Abnormality identification method and device

Abstract

The embodiment of the invention provides an exception recognition method, which comprises the following steps of: acquiring an operation track of a screen of a plurality of target clients; performing gridding and coding on the screen, and mapping the operation track into a track sequence based on the gridding and coding screen; based on the trajectory sequence, adopting a pre-trained target language model to obtain trajectory representation of the target client; clustering is carried out based on the track representation; and determining an abnormal target client based on a clustering result. According to the technical scheme, the abnormal player group can be effectively recognized, bypassing is not likely to happen, the recognition effect is stable, a large number of abnormal player samples do not need to be marked, and good generalization is achieved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of artificial intelligence technology, and in particular, to an abnormality identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the field of gaming, click-simulating plug-in tools are a common means of cheating. These plug-in tools simulate specific touch behaviors through recording or programming to achieve functions such as automatic resource collection, automatic tasks, automatic combat, etc. These plug-in tools will have a very serious negative impact on the fairness of the game.

[0003] At present, there are usually two methods to identify these plug-in tools: one is a rule-based method, which designs abnormal recognition rules based on the player's screen click pixels for identification; the other is to design and train classification models for identification.

[0004] However, the first method is not easy to identify and can be easily bypassed as long as the plug-in tool adds a random jitter when clicking; the second method requires manual labeling of a large number of abnormal player samples, which is labor-intensive and has poor results.

[0005] It should be noted that the above content is not necessarily prior art, nor is it intended to limit the scope of patent protection of this application. Summary of the invention

[0006] The embodiments of the present application provide an abnormality identification method, apparatus, computer device, computer-readable storage medium, and computer program product to solve or alleviate one or more of the technical problems raised above.

[0007] One aspect of an embodiment of the present application provides an abnormality identification method, the method comprising: Collecting operation traces of screens of target clients, where there are multiple target clients; Gridding and encoding the screen, and mapping the operation trajectory into a trajectory sequence based on the gridded and encoded screen; Acquire a trajectory representation of the target client using a pre-trained target language model based on the trajectory sequence; performing clustering based on the trajectory representation; Based on the clustering result, the target client with abnormality is determined.

[0008] Optionally, the gridding and encoding the screen, and mapping the operation track into a track sequence based on the gridded and encoded screen, comprises: Dividing the screen into a predetermined number of grids; Mapping each grid to a different specific symbol, each of the specific symbols corresponds to a unique number; Determine a specific symbol corresponding to the operation trajectory; The operation trajectory is mapped into a trajectory sequence using the number based on the specific symbol corresponding to the operation trajectory.

[0009] Optionally, the specific symbol is a Chinese character.

[0010] Optionally, the acquiring the trajectory representation of the target client by using a pre-trained target language model based on the trajectory sequence includes: Inputting the trajectory sequence into a pre-trained target language model prediction to obtain a hidden layer output of the pre-trained target language model; A trajectory representation of the target client is obtained based on the hidden layer output.

[0011] Optionally, the method further comprises: Acquire a training data set, wherein the training data set includes a plurality of training trajectory sequences; Masking the training trajectory sequence according to a first ratio to obtain a masked training trajectory sequence; Predicting the masked portion of the masked training trajectory sequence using a target language model; After the prediction result of the target language model reaches a preset accuracy, the pre-trained target language model is obtained.

[0012] Optionally, clustering based on the trajectory representation includes: Performing dimensionality reduction processing on the trajectory representation to obtain a trajectory representation after dimensionality reduction; Clustering is performed based on trajectory representation after dimensionality reduction.

[0013] Optionally, determining an abnormal target client based on a clustering result includes: When the aggregation degree of any cluster exceeds a preset threshold, the cluster corresponding to the preset threshold is regarded as an abnormal cluster; The target client corresponding to the abnormal cluster is determined, and the target client corresponding to the abnormal cluster is used as the target client with abnormality.

[0014] Another aspect of the embodiments of the present application provides an abnormality identification device, the device comprising: A collection module, used to collect operation tracks of the screen of a target client, where there are several target clients; A mapping module, used for gridding and encoding the screen, and mapping the operation track into a track sequence based on the gridded and encoded screen; An acquisition module, configured to acquire a trajectory representation of the target client based on the trajectory sequence using a pre-trained target language model; A clustering module, used for clustering based on the trajectory representation; The determination module is used to determine the target client with abnormalities based on the clustering result.

