Abnormality detection method, device, electronic device and storage medium

Abstract

The present application relates to the field of data processing technology, and provides an anomaly detection method, device, electronic device and storage medium. In the method, by taking the resource transfer data of the target object, the transfer behavior characteristics of the resource transfer data are extracted using a trained target detection model, and the anomaly detection result of the target object is obtained based on the transfer behavior characteristics. The above-mentioned target detection model is obtained by using a sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration: the N sample behavior features extracted based on the N sample transfer data are sequentially input into the middle layer of the detection model to obtain N sample fusion features. The N sample fusion features are input into the fully connected layer of the detection model to obtain the sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels. The use of the above-mentioned target detection model can improve the detection accuracy of anomaly detection.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and specifically discloses an anomaly detection method, device, electronic device and storage medium. Background Art

[0002] With the advent of the networking era, online channels generate tens of thousands of resource transfers every second. Currently, the Internet is gradually becoming the mainstream market for resource transactions. For example, money transactions such as scanning code transfers and sending red envelopes are carried out on the Internet.

[0003] In order to ensure the security of resource transactions, risk control management of transaction objects is an important indicator of resource transactions, which is used to block potential risks that may arise during the transaction process.

[0004] Under related technologies, risk control management is mainly implemented based on preset risk control rules. Specifically, abnormal detection can be performed on the resource transfer records of the transaction object. When it is detected that the resource transfer record hits the preset risk control rules, it means that the transaction object has abnormal resource transfer behavior. At this time, the transaction object will be determined as an abnormal object suspected of having resource transfer risks, and then the resource transfer permissions of the abnormal object will be disabled to prevent the occurrence of potential risks.

[0005] For example, if the total number of resource transfer operations performed by the target object to multiple unfamiliar transaction objects within a specified period reaches a set first number threshold, it is determined that the target object hits the preset risk control rule. At this time, the target object is determined to be an abnormal object, and the resource transfer permission of the abnormal object is disabled.

[0006] For another example, if the target object performs resource transfer operations on the same unfamiliar transaction object for a specified period of time, the number of times reaches the set second number threshold, and the number of resources involved in each resource transfer operation reaches the set number threshold, then it is determined that the target object hits the preset risk control rule. At this time, the target object is determined to be an abnormal object, and the resource transfer permission of the abnormal object is disabled.

[0007] The accuracy of the above-mentioned anomaly detection for transaction objects is completely dependent on the perfection of the risk control rules. However, the current risk control rules are mainly set by manual evaluation of actual transaction scenarios.

[0008] This not only consumes a lot of human resources to conduct data mining for specific resource transaction scenarios, which results in low efficiency; in addition, whether the risk control rules are well-formulated depends entirely on the business experience of the relevant personnel. Even if the risk control rules initially formulated are relatively complete, their completeness will gradually weaken or even become invalid over time, thereby affecting the accuracy of anomaly detection for transaction objects.

[0009] In view of this, how to ensure and improve the accuracy of anomaly detection of transaction objects in risk control management tasks in a long-term and efficient manner is a technical problem that needs to be solved urgently. Summary of the invention

[0010] The embodiments of the present application provide an anomaly detection method, device, electronic device and storage medium to improve the accuracy of anomaly detection on transaction objects.

[0011] In a first aspect, an embodiment of the present application provides an anomaly detection method, comprising:

[0012] In response to the abnormality detection indication, obtaining resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period;

[0013] Using a trained target detection model, extracting transfer behavior features of the resource transfer data;

[0014] Based on the transfer behavior characteristics, obtaining an abnormality detection result of the target object;

[0015] The target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration, the following operations are performed:

[0016] Inputting N sample behavior features extracted based on N sample transfer data into the middle layer of the detection model in sequence to obtain N sample fusion features output by the middle layer; wherein, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain a corresponding sample fusion feature; the sample feature set is determined based on the sample behavior features accumulated and input into the middle layer;

[0017] The N sample fusion features are input into the fully connected layer of the detection model to obtain sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

[0018] In some possible embodiments, the abnormality detection device further includes:

[0019] The model training unit is configured to execute: constructing the sample transfer dataset in the following manner:

[0020] Obtaining a historical operation data set generated by each object to be processed within a second historical period;

[0021] For each object to be processed, the following operations are performed respectively: extracting M pieces of original resource transfer data from a historical operation data set associated with the object to be processed; wherein each piece of original resource transfer data is extracted from a specified field contained in a corresponding piece of historical operation data, and the specified field represents the familiarity between the object to be processed and the resource interaction party;

[0022] Performing data cleaning processing on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed;

[0023] A set consisting of N pieces of sample transfer data corresponding to each object to be processed is taken as the sample transfer data set.

[0024] In some possible embodiments, performing data cleaning on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed includes:

[0025] If M<N, then NM blank resource transfer data are generated; after the M original resource transfer data and the NM virtual resource transfer data are merged, they are used as N sample transfer data corresponding to the object to be processed; wherein each blank resource transfer data has the same data structure as the original resource transfer data;

[0026] If M=N, the M pieces of original resource transfer data are directly used as the N pieces of sample transfer data corresponding to the object to be processed;

[0027] If M>N, then MN pieces of original resource transfer data are deleted from the M pieces of original resource transfer data, and the remaining N pieces of original resource transfer data are used as N pieces of sample transfer data corresponding to the object to be processed.

[0028] In some possible embodiments, the sample fusion feature is a multi-dimensional feature matrix, and before inputting the N sample fusion features into the fully connected layer of the detection model, the model method further includes:

[0029] For the N sample fusion features, the following operations are performed respectively:

[0030] Transposing a sample fusion feature to obtain a transposed matrix of the sample fusion feature;

[0031] Performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature;

[0032] The state matrix is ​​used as a sample fusion feature after feature correction.

[0033] In some possible embodiments, performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature includes:

[0034] Performing mean processing on the product of the sample fusion feature and the transposed matrix to obtain a covariance matrix of the sample fusion feature;

[0035] The covariance matrix is ​​transformed according to a preset spectrum radius and a preset diagonal matrix to obtain the state matrix.

[0036] In some possible embodiments, before extracting N sample behavior features based on N pieces of sample transfer data respectively, the method further includes:

[0037] Determine that the sample labels corresponding to the N pieces of sample transfer data are all the same, and that the objects to be processed associated with the N pieces of sample transfer data are all the same;

[0038] The sample label indicates whether there is a risk of resource transfer for the object to be processed in the corresponding sample transfer data.

