Team user identification method and device, electronic equipment, medium and program product

Abstract

The invention provides a team user identification method and device, electronic equipment, a medium and a program product, which can be used in the field of data processing. The method comprises the following steps: acquiring first behavior data and first portrait data of a plurality of first users; converting the first behavior data of the first user into first risk image data corresponding to the first user; determining a first user feature vector of the first user according to first risk image data corresponding to the first user and the first portrait data; and clustering the first user feature vectors corresponding to the first users to obtain a clustering group, and determining the first users corresponding to the first user feature vectors in the clustering group as the users belonging to the same risk team. According to the application, the determination accuracy of the team users is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a team user identification method, device, electronic device, medium and program product. Background Art

[0002] Team arbitrage hinders the development of Internet marketing, preventing businesses from obtaining expected profit results, and causing them to suffer many losses including financial and reputational losses. How to accurately identify members of arbitrage teams is an issue that needs to be addressed urgently.

[0003] In the exemplary technology, the behavioral trajectories of users within a team converge, which means that the behaviors of each user belonging to the same team are highly similar, so the similarity between the behavioral data of each user can be used to determine the users belonging to the same team.

[0004] However, the above method only uses the similarity between behavioral data to determine team users, ignoring information other than behavioral data, which will result in low accuracy in determining team users. Summary of the invention

[0005] The present application provides a team user identification method, device, electronic device, medium and program product, which solves the problem of low accuracy in determining team users.

[0006] In a first aspect, the present application provides a team user identification method, comprising:

[0007] Acquire first behavior data and first portrait data of multiple first users;

[0008] converting the first behavior data of the first user into first risk image data corresponding to the first user;

[0009] determining a first user feature vector of the first user according to the first risk image data corresponding to the first user and the first portrait data;

[0010] The first user feature vectors corresponding to the first users are clustered to obtain cluster groups, and the first users corresponding to the first user feature vectors in the cluster groups are determined as users belonging to the same risk team.

[0011] In some embodiments, converting the first behavior data of the first user into first risk image data corresponding to the first user includes:

[0012] Obtaining each first behavior event and the corresponding occurrence time in the first behavior data of the first user;

[0013] Determine a first pixel point of the first behavior event in the initial two-dimensional image according to the first behavior event and the corresponding occurrence time;

[0014] Assigning pixel values ​​to first pixel points corresponding to each first behavior event in the initial two-dimensional image according to encoding parameters corresponding to each first behavior event to obtain an intermediate two-dimensional image;

[0015] First risk image data corresponding to the first user is determined according to the intermediate two-dimensional image.

[0016] In some embodiments, determining first risk image data corresponding to the first user according to the intermediate two-dimensional image includes:

[0017] Determining a risk type corresponding to each of the first behavioral events;

[0018] According to the risk type of each of the first behavior events, a numerical value is assigned to the first pixel point of each of the first behavior events in the intermediate two-dimensional image to obtain a dual-channel image as the first risk image data corresponding to the first user.

[0019] In some embodiments, determining the risk type corresponding to each of the first behavior events includes:

[0020] Determine the event type of the first behavior event according to the event identifier of the first behavior event, and obtain event data associated with the first behavior event;

[0021] Acquire event features according to the event data, and determine the similarity between the event features and the risk features associated with the event type;

[0022] A risk type of the first behavior event is determined according to the similarity.

[0023] In some embodiments, determining a first user feature vector of the first user according to the first risk image data and the first portrait data corresponding to the first user includes:

[0024] The first risk image data and the first portrait data corresponding to the first user are input into a user feature extraction model to obtain a first user feature vector corresponding to the first user output by the user feature extraction model.

[0025] In some embodiments, before inputting the first risk image data and the first portrait data corresponding to the first user into the user feature extraction model, the method further includes:

[0026] Acquire a plurality of training samples, where the training samples are constructed from the second risk image data and the second portrait data of the second user;

[0027] The first preset model and the second preset model are jointly trained according to each of the training samples to obtain the user feature extraction model, wherein the first preset model is used to process the second risk image data, and the second preset model is used to process the second portrait data.

[0028] In some embodiments, obtaining a plurality of training samples includes:

[0029] Acquire second behavior data and second portrait data of multiple second users;

[0030] converting the second behavior data of the second user into second risk image data corresponding to the second user;

[0031] A training sample corresponding to the second user is constructed based on the second risk image data corresponding to the second user and the second portrait data.

[0032] In some embodiments, converting the second behavior data of the second user into second risk image data corresponding to the second user includes:

[0033] Obtain each second behavior event and the corresponding occurrence time in the second behavior data of the second user;

[0034] Determine a second pixel point of the second behavior event in the original two-dimensional image according to the second behavior event and the corresponding occurrence time;

[0035] Assigning pixel values ​​to second pixel points corresponding to each second behavior event in the initial two-dimensional image according to encoding parameters corresponding to each second behavior event to obtain a target two-dimensional image;

[0036] Second risk image data corresponding to the second user is determined according to the target two-dimensional image.

[0037] In some embodiments, determining the second risk image data corresponding to the second user according to the target two-dimensional image includes:

[0038] Determining a risk type corresponding to each of the second behavior events;

[0039] According to the risk type of each second behavior event, a numerical value is assigned to the second pixel point of each second behavior event in the target two-dimensional image to obtain a dual-channel image as the second risk image data corresponding to the second user.

[0040] In some embodiments, the jointly training the first preset model and the second preset model according to each of the training samples includes:

[0041] Inputting the training sample into a joint model, wherein the joint model is constructed based on the first preset model and the second preset model;

[0042] Obtain a second user feature vector output by the joint model and a first team to which the second user corresponding to the training sample belongs;

[0043] The parameters of the joint model are updated according to the label in the training sample and the first team, wherein the label is used to indicate the second team to which the second user belongs.

[0044] In some embodiments, determining the first users corresponding to the first user feature vectors in the cluster group as users belonging to the same risk team includes:

[0045] Obtaining a target number of the first user feature vectors in the cluster group;

[0046] In response to the target number being greater than a preset number, the first users corresponding to the first user feature vectors in the clustering group are determined to be users belonging to the same risk team.

[0047] In some embodiments, determining a first user feature vector of the first user according to the first risk image data and the first portrait data corresponding to the first user includes:

[0048] Determine, according to the first risk image data corresponding to the first user and the first portrait data, a first user feature vector of the first user and an identifier of a risk team to which the first user belongs;

[0049] After determining the first users corresponding to the first user feature vectors in the cluster group as users belonging to the same risk team, the method further includes:

[0050] Determining a processing strategy corresponding to the cluster group according to a risk team identifier of the first user corresponding to the first user feature vector in the cluster group;

[0051] The processing strategy is performed on the account associated with the first user corresponding to each of the first user feature vectors in the cluster group.

[0052] In some embodiments, obtaining the first behavior data of the plurality of first users includes:

[0053] Acquire each first behavior event of a plurality of first users in a set historical time period and the occurrence time of each first behavior event;

[0054] The first behavior data corresponding to the first user is determined according to each of the first behavior events and the corresponding occurrence time.

