Abnormal user determination method and device, computer equipment and storage medium

Abstract

The invention relates to an abnormal user determination method and device, computer equipment and a storage medium, relates to the technical field of artificial intelligence, and can be applied to the financial field or other technical fields. The method comprises the following steps: acquiring target behavior data of each participating user participating in a target activity in a target time period, extracting behavior characteristics of each participating user under an evaluation index from the target behavior data of each participating user, and determining the target activity according to the behavior characteristics of each participating user under the evaluation index and an evaluation threshold value of the evaluation index. And screening the participating users to obtain candidate users, and determining abnormal users in the candidate users through an anomaly detection model according to behavior characteristics of the candidate users under the evaluation indexes. By adopting the method, the abnormal user determination efficiency and accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an abnormal user determination method, apparatus, computer equipment and storage medium, which can be applied to the financial field or other technical fields. Background Art

[0002] With the development of the financial sector, various institutions need to carry out various attractive promotional activities in order to attract new users and promote new products. However, in actual applications, some users repeatedly obtain discounts, which limits the promotion of institutions' promotional activities.

[0003] Therefore, in order to ensure better promotion of preferential activities, it is necessary to identify those users who repeatedly obtain preferential treatment, i.e. abnormal users. At present, it is usually determined whether the user is an abnormal user by manually analyzing the user's behavior data. However, due to the large amount of data in financial institutions, the manual method of determining whether a user is an abnormal user will consume a lot of human resources and reduce the accuracy of abnormal user judgment. Summary of the invention

[0004] Based on this, it is necessary to provide an abnormal user determination method, apparatus, computer device and storage medium that can improve the efficiency and accuracy of abnormal user determination in order to solve the above technical problems.

[0005] In a first aspect, the present application provides a method for determining abnormal users. The method comprises:

[0006] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0007] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0008] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0009] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0010] In one embodiment, extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user includes:

[0011] According to the abnormal information of the server and the activity information of the target activity in the target time period, an evaluation indicator is selected from the candidate indicators; according to the evaluation indicator, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation indicator.

[0012] In one embodiment, each participating user is screened according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users, including:

[0013] For each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0014] In one embodiment, if there are at least two evaluation indicators, an abnormal user among the candidate users is determined according to the behavior characteristics of the candidate users under the evaluation indicators through an abnormal detection model, including:

[0015] For each candidate user, the behavioral characteristics of the candidate user under each evaluation index are spliced ​​to obtain the fusion characteristics of the candidate user; through the anomaly detection model, the abnormal users among the candidate users are determined according to the fusion characteristics of each candidate user.

[0016] In one embodiment, determining abnormal users among the candidate users according to the fusion features of the candidate users through an abnormal detection model includes:

[0017] The fused features of each candidate user are input into the anomaly detection model to obtain the anomaly probability of each candidate user; the candidate users whose anomaly probability is greater than the probability threshold are regarded as abnormal users.

[0018] In one embodiment, obtaining target behavior data of each participating user who participates in a target activity within a target period includes:

[0019] Obtain each participating user who participates in the target activity within the target time period; aggregate the original behavior data of each participating user within the target time period to obtain the target behavior data of each participating user.

[0020] In one embodiment, the anomaly detection model is trained in the following manner:

[0021] The behavioral characteristics corresponding to the sample users are input into the initial detection model to obtain the prediction results of the sample users; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random dropout layer, and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample users; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0022] In a second aspect, the present application also provides an abnormal user determination device. The device comprises:

[0023] A data acquisition module, used to acquire target behavior data of each participating user who participates in the target activity within the target period;

[0024] A feature extraction module is used to extract the behavior features of each participating user under the evaluation index from the target behavior data of each participating user;

[0025] The first determination module is used to screen each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users;

[0026] The second determination module is used to determine abnormal users among candidate users according to the behavioral characteristics of the candidate users under the evaluation index through an abnormal detection model.

