Abnormal behavior detection method, detection model training method and electronic equipment

Abstract

The invention relates to an abnormal behavior detection method, a detection model training method and electronic equipment, and relates to the technical field of computers. The method comprises the steps that a behavior sequence and a time sequence of a user are obtained, and the time sequence is a sequence composed of time interval information of every two adjacent behaviors in the behavior sequence; generating a behavior feature vector according to the behavior sequence and the time sequence; and determining whether the behavior sequence is abnormal or not according to the behavior feature vector.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method for detecting abnormal behavior, a method for training a detection model, and an electronic device. Background Art

[0002] There are some abnormal behaviors of users on the Internet platform. For example, credit card fraud refers to users stealing other people's asset accounts and passwords to complete transactions, causing losses to the stolen users; fake orders refer to users conducting false transactions in batches under the instructions of specific merchants in order to forge merchant transactions, improve their recommendation rankings on the platform, and affect the user experience of normal users.

[0003] In the related technology, the pre-order behavior logs of abnormal users and normal users are extracted and manually summarized, and the differences between the behaviors of abnormal users and normal users before the transaction are formed into features, and then a model is trained based on these differences, and the trained model is used to identify abnormal behavior. Summary of the invention

[0004] The inventors found that: the features formed by manual summarization are dominated by personal prior knowledge, which cannot guarantee the effectiveness and completeness of the features. In addition, individuals often find it difficult to discover the co-occurrence relationship between behaviors that are far apart, and the correlation between this relationship and the label of abnormal behavior, so the trained model has low accuracy in identifying abnormal behaviors. In addition, the features formed by manual summarization do not take into account the time information between each behavior.

[0005] A technical problem to be solved by the present disclosure is to improve the accuracy of abnormal behavior detection.

[0006] According to some embodiments of the present disclosure, a method for detecting abnormal behavior is provided, comprising: obtaining a user's behavior sequence and time series, wherein the time series is a sequence composed of time interval information between every two adjacent behaviors in the behavior sequence; generating a behavior feature vector based on the behavior sequence and the time series; and determining whether the behavior sequence is abnormal based on the behavior feature vector.

[0007] In some embodiments, generating a behavior feature vector based on a behavior sequence and a time series includes: encoding the behavior sequence to obtain a behavior code; encoding the time series to obtain a time code; and fusing the behavior code and the time code according to an attention mechanism to generate a behavior feature vector.

[0008] In some embodiments, the behavior coding and time coding are fused according to the attention mechanism to generate a behavior feature vector, including: determining the attention weight corresponding to the time coding according to the correlation between the behavior coding and the time coding; determining the summary coding according to the time coding and the attention weight corresponding to the time coding; and generating the behavior feature vector according to the summary coding.

[0009] In some embodiments, the behavior coding includes the coding of the behavior sequence, the time coding includes the coding of each time interval information in the time sequence, the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to the behavior sequence, and determining the attention weight corresponding to the time coding according to the correlation between the behavior coding and the time coding includes: determining the correlation between the coding of each time interval information and the coding of the behavior sequence as the attention weight of each time interval information relative to the behavior sequence; determining the summary coding according to the time coding and the attention weight corresponding to the time coding includes: performing weighted summation on the coding of each time interval information according to the attention weight of each time interval information relative to the behavior sequence to obtain the summary coding.

[0010] In some embodiments, generating a behavior feature vector according to the summary code includes: using the summary code as the behavior feature vector; or concatenating the summary code with the code of the behavior sequence to obtain the behavior feature vector.

[0011] In some embodiments, determining the correlation between the encoding of each time interval information and the encoding of the behavior sequence includes: determining the correlation between the encoding of each time interval information and the encoding of the behavior sequence based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior sequence; or determining the correlation between the encoding of each time interval information and the encoding of the behavior sequence using a first neural network module based on the encoding of each time interval information and the encoding of the behavior sequence.

[0012] In some embodiments, the behavior coding includes the coding of each behavior in the behavior sequence, the time coding includes the coding of each time interval information in the time sequence, the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to each behavior, and determining the attention weight corresponding to the time coding according to the correlation between the behavior coding and the time coding includes: for the coding of each behavior, determining the correlation between the coding of each time interval information and the coding of the behavior, as the attention weight of each time interval information relative to the coding of the behavior; determining the summary coding according to the time coding and the attention weight corresponding to the time coding includes: for the coding of each behavior, according to the attention weight of each time interval information relative to the coding of the behavior, weighted summing the coding of each time interval information to obtain the sub-summary coding corresponding to the behavior; and combining the sub-summary coding corresponding to each behavior into a summary coding.

[0013] In some embodiments, generating a behavior feature vector according to the summary coding includes: generating the behavior feature vector according to the summary coding using a fully connected layer module.

[0014] In some embodiments, determining the correlation between the encoding of each time interval information and the encoding of the behavior includes: determining the correlation between the encoding of each time interval information and the encoding of the behavior based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior; or determining the correlation between the encoding of each time interval information and the encoding of the behavior using a second neural network module based on the encoding of each time interval information and the encoding of the behavior.