[0055] In a second aspect, the present application provides a team user identification device, comprising:

[0056] An acquisition module, used to acquire first behavior data and first portrait data of a plurality of first users;

[0057] A conversion module, configured to convert the first behavior data of the first user into first risk image data corresponding to the first user;

[0058] a determination module, configured to determine a first user feature vector of the first user according to the first risk image data corresponding to the first user and the first portrait data;

[0059] The clustering module is used to cluster the first user feature vectors corresponding to the first users to obtain cluster groups, and determine the first users corresponding to the first user feature vectors in the cluster groups as users belonging to the same risk team.

[0060] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory and a communication interface communicatively connected to the processor;

[0061] The communication interface is used to communicate with other communication devices;

[0062] The memory is used to store computer-executable instructions;

[0063] The processor is used to execute the computer-executable instructions stored in the memory to implement the team user identification method provided in the first aspect.

[0064] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the team user identification method provided in the first aspect is implemented.

[0065] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the team user identification method provided in the first aspect.

[0066] The team user identification method, device, electronic device, medium and program product provided in the present application convert the user's behavior data into risk image data, and obtain the user's user feature vector based on the user's risk image data and the user's portrait data, and then cluster each user feature vector, so as to determine the users belonging to the same risk team based on the each user feature vector in the clustering group obtained by clustering, that is, through the combination of the user's portrait data and the user's behavior data, the team to which the user belongs is accurately determined, thereby improving the accuracy of determining team users. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0068] Figure 1 A schematic diagram of the scenarios involved in the user identification method of the application team;

[0069] Figure 2 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 1 ;

[0070] Figure 3 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 2 ;

[0071] Figure 4 A schematic diagram of the construction process of a dual-channel image according to an embodiment of the present application;

[0072] Figure 5 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 3 ;

[0073] Figure 6 A schematic diagram of the workflow of the user feature extraction model involved in the embodiment of the present application;

[0074] Figure 7 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 4 ;

[0075] Figure 8 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 5 ;

[0076] Fig. 9 The following is a schematic diagram of the steps of the team user identification method in the embodiment of the present application: Figure 6 ;

[0077] Fig.10 A schematic diagram of a program module of a team user identification device provided in an embodiment of the present application;

[0078] Fig.11 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0079] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0080] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. In addition, although the disclosure in the present application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete implementation method separately.

[0081] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0082] In addition, the terms "include" and "have" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to those components expressly listed but may include other components not expressly listed or inherent to such products or devices.

[0083] The term "module" used in the embodiments of the present application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform the functions associated with the element.

[0084] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0085] Team arbitrage hinders the development of Internet marketing, preventing businesses from obtaining expected profit results, and causing them to suffer many losses including financial and reputational losses. How to accurately identify members of arbitrage teams is an issue that needs to be addressed urgently.

[0086] In the exemplary technology, the behavioral trajectories of users within a team converge, which means that the behaviors of each user belonging to the same team are highly similar, so the similarity between the behavioral data of each user can be used to determine the users belonging to the same team.

[0087] The inventors of the present application have discovered that, using behavioral data as one-dimensional data to extract behavioral features makes it impossible to fully mine behavioral information. In addition, only using the similarity of behavioral data while ignoring information other than the behavioral sequence will result in low accuracy in determining team users.

[0088] The inventor of the present application therefore conceived of converting the user's behavior data into risk image data, and obtaining the user's user feature vector based on the user's risk image data and the user's portrait data, and then clustering each user feature vector, thereby determining users belonging to the same risk team based on each user feature vector in the clustering group obtained by clustering. That is, through the combination of the user's portrait data and the user's behavior data, the team to which the user belongs can be accurately determined, thereby improving the accuracy of determining team users.

[0089] Reference Figure 1 , Figure 1 The schematic diagram of the scenario of the team user identification method of the present application. The team user identification device 100 obtains the behavior data and portrait data of multiple users, and the behavior data and portrait data can be obtained from the database 200. The team user identification device 100 converts the behavior data into risk image data, and determines the user feature vector corresponding to the user based on the risk image data and portrait data of the user. The team user identification device 100 clusters each user feature vector to obtain a clustering group. The users corresponding to each user feature vector in the clustering group are confirmed to be users of the same risk team. The team user identification device 100 outputs prompt information, which is the information of each user belonging to the same risk team. The user information is, for example, identification information such as the user's account number.

[0090] Combination Figure 1 , in order to explain the technical solution shown in the present application in detail through embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be repeatedly described in different embodiments.

[0091] Reference Figure 2 , Figure 2 The process diagram of the team user identification method provided in the embodiment of the present application is as follows: Figure 1 , team user identification methods include:

[0092] Step S201, obtaining first behavior data and first portrait data of multiple first users.

[0093] In this embodiment, the execution subject is a team user identification device. For the sake of convenience, the device is used to refer to the team user identification device. The device can be a server or a terminal device with a team user identification function. A team user refers to a user belonging to a risk team, and a risk team refers to a team formed by multiple organized users performing organized arbitrage activities.

[0094] The device obtains data of multiple users, the user is defined as a first user, and the data of the first user includes first behavior data and first portrait data of the first user. In one example, the first behavior data includes multiple behavior events of the first user and the time of occurrence of the behavior events. The behavior event is, for example, the first user receiving a coupon, and the coupon is, for example, the first user receiving a discount coupon, an instant discount coupon, etc. The behavior event can also be an event in which the first user purchases a product based on the received coupon, and the behavior event can also be an event in which the first user purchases a product using other preferential methods.

[0095] In another example, the device obtains each first behavior event of multiple users in a set historical time period and the occurrence time of each first behavior event. The set historical time period may be a recent time period, for example, the last week, the last day, or the last month, and the end time point of the recent time period may be today's midnight as the end time point. The device determines the first behavior data corresponding to the first user based on the first behavior event and the corresponding occurrence time.

[0096] In addition, the first behavior data may also include behavior events, occurrence events, event types, and whether there is an arbitrage risk mark, etc. Event types include login, coupon collection, and QR code transactions. Occurrence events can be accurate to small things, such as 20241001-8. In addition, if a more specific description of user behavior is required, the event type can be further divided. For example, the coupon collection event can reflect the activity ID, and the coupon collection event is extended from "coupon collection" to "coupon collection-activity ID".

[0097] The first portrait data includes the basic attributes of the first user, user behavior tags, and risk characteristics. Basic attributes include the account registration time, registration source, and usual location; user behavior tags include the account's active time, account cumulative payments, cumulative browsing times, payment preferences, etc.; risk characteristics include whether the first user's account is a blacklisted account, recent disposal type, device risk characteristics, geographic location tampering, etc. Recent disposal type refers to whether the account has been warned or banned recently, etc., and device risk characteristics refer to whether the device where the first user's account is located has risks.

[0098] Step S202: converting the first behavior data of the first user into first risk image data corresponding to the first user.