[0027] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0028] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0029] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0030] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0031] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0033] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0034] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0035] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0036] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0037] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0039] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0040] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0041] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0042] The above abnormal user determination method, device, computer equipment and storage medium obtain the target behavior data of each participating user who participates in the target activity within the target time period, extract the behavior characteristics of each participating user under the evaluation index, and screen each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users; then, through the abnormal detection model, the candidate users are screened again according to the behavior characteristics of the candidate users under the evaluation index, and the abnormal users among the candidate users can be determined. Compared with the related art that uses manual analysis of user behavior data to determine abnormal users, the above method does not require manual analysis. Through the evaluation index, it can more accurately conduct a comprehensive analysis of the behavior data of the participating users to screen out candidate users, narrow the analysis scope of the abnormal detection model, and improve the efficiency and accuracy of abnormal user determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A diagram of an application environment of a method for determining an abnormal user in one embodiment;

[0044] Figure 2 A schematic diagram of a flow chart of a method for determining an abnormal user in one embodiment;

[0045] Figure 3 A schematic diagram of a process for determining a behavior feature in one embodiment;

[0046] Figure 4 A schematic diagram of a process for determining candidate users in one embodiment;

[0047] Figure 5 A schematic diagram of a process for determining abnormal users in one embodiment;

[0048] Figure 6A flowchart of a method for determining an abnormal user in another embodiment;

[0049] Figure 7 It is a structural block diagram of an abnormal user determination device in one embodiment;

[0050] Figure 8 It is a structural block diagram of an abnormal user determination device in another embodiment;

[0051] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The abnormal user determination method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. For example, the user's behavior data. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. For example, the server 104 obtains the target behavior data of each participating user participating in the target activity during the target period, extracts the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user, and screens each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users. Through the anomaly detection model, according to the behavior characteristics of the candidate users under the evaluation index, the abnormal users among the candidate users are determined; further, the server 104 can send the abnormal users to the terminal 102 for display. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and Internet of Things devices. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0054] With the development of the financial sector, various institutions need to carry out various attractive promotional activities in order to attract new users and promote new products. However, in actual applications, some users repeatedly obtain discounts, which limits the promotion of institutions' promotional activities.

[0055] Therefore, in order to ensure better promotion of preferential activities, it is necessary to identify those users who repeatedly obtain preferential treatment, i.e. abnormal users. At present, it is usually determined whether the user is an abnormal user by manually analyzing the user's behavior data. However, due to the large amount of data in financial institutions, the manual method of determining whether a user is an abnormal user will consume a lot of human resources and reduce the accuracy of abnormal user judgment.

[0056] Based on this, in one embodiment, Figure 2 As shown, a method for determining abnormal users is provided, and the method is applied to Figure 1 The server in the example is used as an example to illustrate the specific steps:

[0057] S201, obtaining target behavior data of each participating user who participates in a target activity within a target period.

[0058] Among them, the target activity can be any marketing activity launched by the target platform, for example, a promotional activity launched by a financial target platform; participating users refer to users on the target platform who participate in the target activity; target behavior data refers to the data generated when participating users operate on the target platform; target period refers to a period for screening abnormal users, for example, it can be the activity period of the target activity.

[0059] Optionally, the participating users corresponding to the target activity may be determined based on the participation in the target activity; then, for each participating user, the target behavior data of the participating user in the target period may be extracted based on the user ID of the participating user. There may be only one piece of target behavior data or multiple pieces of target behavior data.

[0060] It is understandable that in order to accurately streamline the target behavior data of each participating user, only the behavior data determined to be relevant to the abnormal user can be extracted as the target behavior data. For example, all the behavior data of the participating users involving multiple small transactions, fast and frequent transactions, cross-regional or cross-national transactions, frequent recharges and refunds, multi-account transactions, transactions in abnormal time periods, false merchants or recipients, abnormal remittance behaviors and multiple transaction attempts can be used as the target behavior data of the participating user on the target platform.

[0061] S202: extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user.

[0062] Among them, the evaluation index refers to the index used by users to evaluate whether participating users have abnormal operations. For example, the evaluation index can be transaction time, transaction amount, transaction type, transaction location, target region / country, merchant / recipient, transaction frequency, remittance method, abnormal time period, multi-account transaction and multiple transaction attempts, etc.; behavioral characteristics refer to the characteristics of participating users under each evaluation indicator, which can be represented by a string.

[0063] Optionally, for each participating user, after determining the target behavior data of each participating user, the behavior characteristics of the participating user under the evaluation index can be extracted from the target behavior data of the participating user according to the evaluation content of the evaluation index.

[0064] For example, when the evaluation indicator is transaction time, the time information such as hours, minutes, and weeks of the transaction time contained in the target behavior data can be extracted, and then the time information can be encoded to obtain the behavioral characteristics of the participating users under the transaction time; when the evaluation indicator is transaction type, the information of the transaction type contained in the target behavior data can be extracted, and then the transaction type can be converted into a numerical value using one-hot encoding to obtain the behavioral characteristics of the participating users under the transaction type.

[0065] It is understandable that, when there are multiple target behavior data for a participating user, feature extraction may be performed for each target behavior data separately; or, each target behavior data may be aggregated, and feature extraction may be performed for the aggregated target behavior data.