[0015] In some embodiments, encoding the behavior sequence to obtain the behavior code includes: performing embedded coding on each behavior in the behavior sequence to generate a first embedded coding sequence; and using a third neural network module to obtain the behavior code based on the first embedded coding sequence.

[0016] In some embodiments, encoding a time series to obtain a time code includes: binning each time interval information in the time series to obtain multiple time values; embedding each time value in the multiple time values ​​to form a second embedded coding sequence; and using a fourth neural network module according to the second embedded coding sequence to obtain the time code.

[0017] In some embodiments, obtaining the user's behavior sequence includes: obtaining the user's behavior in each cycle; forming an original behavior sequence from a preset starting behavior to the behavior of the current cycle; and selecting some or all of the behaviors to form a behavior sequence based on the importance of each behavior in the original behavior sequence.

[0018] In some embodiments, the method further includes: obtaining multiple consecutive behaviors of each historical user among multiple historical users within a preset historical time period and a label of each historical user, wherein the label of each historical user is used to indicate whether the multiple consecutive behaviors of each historical user are abnormal; determining a relevance index of each behavior relative to the label based on the multiple consecutive behaviors of each historical user within the preset historical time period and the label of each historical user, wherein the relevance index includes: Kolmogorov-Smirnov value or information value or Pearson correlation coefficient; determining the importance of each behavior based on the relevance index of each behavior relative to the label.

[0019] In some embodiments, determining whether the behavior sequence is abnormal according to the behavior feature vector includes: performing classification according to the behavior feature vector to obtain a classification result indicating whether the behavior sequence is abnormal.

[0020] According to some other embodiments of the present disclosure, a training method for an abnormal behavior detection model is provided, comprising: obtaining a behavior sequence, a time series, and a label corresponding to each sample user of a plurality of sample users, wherein the time series is a sequence composed of time interval information between every two adjacent behaviors in the behavior sequence, and the label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal; inputting the behavior sequence and time series of each sample user into the abnormal behavior detection model; in the abnormal behavior detection model, generating a behavior feature vector of each sample user according to the behavior sequence and time series of each sample user, and outputting a result of whether the behavior sequence of each sample user is abnormal according to the behavior feature vector of each sample user; and adjusting the parameters of the abnormal behavior detection model according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user.

[0021] In some embodiments, the result of whether the behavior sequence of each sample user is abnormal includes: the probability of each sample user's behavior sequence being abnormal and the probability of being normal. According to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user, adjusting the parameters of the abnormal behavior detection model includes: determining the cross entropy loss function according to the probability of each sample user's behavior sequence being abnormal and the probability of being normal, and the label of each sample user; and adjusting the parameters of the abnormal behavior detection model according to the cross entropy loss function.

[0022] According to some other embodiments of the present disclosure, an abnormal behavior detection device is provided, including: an acquisition module, used to acquire a user's behavior sequence and time series, wherein the time series is a sequence composed of time interval information between every two adjacent behaviors in the behavior sequence; a generation module, used to generate a behavior feature vector based on the behavior sequence and the time series; and a determination module, used to determine whether the behavior sequence is abnormal based on the behavior feature vector.

[0023] According to some further embodiments of the present disclosure, a training device for an abnormal behavior detection model is provided, comprising: an acquisition module, used to acquire a behavior sequence, a time series and a label corresponding to each sample user among multiple sample users, wherein the time series is a sequence composed of time interval information between every two adjacent behaviors in the behavior sequence, and the label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal; an input module, used to input the behavior sequence and time series of each sample user into the abnormal behavior detection model; a detection module, used to generate a behavior feature vector for each sample user in the abnormal behavior detection model according to the behavior sequence and time series of each sample user, and output a result of whether the behavior sequence of each sample user is abnormal according to the behavior feature vector of each sample user; and an adjustment module, used to adjust the parameters of the abnormal behavior detection model according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user.

[0024] According to some other embodiments of the present disclosure, an electronic device is provided, comprising: a processor; and a memory coupled to the processor, for storing instructions, which, when executed by the processor, causes the processor to execute a method for detecting abnormal behavior or a method for training an abnormal behavior detection model as described in any of the aforementioned embodiments.

[0025] According to some further embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, wherein when the program is executed by a processor, the abnormal behavior detection method or the abnormal behavior detection model training method of any of the aforementioned embodiments is implemented.

[0026] The present disclosure obtains a behavior sequence consisting of multiple behaviors of the user, and a time series consisting of the time interval information of each two adjacent behaviors, generates a behavior feature vector based on the behavior sequence and the time series, and then determines whether the behavior sequence is abnormal based on the behavior feature vector. The present disclosure adopts the behavior sequence of the user to ensure the completeness of the behavior features, and refers to the causal dependencies between various behaviors. By adopting the time series, the time features between behaviors can be captured, and the time features between abnormal behaviors can be considered. Combining the behavior sequence and the time series can more accurately detect abnormal behavior sequences.

[0027] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 A schematic flow chart showing a method for detecting abnormal behavior according to some embodiments of the present disclosure.