[0099] After obtaining the first behavior data, the device converts the first behavior data into risk image data corresponding to the first user, and the risk image data is defined as the first risk image data. Exemplarily, the first behavior data includes the first behavior event and the occurrence time, and the first behavior event and the occurrence time are converted into pixels based on the mapping relationship, that is, each first behavior event has multiple pixels, and each pixel is constructed as a risk image. For example, the row number of the date where the occurrence time of the first behavior event is located, and the occurrence sequence number of the occurrence time on this date is the column number. For example, the first user generates 7 first behavior events on date A, and date A corresponds to row number 1. The 7 first behavior events have sequence numbers, and each sequence number is obtained by sorting the occurrence time. For example, the occurrence time of the first behavior event a is the earliest among the first behavior events in the 7, then the sequence number of the first behavior event a is 1, and thus the column number of the first behavior event a is column number 1. In addition, the specific parameters in the first behavior event are characterized as pixel points corresponding to the first behavior event. In this way, the first behavior data can be converted into an image, and the image is used as the first risk image data.

[0100] Step S203: determining a first user feature vector of the first user according to the first risk image data and the first portrait data corresponding to the first user.

[0101] After obtaining the first risk image data, the device constructs a first user feature vector of the first user based on the first risk image data and the first portrait data. Exemplarily, the device constructs a first feature vector corresponding to the first risk image data, and constructs the first portrait data into a second feature vector, and then concatenates the first feature vector and the second feature vector to obtain a user feature vector, which is defined as the first user feature vector.

[0102] Step S204: clustering the first user feature vectors corresponding to the first users to obtain cluster groups, and determining the first users corresponding to the first user feature vectors in the cluster groups as users belonging to the same risk team.

[0103] The device obtains the first user feature vectors of each first user and clusters each first user feature vector. Exemplarily, the similarity between each two first user feature vectors is calculated, and two first user feature vectors with a similarity greater than a preset similarity are grouped as a group. In this way, each first user feature is clustered to obtain a cluster group, and the similarity between any two first user feature vectors in the cluster group is greater than the preset similarity.

[0104] In one example, after the clustering groups are obtained, the first users corresponding to the first user feature vectors in the clustering groups may be determined as users belonging to the same risk team.

[0105] In another example, a quantity threshold K is set in the device, and the quantity threshold K is a preset number. The device obtains a target number of first user feature vectors in the cluster group. When the target data is greater than the preset number, the first users corresponding to each first user feature vector in the cluster group are determined as users belonging to the same risk team. In addition, if there are multiple cluster groups, cluster groups corresponding to the target number less than or equal to the preset number are eliminated.

[0106] The device may output prompt information, where the prompt information is used to prompt that the first users of each first user feature vector in the cluster group are users of the same risk team.

[0107] In this embodiment, the user's behavior data is converted into risk image data, and the user's user feature vector is obtained based on the user's risk image data and the user's portrait data, and then each user feature vector is clustered, so as to determine the users belonging to the same risk team based on each user feature vector in the clustering group obtained by clustering. That is, through the combination of the user's portrait data and the user's behavior data, the team to which the user belongs is accurately determined, thereby improving the accuracy of determining team users.

[0108] Reference Figure 3 , Figure 3 This is a schematic diagram of the process of user identification method for this application team Figure 2 ,based on Figure 2 In the illustrated embodiment, step S202 includes:

[0109] Step S301, obtaining each first behavior event and the corresponding occurrence time in the first behavior data of the first user.

[0110] Step S302: determining a first pixel point of the first behavior event in the initial two-dimensional image according to the first behavior event and the corresponding occurrence time.

[0111] In this embodiment, the device obtains each first behavior event and the occurrence time corresponding to each first behavior event from the first behavior data, and thereby determines the first pixel point of the first behavior event in the initial two-dimensional image based on the first behavior event and the occurrence time.

[0112] Exemplarily, the initial two-dimensional image is a blank two-dimensional image, and there are multiple pixels in the initial two-dimensional image. The first behavior event has a corresponding pixel in the initial two-dimensional image, and the pixel is defined as the first pixel. The first behavior data includes each first behavior event of the first user within a week and the time of occurrence. Each first behavior event is sorted according to the time of occurrence. The sorting table is shown in Table-1:

[0113] Table-1

[0114]

[0115] Referring to the above table, five first behavior events occurred in the date 20240925 in the order of occurrence time from early to late, which are A, B, c, d and E, and A, B, c, d and E are characterized as event types of first behavior events. Date 20240925 corresponds to the first row in the initial two-dimensional image, and the first behavior event A in date 20240925 is the earliest time of occurrence in the date, that is, the sequence number of the behavior event is 1, and sequence number 1 corresponds to the first column, so the first behavior event A in 20240925 is the pixel point of the first row and the first column in the initial two-dimensional image.

[0116] By means of the above method, the first pixel point corresponding to each first behavior event in the first behavior data in the initial two-dimensional image can be determined.

[0117] Step S303 , assigning pixel values ​​to first pixel points corresponding to each first behavior event in the initial two-dimensional image according to encoding parameters corresponding to each first behavior event, to obtain an intermediate two-dimensional image.

[0118] Each first behavior event corresponds to a coding parameter, and the coding parameter is determined based on the event type of the first behavior event.

[0119] For example, if the event type of the first behavior event is A, the encoding parameter is 1;

[0120] If the event type of the first behavior event is B, the encoding parameter is 2; if the event type of the first behavior event is C, the encoding parameter is 3;

[0121] The event type of the first behavior event is D, and the encoding parameter is 4.

[0122] Exemplarily, based on Table 1, the encoding parameters of each first behavior event in the first behavior data are as shown in Table 2, specifically as shown in Table 2:

[0123] Table-2

[0124] 1 2 3 4 5 1 3 4 5 7 2 3 4 5 6 4 7 8 11 0 3 4 5 8 11 2 3 4 5 0 1 3 4 0 0

[0125] Among them, 0 means that there is no first behavior event at this position. For example, the date is 20241001, and only three first behavior events A, C and d occur. Therefore, the fourth position of the date 20241001 in Table-1 is blank, and the encoding parameter of the corresponding position in Table-2 is 0.

[0126] After obtaining the encoding parameters of each first behavior event, the pixel value is assigned to the first pixel based on the encoding parameters. For example, the encoding parameter of the first pixel in the first row and the first column is 1, and the pixel value of the first pixel is 1. After completing the pixel value assignment of each first pixel in each initial two-dimensional image, the intermediate two-dimensional image can be obtained.

[0127] Step S304: determining first risk image data corresponding to the first user according to the intermediate two-dimensional image.

[0128] After the intermediate two-dimensional image is obtained, first risk image data corresponding to the first user is determined based on the intermediate two-dimensional image.

[0129] In one example, the intermediate two-dimensional image is used as the first risk image data.