[0015] Another aspect of an embodiment of the present application provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein: the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described above.

[0016] Another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the method described above is implemented.

[0017] Another aspect of an embodiment of the present application provides a computer program product, including a computer program, which implements the method described above when executed by a processor.

[0018] The above technical solution adopted in the embodiment of the present application may have the following advantages: By collecting the operation trajectory of the target client's screen, the target client's screen is gridded and encoded, and the operation trajectory is mapped into a trajectory sequence based on the gridded and encoded screen. The trajectory representation of the target client is obtained based on the trajectory sequence using a pre-trained target language model, and clustering is performed based on the trajectory representation. Based on the clustering result, the target client with abnormalities is determined. The abnormal player (group) can be identified by clustering. Compared with the rule-based recognition method, it is not easy to be circumvented, and the recognition effect is relatively stable. It does not require a large number of labeled abnormal player samples, so the workload is small and the recognition effect is better than the classification model. It has good generalization and can be trained once and applied in multiple games. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0020] Figure 1 The following schematically shows an operating environment diagram of the abnormality identification method according to the first embodiment of the present application; Figure 2The flowchart of the abnormality identification method according to the first embodiment of the present application is schematically shown; Figure 3 Schematically shows Figure 2 Flow chart of sub-steps of step S202; Figure 4 An example diagram schematically showing gridding and encoding of a screen; Figure 5 An example diagram of a trajectory sequence obtained by converting the operation trajectory is schematically shown; Figure 6 Schematically shows Figure 2 Flow chart of sub-steps of step S204; Figure 7 A schematic diagram showing an example of the principle of trajectory characterization acquisition; Figure 8 The newly added process of the abnormality identification method according to the first embodiment of the present application is schematically shown; Fig. 9 Schematically shows Figure 2 Flow chart of sub-steps of step S206; Fig.10 Schematically shows Figure 2 Flow chart of sub-steps of step S208; Fig.11 A block diagram of an abnormality identification device according to Embodiment 2 of the present application is schematically shown; and Fig.12 The hardware architecture diagram of the computer device according to the third embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0022] It should be noted that the descriptions involving "first", "second", etc. in the embodiments of the present application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0023] In the description of the present application, it should be understood that the numerical labels before the steps do not indicate the order in which the steps are executed, but are only used to facilitate the description of the present application and to distinguish each step, and therefore should not be understood as a limitation on the present application.

[0024] First, the following terms are explained: Language model: A natural language processing model based on probability statistics, designed to understand and generate human language. It analyzes a large amount of text data, learns the grammar, semantics and contextual knowledge of the language, and is able to predict the next word, generate text, translate language, etc.

[0025] Clustering: It is an unsupervised learning method that aims to divide the data points in a dataset into different groups or clusters so that the objects within the same cluster are more similar, while the objects between different clusters are less similar.

[0026] Hidden layer: It is one or more layers of neurons located between the input layer and the output layer in an artificial neural network. These neurons do not interact directly with the outside world, but process the input data, extract features, and pass them to the next layer to produce output.

[0027] Masked Language Model (MLM): is a pre-training technology widely used in the field of natural language processing. Its core idea is to randomly mask some words in the input text and then let the model predict these masked words. In this way, the model can learn contextual information and better understand the language.

[0028] Secondly, in order to facilitate those skilled in the art to understand the technical solutions provided in the embodiments of the present application, the relevant technologies are described below: In the field of games, especially mobile games, plug-in tools that simulate clicks, such as "Cellular Assistant", "Touch Elf" or "Auto Clicker", are extremely common cheating methods. These plug-in tools simulate specific touch behaviors through recording or programming to achieve functions such as automatic resource collection, automatic tasks, automatic combat, etc. This cheating method not only significantly reduces the difficulty of the game and speeds up the clearance time, but also brings unfair competitive advantages to players, causing serious negative impacts on the fairness of the game and the economic system.