[0066] S203, screening each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users.

[0067] Among them, the evaluation threshold refers to the numerical value used to determine whether the behavioral characteristics under the evaluation index meet the preset standards; the candidate user refers to the user who may have abnormal operation behavior among the participating users.

[0068] Optionally, for each participating user, the behavioral characteristics of the participating user under the evaluation index can be compared with the evaluation threshold. If the comparison result between the behavioral characteristics of the participating user under the evaluation index and the evaluation threshold meets the preset comparison result, it indicates that the participating user is normal; if the comparison result between the behavioral characteristics of the participating user under the evaluation index and the evaluation threshold does not meet the preset comparison result, it indicates that there is a possibility that the participating user is abnormal, and therefore, the participating user can be used as a candidate user.

[0069] For example, the behavioral characteristics of the participating user under the transaction amount are compared with the evaluation threshold. If the behavioral characteristics of the participating user are greater than the evaluation threshold, it means that the participating user is normal; if the behavioral characteristics of the participating user are less than the evaluation threshold, it means that the transaction amount of the participating user is small and there is a possibility of abnormal transaction. Therefore, the participating user can be used as a candidate user.

[0070] S204, determining abnormal users among the candidate users according to the behavioral characteristics of the candidate users under the evaluation index through the anomaly detection model.

[0071] Among them, the anomaly detection model refers to a trained neural network, which is used to identify abnormal users among candidate users; abnormal users refer to users with abnormal operating behaviors.

[0072] Optionally, for each candidate user, the behavior characteristics of the candidate user under the evaluation index may be input into an anomaly detection model, and the anomaly detection model determines whether the candidate user is an abnormal user based on the behavior characteristics and model parameters.

[0073] It is understandable that in order to ensure the uniformity of the behavior characteristics, the behavior characteristics can be standardized. Exemplarily, the behavior characteristics of the candidate user can be scaled to a range of a mean of 0 and a standard deviation of 1, and then the standardized behavior characteristics are input into the anomaly detection model, and the anomaly detection model outputs an abnormal probability value based on the standardized behavior characteristics and model parameters. If the output abnormal probability value is close to 1, it indicates that the candidate user is an abnormal user; if the output abnormal probability value is close to 0, it indicates that the candidate user is a normal user.

[0074] In the above abnormal user determination method, by obtaining the target behavior data of each participating user who participates in the target activity within the target time period, extracting the behavior characteristics of each participating user under the evaluation index, and screening each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, to obtain candidate users; then, through the anomaly detection model, according to the behavior characteristics of the candidate users under the evaluation index, the candidate users are screened again to determine the abnormal users among the candidate users. Compared with the related art that uses manual analysis of user behavior data to determine abnormal users, the above method does not require manual analysis. Through the evaluation index, it can more accurately conduct a comprehensive analysis of the behavior data of the participating users to screen out candidate users, narrow the analysis scope of the anomaly detection model, and improve the efficiency and accuracy of abnormal user determination.

[0075] In order to ensure the accuracy of the determination of the behavior characteristics, based on the above embodiments, in this embodiment, an optional method for determining the behavior characteristics is provided, such as Figure 3As shown, the specific steps include:

[0076] S301, selecting an evaluation index from candidate indexes according to abnormal information of the server and activity information of the target activity within a target period.

[0077] Among them, abnormal information refers to whether the server has experienced abnormal data fluctuations; activity information refers to the basic information of the target activity, such as the specified amount of the activity, the conditions for participating in the activity, and the organizer of the activity.

[0078] It is understandable that since the behavioral data contains a lot of data content, in order to more comprehensively extract the behavioral characteristics of participating users, indicators under multiple dimensions can be preset as candidate indicators; then, one or more evaluation indicators can be selected from the candidate indicators based on the abnormal information of the server during the target period and the activity information of the target activity.

[0079] For example, if there is an abnormality in the server during the target time period, the abnormal time period can be selected as the evaluation indicator; if the activity stipulated amount of the target activity is low, the transaction amount can be selected as the evaluation indicator.

[0080] S302: Analyze the target behavior data of each participating user according to the evaluation index to obtain the behavior characteristics of each participating user under the evaluation index.

[0081] Optionally, for each participating user, the target behavior data of the participating user may be analyzed according to the determined evaluation index to obtain the behavior characteristics of the participating user under the evaluation index.