[0130] In another example, the first behavior data includes a label of whether the first behavior event is an arbitrage risk, and the risk type is determined by the label of the first behavior event. For example, if the label is that there is an arbitrage risk, then the risk type is an arbitrage risk; if the label is that there is no arbitrage risk, then the risk type is a non-arbitrage type. The device assigns a numerical value to the first pixel point based on the risk type to obtain a dual-channel image as the first risk image data. For example, if the risk type is an arbitrage risk, then the value assigned is 1; if the risk type is a non-arbitrage risk, then the value assigned is 0. Figure 4 , based on each behavioral event in the behavioral sequence, a dual-channel image is constructed. Figure 4 The box in the middle represents the behavior events and the time of occurrence in the behavior sequence, and the pixel values ​​of the pixels in the two-dimensional image are assigned. Figure 4 The risk feature vector (risk type) of the behavior event represented by the middle circle is used to assign the risk image channel, thereby obtaining a dual-channel image.

[0131] The risk type can also be determined based on similarity. Specifically, the first behavior event corresponds to an event type. The device can determine the event type of the first behavior event based on the event identifier of the first behavior event, obtain the data associated with the first behavior event, obtain the event feature based on the event type, and determine the similarity between the event feature and the risk feature of the event type, thereby determining the risk type of the first behavior event based on the similarity. For example, the event type is a QR code transaction, and the risk feature is that the frequency of the QR code transaction exceeds the preset frequency, the number of QR code refreshes in the QR code transaction exceeds the preset number, and the transaction amount in the QR code transaction exceeds the target amount; the event features extracted based on the event data include the number of QR code refreshes, the transaction amount, and the transaction frequency. When the transaction frequency exceeds the preset frequency, the transaction amount is greater than the target amount, and the number of refreshes is greater than the preset number, the similarity between the event feature and the risk feature is 100%, then the risk type is that there is arbitrage; if only the transaction frequency exceeds the preset frequency, the similarity between the event feature and the risk feature is 33.3%, and the risk type is that there is no arbitrage.

[0132] In this embodiment, considering that the collection of behavioral data is consistent for all users, the types of behavioral events included in the collection range will be extracted, resulting in redundant or interfering information mixed into the behavioral sequence. In this regard, in the risk control scenario, normal users and risk team users may also perform the same operations at a certain stage. Therefore, with the help of the multi-channel characteristics of the image, a risk image channel is added to the above-mentioned two-dimensional image, and a numerical value is given to the two-dimensional image pixel according to the risk type obtained from the accumulated risk data. This value reflects the risk characteristics of the behavioral event corresponding to the pixel, such as whether there is arbitrage, the degree of arbitrage or the type of risk. The behavior before and after the behavioral event with risk characteristics can better reflect the risk information. In this way, the multi-channel characteristics of the image can be brought into play, and more risk characteristic information can be further integrated into the behavior sequence to improve the accuracy of feature extraction.

[0133] Reference Figure 5 , Figure 5 This is a schematic diagram of the process of user identification method for this application team Figure 3 ,based on Figure 2 or Figure 3 In the illustrated embodiment, step S203 includes:

[0134] Step S501: input the first risk image data and the first portrait data corresponding to the first user into a user feature extraction model to obtain a first user feature vector corresponding to the first user output by the user feature extraction model.

[0135] In this embodiment, a user feature extraction model is provided in the device. The device inputs the first risk image data and the first portrait data into the user feature extraction model, and the user feature extraction model outputs a first user feature vector corresponding to the first user.

[0136] Furthermore, the device determines the first user feature vector of the first user and the risk team identification to which the first user belongs based on the first risk image data and the first portrait data of the first user. Specifically, the device inputs the first risk image data and the first portrait data into the user feature extraction model to obtain the first user feature vector and the risk team identification output by the user feature extraction model. The user feature extraction model is composed of a nonlinear model and a linear model. The linear model is used to process the first portrait data to obtain a vector representation, and the nonlinear model is used to process the first risk image data to obtain a vector representation. These two parts of the vector representation are spliced ​​and merged to complete the fusion of the behavioral data represented by the portrait data and the risk image data. Subsequently, the user feature vector is obtained through nonlinear transformations of several fully connected layers in succession. Finally, the risk team identification to which the first user belongs is given under the action of the Softmax function of the output layer. For details, refer to Figure 6 , the portrait data is processed by the linear model, and the risk image data is processed by the deep neural network of the nonlinear model. The data processed by the two models are processed by the fully connected layer and input to the Softmax output layer. The Softmax output layer obtains the user feature vector and the predicted value of each team type, and the identification of the team type with the largest predicted value is used as the risk team identification. The nonlinear model includes a convolutional neural network CNN, which extracts the deep behavioral features of the user behavior sequence from the dual-channel image, thereby improving the generalization ability of the user feature extraction model.

[0137] After the first users corresponding to the first user feature vectors in the cluster group are determined to be users belonging to the same risk team, the device determines the processing strategy corresponding to the cluster group based on the risk team identifier of the first user corresponding to the first user feature vector in the cluster group, thereby processing the processing strategy based on the account associated with the first user corresponding to each first user feature vector in the cluster group. Exemplarily, the cluster group is a, and when the risk team identifier of cluster group a represents that the risk team is risk team A, and the processing strategy of risk team A is to ban the account, then the account of each first user in cluster group a is banned; the cluster group is b, and when the risk team identifier of cluster group b represents that the risk team is risk team B, and the processing strategy of risk team B is to warn the account, then an alarm message is sent to the account of each first user in cluster group b.

[0138] In this embodiment, the device quickly obtains the first user feature vector of the first user based on the user feature extraction model.

[0139] Reference Figure 7 , Figure 7 This is a schematic diagram of the process of user identification method for this application team Figure 4 ,based on Figure 5 In the embodiment shown, before step S501, the following steps are further included:

[0140] Step S701: Acquire multiple training samples, where the training samples are constructed from the second risk image data and the second portrait data of the second user.

[0141] In this embodiment, the device can also train a user feature extraction model. Specifically, the device obtains multiple training samples, and the training samples are constructed by the second risk image data and the second portrait data of the second user. The second portrait data includes the basic attributes of the second user, user behavior labels, and risk characteristics. Basic attributes include the registration time, registration source, and usual place of the account; user behavior labels include the active time of the account, the cumulative payment of the account, the cumulative number of views, payment preferences, etc.; risk characteristics include whether the second user's account is a blacklisted account, recent disposal type, device risk characteristics, geographic location tampering, etc. The recent disposal type refers to whether the account has been warned or banned recently, etc. The device risk characteristics refer to whether the device where the second user's account is located is at risk.

[0142] The second risk image data is obtained from the second behavior data of the second user. In one example, the second behavior data includes multiple behavior events of the second user and the time of occurrence of the behavior events. The behavior event is, for example, the second user receiving a coupon, and the coupon is, for example, the second user receiving a coupon, an instant discount coupon, etc. The behavior event can also be an event in which the second user purchases goods based on the received coupon, and the behavior event can also be an event in which the second user purchases goods using other preferential methods.

[0143] In another example, the device obtains each second behavior event of multiple users in a set historical time period and the occurrence time of each second behavior event. The set historical time period may be a recent time period, for example, the last week, the last day, or the last month, and the end time point of the recent time period may be today's midnight as the end time point. The device determines the second behavior data corresponding to the second user based on the second behavior event and the corresponding occurrence time.