[0039] In some possible embodiments, the sample feature set includes each sample behavior feature that has been accumulated and input into the intermediate layer.

[0040] In some possible embodiments, the sample feature set includes each sample fusion feature that has been accumulated and output by the intermediate layer.

[0041] In a second aspect, the embodiment of the present application further provides an abnormality detection device, including:

[0042] The data acquisition unit is configured to execute: in response to the abnormality detection indication, acquire resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period;

[0043] The feature extraction unit is configured to perform: using a trained target detection model to extract transfer behavior features of the resource transfer data;

[0044] An anomaly detection unit is configured to perform: obtaining an anomaly detection result of the target object based on the transfer behavior feature;

[0045] The target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration, the following operations are performed:

[0046] Inputting N sample behavior features extracted based on N sample transfer data into the middle layer of the detection model in sequence to obtain N sample fusion features output by the middle layer; wherein, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain a corresponding sample fusion feature; the sample feature set is determined based on the sample behavior features accumulated and input into the middle layer;

[0047] The N sample fusion features are input into the fully connected layer of the detection model to obtain sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

[0048] In some possible embodiments, the abnormality detection device further includes:

[0049] The model training unit is configured to execute: constructing the sample transfer dataset in the following manner:

[0050] Obtaining a historical operation data set generated by each object to be processed within a second historical period;

[0051] For each object to be processed, the following operations are performed respectively: extracting M pieces of original resource transfer data from a historical operation data set associated with the object to be processed; wherein each piece of original resource transfer data is extracted from a specified field contained in a corresponding piece of historical operation data, and the specified field represents the familiarity between the object to be processed and the resource interaction party;

[0052] Performing data cleaning processing on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed;

[0053] A set consisting of N pieces of sample transfer data corresponding to each object to be processed is taken as the sample transfer data set.

[0054] In some possible embodiments, the data cleaning process is performed on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed, and the model training unit is configured as follows:

[0055] If M<N, then NM blank resource transfer data are generated; after the M original resource transfer data and the NM virtual resource transfer data are merged, they are used as N sample transfer data corresponding to the object to be processed; wherein each blank resource transfer data has the same data structure as the original resource transfer data;

[0056] If M=N, the M pieces of original resource transfer data are directly used as the N pieces of sample transfer data corresponding to the object to be processed;

[0057] If M>N, then MN pieces of original resource transfer data are deleted from the M pieces of original resource transfer data, and the remaining N pieces of original resource transfer data are used as N pieces of sample transfer data corresponding to the object to be processed.

[0058] In some possible embodiments, the sample fusion feature is executed as a multi-dimensional feature matrix, and before the N sample fusion features are input into the fully connected layer of the detection model, the model training unit is further configured as follows:

[0059] For the N sample fusion features, the following operations are performed respectively:

[0060] Transposing a sample fusion feature to obtain a transposed matrix of the sample fusion feature;

[0061] Performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature;

[0062] The state matrix is ​​used as a sample fusion feature after feature correction.

[0063] In some possible embodiments, the matrix transformation of the sample fusion feature based on the transposed matrix is ​​performed to obtain a state matrix of the sample fusion feature, and the model training unit is configured as follows:

[0064] Performing mean processing on the product of the sample fusion feature and the transposed matrix to obtain a covariance matrix of the sample fusion feature;

[0065] The covariance matrix is ​​transformed according to a preset spectrum radius and a preset diagonal matrix to obtain the state matrix.

[0066] In some possible embodiments, before executing the N sample behavior features extracted based on the N sample transfer data respectively, the model training unit is further configured to:

[0067] Determine that the sample labels corresponding to the N pieces of sample transfer data are all the same, and that the objects to be processed associated with the N pieces of sample transfer data are all the same;

[0068] The sample label indicates whether there is a risk of resource transfer for the object to be processed in the corresponding sample transfer data.

[0069] In some possible embodiments, the sample feature set includes each sample behavior feature that has been accumulated and input into the intermediate layer.

[0070] In some possible embodiments, the sample feature set includes each sample fusion feature that has been accumulated and output by the intermediate layer.

[0071] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory and a display, wherein the display provides a command line interface for receiving triggered operations, and the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of any of the above-mentioned abnormality detection methods.

[0072] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer-executable instructions stored thereon, which implement the steps of any of the above-mentioned anomaly detection methods when the computer-executable instructions are executed by a computer device.

[0073] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which implements the steps of any of the above-mentioned anomaly detection methods when executed by a computer device.

[0074] The beneficial effects of this application are as follows:

[0075] By taking the resource transfer data of the target object, the trained target detection model is used to extract the transfer behavior characteristics of the resource transfer data, and the abnormal detection result of the target object is obtained based on the transfer behavior characteristics. The above target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration:

[0076] The N sample behavior features extracted based on the N sample transfer data are input into the middle layer of the detection model in sequence; the N sample fusion features output by the middle layer are obtained. Finally, the sample detection results are obtained by inputting the N sample fusion features into the fully connected layer of the detection model, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

[0077] The above-mentioned intermediate layer will output corresponding N sample fusion features for the input N sample behavior features. And the number and content of sample behavior features contained in each sample fusion feature are different. In this way, richer high-order features can be extracted, thereby improving the detection accuracy of the model. Therefore, by performing anomaly detection on the target object through the target detection model provided in the embodiment of the present application, not only can it have a higher detection accuracy, but also can avoid a series of problems existing in the aforementioned traditional detection method that relies on risk control rules.

