Abnormal behavior alarm method and device, equipment, medium and product
The proposed method improves financial anomaly detection by using pre-trained models to assess user behavior attributes and frequencies, addressing the low accuracy of existing methods and enhancing fraud prevention in the financial sector.
Patent Information
- Application Number
- CN202411927264.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-03-28
AI Technical Summary
Current financial anomaly detection and alert methods in the financial sector have low accuracy due to reliance on simple transaction thresholds and manual reviews, which are inefficient and unable to capture complex transaction patterns, and lack adaptability to evolving fraud techniques, especially in cross-regional and cross-platform transactions.
A method that involves detecting user behavior requests, generating permission requests, obtaining relevant attributes and request frequencies, and inputting these into a pre-trained anomaly recognition model to generate alert scores, thereby improving the accuracy of anomaly detection and alerting.
This approach enhances the accuracy of anomaly detection and alerting by leveraging pre-trained models to assess behavior patterns, effectively identifying and preventing potential fraudulent activities.
Smart Images
Figure CN119722077A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of big data, and in particular to an abnormal behavior alarm method, device, equipment and medium. Background Art
[0002] In today's highly digitalized and globalized financial sector, the scale and complexity of transaction activities are increasing. For financial institutions, timely and effective identification and alerting of abnormal behavior is a key link in ensuring financial security and preventing risks.
[0003] Traditional financial abnormal behavior detection and alarm methods have many shortcomings. In the past, they mainly relied on simple transaction amount threshold settings and manual review to judge anomalies. However, this method cannot cope with complex and changeable financial transaction patterns and fraud methods. For example, manual review is inefficient and prone to omissions, making it difficult to quickly and accurately identify anomalies in massive transaction data; and the simple amount threshold setting is too rigid and cannot capture multi-dimensional abnormal characteristics such as transaction frequency and transaction object association. In early technical solutions, some rule-based systems lacked flexibility and adaptability, and it was difficult to adapt to the rapid changes in the financial market and the emergence of new fraud methods. At the same time, these methods have problems with data integration and incomplete analysis when dealing with cross-regional and cross-platform financial transaction data.
[0004] With the rapid development of financial technology, financial crime methods are becoming increasingly diverse and intelligent, including money laundering, credit card fraud, insider trading, etc. Traditional abnormal behavior detection methods can no longer meet the high requirements of the financial industry for risk prevention and control.
[0005] In summary, the existing abnormal behavior alarm method has the problem of low accuracy of abnormal behavior alarm. Summary of the invention
[0006] The present invention provides an abnormal behavior alarm method, device, equipment and medium, which can solve the problem of low accuracy of abnormal behavior alarm in the prior art.
[0007] In a first aspect, an embodiment of the present invention provides an abnormal behavior alarm method, the method comprising:
[0008] Detect the user's target behavior request, generate a permission request and display it;
[0009] In response to a user's confirmation operation on the permission acquisition request, obtaining a target behavior attribute and a request frequency that match the target behavior request;
[0010] The target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and an alarm result is generated according to the behavior score.
[0011] In a second aspect, an embodiment of the present invention provides an abnormal behavior alarm device, the device comprising:
[0012] The permission request module is used to detect the user's target behavior request, generate a permission acquisition request and display it;
[0013] An attribute acquisition module, configured to acquire a target behavior attribute matching the target behavior request in response to a user's confirmation operation on the permission acquisition request;
[0014] The result generation module is used to input the target behavior attribute into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and generate an alarm result according to the behavior score.
[0015] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:
[0016] at least one processor; and
[0017] a memory communicatively connected to the at least one processor; wherein,
[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal behavior alarm method described in any embodiment of the present invention.
[0019] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement an abnormal behavior alarm method described in any embodiment of the present invention when executed.
[0020] In a fifth aspect, an embodiment of the present invention provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements an abnormal behavior alarm method described in any embodiment of the present invention.