[0144] In addition, the second behavior data may also include behavior events, occurrence events, event types, and whether there is an arbitrage risk mark, etc. Event types include login, coupon collection, and QR code transactions. Occurrence events can be accurate to small things, such as 20241001-8. In addition, if a more specific description of user behavior is required, the event type can be further divided. For example, the coupon collection event can reflect the activity ID, and the coupon collection event is extended from "coupon collection" to "coupon collection-activity ID".

[0145] After obtaining the second behavior data, the device converts the second behavior data into risk image data corresponding to the second user, and the risk image data is defined as the second risk image data. Exemplarily, the second behavior data includes a second behavior event and an occurrence time, and the second behavior event and the occurrence time are converted into pixels based on a mapping relationship, that is, each second behavior event has multiple pixels, and each pixel is constructed as a risk image. For example, the row number of the date where the occurrence time of the second behavior event is located, and the occurrence sequence number of the occurrence time on this date is the column number. For example, the second user generates 7 second behavior events on date A, and date A corresponds to row number 1. The 7 second behavior events have sequence numbers, and each sequence number is obtained by sorting the occurrence time. For example, the occurrence time of the second behavior event a is the earliest among the 7 second behavior events, then the sequence number of the second behavior event a is 1, and thus the column number of the second behavior event a is column number 1. In addition, the specific parameters in the second behavior event are characterized as pixel points corresponding to the second behavior event. In this way, the second behavior data can be converted into an image, and the image is used as the second risk image data.

[0146] Step S702, jointly training the first preset model and the second preset model according to each training sample to obtain a user feature extraction model, wherein the first preset model is used to process the second risk image data, and the second preset model is used to process the second portrait data.

[0147] After obtaining each training sample, the first preset model and the second preset model can be jointly trained to obtain a user feature extraction model. The first preset model is used to process the second risk image data, and the second preset model is used to process the second portrait data.

[0148] In addition, the second preset model is a linear model, which is implemented by a logistic regression model, and can actually be other models. The output of the second preset model, that is, the output of the logistic regression model, is expressed by the following formula:

[0149] Y=XW+b

[0150] In the formula, X is the feature matrix input to the second preset model, each row represents the portrait data of a user's account to be identified, W is the weight matrix, and b is the bias vector. The matrix W and the vector b are the parameters to be learned by the second preset model.

[0151] The first preset model is a nonlinear model. The nonlinear model uses a convolutional neural network (CNN). In fact, other image feature extraction models can also be used, such as an improved CNN model, a Transformer model, etc. The CNN network structure consists of an input layer, a convolution layer, a pooling layer, and an output layer. Each neuron in the input layer corresponds to each pixel of the input image, and passes the behavior sequence graph data to the convolution layer; the convolution layer performs a convolution operation to extract features from the input image, and then enters the pooling layer to reduce the feature dimension, remove redundancy, and retain important information; after passing through multiple convolution layers and pooling layers, the data enters the output layer, which performs a combination operation on the input features and outputs a vector of a fixed size.

[0152] During the data processing stage, necessary feature engineering is performed on the portrait data and dual-channel images obtained above based on business prior knowledge and feature engineering techniques. The former focuses on text feature processing, while the latter focuses on image feature processing, including but not limited to data cleaning, normalization, feature selection, feature combination, and feature dimensionality reduction.

[0153] Furthermore, the device inputs the training sample into the joint model, and the joint model is constructed based on the first preset model and the second preset model. The device obtains the second user feature vector output by the joint model and the first team to which the second user corresponding to the training sample belongs, and updates the parameters of the joint model based on the label in the training sample and the first team. The label is used to indicate the second team to which the second user belongs. The label in the training sample is manually labeled, and the label is, for example, the type of team to which the second user belongs, such as real-person crowdsourcing and group control operation. The label and the first team update the parameters of the joint model, which refers to the difference between the labeled risk team (the value of the labeled risk team is 1) and the predicted value of the predicted risk team type, and updates the loss function in the joint model.

[0154] It should be noted that the label of the training sample can indicate whether the user belongs to a team. If the user belongs to a team, the label contains a serial number, which represents the type of team. For example, if the label of the training sample is serial number 1, it represents that the second user corresponding to the training sample is a member of team A. If the label of the training sample is serial number 3, it represents that the second user corresponding to the training sample is a member of team C. If the label of the training sample is a preset value, such as 0, it represents that the second user corresponding to the training sample is not a member of the team. Similarly, the predicted value obtained based on the training sample is a serial number and a probability value. The serial number represents the team to which the user predicted by the model belongs, and the probability value is the probability that the user belongs to the team corresponding to the serial number. The device uses the training sample and the first team to update the parameters of the joint model, which means that the device selects the maximum probability value and the label of the training sample to update the loss function in the joint model. The team with the serial number corresponding to the maximum probability value is the first team.

[0155] During joint model training, the second preset model and the first preset model of the joint model process the portrait data and risk image data respectively to obtain their own vector representations. After the two vector representations are concatenated and merged, they are successively transformed through several fully connected layers for nonlinear transformation to further enhance the generalization ability of the model. The expression of the fully connected layer is as follows:

[0156] a (l+1) =f(W (l) a (l) +b (l) )

[0157] In the formula, l represents the number of hidden layers; f represents the activation function, which is generally ReLU; a (l) , W (l) and b (l) They represent the output, weight matrix and bias vector of the lth hidden layer respectively, and the weight matrix and bias vector are the parameters that need to be learned by the joint model. The fully connected layer is followed by the output layer. The output layer uses the Softmax function to obtain the probability that the second user's account to be identified belongs to each gang type based on the output vector of the fully connected layer. The probability calculation formula is as follows:

[0158]

[0159] In the formula, z i is the input value of the i-th node, and C is the number of output nodes, that is, the number of group types. The larger the probability value, the greater the probability that the second user belongs to the corresponding group type. The joint model will eventually select the group type with the largest probability value as the group type to which the second user's account to be identified belongs. Under the goal of minimizing the loss function, the joint model adopts a joint training method, and the parameters of the second preset model and the first preset model are synchronously iterated and optimized. The loss function uses the cross entropy loss commonly used in multi-classification tasks. After the sample training is completed, the optimal parameters are selected and imported into the joint model, and the user feature extraction model is finally obtained.

[0160] In this embodiment, the device trains the joint model by acquiring various training samples, thereby obtaining a user feature extraction model, and then quickly acquires a user feature vector corresponding to the user based on the user feature extraction model.

[0161] Reference Figure 8 , Figure 8 This is a schematic diagram of the process of user identification method for this application team Figure 5 ,based on Figure 7 In the illustrated embodiment, step S701 includes:

[0162] Step S801, obtaining second behavior data and second portrait data of multiple second users.

[0163] Step S802: converting the second behavior data of the second user into second risk image data corresponding to the second user.

[0164] Step S803: construct a training sample corresponding to the second user based on the second risk image data and the second portrait data corresponding to the second user.

