Risk behavior identification method and device and computer readable storage medium

Abstract

The invention provides a risk behavior identification method and device and a computer readable storage medium, relates to the technical field of information security, and can improve the capability of identifying and learning fraud-related behaviors and provide timely and effective fraud prevention service for a user. The method comprises the following steps: acquiring an initial sample set and an online real sample set; according to the online real sample set, expanding the initial sample set to obtain an offline enhanced sample set; training a classification model according to the offline enhanced sample set and the online real sample set to obtain a reasoning prediction model; and sending the reasoning prediction model to an electronic device, so that the electronic device performs risk identification on the behavior of the user by using the reasoning prediction model.

Description

Technical Field

[0001] This application relates to the field of information security technology, and particularly to a risk behavior recognition method, device, and computer-readable storage medium. Background Art

[0002] With the popularization and development of the Internet, telecommunications fraud has become increasingly rampant, causing huge economic losses to users. Existing anti-fraud technologies mainly rely on existing blacklist data to provide anti-fraud services for users. The fraud means and methods of fraud analysis are constantly upgraded in the anti-fraud confrontation, making it more difficult to identify fraud behaviors. The existing anti-fraud recognition methods have very limited preventive effects on variant frauds and new types of frauds, and cannot provide timely and effective anti-fraud services for users. Summary of the Invention

[0003] Embodiments of this application provide a risk behavior recognition method, device, and computer-readable storage medium, which can improve the ability to identify and learn fraud-related behaviors and provide timely and effective anti-fraud services for users.

[0004] To achieve the above object, the embodiments of this application adopt the following technical solutions:

[0005] In a first aspect, embodiments of this application provide a risk behavior recognition method applied to a service device. The method includes: The service device obtains an initial sample set and an online real sample set; expands the initial sample set according to the online real sample set to obtain an offline enhanced sample set; trains a classification model according to the offline enhanced sample set and the online real sample set to obtain an inference prediction model; and sends the inference prediction model to an electronic device so that the electronic device uses the inference prediction model to perform risk identification on the user's behavior.

[0006] Based on the technical solution provided by this application, the service device expands the initial sample set based on the online real sample set to ensure that the number of enhanced sample sets is within a suitable range. In this way, training based on the expanded offline enhanced sample set and the online real sample set can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, improve the accuracy of the inference prediction model, and improve the ability of the inference prediction model to identify and learn fraud-related behaviors.

[0007] In a possible implementation manner of the first aspect, the service device obtains an initial sample set, including: obtaining risk behaviors of a fraud chain; constructing a basic sample type according to the risk behaviors; and constructing an initial sample set according to the basic sample type.

[0008] Based on the above possible implementation methods, the service device constructs the basic sample types through the risk behaviors of the fraud link, and then constructs the initial sample set, which can ensure that various possible types of initial samples are obtained, avoiding the problem that since fraud cases are sparser than non-fraud cases, directly using real fraud cases to generate samples cannot ensure that all types of fraud cases can be collected. The multi-type sample data provides data support for improving the accuracy of the inference prediction model and the ability to capture fraud-related behaviors.

[0009] In a possible implementation method of the first aspect, the risk behaviors include preset area telephone behaviors, preset risk status behaviors, and jump payment behaviors;

[0010] The preset risk status behaviors include turning on screen sharing, turning on do not disturb, turning on call blocking, turning on text message blocking, and turning on call forwarding.

[0011] Based on the above possible implementation methods, the service device can construct different types of basic samples based on various risk behaviors, providing data support for constructing the initial sample set.

[0012] In a possible implementation method of the first aspect, the service device expands the initial sample set according to the online real sample set to obtain an offline enhanced sample set, including: determining the number of real samples in the online real sample set; resampling and expanding the initial sample set according to the number of real samples and a preset ratio threshold to obtain an offline enhanced sample set.

[0013] Based on the above possible implementation methods, the service device expands the initial sample set based on the number of the online real sample set to ensure that the number of the enhanced sample set is within a suitable range, which can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, and provide support for improving the learning ability and accuracy of the inference prediction model to capture fraud-related behaviors.

