the target deep learning models are fused to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

[0010] Optionally, before acquiring the target network data containing network fraud risk information from the target network data source, the method further includes:

[0011] Determine each target network data source, and determine the data collection method and collection frequency corresponding to each target network data source.

[0012] Optionally, the step of obtaining target network data containing network fraud risk information from a target network data source includes:

[0013] Based on the data collection method and the collection frequency corresponding to each of the target network data sources, target network data containing network fraud risk information is obtained from each of the target network data sources.

[0014] Optionally, the processing the target network data to obtain first target data includes:

[0015] The target network data is cleaned based on preset data cleaning rules to obtain cleaned data, and the cleaned data is converted into a target format to obtain the first target data.

[0016] Optionally, before fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain the target large model, the method further includes:

[0017] Determine the model architecture of the pre-trained large model and configure the operating environment of the pre-trained large model.

[0018] Optionally, fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain a target large model includes:

[0019] Determine target training parameters, and based on the target training parameters, fine-tune the pre-trained large model using the first target training set and the first target test set to obtain a target large model; the target training parameters include a target learning rate, a target batch size, and a target number of training rounds.

[0020] Optionally, the using the target macro model and a natural language processing tool to process the first target data to obtain second target data includes:

[0021] inputting the first target data into the target macromodel to obtain first processed data;

[0022] Processing the first target data using the natural language processing tool to obtain second processed data;

[0023] The first processed data and the second processed data are screened by using a feature selection algorithm to obtain second target data.

[0024] In a second aspect, the present application discloses a network fraud risk detection device, comprising:

[0025] A first data processing module, used for acquiring target network data containing network fraud risk information from a target network data source, and processing the target network data to obtain first target data;

[0026] A model fine-tuning module, used for dividing the first target data to obtain a first target training set and a first target test set, and fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain a target large model;

[0027] A second data processing module is used to process the first target data using the target large model and a natural language processing tool to obtain second target data, and to construct a second target training set and a second target test set based on the second target data;

[0028] A risk detection module is used to train the target machine learning model and the target deep learning model using the second target training set and the second target test set to obtain the trained target machine learning model and the target deep learning model, and to perform model fusion on all the target machine learning models and all the target deep learning models to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

[0029] In a third aspect, the present application discloses an electronic device, comprising:

[0030] Memory, used to store computer programs;

[0031] The processor is used to execute the computer program to implement the aforementioned network fraud risk detection method.

[0032] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned network fraud risk detection method when executed by a processor.

[0033] In the present application, when constructing a target network fraud risk detection model, target network data containing network fraud risk information is obtained from a target network data source, and the target network data is processed to obtain first target data;

[0034] The first target data is divided into a first target training set and a first target test set, and the first target training set and the first target test set are used to fine-tune the pre-trained large model to obtain a target large model; the first target data is processed using the target large model and a natural language processing tool to obtain second target data, and a second target training set and a second target test set are constructed based on the second target data; the target machine learning model and the target deep learning model are trained using the second target training set and the second target test set to obtain trained target machine learning model and target deep learning model, and all the target machine learning models and all the target deep learning models are model fused to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected. It can be seen that the present application obtains the first target data by processing the target network data including various fraud cases obtained from the target network data source, and constructs the first target training set and the first target test set with the first target data, so as to use the first target training set and the first target test set to fine-tune the pre-selected pre-trained large model (that is, the large language model) to obtain the target large model, and then uses the natural language processing tool and the target large model to process the first target data to accurately extract the second target data related to the fraud, so as to use the second target data to construct the second target training set and the second target test set, and use the second target training set and the second target test set to train the target machine learning model and the target deep learning model, so that the trained target machine learning model and the target deep learning model can perform network fraud risk detection for the input data, and finally all the trained target machine learning models and the target deep learning models are model-fused to obtain a target network fraud risk detection model with a higher accuracy in identifying fraudulent means. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0036] Figure 1 A flow chart of a network fraud risk detection method disclosed in this application;

[0037] Figure 2 A schematic diagram of a specific network fraud risk detection process disclosed in this application;

[0038] Figure 3 A schematic diagram of a specific data collection process disclosed in this application;

[0039] Figure 4 This is a schematic diagram of the structure of a network fraud risk detection device disclosed in this application;