[0021] The technical solution of the embodiment of the present invention first detects the user's target behavior request, generates and displays a permission acquisition request, and then responds to the user's confirmation operation on the permission acquisition request to obtain the target behavior attribute and the request frequency that match the target behavior request. Finally, the target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score that matches the target behavior attribute, and an alarm result is generated according to the behavior score. This solves the problem of low accuracy of abnormal behavior alarms in the prior art, realizes the recognition and alarm of abnormal behaviors, and improves the accuracy of abnormal behavior recognition.
[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0024] Figure 1 This is a flow chart of an abnormal behavior alarm method provided according to Embodiment 1 of the present invention;
[0025] Figure 2 This is a flow chart of an abnormal behavior alarm method provided according to Embodiment 2 of the present invention;
[0026] Figure 3 This is a schematic diagram of the structure of an abnormal behavior alarm device provided according to Embodiment 3 of the present invention;
[0027] Figure 4 The present invention is a schematic diagram of the structure of an electronic device for implementing an abnormal behavior alarm method according to an embodiment of the present invention. DETAILED DESCRIPTION
[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variation of the terms "including" and "having" is intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0030] Embodiment 1
[0031] Figure 1 A flowchart of an abnormal behavior alarm method provided in Example 1 of the present invention. This embodiment is applicable to situations where abnormal behavior is identified and alarmed. The method can be executed by an abnormal behavior alarm device, which can be implemented in the form of hardware and / or software. The abnormal behavior alarm device can be configured in a terminal or server with an abnormal behavior alarm function.
[0032] like Figure 1 As shown, the method includes:
[0033] S110: Detect the user's target behavior request, generate a permission acquisition request and display it.
[0034] The user's target behavior request refers to the user's explicit intention to trigger the bank client to make a payment in order to complete a transaction in other software. For example, when a user chooses to pay for goods by launching the bank client when settling a purchase on an e-commerce platform, the request to launch the bank client is the target behavior request; further, once the system detects the user's target behavior request, it will generate a permission acquisition request based on the pre-set security mechanism and business logic. The permission acquisition request refers to the prompt information that the system applies to the user for necessary permissions and information in order to legally and safely process the user's payment operation.
[0035] Furthermore, in this embodiment, the generated permission acquisition request will be displayed in an appropriate and user-friendly manner. The display format is rich and varied and can be set by the developer according to actual needs. It may be an independent and clearly laid out window that pops up on the user's mobile device screen, detailing the purpose, importance and related instructions of the required permission, and providing the user with clear confirmation and cancellation options; it may also be a prominent display of relevant prompts for permission acquisition in a specific prominent format and eye-catching color in a prominent position on the current operation page.
[0036] S120: In response to the user's confirmation operation on the permission acquisition request, obtain a target behavior attribute and a request frequency that match the target behavior request.
[0037] The target behavior attribute includes: at least one of a device model, an application version, a network environment, a region information, a transaction item information, and a transaction time that matches the target behavior request.
[0038] Among them, the device model specifically refers to the model of the device corresponding to the target behavior request. For example, if the user uses a mobile phone to pull up the bank client, the device model may be the brand and model of the user's mobile phone; the application version is the version number and application information of the application that pulls the bank client, such as shopping software A or game platform B; the network environment is the network connection status of the issuing device when the target behavior attribute is issued, such as 5G high-speed network or Wi-Fi environment; the regional information is the geographical location of the device that issues the request when the user issues the target behavior request, such as Beijing, Shanghai or other regions; the transaction item information can be used to express specific transaction information such as purchase content or transaction party name; the transaction time is used to express the time when the target behavior request is issued.
[0039] Furthermore, the request frequency refers to the number of times a user initiates a similar target behavior request within a certain period of time. For example, the total number of times a user performs payment operations in software A by launching a bank client within a period of time.
[0040] S130: Input the target behavior attribute and the request frequency into a pre-trained abnormal behavior recognition model to obtain a behavior score that matches the target behavior attribute, and generate an alarm result according to the behavior score.
[0041] Among them, generating an alarm result according to the behavior score includes: determining whether the behavior score is greater than a preset score threshold; if greater, generating a warning pop-up window and rejecting the user's target behavior request; if not greater, not generating an alarm and allowing the user's target behavior request.