[0082] It is understandable that when a participating user has multiple target behavior data, each target behavior data can be analyzed separately to obtain the behavior characteristics of each target behavior data under the evaluation index. For example, a participating user has target behavior data A and target behavior data B, and the evaluation indexes are M and N. After analyzing the target behavior data A and target behavior data B of the participating user, the behavior characteristics "A" of the participating user can be obtained. M -A N ” and “B M -B N ”.

[0083] In this embodiment, the evaluation index is determined by combining the abnormal information of the server and the activity information of the target activity within the target time period, and then the behavior characteristics of the participating users are determined, which can ensure the accuracy of the determination of the behavior characteristics.

[0084] In order to ensure the accuracy of candidate user determination, based on the above embodiment, in this embodiment, an optional method for determining candidate users is provided, such as Figure 4As shown, the specific steps include:

[0085] S401, for each participating user, encoding the behavior characteristics of the participating user under the evaluation index to obtain a behavior characteristic value.

[0086] The behavior characteristic value refers to the coded value used to represent the user behavior characteristic.

[0087] Optionally, since some behavior features need to be represented by character strings, in order to facilitate comparison between the behavior features and the evaluation threshold, each behavior feature may be encoded to obtain a behavior feature value corresponding to the behavior feature.

[0088] S402: If the magnitude relationship between the behavior feature value and the evaluation threshold of the evaluation index satisfies the index abnormality condition, the participating user is regarded as a candidate user.

[0089] The indicator abnormality condition refers to the relationship between the behavior characteristic value under each evaluation indicator and the evaluation threshold of the evaluation indicator.

[0090] Optionally, for each participating user, the behavioral characteristic value, evaluation threshold and indicator abnormality condition of the participating user under the evaluation index can be obtained. If the relationship between the behavioral characteristic value and the evaluation threshold of the participating user under the evaluation index meets the indicator abnormality condition, the participating user will be regarded as a candidate user.

[0091] For example, when the evaluation indicator is the transaction amount, the abnormal condition of the indicator is that the behavior characteristic value of the participating user is less than the evaluation threshold. If the behavior characteristic value of participating user C is 10 and the evaluation threshold is 15, participating user C will be selected as a candidate user.

[0092] It is understandable that in order to ensure the comprehensiveness of the determination of candidate users, when there are multiple evaluation indicators, if a participating user has an evaluation indicator that meets the indicator abnormality condition, the participating user can be regarded as a candidate user.

[0093] In this embodiment, an abnormal indicator condition is introduced, and the accuracy of determining candidate users can be improved by comparing the magnitude relationship between the behavior feature value and the evaluation threshold of the evaluation indicator with the abnormal indicator condition.

[0094] In order to ensure the accuracy of abnormal user determination, based on the above embodiment, when there are at least two evaluation indicators, an optional method for determining abnormal users is provided, such as Figure 5 As shown, the specific steps include:

[0095] S501, for each candidate user, the behavior features of the candidate user under each evaluation index are combined to obtain a fusion feature of the candidate user.

[0096] Among them, the fusion feature refers to the feature obtained by splicing various behavioral features.

[0097] Optionally, in order to more accurately identify abnormal users based on behavioral characteristics under each evaluation indicator, for each candidate user, the behavioral characteristics of the candidate user under each evaluation indicator may be concatenated in a preset format to obtain a fusion feature of the candidate user.

[0098] For example, the behavioral feature of the candidate user under transaction time is S1, and the behavioral feature under transaction amount is S2. By concatenating S1 and S2 according to the preset format "transaction time-transaction amount", the fusion feature "S1-S2" of the candidate user can be obtained.

[0099] S502, determining abnormal users among the candidate users according to the fusion features of the candidate users through an abnormal detection model.

[0100] Optionally, for each candidate user, after determining the fusion feature of the candidate user, the fusion feature of the user may be input into an anomaly detection model to determine whether the candidate user is an abnormal user based on the fusion feature of the user and the model parameters.

[0101] In this embodiment, by splicing the behavioral features of the candidate users under various evaluation indicators to obtain fused features, the anomaly detection model can more comprehensively analyze the behavioral features of the candidate users, thereby ensuring the accuracy of determining abnormal users.

[0102] It is understandable that in order to further ensure the accuracy of abnormal user determination, the fusion features of each candidate user can be input into the anomaly detection model to obtain the abnormal probability of each candidate user, and the candidate user whose abnormal probability is greater than the probability threshold is regarded as an abnormal user. Among them, the abnormal probability refers to the predicted value output by the anomaly detection model; the probability threshold refers to the value used to determine whether the candidate user is abnormal.