[0040] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] Traditional network fraud risk detection methods mainly rely on rule engines and data analysis technologies to identify and prevent network fraud risks through predefined rules and data statistical models. However, with the continuous upgrading and complexity of fraud methods, traditional network fraud risk detection methods have gradually exposed their limitations, and often seem to be unable to cope with increasingly complex and diverse fraud methods. Existing network fraud risk detection is mainly based on predefined rules and models, and uses machine learning and data mining methods to perform basic processing and analysis on text data using a big data analysis platform to extract information related to network fraud risks. Rule-based methods require experts to continuously update and maintain the rule base, and the coverage and real-time performance of the rules are limited when facing new and complex fraud methods. Traditional machine learning models have insufficient generalization capabilities when facing new fraud methods, and are prone to false positives and false negatives. Traditional NLP methods lack a deep understanding of the context when processing text data, and it is difficult to accurately extract information related to network fraud risks. In order to solve the above technical problems, the present application discloses a network fraud risk detection method that can improve the ability to detect, identify and warn network fraud risks.

[0043] See also Figure 1 As shown, the embodiment of the present invention discloses a network fraud risk detection method, comprising:

[0044] Step S11: acquiring target network data containing network fraud risk information from a target network data source, and processing the target network data to obtain first target data.

[0045] In this embodiment, the target network data source can be multiple data sources such as social media, news websites, emails, forums, internal data, etc. Different data sources correspond to different data collection methods, such as Scrapy, BeautifulSoup, etc. for web page data collection; Apache Kafka, Flume, etc. for real-time data stream processing, and the data generation rate of different data sources will also be different. Therefore, before obtaining the target network data containing network fraud risk information from the target network data source, it also includes: determining each target network data source, and determining the data collection method and collection frequency corresponding to each target network data source. Figure 2 As shown in FIG. 1 , after determining the data collection method and collection frequency corresponding to each target data source, the target network data can be collected from each target data source, thereby realizing intelligent collection. The specific target network data collection process is as follows: Figure 3As shown, the acquisition core obtains intelligence data from the acquisition data source through task scheduling, and then distributes it to the intelligence analyzer for processing and analysis. The data pre-processing link before model processing is completed. Correspondingly, the target network data containing network fraud risk information is obtained from the target network data source, which may specifically include: based on the data collection method and collection frequency corresponding to each target network data source, the target network data containing network fraud risk information is obtained from each target network data source, so as to ensure the real-time and coverage of the collected target network data. After obtaining the target network data, the target network data can be processed to obtain the first target data, which specifically includes: cleaning the target network data based on the preset data cleaning rules to obtain the cleaned data, and converting the cleaned data into the target format to obtain the first target data. That is to say, preset data cleaning rules can be written based on actual needs to remove noise, redundant information and repeated information in the target network data, such as HTML (Hyper Text Markup Language) tags, advertising content, etc., while ensuring that only one copy of the same or similar records is retained, thereby obtaining the cleaned data, and then the cleaned data is formatted to convert data from different data sources into the first target data in a standard format, such as JSON (JavaScript Object Notation) format or CSV (Comma-Separated Values) format, for subsequent processing.

[0046] Step S12: divide the first target data to obtain a first target training set and a first target test set, and use the first target training set and the first target test set to fine-tune the pre-trained large model to obtain a target large model.

[0047] In this embodiment, after obtaining the first target data, a first target training set and a first target test set for fine-tuning the pre-trained large model can be constructed based on the first target data. Before fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain the target large model, it also includes: determining the model architecture of the pre-trained large model and configuring the operating environment of the pre-trained large model. In other words, large language models that have been pre-trained with massive data, such as GPT, BERT, etc., can be introduced. These models have powerful natural language understanding and generation capabilities. Then, the operating environment of the large language model is configured, and the selected pre-trained large model is fine-tuned according to the specific data analysis request to optimize the performance in the target scenario using the first target test set and the first target training set. LLM (Large Language Models) can perform in-depth analysis of unstructured Internet data. Since the target network data can contain various typical fraud cases, such as telecommunications fraud, the fine-tuned LLM can accurately extract fraud features, thereby improving the accuracy and comprehensiveness of detection. LLM's powerful natural language understanding and generation capabilities can extract complex fraud methods from massive amounts of Internet data and improve recognition rates. At the same time, LLM can quickly adapt to new fraud methods through continuous learning and updating, reduce model maintenance costs, and improve system flexibility and adaptability.