[0029] At present, in order to identify these plug-in tools and protect the fairness of the game, two methods are usually used: one is a rule-based method, which collects the players' screen click pixels, counts repeated substrings for different players' pixel sequences, and designs anomaly recognition rules for identification; the other is to design and train classification models to identify abnormal player sequences.

[0030] However, the first method is easy to circumvent, as plug-in tools can be difficult to identify by simply adding random jitter when clicking. The second method requires manual labeling of a large number of abnormal player samples, which is labor-intensive and has poor results.

[0031] To this end, the embodiment of the present application provides a technical solution for abnormal identification. In this technical solution, by collecting the screen operation trajectory of the player, the player's screen is gridded and encoded to serialize the player's screen operation trajectory and map it into a trajectory sequence; the trajectory representation of the trajectory sequence is obtained through language model training, and the trajectory representation is clustered to identify abnormal player groups. Compared with the rule recognition method, it is not easy to be circumvented, and the recognition effect is relatively stable; and it does not require a large number of labeled abnormal player samples, and the recognition effect is also better than the classification model; it has good generalization, and can achieve the effect of one training and application in multiple games. See below for details.

[0032] Finally, for ease of understanding, an exemplary operating environment is provided below.

[0033] like Figure 1 As shown, the environment diagram includes a service platform 2, a network 4, and a client 6, wherein: The service platform 2 may be composed of a single or multiple computing devices. The multiple computing devices may include virtualized computing instances. Virtualized computing instances may include virtual machines, such as simulations of computer systems, operating systems, servers, etc. The computing device may load a virtual machine based on a virtual image and / or other data defining specific software (e.g., operating system, dedicated application, server) for simulation. As the demand for different types of processing services changes, different virtual machines may be loaded and / or terminated on one or more computing devices. A hypervisor may be implemented to manage the use of different virtual machines on the same computing device.

[0034] The service platform 2 may be configured to communicate with the client 6 or the like via a network 4. The network 4 includes various network devices, such as routers, switches, multiplexers, hubs, modems, bridges, repeaters, firewalls, proxy devices, and / or the like. The network 4 may include physical links, such as coaxial cable links, twisted pair cable links, optical fiber links, combinations thereof, and the like, or wireless links, such as cellular links, satellite links, Wi-Fi links, and the like.

[0035] The service platform 2 can provide storage, reading, writing, querying, deleting and other services, such as providing services for clients to read and run games.

[0036] The client 6 may be an electronic device running an operating system such as Windows, Android™ or iOS, such as a smart phone, a tablet device, a laptop computer, a virtual reality device, a gaming device, a set-top box, a vehicle terminal, or a smart TV. Based on the above operating system, various applications may be run, such as an application for running games.

[0037] The client 6 may provide / configure a user access page for manipulating the service platform 2 or uploading an object, etc.

[0038] It should be noted that the above devices are exemplary, and the number and type of devices are adjustable in different scenarios or according to different needs.

[0039] The following uses the service platform as the execution subject to introduce the technical solution of the present application through multiple embodiments. It should be noted that these embodiments can be implemented in a variety of different forms and should not be interpreted as being limited to the embodiments described here.

[0040] Embodiment 1 Figure 2 The flowchart of the abnormality identification method according to the first embodiment of the present application is schematically shown.

[0041] like Figure 2 As shown, the abnormality identification method may include steps S200 to S208, wherein: Step S200 , collecting operation tracks of the screen of a target client, where there are multiple target clients.

[0042] Step S202 , gridding and encoding the screen, and mapping the operation track into a track sequence based on the gridded and encoded screen.

[0043] Step S204 , obtaining a trajectory representation of the target client using a pre-trained target language model based on the trajectory sequence.

[0044] Step S206: clustering based on the trajectory representation.

[0045] Step S208: determining an abnormal target client based on the clustering result.

[0046] The abnormality identification method provided in this embodiment collects the operation trajectory of the screen of the target client, grids and encodes the screen of the target client, maps the operation trajectory into a trajectory sequence based on the gridded and encoded screen, obtains the trajectory representation of the target client based on the trajectory sequence using a pre-trained target language model, clusters based on the trajectory representation, and determines the target client with abnormalities based on the clustering result. The abnormal player (group) can be identified by clustering, which is not easy to be circumvented compared with the rule-based identification method, and the identification effect is more stable; it does not require a large number of labeled abnormal player samples, the workload is small, and the identification effect is better than the classification model; it has good generalization, and can achieve the effect of one-time training and application in multiple games.