[0078] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0080] Figure 1 A schematic diagram of the structure of the storage pool computing network provided in the embodiment of the present application;

[0081] Figure 2 A schematic diagram of a traditional risk control management process provided for an embodiment of the present application;

[0082] Figure 3 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0083] Figure 4 A schematic diagram of the construction process of the sample transfer data set provided in the embodiment of the present application;

[0084] Figure 5 A schematic diagram of a historical operation data set provided in an embodiment of the present application;

[0085] Figure 6 Another schematic diagram of a historical operation data set provided by an embodiment of the present application;

[0086] Figure 7 A schematic diagram of the data structure of historical operation data provided in an embodiment of the present application;

[0087] Figure 8 A schematic diagram of original resource transfer data provided in an embodiment of the present application;

[0088] Fig. 9 A schematic diagram of blank resource transfer data provided in an embodiment of the present application;

[0089] Fig.10 A schematic diagram of a sample transfer data set provided in an embodiment of the present application;

[0090] Fig.11 A schematic diagram of the network structure of the detection network provided in the embodiment of the present application;

[0091] Fig.12 A schematic diagram of feature extraction of Word2vec provided in an embodiment of the present application;

[0092] Fig.13 A schematic diagram of feature fusion of the intermediate layer provided in an embodiment of the present application;

[0093] Fig.14 Another schematic diagram of feature fusion of the intermediate layer provided in an embodiment of the present application;

[0094] Fig.15 A schematic diagram of a detection process for a detection network provided in an embodiment of the present application;

[0095] Fig.16 An overall flow chart of an anomaly detection method provided in an embodiment of the present application;

[0096] Fig.17 A structural diagram of an abnormality detection device provided in an embodiment of the present application;

[0097] Fig.18 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0098] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0099] The following is an introduction to some concepts involved in the embodiments of the present application.

[0100] Word2vec (a tool for converting words into vector form) contains only one layer of neural network (CBOW), and uses this layer of neural network to map words in natural language into multi-dimensional dense feature vectors (Dense Vector) that can be understood by computers.

[0101] Reservoir Computing: Reservoir Computing is a simplified extension framework of the recurrent neural network (RNN). Figure 1 As shown in the figure, the reserve pool computing network mainly consists of three parts: input layer, middle layer and output layer.

[0102] The network structure of the input layer belongs to a feedforward neural network, which is composed of one or more neuron nodes and is used to extract features from the input content. The middle layer is composed of multiple neuron nodes and is used to perform feature fusion on the feature vector extracted from the input layer. The output layer is an adder with weights, which is used to perform feature recognition on the feature fusion results extracted from the middle layer.

[0103] The biggest feature of the reserve pool computing network is that Figure 1As shown in , the characteristic of the intermediate layer reserve pool computing network is that the connection matrix of the intermediate layer (i.e., the model parameters of the intermediate layer) is randomly generated and remains unchanged after being generated. That is, the network parameters of the intermediate layer are pre-set fixed values, so that during the network training process, only the network parameters of the output layer need to be trained, and the network parameters of the intermediate layer do not need to be trained.

[0104] The following is a brief introduction to the design concept of the embodiment of the present application:

[0105] As mentioned above, current risk control management is mainly implemented based on preset risk control rules, such as Figure 2 As shown, the resource trading platform calls the resource transfer records generated by the transaction object within the specified period from the database, and matches each resource transfer record based on the preset risk control rules to obtain the corresponding anomaly detection results. Specifically, when a resource transfer record that hits the risk control rule is detected, the transaction object will be determined to be an abnormal object suspected of having resource transfer risks. Then, the occurrence of risky transactions is prevented by manually reviewing the abnormal object or temporarily disabling the resource transfer permissions of the abnormal object.

[0106] The above-mentioned risk control rules are mainly set by manual evaluation of actual transaction scenarios, and the risk control rules in different transaction scenarios are different.

[0107] For example, in the escrow business for the reservation fund of a house purchase, the reservation fund for the house purchase will be transferred to the seller's account only after the transaction parties have completed the house transfer. That is, the completion of this escrow business requires the transaction parties to handle multiple joint businesses such as house transfer offline during the escrow period. Usually, a escrow business for the reservation fund of a house purchase will not be completed within 24 hours. Therefore, the corresponding risk control rules can be set as follows: when the escrow business for the reservation fund of a house purchase completes the entire process from application for escrow to completion of escrow within a single day, the applicant of the escrow business is judged to be an abnormal object suspected of risky transactions.

[0108] For example, in the transfer business of a dating software, if the target object makes multiple large transfers to a stranger transaction object with whom he does not have a friend relationship within a specified period of time, the target object will be determined as an abnormal object suspected of having risky transactions.

[0109] It can be seen that the detection accuracy of abnormal objects in the traditional risk control management process is completely dependent on whether the risk control rules are perfect. The current risk control rules mostly rely on manual evaluation and setting of actual transaction scenarios, which not only consumes a lot of human resources to conduct data mining for specific resource transaction scenarios, but also has the problem of low efficiency; moreover, whether the risk control rules are formulated and perfected depends entirely on the business experience of the relevant personnel. Even if the risk control rules initially formulated are relatively perfect, their perfection will gradually weaken or even fail over time, thus affecting the detection accuracy.

[0110] In view of this, the embodiments of the present application provide an anomaly detection method, device, electronic device and storage medium. The method includes: obtaining resource transfer data of a target object, extracting transfer behavior features of the resource transfer data using a trained target detection model, and obtaining an anomaly detection result of the target object based on the transfer behavior features.

[0111] The above target detection model is obtained by using the sample transfer dataset to perform cyclic iterative training on the detection model to be trained. In each round of iteration:

[0112] First, N sample behavior features extracted based on N sample transfer data are input into the middle layer of the detection model in sequence. That is, the input of each iteration of the model is multiple sample transfer data. Taking the scenario of fund transaction as an example, one sample transfer data is equivalent to one transaction record. The sample behavior feature corresponding to the sample transfer data is equivalent to the transaction behavior feature of the transaction record. Therefore, the transaction behavior features of multiple transaction records can be extracted at one time through the above method.

[0113] Since a transaction record usually cannot directly reflect whether the transaction object has risky transactions, the above process is essentially to let the detection model perform a comprehensive detection of the transaction behavior characteristics of multiple transaction records at one time. In this way, it can more directly and accurately reflect whether the transaction object is an abnormal object suspected of risky transactions.

[0114] Furthermore, the N sample behavior features extracted above are sequentially input into the middle layer of the detection model in the order of extraction to obtain N sample fusion features output by the middle layer. Finally, the sample detection results are obtained by inputting the N sample fusion features into the fully connected layer of the detection model, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

[0115] The essence of feature fusion is to extract high-level features that can more intuitively prove the detection results from surface (low-level) features. In the above process, the output of the middle layer is not the cumulative fusion of N sample behavior features as a whole, but the cumulative processing of each input sample behavior feature and the accumulated input sample feature set to obtain the corresponding sample fusion feature.