[0165] In this embodiment, the training sample is composed of the second risk image data and the second image data. The second portrait data includes the basic attributes of the second user, user behavior labels and risk characteristics. Basic attributes include the registration time, registration source and usual place of the account; user behavior labels include the active time of the account, the cumulative payment of the account, the cumulative number of views, payment preferences, etc.; risk characteristics include whether the second user's account is a blacklisted account, recent disposal type, device risk characteristics, geographic location tampering, etc. The recent disposal type refers to whether the account has been warned or banned recently, etc. The device risk characteristics refer to whether there is a risk on the device where the second user's account is located.

[0166] The second risk image data is obtained from the second behavior data of the second user. In one example, the second behavior data includes multiple behavior events of the second user and the time of occurrence of the behavior events. The behavior event is, for example, the second user receiving a coupon, and the coupon is, for example, the second user receiving a coupon, an instant discount coupon, etc. The behavior event can also be an event in which the second user purchases goods based on the received coupon, and the behavior event can also be an event in which the second user purchases goods using other preferential methods.

[0167] In another example, the device obtains each second behavior event of multiple users in a set historical time period and the occurrence time of each second behavior event. The set historical time period may be a recent time period, for example, the last week, the last day, or the last month, and the end time point of the recent time period may be today's midnight as the end time point. The device determines the second behavior data corresponding to the second user based on the second behavior event and the corresponding occurrence time.

[0168] In addition, the second behavior data may also include behavior events, occurrence events, event types, and whether there is an arbitrage risk mark, etc. Event types include login, coupon collection, and QR code transactions. Occurrence events can be accurate to small things, such as 20241001-8. In addition, if a more specific description of user behavior is required, the event type can be further divided. For example, the coupon collection event can reflect the activity ID, and the coupon collection event is extended from "coupon collection" to "coupon collection-activity ID".

[0169] After obtaining the second behavior data, the device converts the second behavior data into risk image data corresponding to the second user, and the risk image data is defined as the second risk image data. Exemplarily, the second behavior data includes a second behavior event and an occurrence time, and the second behavior event and the occurrence time are converted into pixels based on a mapping relationship, that is, each second behavior event has multiple pixels, and each pixel is constructed as a risk image. For example, the row number of the date where the occurrence time of the second behavior event is located, and the occurrence sequence number of the occurrence time on this date is the column number. For example, the second user generates 7 second behavior events on date A, and date A corresponds to row number 1. The 7 second behavior events have sequence numbers, and each sequence number is obtained by sorting the occurrence time. For example, the occurrence time of the second behavior event a is the earliest among the 7 second behavior events, then the sequence number of the second behavior event a is 1, and thus the column number of the second behavior event a is column number 1. In addition, the specific parameters in the second behavior event are characterized as pixel points corresponding to the second behavior event. In this way, the second behavior data can be converted into an image, and the image is used as the second risk image data.

[0170] In this embodiment, the device constructs training samples based on the second behavior data and the second portrait data of the second user, and trains the model based on each training sample to obtain a user feature extraction model.

[0171] Reference Fig. 9 , Fig. 9 This is a schematic diagram of the process of user identification method for this application team Figure 6 ,based on Figure 8 In the illustrated embodiment, step S802 includes:

[0172] Step S901: Acquire each second behavior event and the corresponding occurrence time in the second behavior data of the second user.

[0173] Step S902: determining a second pixel point of the second behavior event in the original two-dimensional image according to the second behavior event and the corresponding occurrence time.

[0174] In this embodiment, the device obtains each second behavior event and the occurrence time corresponding to each second behavior event from the second behavior data, and thereby determines the second pixel point of the second behavior event in the original two-dimensional image based on the second behavior event and the occurrence time.

[0175] Exemplarily, the original two-dimensional image is a blank two-dimensional image, and there are multiple pixels in the original two-dimensional image. The second behavior event has a corresponding pixel in the original two-dimensional image, and the pixel is defined as a second pixel. The second behavior data includes each second behavior event of the second user within a week and the occurrence time. Each second behavior event is sorted according to the occurrence time, and the sorting table is shown in the above Table-1.

[0176] Referring to Table-1, five second behavior events occurred in the date 20240925 in the order of occurrence time from early to late, which are A, B, c, d and E, and A, B, c, d and E represent the event types of the second behavior events. The date 20240925 corresponds to the first row in the original two-dimensional image, and the second behavior event A in the date 20240925 is the earliest time of occurrence in the date, that is, the sequence number of the behavior event is 1, and the sequence number 1 corresponds to the first column, so the second behavior event A in 20240925 is the pixel point of the first row and the first column in the original two-dimensional image.

[0177] By means of the above method, the second pixel point corresponding to each second behavior event in the second behavior data in the original two-dimensional image can be determined.

[0178] Step S903 , assigning pixel values ​​to second pixel points corresponding to each second behavior event in the initial two-dimensional image according to encoding parameters corresponding to each second behavior event, to obtain a target two-dimensional image.

[0179] Each second behavior event corresponds to a coding parameter, and the coding parameter is determined based on the event type of the second behavior event. For example, if the event type of the second behavior event is A, the coding parameter is 1; if the event type of the second behavior event is B, the coding parameter is 2; if the event type of the second behavior event is C, the coding parameter is 3; if the event type of the second behavior event is D, the coding parameter is 4. Exemplarily, based on Table 1, the coding parameters of each second behavior event in the second behavior data are as shown in Table 2.

[0180] After obtaining the encoding parameters of each second behavior event, the pixel value is assigned to the second pixel based on the encoding parameters. For example, the encoding parameter of the second pixel in the first row and the first column is 1, and the pixel value of the second pixel is 1. After completing the pixel value assignment of each second pixel in each original two-dimensional image, the target two-dimensional image can be obtained.

[0181] Step S904: determining second risk image data corresponding to the second user according to the target two-dimensional image.

[0182] After the target two-dimensional image is obtained, second risk image data corresponding to the second user is determined based on the target two-dimensional image.

[0183] In one example, the target two-dimensional image is used as the second risk image data.

[0184] In another example, the second behavior data includes a labeling of whether the second behavior event is an arbitrage risk, and the risk type is determined by the labeling of the second behavior event. For example, if the labeling indicates that there is an arbitrage risk, then the risk type is an arbitrage risk; if the labeling indicates that there is no arbitrage risk, then the risk type is a non-arbitrage type. The device assigns a numerical value to the second pixel point based on the risk type to obtain a dual-channel image as the second risk image data. For example, if the risk type is an arbitrage risk, then the value assigned is 1; if the risk type is a non-arbitrage risk, then the value assigned is 0. Figure 4 , based on each behavioral event in the behavioral sequence, a dual-channel image is constructed. Figure 4 The box in the middle represents the behavior events and the time of occurrence in the behavior sequence, and the pixel values ​​of the pixels in the two-dimensional image are assigned. Figure 4 The middle circle represents the risk type of the behavioral event, and the value of another channel in the two-dimensional image is assigned to obtain a dual-channel image.