[0047] The following combination Figure 2 , each step in steps S200~S208 and other optional steps are explained in detail.

[0048] Step S200 , collect the operation track of the screen of the target client, and the target clients are several.

[0049] The target client may be a client of the target game, and optionally, may be part or all of the clients of the target game. Specifically, the server may collect the operation track of the target client under the authorization of the corresponding user of the target client. The operation track may include clicking, sliding, long pressing, lifting, pressing, etc. The target client may correspond to a mobile terminal, and the operation track may be a track obtained by the user of the target client by touching the screen. The target client may also correspond to a computer terminal, and the operation track may be a track input by the user of the target client to the screen through an input device such as a mouse or keyboard.

[0050] Step S202 , the screen is gridded and encoded, and the operation trajectory is mapped into a trajectory sequence based on the gridded and encoded screen.

[0051] Specifically, the screen of the target client can be divided into a certain number of grids, each grid corresponds to a different symbol, and then the symbols corresponding to the operation track are mapped and encoded to obtain a track sequence. Some exemplary solutions are provided below.

[0052] In an optional embodiment, if Figure 3 As shown, step S202 may include: Step S300, dividing the screen into a predetermined number of grids.

[0053] Step S302, mapping each grid to a different specific symbol, each specific symbol corresponds to a unique number.

[0054] Step S304: determine the specific symbol corresponding to the operation track.

[0055] Step S306 : Mapping the operation trajectory into a trajectory sequence by using a number based on the specific symbol corresponding to the operation trajectory.

[0056] The specific symbol may be a Chinese character, a number, an English character, etc. The specific symbol corresponding to each grid should be different, so that different specific symbols represent the operations of the user of the target client at different positions on the screen. Preferably, the specific symbol is a Chinese character. Since the number of Chinese characters is relatively large, mapping the grid to Chinese characters can make each grid correspond to a different Chinese character, which helps to express complex and specific operation trajectory information.

[0057] Specifically, the service platform can divide the target client's screen into a predetermined number of grids; then, map each grid to a different specific symbol; for each collected operation track, the corresponding specific symbol and corresponding number can be determined; finally, according to the number corresponding to each operation track, the track sequence corresponding to the target client is formed in chronological order. Among them, the service platform can maintain a correspondence table between specific symbols and numbers in advance, so that the corresponding number can be determined according to the specific symbol corresponding to the operation track. In addition, the predetermined number is, for example, 108 72, if the screen resolution is 1080 720, the screen is divided into 108 When there are 72 grids, you can use 10 A grid size of 10, each grid contains 100 pixels.

[0058] Please refer to Figure 4 , which is an example of how to grid and encode the screen. As shown in the figure, the screen can be divided into multiple grids, and each grid is mapped to a Chinese character. Please refer to Figure 5 , which is an example diagram of a trajectory sequence obtained by converting the operation trajectory. As shown in the figure, according to the numbers corresponding to the Chinese characters corresponding to the operation trajectory, the operation trajectory can be finally mapped to a trajectory sequence.

[0059] In this embodiment, by dividing the screen into a predetermined number of grids, mapping each grid to a different specific symbol, each specific symbol corresponding to a unique number, determining the specific symbol corresponding to the operation trajectory, and mapping the operation trajectory to a trajectory sequence using the number based on the specific symbol corresponding to the operation trajectory, the operation trajectory of the target client can be effectively converted into a trajectory sequence, which is convenient for subsequent feature extraction and clustering processing; at the same time, by dividing the screen into a predetermined number of grids, screens of different resolutions can be unified, thereby facilitating the unification of the operation behaviors of different target clients.

[0060] Step S204 ,Based on the trajectory sequence, a pre-trained target language model is used to obtain the trajectory representation of the target client.