[0048] Specifically, fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain the target large model includes: determining target training parameters, and fine-tuning the pre-trained large model using the first target training set and the first target test set based on the target training parameters to obtain the target large model. The target training parameters include a target learning rate, a target batch size, and a target number of training rounds. That is, this embodiment can optimize the performance of the target large model in the target scenario by adjusting the target training parameters. In addition, the optimization of the target large model can be achieved by obtaining more target network data and improving data quality.

[0049] Step S13: Use the target macro model and natural language processing tools to process the first target data to obtain second target data, and construct a second target training set and a second target test set based on the second target data.

[0050] In this embodiment, LLM can effectively process unstructured data such as text, social media, and emails, and comprehensively mine the network fraud risk intelligence therein. After obtaining the target large model, the specific process of using the target large model and natural language processing tools to process the first target data to obtain the second target data may include: inputting the first target data into the target large model to obtain the first processed data; using the natural language processing tool to process the first target data to obtain the second processed data; using the feature selection algorithm to screen the first processed data and the second processed data to obtain the second target data. After obtaining the second target data, the second target training set and the second target test set can be constructed based on the second target data for subsequent use.

[0051] In a specific implementation, the first target data can be input into the target large model so as to automatically extract the first processed data related to the risk of network fraud from the first target data by using the powerful semantic understanding ability of LLM. At the same time, the first target data can also be input into a natural language processing tool, such as spaCy (an open source machine learning library for natural language processing) and NLTK (Natural Language Toolkit) to extract the second processed data of the first target data. Then, the most representative features, i.e., the second target data, are selected from these first processed data and the second processed data by feature selection, thereby reducing redundant information and improving the training efficiency and prediction accuracy of the model. These second target data include but are not limited to the semantic features, time features, user behavior features, etc. of the text content. Among them, the feature selection algorithm can be LASSO regression, information gain, etc. In addition to using the feature selection algorithm to improve the data quality of the second target data, dimensionality reduction techniques such as PCA (Principal Component Analysis) and t-SNE (t-Distributed Stochastic Neighbor Embedding) can also be used to reduce the feature dimension, thereby improving the training efficiency of the model.

[0052] Step S14: Use the second target training set and the second target test set to train the target machine learning model and the target deep learning model to obtain the trained target machine learning model and the target deep learning model, and perform model fusion on all the target machine learning models and all the target deep learning models to obtain the target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

[0053] In this embodiment, when the target machine learning model and the target deep learning model are trained using the second target training set and the second target test set, the selected target machine model and the target deep learning model can be a variety of models, such as decision trees, random forests, support vector machines and other machine learning models, as well as neural networks, convolutional neural networks and other deep learning models. After determining the model to be trained and the corresponding training parameters, the second target training set and the second target test set constructed based on the second target data can be used to train the model to be trained, and after the training is completed, all the trained target machine learning models and all the target deep learning models are fused together based on integrated learning algorithms such as Bagging (Bootstrap aggregating, guided aggregation algorithm) and Boosting (a machine learning algorithm that can be used to reduce bias in supervised learning) to obtain a target network fraud risk detection model. The target network fraud risk detection model will be used to perform real-time network fraud risk detection on new network data to be detected, including various fraudulent behaviors. The process of obtaining the network data to be detected can also be adopted as follows Figure 3 The target network fraud risk detection model can output a corresponding risk score when performing network fraud risk detection on the network data to be detected. The risk score is a risk score obtained based on the prediction results of the fused models for the network data to be detected, thereby improving the accuracy of the network fraud risk detection results.

[0054] In a specific implementation, if the target network fraud risk detection model is a model obtained by integrating the three models A, B, and C, the three models A, B, and C will output corresponding scoring results for the network data to be detected, and the three scoring results correspond to the three dimensions a, b, and c respectively. Then the target network security detection model will combine the three scoring results based on the pre-configured strategy to give the risk score corresponding to the network data to be detected. When the risk score reaches the preset scoring threshold determined based on historical data and model prediction results, the warning information sending function will be implemented according to the dynamic warning rules, that is, the warning information will be sent to the user in a timely manner through e-mail, text messages, system notifications, etc. By combining big data processing technology, real-time analysis and fraud warning of massive Internet data can be realized, and processing speed and real-time performance can be improved. For example, if the deposit and withdrawal amounts of a user's account in the past year were all lower than the preset limit, and the income and expenditure followed a certain pattern, but since the most recent month there has been frequent large income and / or expenditure every day, and the time of income and expenditure does not conform to the user's corresponding consumption habits and income pattern, and is inconsistent with common sense; for example, a breakfast shop had several single transfers of more than 10,000 yuan between 7 and 9 in the morning in the most recent month, but the average single income of the breakfast shop during this period in the past year was no more than 50 yuan, and mostly between 10 and 20 yuan, then it can be considered that this account has a certain risk of online fraud or the user may have committed fraud.