[0103] Optionally, for each candidate user, the user's fusion features can be input into the anomaly detection model, and the abnormal probability of the candidate user can be determined based on the user's fusion features and model parameters; then, the abnormal probability is compared with the abnormal threshold, if the abnormal probability is greater than or equal to the abnormal threshold, the candidate user is an abnormal user; if the abnormal probability is less than the abnormal threshold, the candidate user is a normal user.

[0104] In order to ensure the comprehensiveness of the target behavior data, on the basis of the above embodiment, when there are multiple behavior data of the participating users within the target time period, an optional method for determining the target behavior data is provided, specifically, obtaining each participating user who participates in the target activity within the target time period, aggregating the original behavior data of each participating user within the target time period, and obtaining the target behavior data of each participating user.

[0105] Among them, raw behavior data refers to unprocessed behavior data.

[0106] Optionally, after determining the participating users corresponding to the target activity based on their participation in the target activity, for each participating user, the original behavior data of the participating user during the target time period and the behavior data under each data dimension may be fused to obtain the target behavior data of the participating user.

[0107] Furthermore, the combined target behavior data can be analyzed according to the evaluation index, and then the behavior characteristics of the target behavior data under the evaluation index can be obtained. For example, a participating user has target behavior data E and target behavior data F, and the evaluation indexes are P and Q. After analyzing the target behavior data E and target behavior data F of the participating user, the behavior characteristics of the participating user "P EF -Q EF ”.

[0108] In this embodiment, the target behavior data is obtained by aggregating the original behavior data of the participating users, so that the comprehensiveness of the target behavior data can be ensured.

[0109] On the basis of the above implementation, in this embodiment, in order to ensure the accuracy of the anomaly detection model, a training method for an anomaly detection model is provided. Specifically, the behavioral characteristics corresponding to the sample user are input into the initial detection model to obtain the prediction results of the sample user. Based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample user. The loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0110] Among them, the initial detection model includes a bidirectional long short-term memory LSTM layer, a random inactivation layer and a fully connected layer.

[0111] The optional bidirectional LSTM layer is a core component of the neural network, which is used to process sequence data and capture its temporal patterns. In the initial detection model, by stacking multiple bidirectional LSTM layers, different levels of features can be extracted from the target behavior data. In addition, the bidirectional LSTM layer can combine forward and backward information to enhance the initial detection model's understanding and modeling capabilities of the target behavior data.

[0112] Adding a random inactivation layer (Dropout layer) after the bidirectional long short-term memory (LSTM) layer can randomly "inactivate" a part of neurons, thereby reducing the overfitting of the initial detection model to the training data and improving the generalization ability of the initial detection model, making it perform better on unseen data.

[0113] The fully connected layer is the last layer of the initial detection model, which is used to map the features learned by the previous layers to the final prediction results. In the initial detection model, the number of output units in the dense layer is usually 1, and the activation function usually selects a growth function (Sigmoid function) to limit the output between 0 and 1 to represent the probability of abnormality.

[0114] Furthermore, after constructing the initial detection model, the behavior characteristics corresponding to the sample users can be input into the initial detection model, and the initial detection model can obtain the prediction results of the sample users based on the behavior characteristics and model parameters; then, referring to the following formula (1), the loss function can be set to binary cross entropy, which is used to measure the difference between the prediction results output by the initial detection model and the actual results during the training process of the initial detection model.

[0115]

[0116] Among them, A is the calculated loss value. The lower the loss value, the closer the model's prediction is to the true label; N is the number of samples; y i is the true result of the sample, which takes the value of 0 or 1; p i It is the prediction result output by the initial detection model, indicating the probability that the sample belongs to the positive class (labeled as 1).

[0117] Subsequently, an Adaptive Moment Estimation (Adam) optimization algorithm is used to adjust the network parameters of the initial detection model according to the obtained loss value, for example, adjusting the weights of each neural network layer, thereby accelerating convergence and improving training efficiency.

[0118] Finally, the initial detection model can be used to predict the correct number of samples and the total number of samples, and the accuracy of the initial detection model evaluation index can be calculated. When the accuracy of the evaluation index is greater than the preset accuracy threshold, the training of the initial detection model is terminated to obtain the anomaly detection model.

[0119] In this embodiment, the initial detection model is trained based on the loss value, which can ensure the accuracy of the anomaly detection model.

[0120] Figure 6 FIG. 2 is a flow chart of a method for determining an abnormal user in another embodiment. Based on the above embodiment, this embodiment provides an optional example of a method for determining an abnormal user. Figure 6 The specific implementation process is as follows:

[0121] S601, obtaining each participating user who participates in a target activity within a target period.