[0030] Figure 2 A flowchart illustrating a method for training an abnormal behavior detection model according to some embodiments of the present disclosure is provided.

[0031] Figure 3 A schematic diagram showing a sequence of behaviors of some embodiments of the present disclosure.

[0032] Figure 4 A schematic diagram showing the architecture of an abnormal behavior detection model according to some embodiments of the present disclosure.

[0033] Figure 5 A schematic diagram showing the structure of an abnormal behavior detection device according to some embodiments of the present disclosure.

[0034] Figure 6 A schematic diagram showing the structure of a training device for an abnormal behavior detection model according to some embodiments of the present disclosure.

[0035] Figure 7 A schematic diagram showing the structure of an electronic device according to some embodiments of the present disclosure.

[0036] Figure 8 A schematic diagram showing the structure of an electronic device according to some other embodiments of the present disclosure. DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0038] This disclosure proposes a method for detecting abnormal behavior. Figure 1 Give a description.

[0039] Figure 1Flowcharts of some embodiments of the abnormal behavior detection method disclosed in the present invention. Figure 1 As shown, the method of this embodiment includes: steps S102 to S106.

[0040] In step S102, the user's behavior sequence and time sequence are obtained.

[0041] The user's behavior sequence includes multiple behaviors, such as logging in, searching, browsing, submitting orders, and paying. The types of user behaviors on the platform are usually constrained by the platform and are a limited set. The user's behavior logs on the platform can be collected, and the behavior logs can include the behavior type and the timestamp corresponding to it.

[0042] In some embodiments, the user's behavior in each cycle is obtained; a plurality of consecutive behaviors from a preset starting behavior to the behavior of the current cycle are formed into an original behavior sequence; and according to the importance of each behavior in the original behavior sequence, some or all behaviors are selected to form a behavior sequence.

[0043] For example, the behavior of users in the platform is obtained every minute with a period of 1 minute. The preset starting behavior can be the first login behavior of the user in the current statistical time period (for example, the current day, the current hour, etc.).

[0044] Important behaviors can be selected based on the importance of each behavior, and only these important behaviors can be retained, while non-important behaviors can be ignored. This can reduce the complexity of preprocessing and subsequent models without losing accuracy, improve processing efficiency, and reduce the pressure when the model is launched.

[0045] In some embodiments, multiple consecutive behaviors of each historical user among multiple historical users within a preset historical time period and a label of each historical user are obtained, wherein the label of each historical user is used to indicate whether the multiple consecutive behaviors of each historical user are abnormal; based on the multiple consecutive behaviors of each historical user within the preset historical time period and the label of each historical user, a relevance index of each behavior relative to the label is determined, wherein the relevance index includes: Kolmogorov-Smirnov value or information value or Pearson correlation coefficient; based on the relevance index of each behavior relative to the label, the importance of each behavior is determined.

[0046] For each behavior, the larger the Kolmogorov-Smirnov (KS) value or the Information Value (IV) or the Pearson correlation coefficient is, the higher the importance of the behavior is.

[0047] For example, the types of behaviors include: changing passwords, logging in, etc. By obtaining multiple consecutive behaviors of each historical user within 48 hours before placing an order and the label of each historical user, Table 1 can be formed.

[0048] Table 1

[0049]

[0050]

[0051] For each historical user, a label of 0 indicates that multiple consecutive behaviors of the historical user are normal, and a label of 1 indicates that multiple consecutive behaviors of the historical user are abnormal. Then, the KS value, IV, or Pearson correlation coefficient of each behavior relative to the label can be calculated respectively. If the KS value, IV, or Pearson correlation coefficient is negative, its absolute value can be taken. For example, the Pearson correlation coefficient of each behavior relative to the label is calculated to obtain Table 2. According to Table 2, it can be concluded that the login behavior is more important. Therefore, the login behavior before placing an order has a high correlation with determining whether the behavior sequence is abnormal, while the password modification behavior has a low correlation with determining whether the behavior sequence is abnormal. Therefore, the login behavior is an important behavior, and the password modification behavior is an unimportant behavior. When generating a behavior sequence, only the login behavior can be considered.

[0052] Table 2

[0053]

[0054] After obtaining the user's behavior sequence, the time interval information between every two adjacent behaviors can be determined based on the timestamp of each behavior in the behavior sequence, thereby forming a time series.

[0055] In step S104, a behavior feature vector is generated according to the behavior sequence and the time series.

[0056] In some embodiments, the behavior sequence is encoded to obtain the behavior code; the time sequence is encoded to obtain the time code; the behavior code and the time code are fused according to the attention mechanism to generate the behavior feature vector. The attention mechanism can determine the correlation between the behavior code and the time code, and fuse the behavior code and the time code according to the correlation to generate the behavior feature vector.

[0057] The abnormal behavior detection method disclosed in the present invention can be implemented by using an abnormal behavior detection model. The detection model may include a first encoding module for encoding a behavior sequence, a second encoding module for encoding a time series, and an attention module for generating a behavior feature vector.