[0116] That is, the above intermediate layer will output N corresponding sample fusion features for the input N sample behavior features. And the number and content of sample behavior features contained in each sample fusion feature are different. In this way, more abundant high-order features can be extracted, thereby improving the detection accuracy of the model.

[0117] It can be seen that performing anomaly detection on the target object through the target detection model provided in the embodiment of the present application can not only have a higher detection accuracy, but also avoid a series of problems existing in the aforementioned traditional detection method that relies on risk control rules.

[0118] like Figure 3 As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes a target object 301, a client 302 and a server 303.

[0119] In some possible embodiments, the client 302 and the server 303 may communicate via a wired network or a wireless network.

[0120] In the embodiment of the present application, the client 302 includes but is not limited to a personal computer, a laptop computer, a smart phone, a tablet computer and other intelligent interactive devices. The server 303 is the background server of the target application installed on the client 302.

[0121] Specifically, server 303 can be a distributed system composed of multiple physical servers, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. This application does not limit the specific composition of server 303.

[0122] exist Figure 3 In the application scenario shown, the target object 301 can use the target application stored on the client 302 to perform resource transactions with other users of the target application. The client 302 obtains the resource transfer behavior generated by the target object 301 within a specified period of time, determines the resource transfer data of the target object 301 according to the resource transfer behavior, and uploads the resource transfer data to the server 303.

[0123] The server 303 has a pre-stored trained target detection model. After receiving the resource transfer data uploaded by the client 302, the server 303 inputs the resource transfer data into the target detection model for feature recognition to obtain an abnormality detection result of whether the target object 301 is an abnormal object. Further, the server 303 will send the abnormality detection result for the target object 301 to the client 302, and the client 302 will perform a preset risk control operation on the target object 301 based on the received abnormality detection result. For example, the client 302 will limit the resource transfer authority of the target object 301 in the target application.

[0124] It should be noted that Figure 3 The figure is only an example for facilitating understanding of the application scenario of the technical solution of the present application. The number of clients 302 and servers 303 in actual applications is not limited and is not specifically limited in the embodiments of the present application.

[0125] The foregoing content has explained that the target detection network in the embodiment of the present application is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained.

[0126] To facilitate understanding of the technical solution provided by the present application, the sample transfer data set used for model training in the embodiments of the present application and the specific training process of the model are described separately below.

[0127] See first Figure 4 , Figure 4 The specific construction process of the sample transfer data set in the embodiment of the present application is shown, including the following steps:

[0128] Step 401: obtaining a historical operation data set generated by each object to be processed in a second historical period;

[0129] To facilitate the subsequent explanation of the solution, the embodiment of the present application is explained by taking a target application supporting resource transactions as an example.

[0130] The second historical period in the embodiment of the present application refers to any day in the last six months. The object to be processed is the user of the target application. During implementation, all historical operation data generated by each object to be processed every day in the last six months is obtained. Each piece of historical operation data can be understood as a resource transfer behavior generated by the object to be processed using the target application.

[0131] After obtaining all historical operation data generated every day for each object to be processed through the above process in the past six months, all historical operation data generated by the object to be processed every day are taken as the historical operation data set generated by the object to be processed on that day.

[0132] Next, Figure 5 As shown, Figure 5 The following table shows all the historical operation data generated by the object to be processed "Zhang San" on the 11th, 12th and 13th. As mentioned above, each historical operation data set contains all the historical operation data generated by the object to be processed on any day in the past six months. Since the 11th, 12th and 13th are three days in the past six months, Figure 5 Three historical operation data sets of the object to be processed "Zhang San" can be obtained. Taking fund transfer as an example, a historical operation data can represent a record of fund transfer behavior, such as transfer record, scan code payment record, red envelope record and withdrawal record.

[0133] Still with the above Figure 5 For example, Figure 6 As shown. Assuming that the object to be processed "Zhang San" generates 1 transfer record, 2 scan code payment records, 3 red envelope records and 1 withdrawal record on the 11th, Zhang San's historical operation data set on the 11th may include: transfer record 1, transfer record 2, transfer record 3, scan code payment record 1, scan code payment record 2, red envelope record 1, red envelope record 2, red envelope record 3 and withdrawal record 1, a total of 7 historical operation data.

[0134] The specific selection rules of the objects to be processed can be set according to the actual application scenario. For example, a preset number of objects can be randomly selected from the user objects of the target application as the objects to be processed. For another example, a preset number of objects can be selected from the user objects that have generated payment behaviors more frequently in the past six months as the objects to be processed, and this application does not limit this.

[0135] Step 402: for each object to be processed, perform the following operations respectively: extract M pieces of original resource transfer data from a historical operation data set associated with the object to be processed;

[0136] Each piece of original resource transfer data is extracted from a specified field contained in a corresponding piece of historical operation data, and the specified field represents the familiarity between the object to be processed and the resource interacting party;

[0137] As described in the aforementioned step 401, a historical operation data set associated with an object to be processed includes all resource transfer behaviors generated by the object to be processed on a certain day in the past six months.

[0138] A piece of historical operation data can be specifically Figure 7 As shown, it specifically includes multiple fields such as the resource transfer time, resource transferor (i.e., the object to be processed corresponding to the historical operation data), resource transferee, resource transfer type, resource transfer quantity, intimacy, security, time interval, etc. in the resource transfer behavior.

[0139] The above resource transfer types refer to the channels through which the resource transferor transfers resources to the account of the resource transferee. Taking the above fund transfer as an example, the corresponding resource transfer types may include transfer, QR code payment, red envelope and cash withdrawal.

[0140] The above-mentioned intimacy and security refer to the degree of familiarity between the two parties of the resource transaction (the resource transferor and the resource transferee). In the embodiment of the present application, the intimacy can be determined based on the number of common friends between the two parties of the resource transaction, while the security can be determined based on the length of time that the two parties of the resource transaction have been friends with each other in the target application.

[0141] The above time interval refers to the resource transferor in the historical operation data, and the interval between the generation of the historical operation data and the generation of the previous historical operation data.

[0142] It should be noted that the specific implementation methods of this application involve various resource transfer-related information extracted from the resource transfer behavior generated by the transaction object, and the friend-related information of the two parties to the resource transaction in the target application. When applied to the methods or products of the embodiments of this application, they should strictly comply with the requirements of the laws of the relevant country, obtain the permission or consent of the information subject, and the collection, use and processing of relevant information shall comply with the laws, regulations and standards of the relevant countries and regions.