[0042] Specifically, the target behavior attributes and request frequency are input into the pre-trained abnormal behavior recognition model. The model will perform complex calculations and analysis on the input information to obtain a behavior score that matches the target behavior attributes. The behavior score is a quantitative evaluation indicator used to characterize the abnormal possibility of the current target behavior. Next, an alarm result is generated based on the behavior score. This process includes: first, determining whether the behavior score is greater than a preset score threshold. The score threshold is a critical value set based on the system's security policy and historical data experience. If the behavior score is greater than the preset score threshold, it means that the current target behavior has a high abnormal risk. At this time, the system will generate a warning pop-up window, which will be highlighted on the user interface to attract the user's attention and explain the possible risks to the user. At the same time, the system will reject the user's target behavior request to ensure the user's financial security and prevent potential fraud. For example, if a user frequently uses old device models and low-version applications from abnormal areas to conduct high-value transactions in a short period of time, the behavior score exceeds the threshold, which will trigger a warning pop-up window and reject the request. If the behavior score is not greater than the preset score threshold, it indicates that the current target behavior is within the normal range. At this time, the system will not generate an alarm and allow the user's target behavior request to proceed smoothly, providing users with convenient payment services.
[0043] Optionally, after generating an alarm result according to the behavior score, it also includes: pushing a result confirmation report to the user after a preset time threshold to obtain user feedback information on the alarm result; obtaining a target behavior score that matches the target behavior request based on the user's feedback information; forming a target training sample according to the target behavior request, a target behavior attribute that matches the target behavior request, a request frequency, and the target behavior score, and the target behavior score is used as labeled data in the target training sample; and using the target training sample to perform negative feedback training on the abnormal behavior recognition model to optimize the abnormal behavior recognition model.
[0044] In a specific implementation scenario of this embodiment, after completing the operations of the above steps, the system will push a result confirmation report to the user after a preset time threshold. The preset time threshold here is a specific time period set based on the actual business needs and user experience. It can be adjusted and set by the developer according to actual needs, for example, 24 hours, 48 hours, etc. The result confirmation report will present the previous alarm results and related processing details in the form of SMS, email or push messages in the application. In this way, the user's feedback information on the alarm result is obtained. The user's feedback information may include recognition, questioning of the alarm result, or providing more background and explanation related to the target behavior. Based on the user's feedback information, the system will further conduct in-depth analysis and processing to obtain the target behavior score that matches the target behavior request. This score will comprehensively consider the user's feedback and the previous evaluation factors, and more accurately reflect the true nature of the target behavior. Subsequently, a target training sample is formed according to the target behavior request, the target behavior attribute that matches the target behavior request, the request frequency, and the target behavior score. In this process, the target behavior score is used as the labeled data in the target training sample to provide clear guidance for the learning and improvement of the model. Finally, the target training samples are used to perform negative feedback training on the abnormal behavior recognition model. In this way, the parameters and weights of the model are continuously adjusted to optimize the performance and accuracy of the model, so that it can better adapt to the ever-changing user behavior and payment environment, thereby continuously optimizing and improving the abnormal behavior recognition model.
[0045] The technical solution of the embodiment of the present invention first detects the user's target behavior request, generates and displays a permission acquisition request, and then responds to the user's confirmation operation on the permission acquisition request to obtain the target behavior attribute and the request frequency that match the target behavior request. Finally, the target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score that matches the target behavior attribute, and an alarm result is generated according to the behavior score, thereby realizing the recognition and alarm of abnormal behavior and improving the accuracy of abnormal behavior recognition.
[0046] Embodiment 2
[0047] Figure 2 This is a flow chart of a method for constructing an abnormal behavior recognition model provided in the second embodiment of the present invention. This embodiment is supplemented on the basis of the above embodiment, and specifically supplements the method for constructing an abnormal behavior recognition model in this embodiment.
[0048] like Figure 2 As shown, the method includes:
[0049] S210: Acquire a historical behavior data set matching the user.
[0050] The historical behavior data includes at least one historical behavior request, a historical behavior attribute matching the historical behavior request, a historical request frequency, and a historical behavior score.