[0058] In some embodiments, the attention weight corresponding to the time code is determined based on the correlation between the behavior code and the time code; the summary code is determined based on the time code and the attention weight corresponding to the time code; and the behavior feature vector is generated based on the summary code.

[0059] In some embodiments, the behavior coding includes the coding of the behavior sequence, that is, the coding of the entire behavior sequence, the time coding includes the coding of each time interval information in the time sequence, and the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to the behavior sequence; the correlation between the coding of each time interval information and the coding of the behavior sequence is determined as the attention weight of each time interval information relative to the behavior sequence, and according to the attention weight of each time interval information relative to the behavior sequence, the coding of each time interval information is weighted and summed to obtain a summary coding.

[0060] In some embodiments, the summary code is used as a behavior feature vector; or the summary code is concatenated with the code of the behavior sequence to obtain a behavior feature vector.

[0061] The following method can be used to determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence: determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior sequence; or use the first neural network module to determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence. The vector inner product may contain trainable parameters. The method for determining the correlation between the encoding of each time interval information and the encoding of the behavior sequence is not limited to the examples given. The first neural network module is located in the attention module.

[0062] In some embodiments, the behavior coding includes the coding of each behavior in the behavior sequence, the time coding includes the coding of each time interval information in the time series, and the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to each behavior; for the coding of each behavior, the correlation between the coding of each time interval information and the coding of the behavior is determined as the attention weight of each time interval information relative to the coding of the behavior; for the coding of each behavior, the coding of each time interval information is weighted and summed according to the attention weight of each time interval information relative to the coding of the behavior to obtain the sub-aggregate coding corresponding to the behavior; the sub-aggregate coding corresponding to each behavior is combined into an aggregate coding.

[0063] In some embodiments, a fully connected layer module is used to generate a behavior feature vector according to the summary coding. The fully connected layer module is located in the attention module.

[0064] The following method can be used to determine the correlation between the encoding of each time interval information and the encoding of the behavior: determine the correlation between the encoding of each time interval information and the encoding of the behavior based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior; or use a second neural network module to determine the correlation between the encoding of each time interval information and the encoding of the behavior based on the encoding of each time interval information and the encoding of the behavior. The vector inner product may contain trainable parameters. The second neural network module is located in the attention module.

[0065] The above-mentioned method of fusing behavior coding and time coding based on attention mechanism can be summarized as including three schemes.

[0066] (1) Determine the attention weight of each time interval information relative to the behavior sequence. According to the attention weight of each time interval information relative to the behavior sequence, perform weighted summation on the encoding of each time interval information to obtain a summary encoding, which is directly used as the behavior feature vector.

[0067] (2) Determine the attention weight of each time interval information relative to the behavior sequence. According to the attention weight of each time interval information relative to the behavior sequence, perform weighted summation on the encoding of each time interval information to obtain a summary encoding. The summary encoding is concatenated with the encoding of the behavior sequence to obtain a behavior feature vector.

[0068] (3) For the encoding of each behavior, determine the attention weight of each time interval information relative to the encoding of the behavior; for the encoding of each behavior, perform weighted summation on the encoding of each time interval information according to the attention weight of each time interval information relative to the encoding of the behavior to obtain the sub-aggregate encoding corresponding to the behavior, organize the sub-aggregate encodings corresponding to each behavior into a matrix, and use a fully connected layer module to generate a behavior feature vector.

[0069] During the training process, you can choose which of the above three solutions to use based on the accuracy of the overall model and the training speed.

[0070] In some embodiments, each behavior in the behavior sequence is embedded coded to generate a first embedded coded sequence; based on the first embedded coded sequence, a third neural network module is used to obtain the behavior coding.

[0071] For example, the first encoding module includes: an embedding module and a third neural network module. The embedding module is used to perform embedded encoding on each behavior to generate a first embedded encoding sequence, and the first embedded encoding sequence can be input into the encoding module of the Transformer to obtain the encoding of each behavior and the encoding of the entire behavior sequence. The third neural network module can also be RNN (Recurrent Neural Network), CNN (Convolutional Neural Networks), etc., not limited to the examples given.

[0072] In some embodiments, each time interval information in the time series is binned to obtain multiple time values; each of the multiple time values ​​is embedded encoded to form a second embedded coding sequence; based on the second embedded coding sequence, a fourth neural network module is used to obtain time coding.

[0073] For example, the second encoding module includes: a binning module, an embedding module and a fourth neural network module. The time interval information is binned according to 1 second intervals, discretized into seconds, and multiple time values ​​are obtained. An embedding module can be used to perform embedded encoding on each time value to generate a second embedded encoding sequence, and the second embedded encoding sequence can be input into the encoding module of the Transformer to obtain the encoding of each time interval information. The fourth neural network module can also be RNN, CNN, etc., not limited to the examples given.

[0074] In step S106, it is determined whether the behavior sequence is abnormal based on the behavior feature vector.

[0075] The detection model may also include a classification module. In some embodiments, classification is performed based on the behavior feature vector to obtain a classification result indicating whether the behavior sequence is abnormal. For example, DNN (Deep Neural Networks) is used for classification to obtain the probability of abnormal behavior sequence and the probability of normal behavior sequence.