[0143] In addition, when executing step 402, for each piece of historical operation data in the historical operation data set, a piece of original resource transfer data corresponding to the piece of historical operation data is obtained by extracting the specified field of the piece of historical operation data. Figure 7 The historical operation data shown is taken as an example. Figure 8 As shown in FIG. 1 , the resource transfer type, resource transfer quantity, intimacy, security, and time interval in a historical operation data can be used as the specified fields. Figure 8 The five fields in the historical operation data of the object to be processed "Zhang San" are extracted and sorted in a preset order, and the corresponding original resource transfer data is obtained as follows: resource transfer type (transfer)_resource transfer quantity (500)_intimacy (0.7)_security (0.8)_time interval (240).

[0144] Through the above process, for each historical operation data set, the specified field can be extracted according to all the historical operation data in the historical operation data set to obtain the corresponding M pieces of original resource transfer data.

[0145] Step 403: performing data cleaning processing on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed;

[0146] In the embodiment of the present application, the M pieces of original resource transfer data corresponding to a historical operation data set are equivalent to a training sample. The purpose of data cleaning is to make the data volume of each training sample the same, so as to facilitate the training of the model.

[0147] During implementation, the amount of data N (e.g., 10) required to contain sample transfer data in a training sample can be preset. After obtaining M pieces of original resource transfer data corresponding to the historical operation data set through the aforementioned step 402, M is compared with N:

[0148] If M=N, the original resource transfer data can be directly used as sample transfer data. That is, the M pieces of original resource transfer data can be directly used as the N pieces of sample transfer data corresponding to the object to be processed;

[0149] If M < N, it means that the amount of data of the original resource transfer data does not meet the standard of one training sample. At this time, NM blank resource transfer data can be generated; after the M original resource transfer data and the NM virtual resource transfer data are merged, they are used as N sample transfer data corresponding to the object to be processed; wherein each blank resource transfer data has the same data structure as the original resource transfer data.

[0150] The above blank resource transfer data can be Fig. 9 As shown, it contains the same data structure as the original resource transfer data, that is, it contains the same specified fields as the original resource transfer data, and the order of each specified field is the same. For example, the original resource transfer data is resource transfer type (transfer)_resource transfer amount (500)_intimacy (0.7)_security (0.8)_time interval (240). Then the blank resource transfer data can be resource transfer type (null (empty))_resource transfer amount (null)_intimacy (null)_security (null empty)_time interval (null).

[0151] If M>N, it means that the amount of original resource transfer data exceeds the standard of one training sample. At this time, MN original resource transfer data can be deleted from the M original resource transfer data, and the remaining N original resource transfer data can be used as the N sample transfer data corresponding to the object to be processed.

[0152] In specific implementation, MN pieces of data to be deleted may be randomly selected from the M pieces of original resource transfer data. Original resource transfer data with high sample similarity may also be deleted, which is not limited in this application.

[0153] Step 404: taking a set of N sample transfer data corresponding to each object to be processed as a sample transfer data set.

[0154] Through the process shown in the above steps 401 to 403, the following can be obtained: Fig.10 The sample transfer data set shown in FIG. 1 contains N pieces of sample transfer data corresponding to the historical operation data set produced every day by each object to be processed in the past six months. Each piece of N sample transfer data is a training sample for a single input model.

[0155] During the specific implementation, the following operations are performed for each object to be processed:

[0156] Take the N sample transfer data corresponding to the historical operation data set generated by an object to be processed in one day as a training sample; and add the corresponding sample label to the training sample, and the sample label can be represented by 1 and 0. Among them, 1 represents an abnormal object and 0 represents a non-abnormal object. The sample label specifically refers to whether the sample transfer data in the training sample represents that the object to be processed is an abnormal object suspected of risky transactions. That is, the N sample transfer data contained in a training sample come from the same object to be processed, and these N sample transfer data share the same sample label.

[0157] Finally, by forming a set of training samples obtained from each object to be processed, a sample transfer data set for training the detection model is obtained.

[0158] In addition, it should be noted that the extraction of time intervals in the embodiments of the present application can effectively solve the problem of time migration. As mentioned above, a major problem with traditional risk control rules is that even if the risk control rules initially set are relatively perfect, their perfection will gradually decrease with the passage of time. What is mainly referred to here is that with the change of time, the distribution state of data generated in the resource transaction scenario will gradually increase, which is likely to generate some data that is not hit by the risk control rules but still has transaction risks. By introducing the concept of the aforementioned time interval in the sample transfer data set, the model can learn the distribution state of the data from the time dimension. Under the condition of sample support with sufficient data volume, it can effectively weaken or even avoid the accuracy problems caused by time migration.

[0159] Next, the model structure of the detection network to be trained in the embodiment of the present application is introduced, as shown in the following figure: Fig.11 As shown, Fig.11 The network structure of the detection network to be trained in the present application is shown, and the network structure of the detection network mainly includes three parts: a feature extraction layer 101, an intermediate layer 102 and a fully connected layer 103.

[0160] The feature extraction layer 101 is used to extract the corresponding feature vector from the input content. In the embodiment of the present application, Word2vec is used as the feature extraction layer 101. Word2vec only includes a layer of neural network structure, which can quickly and accurately map the specified content in the text into a multi-dimensional dense feature vector that can be understood by the computer.

[0161] The middle layer 102, in the embodiment of the present application, adopts the middle layer structure of the reserve pool computing network to construct the middle layer 102. The purpose of this design is mainly the following two points:

[0162] First, as mentioned above Figure 1 As shown in the figure, the intermediate layer structure of the reserve pool computing network is used to perform feature fusion on the feature vector extracted by the model, and the model parameters in the intermediate layer structure can be randomly set and do not need to be adjusted during the training process. Therefore, the intermediate layer structure of the reserve pool computing network is used to set the intermediate layer 102 of the detection network of the present application, which can reduce the difficulty of training and save training time.

[0163] Second, the middle layer structure of the reserve pool computing network is used for feature fusion. The specific fusion process will add and fuse the feature vector of each input with all the feature vectors that have been input to obtain the fusion feature corresponding to the feature vector of this input. The traditional feature fusion method is to add and fuse all the feature vectors into a multi-dimensional fusion feature. In the resource trading scenario, this feature fusion method of the reserve pool computing network can extract richer fusion features and is more suitable for the technical solution of this application.