[0055] In addition, this embodiment can also obtain post and comment data from social media platforms (such as Twitter, Facebook, etc.) through the intelligent collection platform. After cleaning and formatting the acquired data, pre-processing operations such as word segmentation and named entity recognition are performed. Then the LLM model is loaded and fine-tuned, sentiment analysis and topic extraction are performed on posts and comments, and potential network fraud risk information is identified, so as to extract features related to fraudulent behavior from the analysis results and perform vectorization processing. Finally, the extracted features are identified using the trained target network fraud risk detection model to detect whether there is a network fraud risk. According to the set warning rules, warning information is sent to users through emails and system notifications, and logs are recorded.

[0056] It can be seen that the present application obtains the first target data by processing the target network data including various fraud cases obtained from the target network data source, and constructs the first target training set and the first target test set with the first target data, so as to use the first target training set and the first target test set to fine-tune the pre-selected pre-trained large model (that is, the large language model) to obtain the target large model, and then uses the natural language processing tool and the target large model to process the first target data to accurately extract the second target data related to the fraud, so as to use the second target data to construct the second target training set and the second target test set, and use the second target training set and the second target test set to train the target machine learning model and the target deep learning model, so that the trained target machine learning model and the target deep learning model can perform network fraud risk detection for the input data, and finally all the trained target machine learning models and the target deep learning models are model-fused to obtain a target network fraud risk detection model with a higher accuracy in identifying fraudulent means.

[0057] See also Figure 4 As shown, the present application discloses a network fraud risk detection device, comprising:

[0058] A first data processing module 11 is used to obtain target network data containing network fraud risk information from a target network data source, and process the target network data to obtain first target data;

[0059] A model fine-tuning module 12, configured to divide the first target data into a first target training set and a first target test set, and fine-tune the pre-trained large model using the first target training set and the first target test set to obtain a target large model;

[0060] A second data processing module 13 is used to process the first target data using the target large model and a natural language processing tool to obtain second target data, and to construct a second target training set and a second target test set based on the second target data;

[0061] The risk detection module 14 is used to use the second target training set and the second target test set to train the target machine learning model and the target deep learning model to obtain the trained target machine learning model and the target deep learning model, and to perform model fusion on all the target machine learning models and all the target deep learning models to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

[0062] It can be seen that the present application obtains the first target data by processing the target network data including various fraud cases obtained from the target network data source, and constructs the first target training set and the first target test set with the first target data, so as to use the first target training set and the first target test set to fine-tune the pre-selected pre-trained large model (that is, the large language model) to obtain the target large model, and then uses the natural language processing tool and the target large model to process the first target data to accurately extract the second target data related to the fraud, so as to use the second target data to construct the second target training set and the second target test set, and use the second target training set and the second target test set to train the target machine learning model and the target deep learning model, so that the trained target machine learning model and the target deep learning model can perform network fraud risk detection for the input data, and finally all the trained target machine learning models and the target deep learning models are model-fused to obtain a target network fraud risk detection model with a higher accuracy in identifying fraudulent means.

[0063] In a specific embodiment, the device may further include:

[0064] The configuration module is used to determine each target network data source, and determine the data collection method and collection frequency corresponding to each target network data source.

[0065] In a specific implementation, the first data processing module 11 may specifically include:

[0066] The network data acquisition unit is used to acquire target network data containing network fraud risk information from each target network data source based on the data acquisition method and the acquisition frequency corresponding to each target network data source.

[0067] In a specific implementation, the first data processing module 11 may specifically include:

[0068] The first data acquisition unit is used to clean the target network data based on a preset data cleaning rule to obtain cleaned data, and convert the cleaned data into a target format to obtain the first target data.