[0051] In this embodiment, the historical behavior data set specifically includes: at least one historical behavior request. For example, payment requests, transfer requests or other operation requests related to financial transactions initiated by users in different scenarios in the past; at the same time, it also includes historical behavior attributes matching the historical behavior request, which may include whether the device model used at the time is a high-end smartphone or an old mobile device, whether the application version used is the latest updated version or an older version, whether the network environment is a stable and high-speed 5G network or a Wi-Fi network with large fluctuations, whether the area information is an economically developed area or a relatively remote area, whether the transaction item information involved is the purchase of daily consumer goods or investment in financial products, and the specific transaction time, whether it is a busy period on weekdays or a rest time at night, etc. In addition, the historical behavior data also includes the frequency of historical requests. This refers to the statistics of the number of times a user initiates similar behavior requests within a specific time period, such as a month, a quarter or a year. Finally, the historical behavior data set also covers the historical behavior score, which is a quantitative indicator based on the previous evaluation and analysis of these historical behaviors, used to reflect the risk level or normality of each historical behavior.
[0052] S220: Process each historical behavior data in the historical behavior attribute set based on preset rules to obtain a training sample set.
[0053] Among them, each historical behavior data in the historical behavior attribute set is processed based on preset rules to obtain a training sample set, including: using a hash algorithm to process the historical behavior attributes in each historical behavior data to obtain historical behavior features that match each historical behavior data; aggregating historical behavior data with the same historical behavior features to obtain each historical behavior grouping; according to the historical request frequency of each historical behavior request in each historical behavior group, statistically obtaining the total request frequency that matches each historical behavior group; according to the historical behavior score of each historical behavior request in the historical behavior group, calculating the average behavior score of the historical behavior group; forming a training sample based on the historical behavior group, the total request frequency that matches the historical behavior group and the average behavior score of the historical behavior group, and the average behavior score of the historical behavior group, and the average behavior score is used as the annotation data in the training sample.
[0054] Specifically, the process of processing each historical behavior data in the historical behavior attribute set based on the preset rules to obtain the training sample set specifically includes: first, using the hash algorithm to process the historical behavior attributes in each historical behavior data. The hash algorithm is a common data processing technology that can convert complex historical behavior attributes into hash values of fixed length, and then obtain historical behavior features that match each historical behavior data. In this way, the historical behavior attributes can be efficiently compressed and encoded, which is convenient for subsequent analysis and processing. Next, the historical behavior data with the same historical behavior characteristics are aggregated to obtain each historical behavior group. Then, according to the historical request frequency of each historical behavior request in each historical behavior group, statistics are performed. Specifically, the sum of the historical request frequencies of all historical behavior requests in each historical behavior group is calculated, so as to obtain the sum of the request frequencies that match each historical behavior group. This sum data can reflect the overall situation of each historical behavior group in terms of request frequency. Then, according to the historical behavior scores of each historical behavior request in the historical behavior group, the average behavior score of the historical behavior group is obtained by mathematical calculation methods, such as averaging. This average behavior score can represent the overall behavior performance level of the historical behavior group. Finally, a training sample is formed based on the historical behavior group, the total request frequency matching the historical behavior group, and the average behavior score of the historical behavior group. In this training sample, the average behavior score serves as important annotation data, providing key reference and guidance for subsequent model training and optimization.
[0055] For example, assume that we have the following historical behavior data: 1) Historical behavior data 1: Historical behavior request: Purchase electronic products worth 500 yuan. Historical behavior attributes: Using mobile phone A, application version is shopping application A, in 5G network environment, region is Beijing, transaction time is 12 noon. Historical request frequency: 5 times, historical behavior score: 80. 2) Historical behavior data 2: Historical behavior request: Purchase clothing worth 800 yuan. Historical behavior attributes: Using mobile phone B, application version is shopping application B, in Wi-Fi network environment, region is Shanghai, transaction time is 3 pm. Historical request frequency: 3 times, historical behavior score: 70. 3) Historical behavior data 3: Historical behavior request: Transfer 1,000 yuan to a friend. Historical behavior attributes: Using mobile phone A, application version is shopping application A, in 5G network environment, region is Beijing, transaction time is 8 pm, historical request frequency: 2 times, historical behavior score: 90.