[0164] The fully connected layer 103 is used to perform feature recognition on the fused features. In the embodiment of the present application, the fully connected layer 103 is constructed using a traditional feedforward neural network structure. Thus, by sequentially combining the feature extraction layer 101, the intermediate layer 102 and the fully connected layer 103, the aforementioned Fig.11 The network structure of the detection network is shown in FIG.

[0165] The sample transfer dataset is used to carry out the cyclic iterative training phase for the detection model to be trained. In each round of iteration, the detection loss value obtained by the model in this round is compared with the preset loss threshold. The iteration is stopped when the detection loss value of any round is less than the preset loss threshold, and the detection model obtained after stopping the iteration is used as the trained target detection network.

[0166] As mentioned above, a training sample contains N sample transfer data. These N transfer data all come from the same object to be processed, and these N sample transfer data share the same sample label. Next, we will take a training sample as an example to explain each round of the model iteration process in detail:

[0167] When implemented, a training sample is input into the feature extraction layer of the detection model, such as Fig.12As shown, the feature extraction layer of the detection model maps each sample transfer data in the training sample from the text in the natural language to a dense feature vector of n×n dimensions (i.e., sample behavior feature). Thus, N sample behavior features corresponding to N sample transfer data can be obtained through the feature extraction layer.

[0168] Next, the feature extraction layer will input these N sample behavior features into the middle layer of the detection model in turn, and obtain N sample fusion features output by the middle layer; among them, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain the corresponding sample fusion feature.

[0169] The feature fusion process of the above intermediate layer can be expressed by the following formula (1):

[0170] x(t(i))=f(Win *u(t(i))+Wx(t(i-1))) (1)

[0171] Among them, u(t(i)) is the sample behavior feature of the i-th input intermediate layer; x(t(i)) is the sample fusion feature output by the i-th intermediate layer. W is the connection weight of the intermediate layer; Win is the input layer connection weight; f() is the activation function tanh. x(t(i-1)) is the sample feature set, which is determined based on the sample behavior features accumulated into the intermediate layer. Specifically, it can be set to the sample behavior features of the 1st to i-1th input intermediate layer, or it can be set to the sample fusion features output by the intermediate layer from the 1st to i-1th.

[0172] The essence of feature fusion is to extract high-order features that can more intuitively support the detection results from the surface (low-order) features. From the above formula (1), it can be seen that the output of the middle layer is not the cumulative fusion of the N sample behavior features as a whole, but the cumulative processing of the sample behavior features input each time and the sample feature set to obtain the corresponding sample fusion features. That is, the above middle layer will output the corresponding N sample fusion features for the N sample behavior features input. And the number and content of sample behavior features contained in each sample fusion feature are different. In this way, richer high-order features can be extracted, thereby improving the detection accuracy of the model.

[0173] Take the sample feature set including the sample behavior features of the accumulated input intermediate layer as an example to illustrate. Fig.13 The feature fusion process of the intermediate layer is shown as an example. Fig.13As shown, when the sample behavior feature 1 input for the first time enters the middle layer, since there are no other input sample behavior features before the sample behavior feature 1, the middle layer will store the sample behavior feature 1 in the sample behavior feature set, and adjust the sample behavior feature 1 based on the preset weight of the middle layer to obtain the sample fusion feature 1.

[0174] Below Fig.14 As shown in the figure, when the second sample behavior feature 2 is input, since sample behavior feature 1 has been input before sample behavior feature 2, the sample behavior feature set at this time includes sample behavior feature 1. Taking the above formula (1) as an example, the sample behavior feature 2 input this time is equivalent to u(t(i)) in formula (1). The sample behavior feature 1 currently accumulated and input into the middle layer is the sample feature set, that is, x(t(i-1)) in formula (1). At this time, sample behavior feature 2 and sample behavior feature 1 are substituted into the above formula (1) for cumulative fusion to obtain sample fusion feature 2.

[0175] Next, for subsequent sample behavior features 3 to N, the same method can be used to obtain sample fusion feature 3 obtained by cumulatively fusing sample behavior feature 3 with the accumulated input sample behavior features 1 to 2, sample fusion feature 4 obtained by cumulatively fusing sample behavior feature 4 with the accumulated input sample behavior features 1 to 3, and ... sample fusion feature N obtained by cumulatively fusing sample behavior feature N with the accumulated input sample behavior features 1 to N-1.

[0176] Through the above process, the middle layer obtains the corresponding N sample fusion features for the input N sample behavior features.

[0177] In some possible embodiments, specifically, Fig.15 As shown, in order to improve the detection accuracy of the model, the embodiment of the present application introduces a conceptualizer structure in the middle layer, and the conceptualizer is used to describe and correct the state matrix using the covariance matrix. The eigenvectors and eigenvalues ​​of the covariance matrix correspond to the main direction of data change and the amount of change in this direction. For a set of appropriate data, the overall pattern of the data can be well represented. Based on the covariance matrix R, matrix scaling can be further performed to obtain a state matrix C with the same eigenvector.

[0178] Specifically, each sample fusion feature output by the middle layer is essentially a multi-dimensional feature matrix. The concept detector can be used to correct the feature output of the middle layer. When implemented, the following operations are performed for the N sample fusion features obtained above:

[0179] First, a sample fusion feature is transposed to obtain the transposed matrix of the sample fusion feature;

[0180] Then, the sample fusion feature is matrix-transformed based on the transposed matrix to obtain the state matrix of the sample fusion feature. During implementation, the product of the sample fusion feature and the transposed matrix is ​​averaged to obtain the covariance matrix of the sample fusion feature; and the covariance matrix is ​​matrix-transformed according to the preset spectral radius and the preset diagonal matrix to obtain the corresponding state matrix.

[0181] Finally, the state matrix is ​​used as the sample fusion feature after feature correction. The above processing flow can be specifically shown in the following formula (2):

[0182]

[0183] Among them, function E represents the calculation of averaging; i is the serial number of the sample fusion feature; x(t) is a sample fusion feature, x(t) T is the transposed result of the sample fusion feature x(t), R i is the covariance matrix of sample fusion feature x(t); is the preset spectrum radius, I is the i A preset diagonal matrix of uniform size, and I are fixed values, C i is the covariance matrix R i The transformed state matrix is ​​the sample fusion feature after feature correction.