[0061] Specifically, a pre-trained target language model can be used to extract features from the trajectory sequence to obtain the trajectory representation of the target client. The target language model can be pre-trained using multiple trajectory sequence samples, and after reaching a preset accuracy, a pre-trained target language model is obtained. Some exemplary solutions are provided below.

[0062] In an optional embodiment, if Figure 6 As shown, step S204 may include: Step S400: input the trajectory sequence into the pre-trained target language model prediction to obtain the hidden layer output of the pre-trained target language model.

[0063] Step S402, obtaining a trajectory representation of the target client based on the hidden layer output.

[0064] The pre-trained target language model may be a model constructed based on a recurrent neural network (RNN), a long short-term memory network (LTSM), or a Transformer and trained using an MLM method. Alternatively, the pre-trained target language model may also be a model obtained through pre-training such as BERT.

[0065] Specifically, a trajectory sequence for training can be constructed, and then the trajectory sequence for training can be masked according to a certain ratio. The target language model can be used to predict the masked trajectory sequence for training, and a pre-trained target language model can be obtained after the training reaches a preset accuracy. For example, part of the trajectory sequence for training can be replaced with a masking mark "mask", and the behavior type corresponding to the masked part is the behavior type that the target language model needs to predict. After obtaining the pre-trained target language model, the trajectory sequence corresponding to the target client can be input into the pre-trained target language model to obtain the hidden layer output of the pre-trained target language model; after obtaining the hidden layer output, the hidden layer output can be directly used as the trajectory representation of the target client, or the hidden layer output can be further processed, such as average pooling or maximum pooling, and the trajectory representation of the target client can be obtained according to the result of the further processing. Please refer to Figure 7, which is an example diagram of the principle of trajectory representation acquisition. As shown in the figure, after token embedding and position embedding, the input enters multiple BERT layers for processing to obtain context-related vectors, and finally outputs after the fully connected layer. Among them, the context-related vectors obtained after processing by multiple BERT layers are the hidden layer outputs, and the trajectory representation of the target client can be obtained based on the hidden layer outputs. In addition, the BERT layer can be composed of multiple Transformer encoders stacked together, and the Transformer encoder can be composed of an attention mechanism and a feedforward neural network.

[0066] It can be understood that since the hidden layer output can represent the relatively advanced features of the target client's operation trajectory, by obtaining the hidden layer output of the pre-trained target language model, the trajectory representation of the target client is obtained based on the hidden layer output, and then clustering is performed based on it to obtain a more accurate result.

[0067] In this embodiment, by inputting the trajectory sequence into a pre-trained target language model, obtaining the hidden layer output of the pre-trained target language model, and obtaining the trajectory representation of the target client based on the hidden layer output, the hidden layer output of the pre-trained target language model can be used to obtain the high-level operation characteristics of the target client, which facilitates subsequent accurate clustering and improves the accuracy of clustering.

[0068] In an optional embodiment, if Figure 8 As shown, the abnormality identification method of the embodiment of the present application may also include: Step S500: obtaining a training data set, where the training data set includes a plurality of training trajectory sequences.

[0069] Step S502: mask the training trajectory sequence according to a first ratio to obtain a masked training trajectory sequence.

[0070] Step S504: using the target language model to predict the masked part of the masked training trajectory sequence.

[0071] Step S506, after the prediction result of the target language model reaches a preset accuracy, a pre-trained target language model is obtained.

[0072] The first ratio can be configured according to actual needs and is not specifically limited here.

[0073] Specifically, the operation trajectories of multiple clients can be collected in advance, and the operation trajectories of these clients can be converted into trajectory sequences to obtain training trajectory sequences; then, these training trajectory sequences are randomly masked according to a first ratio, and the target language model is used to predict the masked parts in the training trajectory sequences. Training is performed by minimizing the gap between the results predicted by the target language model and the actual contents of the masked parts. After the prediction results of the target language model reach a preset accuracy, a pre-trained target language model is obtained.

[0074] In this embodiment, a training data set is obtained, the training data set includes multiple training trajectory sequences, the training trajectory sequence is masked according to a first ratio, and a masked training trajectory sequence is obtained. The masked part of the masked training trajectory sequence is predicted using a target language model. After the prediction result of the target language model reaches the prediction accuracy, a pre-trained target language model is obtained, and a model for obtaining trajectory representation can be effectively trained, so that the hidden layer output corresponding to the trained model accurately reflects the operation trajectory characteristics of the target client.