[0185] In this embodiment, considering that the collection of behavioral data is consistent for all users, the types of behavioral events included in the collection range will be extracted, resulting in redundant or interfering information mixed into the behavioral sequence. In this regard, in the risk control scenario, normal users and risk team users may also perform the same operations at a certain stage. Therefore, with the help of the multi-channel characteristics of the image, a risk image channel is added to the above-mentioned two-dimensional image, and a numerical value is given to the two-dimensional image pixel according to the risk type obtained from the accumulated risk data. This value reflects the risk characteristics of the behavioral event corresponding to the pixel, such as whether there is arbitrage, the degree of arbitrage or the type of risk. The behavior before and after the behavioral event with risk characteristics can better reflect the risk information. In this way, the multi-channel characteristics of the image can be brought into play, and more risk feature information can be further integrated into the behavior sequence, the accuracy of feature extraction can be improved, and accurate training samples can be constructed.

[0186] Based on the contents described in the above embodiments, a team user identification device is also provided in the embodiments of the present application. Fig.10 , Fig.10 This is a schematic diagram of a program module of a team user identification device provided in an embodiment of the present application. In some implementations, the team user identification device 1000 includes:

[0187] An acquisition module 1010 is used to acquire first behavior data and first portrait data of a plurality of first users;

[0188] A conversion module 1020, configured to convert the first behavior data of the first user into first risk image data corresponding to the first user;

[0189] A determination module 1030, configured to determine a first user feature vector of the first user according to the first risk image data and the first portrait data corresponding to the first user;

[0190] The clustering module 1040 is configured to cluster the first user feature vectors corresponding to the first users to obtain cluster groups, and determine the first users corresponding to the first user feature vectors in the cluster groups as users belonging to the same risk team.

[0191] In some embodiments, the team user identification device 1000 is specifically used for:

[0192] Obtain each first behavior event and the corresponding occurrence time in the first behavior data of the first user;

[0193] Determine a first pixel point of the first behavior event in the initial two-dimensional image according to the first behavior event and the corresponding occurrence time;

[0194] Assigning pixel values ​​to first pixel points corresponding to each first behavior event in the initial two-dimensional image according to encoding parameters corresponding to each first behavior event to obtain an intermediate two-dimensional image;

[0195] First risk image data corresponding to the first user is determined according to the intermediate two-dimensional image.

[0196] In some embodiments, the team user identification device 1000 is specifically used for:

[0197] Determine the risk type corresponding to each first behavioral event;

[0198] According to the risk type of each first behavior event, a numerical value is assigned to the first pixel point of each first behavior event in the intermediate two-dimensional image to obtain a dual-channel image as the first risk image data corresponding to the first user.

[0199] In some embodiments, the team user identification device 1000 is specifically used for:

[0200] Determine the event type of the first behavior event according to the event identifier of the first behavior event, and obtain event data associated with the first behavior event;

[0201] Acquire event features based on event data, and determine similarities between the event features and risk features associated with the event type;

[0202] The risk type of the first behavioral event is determined based on the similarity.

[0203] In some embodiments, the team user identification device 1000 is specifically used for:

[0204] The first risk image data and the first portrait data corresponding to the first user are input into the user feature extraction model to obtain a first user feature vector corresponding to the first user output by the user feature extraction model.

[0205] In some embodiments, the team user identification device 1000 is specifically used for:

[0206] Acquire a plurality of training samples, where the training samples are constructed from the second risk image data and the second portrait data of the second user;

[0207] The first preset model and the second preset model are jointly trained according to each training sample to obtain a user feature extraction model, wherein the first preset model is used to process the second risk image data, and the second preset model is used to process the second portrait data.

[0208] In some embodiments, the team user identification device 1000 is specifically used for:

[0209] Acquire second behavior data and second portrait data of multiple second users;

[0210] converting the second behavior data of the second user into second risk image data corresponding to the second user;

[0211] A training sample corresponding to the second user is constructed based on the second risk image data and the second portrait data corresponding to the second user.

[0212] In some embodiments, the team user identification device 1000 is specifically used for:

[0213] Obtain each second behavior event and the corresponding occurrence time in the second behavior data of the second user;

[0214] Determine a second pixel point of the second behavior event in the original two-dimensional image according to the second behavior event and the corresponding occurrence time;

[0215] Assigning pixel values ​​to second pixel points corresponding to each second behavior event in the initial two-dimensional image according to encoding parameters corresponding to each second behavior event to obtain a target two-dimensional image;

[0216] Second risk image data corresponding to the second user is determined according to the target two-dimensional image.

[0217] In some embodiments, the team user identification device 1000 is specifically used for:

[0218] Determine the risk type corresponding to each second behavioral event;

[0219] According to the risk type of each second behavior event, a numerical value is assigned to the second pixel point of each second behavior event in the target two-dimensional image to obtain a dual-channel image as the second risk image data corresponding to the second user.

[0220] In some embodiments, the team user identification device 1000 is specifically used for:

[0221] Inputting the training sample into the joint model, where the joint model is constructed based on the first preset model and the second preset model;

[0222] Obtain the second user feature vector output by the joint model and the first team to which the second user corresponding to the training sample belongs;

[0223] The parameters of the joint model are updated according to the label in the training sample and the first team, where the label is used to indicate the second team to which the second user belongs.

[0224] In some embodiments, the team user identification device 1000 is specifically used for:

[0225] Obtaining a target number of first user feature vectors in a cluster group;

[0226] In response to the target number being greater than the preset number, the first users corresponding to the first user feature vectors in the clustering group are determined to be users belonging to the same risk team.

[0227] In some embodiments, the team user identification device 1000 is specifically used for:

[0228] Determine, according to the first risk image data and the first portrait data corresponding to the first user, a first user feature vector of the first user and an identifier of the risk team to which the first user belongs;

[0229] After determining the first users corresponding to the first user feature vectors in the cluster group as users belonging to the same risk team, the method further includes:

[0230] Determine a processing strategy corresponding to the cluster group according to the risk team identifier of the first user corresponding to the first user feature vector in the cluster group;

[0231] The processing strategy is performed on the account associated with the first user corresponding to each first user feature vector in the cluster group.

[0232] In some embodiments, the team user identification device 1000 is specifically used for:

[0233] Acquire each first behavior event of a plurality of first users in a set historical time period and the occurrence time of each first behavior event;

[0234] According to each first behavior event and the corresponding occurrence time, first behavior data corresponding to the first user is determined.

[0235] It should be noted that the various steps in the team user identification method executed by the team user identification device refer to the above embodiments for details, and will not be described in detail here.

[0236] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor, and a communication interface and a memory connected to the processor; wherein the communication interface is used to communicate with other communication devices, and the memory stores computer execution instructions; the above at least one processor executes the computer execution instructions stored in the memory to implement each step in the team user identification method described in the above embodiments.