[0184] Next, as mentioned above Fig.14 As shown in the figure, the N sample fusion features after feature correction are input into the fully connected layer. During implementation, the fully connected layer will perform feature recognition on the N sample fusion features based on the current model parameters to obtain an abnormality detection result of whether the object to be processed corresponding to the N sample fusion features is an abnormal object. Then, the loss of the abnormality detection result and the sample label corresponding to the N sample fusion features is calculated to obtain the corresponding detection loss value.

[0185] If the obtained detection loss value is greater than the preset detection loss threshold, the model parameters of the fully connected layer are adjusted according to the detection loss value. If the detection loss value is not greater than the detection loss threshold, it indicates that the detection model has converged. At this time, the iterative training of the model can be stopped and the detection model can be used as the trained target detection model.

[0186] Next, the specific process of how to use the above target detection model to detect anomalies of the target object is described. Fig.16 As shown, the following steps are included:

[0187] Step 161: In response to the abnormality detection indication, obtaining resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period;

[0188] The first historical period is the 24 hours of the target object on that day, and the resource transfer data of the target object is determined based on the resource transfer behavior generated by the target object within the 24 hours of that day.

[0189] The meaning of the resource transfer data representation here is the same as the meaning of the sample transfer data of the object to be processed mentioned above. The specific acquisition process can refer to the aforementioned sample transfer data acquisition process, which will not be repeated here.

[0190] In specific implementation, all resource transfer data generated by the target object within 24 hours of the day can be obtained and input into the trained target detection model for anomaly detection.

[0191] Step 162: using the trained target detection model to extract the transfer behavior features of the resource transfer data; based on the transfer behavior features, obtaining anomaly detection results of the target object;

[0192] The target detection model will extract the transfer behavior features corresponding to each resource transfer data through the aforementioned feature extraction layer. That is, inputting N resource transfer data can obtain the corresponding N transfer behavior features. Then the N transfer behavior features are input into the aforementioned intermediate layer to obtain the corresponding N fusion features, and the N fusion features are corrected through the aforementioned concept device.

[0193] Finally, the N fused features after feature correction are input into the aforementioned fully connected layer for feature recognition to obtain an anomaly detection result of whether the target object is an abnormal object.

[0194] From the above content, it can be seen that using the target detection model provided in the embodiment of the present application to perform anomaly detection on the target object can not only have a higher detection accuracy, but also avoid a series of problems existing in the aforementioned traditional detection method that relies on risk control rules.

[0195] Based on the same inventive concept, the present application embodiment also provides an abnormality detection device 170, specifically, Fig.17 As shown, including:

[0196] The data acquisition unit 171 is configured to execute: in response to the abnormality detection indication, acquire resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period;

[0197] The feature extraction unit 172 is configured to perform: extracting transfer behavior features of resource transfer data using a trained target detection model;

[0198] The anomaly detection unit 173 is configured to perform: obtaining an anomaly detection result of the target object based on the transfer behavior feature;

[0199] The target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration, the following operations are performed:

[0200] Input N sample behavior features extracted based on N sample transfer data into the middle layer of the detection model in sequence to obtain N sample fusion features output by the middle layer; wherein, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain the corresponding sample fusion feature; the sample feature set is determined based on the sample behavior features accumulated and input into the middle layer;

[0201] The N sample fusion features are input into the fully connected layer of the detection model to obtain the sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

[0202] In some possible embodiments, the abnormality detection device further includes:

[0203] The model training unit 174 is configured to execute: constructing a sample transfer data set in the following manner:

[0204] Obtaining a historical operation data set generated by each object to be processed within a second historical period;

[0205] For each object to be processed, the following operations are performed respectively: extract M pieces of original resource transfer data from a historical operation data set associated with the object to be processed; wherein each piece of original resource transfer data is extracted from a specified field contained in a corresponding piece of historical operation data, and the specified field represents the familiarity between the object to be processed and the resource interaction party, and the time interval between the generation of one piece of historical operation data and the generation of the previous piece of historical operation data by the object to be processed;

[0206] Perform data cleaning on M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed;

[0207] A set of N sample transfer data corresponding to each object to be processed is taken as a sample transfer data set.

[0208] In some possible embodiments, data cleaning is performed on M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed, and the model training unit 174 is configured as follows:

[0209] If M<N, then NM blank resource transfer data are generated; after the M original resource transfer data and the NM virtual resource transfer data are merged, they are used as N sample transfer data corresponding to the object to be processed; wherein each blank resource transfer data has the same data structure as the original resource transfer data;

[0210] If M=N, then the M pieces of original resource transfer data are directly used as the N pieces of sample transfer data corresponding to the object to be processed;

[0211] If M>N, then MN pieces of original resource transfer data are deleted from the M pieces of original resource transfer data, and the remaining N pieces of original resource transfer data are used as N pieces of sample transfer data corresponding to the object to be processed.

[0212] In some possible embodiments, the sample fusion feature is a multi-dimensional feature matrix, and before the N sample fusion features are input into the fully connected layer of the detection model, the model training unit 174 is further configured as follows:

[0213] For N sample fusion features, the following operations are performed respectively:

[0214] Transpose a sample fusion feature to obtain a transposed matrix of the sample fusion feature;

[0215] Performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature;

[0216] The state matrix is ​​used as a sample fusion feature after feature correction.

[0217] In some possible embodiments, matrix transformation is performed on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature, and the model training unit 174 is configured as follows:

[0218] The product of the sample fusion feature and the transposed matrix is ​​averaged to obtain the covariance matrix of the sample fusion feature;

[0219] The covariance matrix is ​​transformed according to a preset spectrum radius and a preset diagonal matrix to obtain a state matrix.

[0220] In some possible embodiments, before executing the N sample behavior features extracted based on the N sample transfer data, the model training unit 174 is further configured to:

[0221] Determine that the sample labels corresponding to the N pieces of sample transfer data are all the same, and that the objects to be processed associated with the N pieces of sample transfer data are all the same;

[0222] Among them, the sample label represents whether there is a resource transfer risk for the object to be processed in the corresponding sample transfer data.

[0223] In some possible embodiments, the sample feature set includes each sample behavior feature that has been accumulated and input into the intermediate layer.