[0076] The user's behavior in each cycle can be obtained; based on multiple consecutive behaviors from the preset starting behavior to the behavior of this cycle, a behavior sequence is obtained, and then the probability of an abnormality is predicted based on the behavior sequence. When the user generates a preset ending behavior and the probability of an abnormality is higher than a threshold, it is determined that the user's behavior sequence (overall behavior) is abnormal, the preset ending behavior can be rejected, and the rejection information is returned.

[0077] The method of the above embodiment obtains a behavior sequence composed of multiple behaviors of the user, and a time series composed of the time interval information of each two adjacent behaviors, generates a behavior feature vector based on the behavior sequence and the time series, and then determines whether the behavior sequence is abnormal based on the behavior feature vector. The method of the above embodiment adopts the behavior sequence of the user, ensures the completeness of the behavior features, and refers to the causal dependencies between various behaviors. By adopting the time series, the time features between behaviors can be captured, and the time features between abnormal behaviors can be considered. Combining the behavior sequence and the time series can more accurately detect abnormal behavior sequences.

[0078] In addition, by fusing behavioral coding and time coding based on the attention mechanism, it is possible to capture behavioral patterns with extremely short action intervals, capture the similarities in time intervals between different behavioral sequences, and improve the accuracy of detecting abnormal behaviors.

[0079] Combine the following Figure 2 Describes the training methods for detection models of anomalous behavior.

[0080] Figure 2 Flowcharts of some embodiments of the training method of the abnormal behavior detection model disclosed in the present invention. Figure 2 As shown, the method of this embodiment includes: steps S202 to S208.

[0081] In step S202, a behavior sequence, a time sequence, and a label corresponding to each sample user among a plurality of sample users are obtained.

[0082] The time series is a sequence consisting of the time interval information of each two adjacent behaviors in the behavior sequence. The label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal.

[0083] In step S204, the behavior sequence and time series of each sample user are input into the abnormal behavior detection model.

[0084] In step S206, the abnormal behavior detection model outputs a result of whether the behavior sequence of each sample user is abnormal.

[0085] In the abnormal behavior detection model, a behavior feature vector of each sample user is generated according to the behavior sequence and time series of each sample user, and a result of whether the behavior sequence of each sample user is abnormal is output according to the behavior feature vector of each sample user. The method executed in the abnormal behavior detection model can refer to the above embodiment and will not be repeated here.

[0086] In step S208, the parameters of the abnormal behavior detection model are adjusted according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user.

[0087] Each round of training may perform the above steps S204 to S208, and multiple rounds of training may be repeated until a preset convergence condition is reached. For example, the preset condition is that the loss function value reaches a preset value or a minimum value, or reaches a preset number of iterations, etc., and is not limited to the examples given.

[0088] In some embodiments, the result of whether the behavior sequence of each sample user is abnormal includes: the probability of each sample user's behavior sequence being abnormal and the probability of being normal; determining the cross-entropy loss function based on the probability of each sample user's behavior sequence being abnormal and the probability of being normal, and the label of each sample user; and adjusting the parameters of the abnormal behavior detection model based on the cross-entropy loss function.

[0089] For example, the parameters of the detection model can be adjusted by using a gradient descent method according to the cross entropy loss function. The adjustment method can refer to the prior art and will not be described in detail here.

[0090] Combine the following Figure 3 and 4 Some specific application examples of the abnormal behavior detection method disclosed in the present invention are described.

[0091] Taking cashing out as an example of abnormal behavior sequence, in actual application scenarios, there are two steps: the cashing out intermediary takes over the user account to complete the order and the user retrieves the account to complete the payment. The operation sequence of abnormal accounts is consistent. Figure 3 As shown in Figure 3, the operation sequences of abnormal users A and B are exactly the same. But they are also exactly the same as those of normal user C. In this case, as shown in Figure 3, the only difference between normal users and abnormal users is the time interval between each behavior. Introducing the time interval sequence into the model helps to distinguish these abnormal users from normal users and improve the detection effect of the model.

[0092] For example, for a user, obtain the user's behavior sequence: login, browse homepage, place an order, log out, login, place an order, and the time sequence: 1s, 2s, 5s, 60s, 5s. Figure 4 As shown in the figure, each behavior is encoded to obtain the behavior code, and the time interval between each two adjacent behaviors is discretized into seconds and then encoded to obtain the time code. The behavior code and time code are fused based on the attention mechanism. Finally, the fused behavior features are adjacently classified to obtain the classification result of whether it is a cash-out behavior.

[0093] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0094] For example: After collecting user behavior or time information, the data will be de-identified through technical means, and secure encryption technology and other methods will be used to ensure that the recipient of the information cannot re-identify a specific individual.

[0095] The present disclosure also provides a detection device for abnormal behavior. Figure 5 Give a description.