[0069] In a specific embodiment, the device may further include:

[0070] The model configuration unit is used to determine the model architecture of the pre-trained large model and configure the operating environment of the pre-trained large model.

[0071] In a specific implementation, the model fine-tuning module 12 may specifically include:

[0072] A model fine-tuning unit is used to determine target training parameters, and based on the target training parameters, fine-tune the pre-trained large model using the first target training set and the first target test set to obtain a target large model; the target training parameters include a target learning rate, a target batch size, and a target number of training rounds.

[0073] In a specific implementation, the second data processing module 13 may specifically include:

[0074] A first processed data acquisition unit, used for inputting the first target data into the target macro model to acquire first processed data;

[0075] A second processed data acquisition unit, configured to process the first target data using the natural language processing tool to obtain second processed data;

[0076] The second target data acquisition unit is used to screen the first processed data and the second processed data by using a feature selection algorithm to obtain second target data.

[0077] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0078] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network fraud risk detection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0079] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0080] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0081] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network fraud risk detection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0082] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed network fraud risk detection method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0083] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0084] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0085] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0086] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0087] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A network fraud risk detection method, characterized in that: include: Acquire target network data containing network fraud risk information from a target network data source, and process the target network data to obtain first target data; Dividing the first target data to obtain a first target training set and a first target test set, and using the first target training set and the first target test set to fine-tune the pre-trained large model to obtain a target large model; Processing the first target data using the target macro model and a natural language processing tool to obtain second target data, and constructing a second target training set and a second target test set based on the second target data; The target machine learning model and the target deep learning model are trained using the second target training set and the second target test set to obtain the trained target machine learning model and the target deep learning model, and all the target machine learning models and all the target deep learning models are fused to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

2. The network fraud risk detection method according to claim 1, characterized in that: Before acquiring the target network data containing the network fraud risk information from the target network data source, the method further includes: Determine each target network data source, and determine the data collection method and collection frequency corresponding to each target network data source.

3. The network fraud risk detection method according to claim 2, characterized in that: The step of obtaining target network data containing network fraud risk information from a target network data source includes: Based on the data collection method and the collection frequency corresponding to each of the target network data sources, target network data containing network fraud risk information is obtained from each of the target network data sources.

4. The network fraud risk detection method according to claim 1, characterized in that: The processing of the target network data to obtain first target data includes: The target network data is cleaned based on preset data cleaning rules to obtain cleaned data, and the cleaned data is converted into a target format to obtain the first target data.

5. The network fraud risk detection method according to claim 1, characterized in that: Before fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain the target large model, the method further includes: Determine the model architecture of the pre-trained large model and configure the operating environment of the pre-trained large model.

6. The network fraud risk detection method according to claim 1, characterized in that: The step of fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain a target large model includes: Determine target training parameters, and based on the target training parameters, fine-tune the pre-trained large model using the first target training set and the first target test set to obtain a target large model; the target training parameters include a target learning rate, a target batch size, and a target number of training rounds.

7. The network fraud risk detection method according to any one of claims 1 to 6, characterized in that: The using the target macro model and the natural language processing tool to process the first target data to obtain the second target data includes: inputting the first target data into the target macromodel to obtain first processed data; Processing the first target data using the natural language processing tool to obtain second processed data; The first processed data and the second processed data are screened using a feature selection algorithm to obtain second target data.

8. A network fraud risk detection device, characterized in that: include: A first data processing module, used for acquiring target network data containing network fraud risk information from a target network data source, and processing the target network data to obtain first target data; A model fine-tuning module, used for dividing the first target data to obtain a first target training set and a first target test set, and fine-tuning the pre-trained large model using the first target training set and the first target test set to obtain a target large model; A second data processing module is used to process the first target data using the target large model and a natural language processing tool to obtain second target data, and to construct a second target training set and a second target test set based on the second target data; A risk detection module is used to train the target machine learning model and the target deep learning model using the second target training set and the second target test set to obtain the trained target machine learning model and the target deep learning model, and to perform model fusion on all the target machine learning models and all the target deep learning models to obtain a target network fraud risk detection model, so as to use the target network fraud risk detection model to perform network fraud risk detection on the network data to be detected.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network fraud risk detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the network fraud risk detection method according to any one of claims 1 to 7 is implemented.

Images