[0237] In order to better understand the embodiments of the present application, refer to Fig.11 , Fig.11 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0238] like Fig.11 As shown, the electronic device 1100 of this embodiment includes: a processor 1101, a memory 1102, and a communication interface 1104; wherein:

[0239] Memory 1102, used to store computer-executable instructions;

[0240] The communication interface 1104 is used to communicate with other communication devices;

[0241] The processor 1101 is used to execute the computer-executable instructions stored in the memory to implement the various steps in the query optimization method described in the above embodiment.

[0242] Optionally, the memory 1102 may be independent or integrated with the processor 1101 .

[0243] When the memory 1102 is independently provided, the device further includes a bus 1103 for connecting the memory 1102 , the communication interface 1104 and the processor 1101 .

[0244] An embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, each step of the team user identification method described in the above embodiment is implemented.

[0245] An embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the various steps in the team user identification method described in the above embodiment.

[0246] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0247] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0248] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0249] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0250] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0251] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0252] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0253] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0254] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A team user identification method, characterized in that: include: Acquire first behavior data and first portrait data of multiple first users; converting the first behavior data of the first user into first risk image data corresponding to the first user; determining a first user feature vector of the first user according to the first risk image data corresponding to the first user and the first portrait data; The first user feature vectors corresponding to the first users are clustered to obtain cluster groups, and the first users corresponding to the first user feature vectors in the cluster groups are determined as users belonging to the same risk team.

2. The method according to claim 1, characterized in that The converting the first behavior data of the first user into first risk image data corresponding to the first user includes: Obtaining each first behavior event and the corresponding occurrence time in the first behavior data of the first user; Determine a first pixel point of the first behavior event in the initial two-dimensional image according to the first behavior event and the corresponding occurrence time; Assigning pixel values ​​to first pixel points corresponding to each first behavior event in the initial two-dimensional image according to encoding parameters corresponding to each first behavior event to obtain an intermediate two-dimensional image; First risk image data corresponding to the first user is determined according to the intermediate two-dimensional image.

3. The method according to claim 2, characterized in that The determining, according to the intermediate two-dimensional image, first risk image data corresponding to the first user comprises: Determining a risk type corresponding to each of the first behavioral events; According to the risk type of each of the first behavior events, a numerical value is assigned to the first pixel point of each of the first behavior events in the intermediate two-dimensional image to obtain a dual-channel image as the first risk image data corresponding to the first user.

4. The method according to claim 3, characterized in that The determining the risk type corresponding to each of the first behavior events includes: Determine the event type of the first behavior event according to the event identifier of the first behavior event, and obtain event data associated with the first behavior event; Acquire event features according to the event data, and determine the similarity between the event features and the risk features associated with the event type; A risk type of the first behavior event is determined according to the similarity.

5. The method according to claim 1, characterized in that The determining, according to the first risk image data corresponding to the first user and the first portrait data, a first user feature vector of the first user includes: The first risk image data and the first portrait data corresponding to the first user are input into a user feature extraction model to obtain a first user feature vector corresponding to the first user output by the user feature extraction model.

6. The method according to claim 5, characterized in that Before inputting the first risk image data and the first portrait data corresponding to the first user into the user feature extraction model, the method further includes: Acquire a plurality of training samples, where the training samples are constructed from the second risk image data and the second portrait data of the second user; The first preset model and the second preset model are jointly trained according to each of the training samples to obtain the user feature extraction model, wherein the first preset model is used to process the second risk image data, and the second preset model is used to process the second portrait data.

7. The method according to claim 6, characterized in that The obtaining of multiple training samples comprises: Acquire second behavior data and second portrait data of multiple second users; converting the second behavior data of the second user into second risk image data corresponding to the second user; A training sample corresponding to the second user is constructed based on the second risk image data corresponding to the second user and the second portrait data.

8. The method according to claim 7, characterized in that The converting the second behavior data of the second user into second risk image data corresponding to the second user includes: Obtain each second behavior event and the corresponding occurrence time in the second behavior data of the second user; Determine a second pixel point of the second behavior event in the original two-dimensional image according to the second behavior event and the corresponding occurrence time; Assigning pixel values ​​to second pixel points corresponding to each second behavior event in the initial two-dimensional image according to encoding parameters corresponding to each second behavior event to obtain a target two-dimensional image; Second risk image data corresponding to the second user is determined according to the target two-dimensional image.

9. The method according to claim 8, characterized in that The determining, according to the target two-dimensional image, second risk image data corresponding to the second user includes: Determining a risk type corresponding to each of the second behavior events; According to the risk type of each second behavior event, a numerical value is assigned to the second pixel point of each second behavior event in the target two-dimensional image to obtain a dual-channel image as the second risk image data corresponding to the second user.

10. The method according to claim 6, characterized in that The jointly training the first preset model and the second preset model according to each of the training samples includes: Inputting the training sample into a joint model, wherein the joint model is constructed based on the first preset model and the second preset model; Obtain a second user feature vector output by the joint model and a first team to which the second user corresponding to the training sample belongs; The parameters of the joint model are updated according to the label in the training sample and the first team, wherein the label is used to indicate the second team to which the second user belongs.

11. The method according to claim 1, characterized in that: The step of determining the first users corresponding to the first user feature vectors in the cluster group as users belonging to the same risk team includes: Obtaining a target number of the first user feature vectors in the cluster group; In response to the target number being greater than a preset number, the first users corresponding to the first user feature vectors in the clustering group are determined to be users belonging to the same risk team.

12. The method according to claim 1, characterized in that The determining, according to the first risk image data corresponding to the first user and the first portrait data, a first user feature vector of the first user includes: Determine, according to the first risk image data corresponding to the first user and the first portrait data, a first user feature vector of the first user and an identifier of a risk team to which the first user belongs; After determining the first users corresponding to the first user feature vectors in the cluster group as users belonging to the same risk team, the method further includes: Determining a processing strategy corresponding to the cluster group according to a risk team identifier of the first user corresponding to the first user feature vector in the cluster group; The processing strategy is performed on the account associated with the first user corresponding to each of the first user feature vectors in the cluster group.

13. The method according to any one of claims 1 to 12, characterized in that The obtaining of first behavior data of a plurality of first users includes: Acquire each first behavior event of a plurality of first users in a set historical time period and the occurrence time of each first behavior event; The first behavior data corresponding to the first user is determined according to each of the first behavior events and the corresponding occurrence time.

14. A team user identification device, characterized in that: include: An acquisition module, used to acquire first behavior data and first portrait data of a plurality of first users; A conversion module, configured to convert the first behavior data of the first user into first risk image data corresponding to the first user; a determination module, configured to determine a first user feature vector of the first user according to the first risk image data corresponding to the first user and the first portrait data; The clustering module is used to cluster the first user feature vectors corresponding to the first users to obtain cluster groups, and determine the first users corresponding to the first user feature vectors in the cluster groups as users belonging to the same risk team.

15. An electronic device, characterized in that: include: A processor, and a memory and a communication interface communicatively connected to the processor; The communication interface is used to communicate with other communication devices; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the team user identification method as described in any one of claims 1-13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the team user identification method as described in any one of claims 1-13 is implemented.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the team user identification method as described in any one of claims 1-13 is implemented.

Images