[0096] Figure 5 FIG. 1 is a structural diagram of some embodiments of the abnormal behavior detection device disclosed in the present invention. Figure 5 As shown, the device 50 of this embodiment includes: an acquisition module 510 , a generation module 520 , and a determination module 530 .

[0097] The acquisition module 510 is used to acquire the user's behavior sequence and time sequence, wherein the time sequence is a sequence composed of the time interval information between every two adjacent behaviors in the behavior sequence.

[0098] In some embodiments, the acquisition module 510 is used to acquire the user's behavior in each cycle; form an original behavior sequence from a preset starting behavior to the behavior of this cycle; and select some or all of the behaviors to form a behavior sequence based on the importance of each behavior in the original behavior sequence.

[0099] In some embodiments, the acquisition module 510 is also used to obtain multiple consecutive behaviors of each historical user among multiple historical users within a preset historical time period and a label of each historical user, wherein the label of each historical user is used to indicate whether the multiple consecutive behaviors of each historical user are abnormal; based on the multiple consecutive behaviors of each historical user within the preset historical time period and the label of each historical user, determine the relevance index of each behavior relative to the label, wherein the relevance index includes: Kolmogorov-Smirnov value or information value or Pearson correlation coefficient; determine the importance of each behavior based on the relevance index of each behavior relative to the label.

[0100] The generating module 520 is used to generate a behavior feature vector according to the behavior sequence and the time series.

[0101] In some embodiments, the generation module 520 is used to encode the behavior sequence to obtain the behavior code; encode the time series to obtain the time code; and fuse the behavior code and the time code according to the attention mechanism to generate a behavior feature vector.

[0102] In some embodiments, the generation module 520 is used to determine the attention weight corresponding to the time code according to the correlation between the behavior code and the time code; determine the summary code according to the time code and the attention weight corresponding to the time code; and generate a behavior feature vector according to the summary code.

[0103] In some embodiments, the behavior coding includes the coding of the behavior sequence, the time coding includes the coding of each time interval information in the time sequence, the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to the behavior sequence, and the generation module 520 is used to determine the correlation between the coding of each time interval information and the coding of the behavior sequence as the attention weight of each time interval information relative to the behavior sequence; according to the attention weight of each time interval information relative to the behavior sequence, the coding of each time interval information is weighted and summed to obtain a summary coding.

[0104] In some embodiments, the generation module 520 is used to use the summary code as a behavior feature vector; or to concatenate the summary code with the code of the behavior sequence to obtain the behavior feature vector.

[0105] In some embodiments, the generation module 520 is used to determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior sequence; or to determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence using the first neural network module based on the encoding of each time interval information and the encoding of the behavior sequence.

[0106] In some embodiments, the behavior coding includes the coding of each behavior in the behavior sequence, the time coding includes the coding of each time interval information in the time series, and the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to each behavior. The generation module 520 is used to determine, for the coding of each behavior, the correlation between the coding of each time interval information and the coding of the behavior, as the attention weight of each time interval information relative to the coding of the behavior; for the coding of each behavior, the coding of each time interval information is weighted and summed according to the attention weight of each time interval information relative to the coding of the behavior to obtain the sub-aggregate coding corresponding to the behavior; and the sub-aggregate coding corresponding to each behavior is combined into an aggregate coding.

[0107] In some embodiments, the generation module 520 is used to generate a behavior feature vector based on summary coding and using a fully connected layer module.

[0108] In some embodiments, the generation module 520 is used to determine the correlation between the encoding of each time interval information and the encoding of the behavior based on the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior; or to determine the correlation between the encoding of each time interval information and the encoding of the behavior using a second neural network module based on the encoding of each time interval information and the encoding of the behavior.

[0109] In some embodiments, the generation module 520 is used to perform embedded coding on each behavior in the behavior sequence to generate a first embedded coding sequence; based on the first embedded coding sequence, a third neural network module is used to obtain the behavior coding.

[0110] In some embodiments, the generation module 520 is used to perform binning processing on each time interval information in the time series to obtain multiple time values; perform embedded coding on each time value in the multiple time values ​​to form a second embedded coding sequence; and according to the second embedded coding sequence, use a fourth neural network module to obtain time coding.

[0111] The determination module 530 is used to determine whether the behavior sequence is abnormal according to the behavior feature vector.

[0112] In some embodiments, the determination module 530 is used to perform classification according to the behavior feature vector to obtain a classification result indicating whether the behavior sequence is abnormal.

[0113] The present disclosure also provides a training device for an abnormal behavior detection model. Figure 6 Give a description.

[0114] Figure 6 FIG. 1 is a structural diagram of some embodiments of the training device for detecting abnormal behavior of the present disclosure. Figure 6 As shown, the device 60 of this embodiment includes: an acquisition module 610 , an input module 620 , a detection module 630 , and an adjustment module 640 .

[0115] The acquisition module 610 is used to obtain the behavior sequence, time series and label corresponding to each sample user among multiple sample users, wherein the time series is a sequence composed of the time interval information of each two adjacent behaviors in the behavior sequence, and the label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal.

[0116] The input module 620 is used to input the behavior sequence and time series of each sample user into the abnormal behavior detection model.