[0075] Step S206 , clustering based on trajectory representation.

[0076] Specifically, a clustering algorithm (K-means) may be used to cluster the trajectory representations of all target clients.

[0077] In an optional embodiment, if Fig. 9 As shown, step S206 may include: Step S600 , performing dimension reduction processing on the trajectory representation to obtain a trajectory representation after dimension reduction.

[0078] Step S602: clustering based on the trajectory representation after dimensionality reduction.

[0079] Specifically, the trajectory representation can be reduced in dimension by using a linear dimensionality reduction method or a nonlinear dimensionality reduction method to obtain a trajectory representation after dimensionality reduction; then, all the trajectory representations after dimensionality reduction are clustered to obtain clustering results. For example, if the trajectory representation before dimensionality reduction is a 768-dimensional vector, the trajectory representation can be reduced to a 2-dimensional vector by using the tsne dimensionality reduction method, and then the trajectory representation of the 2-dimensional vector is clustered.

[0080] In this embodiment, the trajectory representation is processed by reducing the dimension to obtain the reduced-dimensional trajectory representation, and clustering is performed based on the reduced-dimensional trajectory representation. Since the dimension of the trajectory representation vector obtained based on the hidden layer output is usually high, the computational complexity of direct clustering is high. Therefore, processing the trajectory representation after reducing the dimension can effectively reduce the amount of calculation and is also conducive to visualizing the clustering results.

[0081] Step S208, based on the clustering results, determine the target clients with abnormalities.

[0082] Since the probability of the same operation trajectory sequence corresponding to different normal players is very low, and players using the same plug-in tool will have relatively similar operation trajectory sequences, if multiple trajectory representations are clustered together in the clustering result, it indicates that these trajectory representations are caused by the same plug-in tool, so that the abnormal target client can be determined.

[0083] In an optional embodiment, if Fig.10 As shown, step S208 may include: Step S700: When the aggregation degree of any cluster exceeds a preset threshold, the cluster corresponding to the cluster exceeding the preset threshold is regarded as an abnormal cluster.

[0084] Step S702: determine the target client corresponding to the abnormal cluster, and use the target client corresponding to the abnormal cluster as the target client with abnormality.

[0085] The preset threshold value can be configured according to actual conditions and is not specifically limited here.

[0086] Specifically, the clustering results can be judged. If the number of trajectory representations clustered in a cluster exceeds a preset threshold, the cluster is determined to be an abnormal cluster; then, the target client corresponding to the trajectory representation in the abnormal cluster is determined as the target client with abnormalities; accordingly, the target client group corresponding to the abnormal cluster is the abnormal player group, that is, the abnormal player group corresponding to the use of plug-in tools.

[0087] In this embodiment, when the aggregation degree of any cluster exceeds a preset threshold, the cluster corresponding to the preset threshold is regarded as an abnormal cluster, the target client corresponding to the abnormal cluster is determined, and the target client corresponding to the abnormal cluster is regarded as the target client with an abnormality, so that the abnormal client can be effectively determined according to the clustering result.

[0088] Embodiment 2 Fig.11 The block diagram of the abnormality identification device according to the second embodiment of the present application is schematically shown. The device can be divided into one or more program modules, one or more program modules are stored in a storage medium, and are executed by one or more processors to complete the embodiment of the present application. The program module referred to in the embodiment of the present application refers to a series of computer program instruction segments that can complete specific functions. The following description will specifically introduce the functions of each program module in this embodiment. Fig.11 As shown, the apparatus 800 may include a collection module 810, a mapping module 820, an acquisition module 830, a clustering module 840 and a determination module 850, wherein: A collection module 810 is used to collect operation traces of the screen of a target client, where there are multiple target clients; A mapping module 820, configured to grid and encode the screen, and map the operation track into a track sequence based on the grid and encoded screen; An acquisition module 830 is used to acquire a trajectory representation of the target client based on the trajectory sequence using a pre-trained target language model; A clustering module 840, configured to perform clustering based on the trajectory representation; The determination module 850 is used to determine the target client having abnormalities based on the clustering result.