[0122] S602, aggregate the original behavior data of each participating user in the target time period to obtain the target behavior data of each participating user.

[0123] S603: Select at least two evaluation indicators from candidate indicators according to the abnormal information of the server and the activity information of the target activity within the target period.

[0124] S604: Analyze the target behavior data of each participating user according to at least two evaluation indicators to obtain the behavior characteristics of each participating user under the at least two evaluation indicators.

[0125] S605 , screening each participating user according to the behavior characteristics of each participating user under at least two evaluation indicators and the evaluation threshold of the evaluation indicator to obtain candidate users.

[0126] Optionally, for each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0127] S606: Concatenate the behavior features of each candidate user under at least two evaluation indicators to obtain fusion features of each candidate user.

[0128] S607, inputting the fusion features of each candidate user into an anomaly detection model to obtain the anomaly probability of each candidate user.

[0129] The anomaly detection model is trained in the following way: the behavior characteristics corresponding to the sample user are input into the initial detection model to obtain the prediction results of the sample user; the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random inactivation layer and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample user; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0130] S608: The candidate users whose abnormal probability is greater than the probability threshold are regarded as abnormal users.

[0131] The specific process of the above S601-S608 can refer to the description of the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0132] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] Based on the same inventive concept, the embodiment of the present application also provides an abnormal user determination device for implementing the abnormal user determination method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormal user determination device embodiments provided below can refer to the limitations of the abnormal user determination method above, and will not be repeated here.

[0134] In one embodiment, Figure 7 As shown, an abnormal user determination device 1 is provided, comprising: a data acquisition module 10, a feature extraction module 20, a first determination module 30 and a second determination module 40, wherein:

[0135] The data acquisition module 10 is used to acquire the target behavior data of each participating user who participates in the target activity within the target period;

[0136] The feature extraction module 20 is used to extract the behavior features of each participating user under the evaluation index from the target behavior data of each participating user;

[0137] A first determination module 30 is used to screen each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users;

[0138] The second determination module 40 is used to determine abnormal users among the candidate users according to the behavior characteristics of the candidate users under the evaluation index through the abnormal detection model.

[0139] In one embodiment, the feature extraction module 20 is specifically used for:

[0140] According to the abnormal information of the server and the activity information of the target activity in the target time period, an evaluation indicator is selected from the candidate indicators; according to the evaluation indicator, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation indicator.

[0141] In one embodiment, the first determining module 30 is specifically configured to:

[0142] For each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0143] In one embodiment, the evaluation index is at least two, such as Figure 8 As shown, the second determination module 40 includes:

[0144] A fusion unit 41 is used to combine the behavior features of each candidate user under various evaluation indicators to obtain a fusion feature of the candidate user;

[0145] The determination unit 42 is used to determine abnormal users among the candidate users according to the fusion features of the candidate users through the abnormal detection model.

[0146] In one embodiment, the determining unit 42 is specifically configured to:

[0147] The fused features of each candidate user are input into the anomaly detection model to obtain the anomaly probability of each candidate user; the candidate users whose anomaly probability is greater than the probability threshold are regarded as abnormal users.

[0148] In one embodiment, the data acquisition module 10 is specifically used for:

[0149] Obtain all participating users who participated in the target activity within the target period;

[0150] The original behavior data of each participating user in the target time period is aggregated to obtain the target behavior data of each participating user.

[0151] In one embodiment, the abnormal user determination device 1 further includes a model training module, wherein the model training module is specifically used for:

[0152] The behavioral characteristics corresponding to the sample users are input into the initial detection model to obtain the prediction results of the sample users; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random dropout layer, and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample users; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0153] Each module in the abnormal user determination device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0154] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store user behavior data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal user determination method is implemented.

[0155] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0157] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0158] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0159] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0160] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0161] In one embodiment, when the processor executes the logic of extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user in the computer program, the following steps are specifically implemented:

[0162] According to the abnormal information of the server and the activity information of the target activity in the target time period, an evaluation indicator is selected from the candidate indicators; according to the evaluation indicator, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation indicator.

[0163] In one embodiment, when the processor executes the logic of screening each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index in the computer program to obtain candidate users, the following steps are specifically implemented:

[0164] For each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0165] In one embodiment, when the processor executes the computer program, if there are at least two evaluation indicators, the logic of determining abnormal users among candidate users through an abnormal detection model according to the behavioral characteristics of the candidate users under the evaluation indicators specifically implements the following steps:

[0166] For each candidate user, the behavioral characteristics of the candidate user under each evaluation index are spliced ​​to obtain the fusion characteristics of the candidate user; through the anomaly detection model, the abnormal users among the candidate users are determined according to the fusion characteristics of each candidate user.