[0117] The detection module 630 is used to generate a behavior feature vector for each sample user according to the behavior sequence and time series of each sample user in the abnormal behavior detection model, and output a result of whether the behavior sequence of each sample user is abnormal according to the behavior feature vector of each sample user.

[0118] The adjustment module 640 is used to adjust the parameters of the abnormal behavior detection model according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user.

[0119] In some embodiments, the result of whether the behavior sequence of each sample user is abnormal includes: the probability of each sample user's behavior sequence being abnormal and the probability of being normal. The adjustment module 640 is used to determine the cross-entropy loss function based on the probability of each sample user's behavior sequence being abnormal and the probability of being normal, and the label of each sample user; and adjust the parameters of the abnormal behavior detection model based on the cross-entropy loss function.

[0120] The electronic devices in the embodiments of the present disclosure (for example, the aforementioned detection device or training device) can be implemented by various computing devices or computer systems. Figure 7 as well as Figure 8 Give a description.

[0121] Figure 7 FIG. 1 is a structural diagram of some embodiments of the electronic device disclosed in the present invention. Figure 7 As shown, the electronic device 70 of this embodiment includes: a memory 710 and a processor 720 coupled to the memory 710, and the processor 720 is configured to execute the abnormal behavior detection method or the abnormal behavior detection model training method in any of the embodiments of the present disclosure based on the instructions stored in the memory 710.

[0122] The memory 710 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0123] Figure 8 FIG. 1 is a structural diagram of some other embodiments of the electronic device disclosed in the present invention. Figure 8As shown, the electronic device 80 of this embodiment includes: a memory 810 and a processor 820, which are similar to the memory 710 and the processor 720 respectively. It can also include an input and output interface 830, a network interface 840, a storage interface 850, etc. These interfaces 830, 840, 850 and the memory 810 and the processor 820 can be connected, for example, via a bus 860. Among them, the input and output interface 830 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 840 provides a connection interface for various networked devices, for example, it can be connected to a database server or a cloud storage server. The storage interface 850 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0124] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0128] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A method for detecting abnormal behavior, comprising: Acquire a user's behavior sequence and time sequence, wherein the time sequence is a sequence consisting of time interval information between every two adjacent behaviors in the behavior sequence; Generate a behavior feature vector according to the behavior sequence and the time series; Whether the behavior sequence is abnormal is determined according to the behavior feature vector.

2. The detection method according to claim 1, wherein: Generating a behavior feature vector according to the behavior sequence and the time sequence includes: Encoding the behavior sequence to obtain behavior code; Encoding the time series to obtain a time code; The behavior code and the time code are fused according to an attention mechanism to generate the behavior feature vector.

3. The detection method according to claim 2, wherein: The fusing the behavior code and the time code according to the attention mechanism to generate the behavior feature vector comprises: Determining an attention weight corresponding to the time code according to a correlation between the behavior code and the time code; Determining a summary code according to the time code and the attention weight corresponding to the time code; The behavior feature vector is generated according to the summary coding.

4. The detection method according to claim 3, wherein: The behavior coding includes coding of the behavior sequence, the time coding includes coding of each time interval information in the time sequence, and the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to the behavior sequence, The determining, according to the correlation between the behavior code and the time code, the attention weight corresponding to the time code comprises: Determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence as the attention weight of each time interval information relative to the behavior sequence; The determining of the summary code according to the time code and the attention weight corresponding to the time code comprises: According to the attention weight of each time interval information relative to the behavior sequence, the encoding of each time interval information is weighted summed to obtain the summary encoding.

5. The detection method according to claim 4, wherein: Generating the behavior feature vector according to the summary coding includes: Encode the summary as the behavior feature vector; or The summary code is concatenated with the code of the behavior sequence to obtain the behavior feature vector.

6. The detection method according to claim 4, wherein: The determining of the correlation between the encoding of each time interval information and the encoding of the behavior sequence comprises: Determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence according to the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior sequence; or According to the encoding of each time interval information and the encoding of the behavior sequence, a first neural network module is used to determine the correlation between the encoding of each time interval information and the encoding of the behavior sequence.

7. The detection method according to claim 3, wherein: The behavior coding includes the coding of each behavior in the behavior sequence, the time coding includes the coding of each time interval information in the time sequence, and the attention weight corresponding to the time coding includes the attention weight of each time interval information relative to each behavior, The determining, according to the correlation between the behavior code and the time code, the attention weight corresponding to the time code comprises: For each behavior encoding, determining the correlation between the encoding of each time interval information and the encoding of the behavior as the attention weight of each time interval information relative to the encoding of the behavior; The determining of the summary code according to the time code and the attention weight corresponding to the time code comprises: For the code of each behavior, according to the attention weight of each time interval information relative to the code of the behavior, weighted sum the code of each time interval information to obtain the sub-aggregate code corresponding to the behavior; The sub-aggregate codes corresponding to each of the behaviors are combined into the aggregate code.

8. The detection method according to claim 7, wherein: Generating the behavior feature vector according to the summary coding includes: According to the summary coding, a fully connected layer module is used to generate the behavior feature vector.