[0056] First, use the hash algorithm to process the historical behavior attributes. Assume that after processing, historical behavior data 1 and 3 have the same historical behavior characteristics. Then, aggregate the two data to obtain a historical behavior group. Next, count the total request frequency in this group: 5+2=7 times, and then calculate the average behavior score: (80+90) / 2=85 points. Finally, a training sample is formed based on this historical behavior group, the total request frequency of 7 times, and the average behavior score of 85 points, with 85 points as the labeled data.
[0057] S230: Use the training sample set to train the convolutional neural network model to obtain an abnormal behavior recognition model.
[0058] The technical solution of the embodiment of the present invention first obtains a historical behavior data set matching the user, then processes each historical behavior data in the historical behavior attribute set based on preset rules to obtain a training sample set, and finally uses the training sample set to train a convolutional neural network model to obtain an abnormal behavior recognition model, thereby realizing the construction of the abnormal behavior recognition model and improving the recognition accuracy of abnormal behavior.
[0059] Embodiment 3
[0060] Figure 3 This is a schematic diagram of the structure of an abnormal behavior alarm device provided in Embodiment 3 of the present invention.
[0061] like Figure 3 As shown, the device comprises:
[0062] The permission request module 310 is used to detect the user's target behavior request, generate a permission acquisition request and display it;
[0063] The attribute acquisition module 320 is used to acquire the target behavior attribute matching the target behavior request in response to the user's confirmation operation on the permission acquisition request;
[0064] The result generation module 330 is used to input the target behavior attribute into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and generate an alarm result according to the behavior score.
[0065] The technical solution of the embodiment of the present invention first detects the user's target behavior request, generates and displays a permission acquisition request, and then responds to the user's confirmation operation on the permission acquisition request to obtain the target behavior attribute and the request frequency that match the target behavior request. Finally, the target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score that matches the target behavior attribute, and an alarm result is generated according to the behavior score, thereby realizing the recognition and alarm of abnormal behavior and improving the accuracy of abnormal behavior recognition.
[0066] Based on the above embodiment, the result generation module 330 includes:
[0067] A judging unit, used to judge whether the behavior score is greater than a preset score threshold;
[0068] A rejection unit, configured to generate a warning pop-up window and reject the user's target behavior request if the target behavior is greater than .
[0069] The permission unit is used to not generate an alarm if it is not greater than and to allow the user's target behavior request.
[0070] Based on the above embodiment, the abnormal behavior alarm device further includes:
[0071] A model training module is used to obtain a historical behavior data set matching the user, wherein the historical behavior data includes at least one historical behavior request, a historical behavior attribute matching the historical behavior request, a historical request frequency, and a historical behavior score; based on preset rules, each historical behavior data in the historical behavior attribute set is processed to obtain a training sample set; and the convolutional neural network model is trained using the training sample set to obtain an abnormal behavior recognition model.
[0072] On the basis of the above embodiments, the model training module is also used to: use a hash algorithm to process the historical behavior attributes in each historical behavior data to obtain historical behavior features that match each historical behavior data; aggregate the historical behavior data with the same historical behavior features to obtain each historical behavior grouping; according to the historical request frequency of each historical behavior request in each historical behavior group, statistically obtain the total request frequency that matches each historical behavior group; according to the historical behavior score of each historical behavior request in the historical behavior group, calculate the average behavior score of the historical behavior group; form a training sample based on the historical behavior group, the total request frequency that matches the historical behavior group and the average behavior score of the historical behavior group, and the average behavior score of the historical behavior group, and the average behavior score of the training sample is used as the annotation data in the training sample.
[0073] On the basis of the above embodiment, the result generation module 330 is also used to: after generating an alarm result according to the behavior score, push a result confirmation report to the user after a preset time threshold to obtain user feedback information on the alarm result; based on the user's feedback information, obtain a target behavior score that matches the target behavior request; form a target training sample according to the target behavior request, a target behavior attribute that matches the target behavior request, a request frequency, and the target behavior score, and use the target behavior score as labeled data in the target training sample; use the target training sample to perform negative feedback training on the abnormal behavior recognition model to optimize the abnormal behavior recognition model.