[0167] In one embodiment, when the processor executes the logic of determining abnormal users among the candidate users according to the fusion features of the candidate users through the abnormal detection model in the computer program, the following steps are specifically implemented:

[0168] The fused features of each candidate user are input into the anomaly detection model to obtain the anomaly probability of each candidate user; the candidate users whose anomaly probability is greater than the probability threshold are regarded as abnormal users.

[0169] In one embodiment, when the processor executes the logic of obtaining the target behavior data of each participating user who participates in the target activity within the target time period in the computer program, the following steps are specifically implemented:

[0170] Obtain each participating user who participates in the target activity within the target time period; aggregate the original behavior data of each participating user within the target time period to obtain the target behavior data of each participating user.

[0171] In one embodiment, when the processor executes the logic of anomaly detection model training in the computer program, the following steps are specifically implemented:

[0172] The behavioral characteristics corresponding to the sample users are input into the initial detection model to obtain the prediction results of the sample users; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random dropout layer, and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample users; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0173] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0174] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0175] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0176] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0177] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0178] In one embodiment, when the code logic of extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user in the computer program is executed by the processor, the following steps are specifically implemented:

[0179] According to the abnormal information of the server and the activity information of the target activity in the target time period, an evaluation indicator is selected from the candidate indicators; according to the evaluation indicator, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation indicator.

[0180] In one embodiment, when the code logic of screening each participating user according to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain the candidate user is executed by the processor, the following steps are specifically implemented:

[0181] For each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0182] In one embodiment, if there are at least two evaluation indicators in the computer program, when the code logic of determining abnormal users among candidate users through an abnormal detection model according to the behavioral characteristics of the candidate users under the evaluation indicators is executed by the processor, the following steps are specifically implemented:

[0183] For each candidate user, the behavioral characteristics of the candidate user under each evaluation index are spliced ​​to obtain the fusion characteristics of the candidate user; through the anomaly detection model, the abnormal users among the candidate users are determined according to the fusion characteristics of each candidate user.

[0184] In one embodiment, when the code logic of determining abnormal users among candidate users by using an abnormal detection model according to the fusion features of each candidate user is executed by a processor, the following steps are specifically implemented:

[0185] The fused features of each candidate user are input into the anomaly detection model to obtain the anomaly probability of each candidate user; the candidate users whose anomaly probability is greater than the probability threshold are regarded as abnormal users.

[0186] In one embodiment, when the code logic of obtaining the target behavior data of each participating user who participates in the target activity within the target period in the computer program is executed by the processor, the following steps are specifically implemented:

[0187] Obtain each participating user who participates in the target activity within the target time period; aggregate the original behavior data of each participating user within the target time period to obtain the target behavior data of each participating user.

[0188] In one embodiment, when the code logic of the anomaly detection model training in the computer program is executed by the processor, the following steps are specifically implemented:

[0189] The behavioral characteristics corresponding to the sample users are input into the initial detection model to obtain the prediction results of the sample users; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random dropout layer, and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample users; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0190] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0191] Obtain target behavior data of each participating user who participates in the target activity within the target period;

[0192] Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user;

[0193] According to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, each participating user is screened to obtain candidate users;

[0194] Through the anomaly detection model, abnormal users among candidate users are identified according to their behavioral characteristics under the evaluation indicators.

[0195] In one embodiment, when the computer program is executed by the processor to extract the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user, the following steps are specifically implemented:

[0196] According to the abnormal information of the server and the activity information of the target activity in the target time period, an evaluation indicator is selected from the candidate indicators; according to the evaluation indicator, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation indicator.

[0197] In one embodiment, the computer program is executed by the processor to screen each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index, and when the operation of obtaining the candidate user is obtained, the following steps are specifically implemented:

[0198] For each participating user, the behavioral characteristics of the participating user under the evaluation index are encoded to obtain a behavioral characteristic value; if the relationship between the behavioral characteristic value and the evaluation threshold of the evaluation index meets the index abnormality condition, the participating user is regarded as a candidate user.

[0199] In one embodiment, when the computer program is executed by a processor and the evaluation index is at least two, the following steps are specifically implemented when determining the operation of an abnormal user among the candidate users according to the behavioral characteristics of the candidate users under the evaluation index through an abnormal detection model:

[0200] For each candidate user, the behavioral characteristics of the candidate user under each evaluation index are spliced ​​to obtain the fusion characteristics of the candidate user; through the anomaly detection model, the abnormal users among the candidate users are determined according to the fusion characteristics of each candidate user.