9. The detection method according to claim 7, wherein: The determining of the correlation between the encoding of each time interval information and the encoding of the behavior comprises: Determine the correlation between the encoding of each time interval information and the encoding of the behavior according to the cosine distance or vector inner product between the encoding of each time interval information and the encoding of the behavior; or According to the encoding of each time interval information and the encoding of the behavior, a second neural network module is used to determine the correlation between the encoding of each time interval information and the encoding of the behavior.

10. The detection method according to claim 2, wherein: The encoding of the behavior sequence to obtain the behavior code comprises: Performing embedded coding on each behavior in the behavior sequence to generate a first embedded coding sequence; According to the first embedded coding sequence, a third neural network module is used to obtain the behavioral coding.

11. The detection method according to claim 2, wherein: The encoding of the time series to obtain the time code comprises: Perform binning processing on each time interval information in the time series to obtain multiple time values; Performing embedded coding on each of the multiple time values ​​to form a second embedded coding sequence; According to the second embedded coding sequence, a fourth neural network module is used to obtain the time coding.

12. The detection method according to any one of claims 1 to 11, wherein: The behavior sequence of obtaining the user includes: In each period, the user's behavior in the period is obtained; The continuous multiple behaviors from the preset starting behavior to the behavior of this cycle form an original behavior sequence; According to the importance of each behavior in the original behavior sequence, some or all behaviors are selected to form the behavior sequence.

13. The detection method according to claim 12, further comprising: Acquire a plurality of continuous behaviors of each historical user in a preset historical time period and a label of each historical user, wherein the label of each historical user is used to indicate whether the plurality of continuous behaviors of each historical user is abnormal; Determine, according to the continuous multiple behaviors of each historical user in a preset historical time period and the label of each historical user, a correlation index of each behavior relative to the label, wherein the correlation index includes: Kolmogorov-Smirnov value or information value or Pearson correlation coefficient; The importance of each behavior is determined according to a relevance index of each behavior relative to the label.

14. The detection method according to any one of claims 1 to 11, wherein: The determining whether the behavior sequence is abnormal according to the behavior feature vector comprises: Classification is performed according to the behavior feature vector to obtain a classification result indicating whether the behavior sequence is abnormal.

15. A method for training an abnormal behavior detection model, comprising: Obtaining a behavior sequence, a time series, and a label corresponding to each sample user among multiple sample users, wherein the time series is a sequence composed of time interval information of every two adjacent behaviors in the behavior sequence, and the label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal; Inputting the behavior sequence and time series of each sample user into the abnormal behavior detection model; In the abnormal behavior detection model, a behavior feature vector of each sample user is generated according to the behavior sequence and time series of each sample user, and a result of whether the behavior sequence of each sample user is abnormal is output according to the behavior feature vector of each sample user; According to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user, the parameters of the abnormal behavior detection model are adjusted.

16. The training method according to claim 15, wherein: The result of whether the behavior sequence of each sample user is abnormal includes: the probability of abnormality and the probability of normality of the behavior sequence of each sample user, The adjusting the parameters of the abnormal behavior detection model according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user includes: Determine a cross entropy loss function according to the probability of abnormality and normality of the behavior sequence of each sample user and the label of each sample user; According to the cross entropy loss function, the parameters of the abnormal behavior detection model are adjusted.

17. A device for detecting abnormal behavior, comprising: An acquisition module, used to acquire a user's behavior sequence and time sequence, wherein the time sequence is a sequence composed of time interval information between every two adjacent behaviors in the behavior sequence; A generating module, used for generating a behavior feature vector according to the behavior sequence and the time series; A determination module is used to determine whether the behavior sequence is abnormal according to the behavior feature vector.

18. A training device for an abnormal behavior detection model, comprising: An acquisition module, used to acquire a behavior sequence, a time sequence, and a label corresponding to each sample user among a plurality of sample users, wherein the time sequence is a sequence composed of time interval information of every two adjacent behaviors in the behavior sequence, and the label of each sample user is used to indicate whether the behavior sequence of each sample user is abnormal; An input module, used to input the behavior sequence and time series of each sample user into the abnormal behavior detection model; A detection module, configured to generate a behavior feature vector of each sample user according to the behavior sequence and time sequence of each sample user in the abnormal behavior detection model, and output a result of whether the behavior sequence of each sample user is abnormal according to the behavior feature vector of each sample user; The adjustment module is used to adjust the parameters of the abnormal behavior detection model according to the result of whether the behavior sequence of each sample user is abnormal and the label of each sample user.

19. An electronic device comprising: processor; as well as A memory coupled to the processor, for storing instructions, wherein when the instructions are executed by the processor, the processor executes the abnormal behavior detection method according to any one of claims 1 to 14 or the abnormal behavior detection model training method according to claim 15 or 16.

20. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein: When the program is executed by a processor, the abnormal behavior detection method described in any one of claims 1 to 14 or the abnormal behavior detection model training method described in claim 15 or 16 is implemented.

Images