[0074] An abnormal behavior alarm device provided in an embodiment of the present invention can execute an abnormal behavior alarm method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.
[0075] Embodiment 4
[0076] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0077] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0078] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0079] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an alarm method for abnormal behavior.
[0080] Accordingly, the method comprises:
[0081] Detect the user's target behavior request, generate a permission request and display it;
[0082] In response to a user's confirmation operation on the permission acquisition request, obtaining a target behavior attribute and a request frequency that match the target behavior request;
[0083] The target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and an alarm result is generated according to the behavior score.
[0084] In some embodiments, a method for warning of abnormal behavior may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for warning of abnormal behavior described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute a method for warning of abnormal behavior in any other appropriate manner (e.g., by means of firmware).
[0085] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0086] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0087] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0088] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0089] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0090] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0091] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
Claims
1. A method for warning of abnormal behavior, characterized in that: include: Detect the user's target behavior request, generate a permission request and display it; In response to a user's confirmation operation on the permission acquisition request, obtaining a target behavior attribute and a request frequency that match the target behavior request; The target behavior attribute and the request frequency are input into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and an alarm result is generated according to the behavior score.
2. The method according to claim 1, characterized in that Generate an alarm result based on the behavior score, including: Determining whether the behavior score is greater than a preset score threshold; If it is greater, a warning pop-up window is generated and the user's request for the target behavior is rejected; If not, no alarm is generated and the user's target behavior request is allowed.
3. The method according to claim 1, characterized in that The target behavior attribute includes: at least one of a device model, an application version, a network environment, region information, transaction item information, and a transaction time that matches the target behavior request.
4. The method according to claim 1, characterized in that The construction process of the abnormal behavior recognition model includes: Acquire a historical behavior data set matching the user, wherein the historical behavior data includes at least one historical behavior request, a historical behavior attribute matching the historical behavior request, a historical request frequency, and a historical behavior score; Processing each historical behavior data in the historical behavior attribute set based on preset rules to obtain a training sample set; The convolutional neural network model is trained using the training sample set to obtain an abnormal behavior recognition model.
5. The method according to claim 4, characterized in that The historical behavior data in the historical behavior attribute set are processed based on preset rules to obtain a training sample set, including: Use a hash algorithm to process the historical behavior attributes in each historical behavior data to obtain historical behavior features that match each historical behavior data; Aggregate historical behavior data with the same historical behavior characteristics to obtain historical behavior groups; According to the historical request frequency of each historical behavior request in each historical behavior group, the total request frequency matching each historical behavior group is obtained by counting; Calculating an average behavior score of the historical behavior group according to the historical behavior score of each historical behavior request in the historical behavior group; A training sample is formed based on the historical behavior grouping, the total frequency of requests matching the historical behavior grouping, and the average behavior score of the historical behavior grouping, and the average behavior score is used as the annotation data in the training sample.
6. The method according to claim 1, characterized in that After generating an alarm result according to the behavior score, the method further includes: Pushing a result confirmation report to the user after a preset time threshold to obtain user feedback information on the alarm result; Based on the feedback information of the user, obtaining a target behavior score that matches the target behavior request; forming a target training sample according to the target behavior request, the target behavior attribute matching the target behavior request, the request frequency, and the target behavior score, wherein the target behavior score serves as the annotation data in the target training sample; The target training sample is used to perform negative feedback training on the abnormal behavior recognition model to optimize the abnormal behavior recognition model.
7. An abnormal behavior warning device, characterized in that: include: The permission request module is used to detect the user's target behavior request, generate a permission acquisition request and display it; An attribute acquisition module, configured to acquire a target behavior attribute matching the target behavior request in response to a user's confirmation operation on the permission acquisition request; The result generation module is used to input the target behavior attribute into a pre-trained abnormal behavior recognition model to obtain a behavior score matching the target behavior attribute, and generate an alarm result according to the behavior score.
8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute an abnormal behavior alarm method as described in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement an abnormal behavior alarm method according to any one of claims 1 to 6 when executed.
10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements an abnormal behavior alarm method according to any one of claims 1 to 6.