[0224] In some possible embodiments, the sample feature set includes each sample fusion feature that has been accumulated and output by the intermediate layer.

[0225] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device can be a single server, a distributed cluster including multiple servers, or a terminal device. In this embodiment, the structure of the electronic device can be as follows: Fig.18 As shown, it includes a memory 181 , a communication module 183 and one or more processors 182 .

[0226] The memory 181 is used to store computer programs executed by the processor 182. The memory 181 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and an operating instruction set.

[0227] The memory 181 may be a volatile memory, such as a random-access memory (RAM); the memory 181 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 181 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 181 may be a combination of the above memories.

[0228] The processor 182 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 182 is used to implement the above rendering abnormality detection method when calling the computer program stored in the memory 181 .

[0229] The communication module 183 is used to communicate with terminal devices and other servers.

[0230] The specific connection medium between the memory 181, the communication module 183 and the processor 182 is not limited in the embodiment of the present application. Fig.18 The memory 181 and the processor 182 are connected via a bus 184. Fig.18 The connections between the other components are only for illustration and are not intended to be limiting. The bus 184 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.18The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0231] The memory 181 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the rendering anomaly detection method of the embodiment of the present application. The processor 182 is used to execute the steps of the above rendering anomaly detection method.

[0232] In some possible implementations, various aspects of the data classification method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the rendering anomaly detection method according to various exemplary implementations of the present application described above in this specification.

[0233] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0234] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0235] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0236] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0237] The computer program for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program may be executed entirely on the user computing device, partially on the user computing device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network or a wide area network, or may be connected to an external computing device.

[0238] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0239] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

Claims

1. An anomaly detection method, characterized in that: The method comprises: In response to the abnormality detection indication, obtaining resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period; Using a trained target detection model, extracting transfer behavior features of the resource transfer data; Based on the transfer behavior characteristics, obtaining an abnormality detection result of the target object; The target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration, the following operations are performed: Inputting N sample behavior features extracted based on N sample transfer data into the middle layer of the detection model in sequence to obtain N sample fusion features output by the middle layer; wherein, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain a corresponding sample fusion feature; the sample feature set is determined based on the sample behavior features accumulated and input into the middle layer; The N sample fusion features are input into the fully connected layer of the detection model to obtain sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

2. The method according to claim 1, characterized in that The sample transfer dataset is constructed in the following way: Obtaining a historical operation data set generated by each object to be processed within a second historical period; For each object to be processed, the following operations are performed respectively: extracting M pieces of original resource transfer data from a historical operation data set associated with the object to be processed; wherein each piece of original resource transfer data is extracted from a specified field contained in a corresponding piece of historical operation data, and the specified field represents the familiarity between the object to be processed and the resource interaction party; Performing data cleaning processing on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed; A set consisting of N pieces of sample transfer data corresponding to each object to be processed is taken as the sample transfer data set.

3. The method according to claim 2, characterized in that The performing data cleaning on the M pieces of original resource transfer data to obtain N pieces of sample transfer data corresponding to the object to be processed includes: If M<N, then NM blank resource transfer data are generated; after the M original resource transfer data and the NM virtual resource transfer data are merged, they are used as N sample transfer data corresponding to the object to be processed; wherein each blank resource transfer data has the same data structure as the original resource transfer data; If M=N, the M pieces of original resource transfer data are directly used as the N pieces of sample transfer data corresponding to the object to be processed; If M>N, then MN pieces of original resource transfer data are deleted from the M pieces of original resource transfer data, and the remaining N pieces of original resource transfer data are used as N pieces of sample transfer data corresponding to the object to be processed.

4. The method according to claim 1, 2 or 3, characterized in that: The sample fusion feature is a multi-dimensional feature matrix, and before inputting the N sample fusion features into the fully connected layer of the detection model, the method further includes: For the N sample fusion features, the following operations are performed respectively: Transposing a sample fusion feature to obtain a transposed matrix of the sample fusion feature; Performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature; The state matrix is ​​used as a sample fusion feature after feature correction.

5. The method according to claim 4, characterized in that The performing matrix transformation on the sample fusion feature based on the transposed matrix to obtain a state matrix of the sample fusion feature includes: Performing mean processing on the product of the sample fusion feature and the transposed matrix to obtain a covariance matrix of the sample fusion feature; The covariance matrix is ​​transformed according to a preset spectrum radius and a preset diagonal matrix to obtain the state matrix.

6. The method according to claim 2 or 3, characterized in that: Before extracting N sample behavior features based on the N pieces of sample transfer data, the method further includes: Determine that the sample labels corresponding to the N pieces of sample transfer data are all the same, and that the objects to be processed associated with the N pieces of sample transfer data are all the same; The sample label indicates whether there is a risk of resource transfer for the object to be processed in the corresponding sample transfer data.

7. The method according to claim 1, 2 or 3, characterized in that: The sample feature set includes each sample behavior feature that has been accumulated and input into the intermediate layer.

8. The method according to claim 1, 2 or 3, characterized in that: The sample feature set includes each sample fusion feature that has been accumulated and output by the intermediate layer.

9. An abnormality detection device, characterized in that: The device comprises: The data acquisition unit is configured to execute: in response to the abnormality detection indication, acquire resource transfer data of the target object; wherein the resource transfer data is determined according to the resource transfer behavior generated by the target object in the first historical period; The feature extraction unit is configured to perform: using a trained target detection model to extract transfer behavior features of the resource transfer data; An anomaly detection unit is configured to perform: obtaining an anomaly detection result of the target object based on the transfer behavior feature; The target detection model is obtained by using the sample transfer data set to perform cyclic iterative training on the detection model to be trained. In each round of iteration, the following operations are performed: Inputting N sample behavior features extracted based on N sample transfer data into the middle layer of the detection model in sequence to obtain N sample fusion features output by the middle layer; wherein, each time a sample behavior feature is input, the sample behavior feature is accumulated with the sample feature set through the middle layer to obtain a corresponding sample fusion feature; the sample feature set is determined based on the sample behavior features accumulated and input into the middle layer; The N sample fusion features are input into the fully connected layer of the detection model to obtain sample detection results, and the fully connected layer is adjusted based on the sample detection results and the corresponding sample labels.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1-8.

11. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on an electronic device, the computer program is used to make the electronic device execute the steps of any one of the methods of claims 1-8.

Images