[0201] In one embodiment, when the computer program is executed by the processor through the anomaly detection model, according to the fusion features of each candidate user, to determine the operation of an abnormal user among each candidate user, the following steps are specifically implemented:

[0202] The fused features of each candidate user are input into the anomaly detection model to obtain the anomaly probability of each candidate user; the candidate users whose anomaly probability is greater than the probability threshold are regarded as abnormal users.

[0203] In one embodiment, when the computer program is executed by the processor to obtain the target behavior data of each participating user who participates in the target activity within the target period, the following steps are specifically implemented:

[0204] Obtain each participating user who participates in the target activity within the target time period; aggregate the original behavior data of each participating user within the target time period to obtain the target behavior data of each participating user.

[0205] In one embodiment, when the computer program is executed by the processor to perform the operation of training the anomaly detection model, the following steps are specifically implemented:

[0206] The behavioral characteristics corresponding to the sample users are input into the initial detection model to obtain the prediction results of the sample users; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random dropout layer, and a fully connected layer; based on the loss function, the loss value is determined according to the actual results and the prediction results of the sample users; the loss value is used to adjust the network parameters of the initial detection model to obtain the anomaly detection model.

[0207] It should be noted that the data involved in this application (including but not limited to the target behavior data of each participating user, etc.) are all data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0208] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0209] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0210] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for determining abnormal users, characterized in that: The method comprises: Obtain target behavior data of each participating user who participates in the target activity within the target period; Extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user; Screening each participating user according to the behavioral characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users; By using an anomaly detection model, abnormal users among the candidate users are determined according to the behavioral characteristics of the candidate users under the evaluation index.

2. The method according to claim 1, characterized in that The step of extracting the behavior characteristics of each participating user under the evaluation index from the target behavior data of each participating user includes: Selecting an evaluation indicator from candidate indicators according to abnormal information of the server within the target period and activity information of the target activity; According to the evaluation index, the target behavior data of each participating user is analyzed to obtain the behavior characteristics of each participating user under the evaluation index.

3. The method according to claim 1 or 2, characterized in that: The step of screening each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users includes: For each participating user, the behavior characteristics of the participating user under the evaluation index are encoded to obtain a behavior characteristic value; If the magnitude relationship between the behavior feature value and the evaluation threshold of the evaluation index satisfies the index abnormality condition, the participating user is regarded as a candidate user.

4. The method according to claim 1, characterized in that If the evaluation index is at least two, the abnormal user among the candidate users is determined according to the behavior characteristics of the candidate users under the evaluation index by using the abnormal detection model, including: For each candidate user, the behavior characteristics of the candidate user under each evaluation index are spliced ​​to obtain the fusion characteristics of the candidate user; Through the anomaly detection model, the abnormal users among the candidate users are determined according to the fusion features of each candidate user.

5. The method according to claim 4, characterized in that The method of determining abnormal users among the candidate users according to the fusion features of the candidate users through the abnormal detection model includes: Input the fusion features of each candidate user into the anomaly detection model to obtain the anomaly probability of each candidate user; Candidate users whose abnormal probability is greater than the probability threshold are regarded as abnormal users.

6. The method according to claim 1, characterized in that The step of obtaining target behavior data of each participating user who participates in the target activity within the target period includes: Obtain all participating users who participated in the target activity within the target period; The original behavior data of each participating user in the target time period is aggregated to obtain the target behavior data of each participating user.

7. The method according to claim 1, characterized in that The anomaly detection model is trained in the following way: Inputting the behavior characteristics corresponding to the sample user into the initial detection model to obtain the prediction result of the sample user; wherein the initial detection model includes a bidirectional long short-term memory (LSTM) layer, a random inactivation layer, and a fully connected layer; Based on the loss function, determining a loss value according to the actual results and the predicted results of the sample users; The loss value is used to adjust the network parameters of the initial detection model to obtain an anomaly detection model.

8. An abnormal user identification device, characterized in that: The device comprises: A data acquisition module, used to acquire target behavior data of each participating user who participates in the target activity within the target period; A feature extraction module is used to extract the behavior features of each participating user under the evaluation index from the target behavior data of each participating user; A first determination module is used to screen each participating user according to the behavior characteristics of each participating user under the evaluation index and the evaluation threshold of the evaluation index to obtain candidate users; The second determination module is used to determine abnormal users among the candidate users according to the behavior characteristics of the candidate users under the evaluation index through an abnormal detection model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images