[0089] In an optional embodiment, the mapping module 820 is further configured to: Dividing the screen into a predetermined number of grids; Mapping each grid to a different specific symbol, each of the specific symbols corresponds to a unique number; Determine a specific symbol corresponding to the operation trajectory; The operation trajectory is mapped into a trajectory sequence using the number based on the specific symbol corresponding to the operation trajectory.

[0090] In an optional embodiment, the specific symbol is a Chinese character.

[0091] In an optional embodiment, the acquisition module 830 is further configured to: Inputting the trajectory sequence into a pre-trained target language model prediction to obtain a hidden layer output of the pre-trained target language model; A trajectory representation of the target client is obtained based on the hidden layer output.

[0092] In an optional embodiment, the device 800 is further used for: Acquire a training data set, wherein the training data set includes a plurality of training trajectory sequences; Masking the training trajectory sequence according to a first ratio to obtain a masked training trajectory sequence; Predicting the masked portion of the masked training trajectory sequence using a target language model; After the prediction result of the target language model reaches a preset accuracy, the pre-trained target language model is obtained.

[0093] In an optional embodiment, the clustering module 840 is further configured to: Performing dimensionality reduction processing on the trajectory representation to obtain a trajectory representation after dimensionality reduction; Clustering is performed based on trajectory representation after dimensionality reduction.

[0094] In an optional embodiment, the determination module 850 is further configured to: When the aggregation degree of any cluster exceeds a preset threshold, the cluster corresponding to the preset threshold is regarded as an abnormal cluster; The target client corresponding to the abnormal cluster is determined, and the target client corresponding to the abnormal cluster is used as the target client with abnormality.

[0095] Embodiment 3 Fig.12 The schematic diagram of the hardware architecture of a computer device 10000 suitable for implementing the abnormality identification method according to the third embodiment of the present application is schematically shown. In some embodiments, the computer device 10000 may be a terminal device such as a smart phone, a wearable device, a tablet computer, a personal computer, a vehicle terminal, a game console, a virtual device, a workbench, a digital assistant, a set-top box, a robot, etc. In other embodiments, the computer device 10000 may be a rack server, a blade server, a tower server, or a cabinet server (including an independent server, or a server cluster composed of multiple servers), etc. Fig.12 As shown, the computer device 10000 includes but is not limited to: a memory 10010, a processor 10020, and a network interface 10030 that can communicate with each other through a system bus. Among them: The memory 10010 includes at least one type of computer-readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (such as SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 10010 can be an internal storage module of the computer device 10000, such as a hard disk or memory of the computer device 10000. In other embodiments, the memory 10010 can also be an external storage device of the computer device 10000, such as a plug-in hard disk equipped on the computer device 10000, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 10010 can also include both the internal storage module of the computer device 10000 and its external storage device. In this embodiment, the memory 10010 is generally used to store the operating system and various application software installed in the computer device 10000, such as the program code of the abnormality identification method, etc. In addition, the memory 10010 can also be used to temporarily store various data that have been output or will be output.

[0096] In some embodiments, the processor 10020 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other chips. The processor 10020 is generally used to control the overall operation of the computer device 10000, such as performing control and processing related to data interaction or communication with the computer device 10000. In this embodiment, the processor 10020 is used to run the program code stored in the memory 10010 or process data.

[0097] The network interface 10030 may include a wireless network interface or a wired network interface, and the network interface 10030 is generally used to establish a communication link between the computer device 10000 and other computer devices. For example, the network interface 10030 is used to connect the computer device 10000 to an external terminal through a network, and to establish a data transmission channel and a communication link between the computer device 10000 and the external terminal. The network may be a wireless or wired network such as an intranet, the Internet, the Global System of Mobile communication (GSM), Wideband Code Division Multiple Access (WCDMA), 4G network, 5G network, Bluetooth, Wi-Fi, etc.

[0098] It should be pointed out that Fig.12 Only a computer device having components 10010 - 10030 is shown, but it should be understood that implementation of all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.

[0099] In this embodiment, the exception identification method stored in the memory 10010 can also be divided into one or more program modules and executed by one or more processors (such as processor 10020) to complete the embodiment of the present application.

[0100] Embodiment 4 An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the abnormality identification method in the embodiment are implemented.

[0101] In this embodiment, the computer-readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the computer-readable storage medium may be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. In other embodiments, the computer-readable storage medium may also be an external storage device of a computer device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device. Of course, the computer-readable storage medium may also include both an internal storage unit of a computer device and an external storage device thereof. In this embodiment, the computer-readable storage medium is generally used to store an operating system and various application software installed on a computer device, such as the program code of the abnormality identification method in the embodiment, etc. In addition, the computer-readable storage medium may also be used to temporarily store various types of data that have been output or are to be output.

[0102] Embodiment 5 An embodiment of the present application also provides a computer program product, including a computer program, which implements the method in the above embodiment when executed by a processor.

[0103] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of the present application can be implemented by general-purpose computer devices, they can be concentrated on a single computer device, or distributed on a network composed of multiple computer devices, optionally, they can be implemented by executable program codes of computer devices, so that they can be stored in a storage device and executed by the computer device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0104] It should be noted that the above are only preferred embodiments of the present application, and the patent protection scope of the present application is not limited thereto. Any equivalent structure or equivalent process transformation made using the contents of the specification and drawings of the present application, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for identifying anomalies, characterized in that: The method comprises: Collecting operation traces of screens of target clients, where there are multiple target clients; Gridding and encoding the screen, and mapping the operation trajectory into a trajectory sequence based on the gridded and encoded screen; Acquire a trajectory representation of the target client using a pre-trained target language model based on the trajectory sequence; performing clustering based on the trajectory representation; Based on the clustering result, the target client with abnormality is determined.

2. The method according to claim 1, characterized in that The gridding and encoding the screen, and mapping the operation track into a track sequence based on the gridded and encoded screen, comprises: Dividing the screen into a predetermined number of grids; Mapping each grid to a different specific symbol, each of the specific symbols corresponds to a unique number; Determine a specific symbol corresponding to the operation trajectory; The operation trajectory is mapped into a trajectory sequence using the number based on the specific symbol corresponding to the operation trajectory.

3. The method according to claim 2, characterized in that The specific symbols are Chinese characters.

4. The method according to claim 1, characterized in that: The step of obtaining the trajectory representation of the target client by using a pre-trained target language model based on the trajectory sequence includes: Inputting the trajectory sequence into a pre-trained target language model prediction to obtain a hidden layer output of the pre-trained target language model; A trajectory representation of the target client is obtained based on the hidden layer output.

5. The method according to claim 4, characterized in that The method further comprises: Acquire a training data set, wherein the training data set includes a plurality of training trajectory sequences; Masking the training trajectory sequence according to a first ratio to obtain a masked training trajectory sequence; Predicting the masked portion of the masked training trajectory sequence using a target language model; After the prediction result of the target language model reaches a preset accuracy, the pre-trained target language model is obtained.

6. The method according to any one of claims 1 to 5, characterized in that: The clustering based on the trajectory representation includes: Performing dimensionality reduction processing on the trajectory representation to obtain a trajectory representation after dimensionality reduction; Clustering is performed based on trajectory representation after dimensionality reduction.

7. The method according to any one of claims 1 to 5, characterized in that: Based on the clustering results, abnormal target clients are identified, including: When the aggregation degree of any cluster exceeds a preset threshold, the cluster corresponding to the preset threshold is regarded as an abnormal cluster; The target client corresponding to the abnormal cluster is determined, and the target client corresponding to the abnormal cluster is used as the target client with abnormality.

8. An abnormality identification device, characterized in that: The device comprises: A collection module, used to collect operation tracks of the screen of a target client, where there are several target clients; A mapping module, used for gridding and encoding the screen, and mapping the operation track into a track sequence based on the gridded and encoded screen; An acquisition module, configured to acquire a trajectory representation of the target client based on the trajectory sequence using a pre-trained target language model; A clustering module, used for clustering based on the trajectory representation; The determination module is used to determine the target client with abnormalities based on the clustering result.

9. A computer device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein: The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images