[0014] In a possible implementation method of the first aspect, the method further includes: the service device receives a new real sample set sent by the electronic device; when the number of the new real sample set reaches a preset number threshold, expanding the initial sample set according to the online real sample set and the new real sample set to obtain a new offline enhanced sample set; training a classification model according to the new offline enhanced sample set, the online real sample set, and the new real sample set to obtain a new inference prediction model; sending the new inference prediction model to the electronic device so that the electronic device uses the new inference prediction model to perform risk identification on the user's behavior.

[0015] Based on the above possible implementation manners, the service device continuously collects a real sample set based on the security-significant attack and defense characteristics, and continuously updates the inference prediction model to ensure that the inference prediction model maintains the learning ability of the latest data distribution and the learning ability to capture fraud-related behaviors.

[0016] In a second aspect, an embodiment of the present application further provides a risk behavior recognition method, which is applied to an electronic device. The method includes: when it is collected that the real-time behavior of the user is a payment entry behavior, obtaining the behavior characteristics corresponding to the historical behavior of the user; processing the behavior characteristics by using an inference prediction model to obtain a prediction result, where the inference prediction model is trained by a service device based on an offline enhanced sample set and an online real sample set; and when the prediction result is that a risk is predicted, outputting a prompt message, where the prompt message is used to prompt the user that the real-time behavior has a risk.

[0017] Based on the technical solution provided by the present application, the electronic device determines whether the user behavior is a risk behavior based on the inference prediction model trained by the service device. The inference prediction model is trained based on the expanded offline enhanced sample set and the online real sample set. Combining the iterative mixing and training method of the online real samples on the electronic device side and the offline enhanced samples on the service device side can ensure that the inference prediction model takes into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors, can improve the accuracy of risk behavior recognition, and provide timely and effective anti-fraud services for users.

[0018] In a possible implementation manner of the second aspect, the method further includes: the electronic device obtains the feedback information corresponding to the real-time behavior; generates a real sample based on the behavior characteristics, the prediction result, and the feedback information; adds the real sample to a new real sample set; and when the new real sample set meets a preset condition, sends the new real sample set to the service device so that the service device determines a new inference prediction model based on the new real sample set.

[0019] Based on the above possible implementation manners, the electronic device generates real samples online and reports the real samples to the service device according to preset conditions, so that the service device updates the inference prediction model based on the latest data distribution, providing support for improving the accuracy of risk behavior recognition.

[0020] In a possible implementation manner of the second aspect, when the electronic device collects that the real-time behavior of the user is a payment entry behavior and obtains the behavior characteristics corresponding to the historical behavior of the user, it includes: when it is collected that the real-time behavior of the user is a payment entry behavior, obtaining the historical behavior executed by the user within a preset time period; and determining the behavior characteristics corresponding to the historical behavior according to a preset rule.

[0021] Based on the above possible implementation manners, when it is detected that a payment behavior is entered, the electronic device determines the behavior characteristics corresponding to the historical behavior based on the user's historical behavior and preset rules, and identifies whether there is a risk in the current behavior by analyzing the behavior characteristics corresponding to the historical behavior.

[0022] In a possible implementation manner of the second aspect, the method further includes: when the real-time behavior of the user collected by the electronic device is not a payment behavior, adding the real-time behavior to the historical behavior table.

[0023] Based on the above possible implementation manner, if the current behavior is not a payment behavior, it is stored in the historical behavior table, providing a judgment basis for whether the subsequent payment behavior is a risky behavior.

[0024] In a possible implementation manner of the second aspect, the electronic device obtains the feedback information corresponding to the real-time behavior, including: when the prediction result is a predicted risk-free, determining the feedback information corresponding to the real-time behavior as no feedback and no risk; when the prediction result is a predicted risky, obtaining the feedback behavior executed by the user based on the prompt information; and determining the feedback information corresponding to the real-time behavior according to the feedback behavior.

[0025] Based on the above possible implementation manner, when the prediction result determined by the inference prediction model is a predicted risky, a prompt information is output to remind the user that there is a risk in the current behavior. This method can realize issuing a risk prompt during the event (before payment), helping the user to stop losses in time, and effectively providing anti-fraud services for the user.

[0026] In a possible implementation manner of the second aspect, the electronic device determines the feedback information corresponding to the real-time behavior according to the feedback behavior, including: when the feedback behavior is a risk-free marking behavior, determining the feedback information corresponding to the real-time behavior as having feedback and no risk; when the feedback behavior is a risky marking behavior, determining the feedback information corresponding to the real-time behavior as having feedback and having risk; when the feedback behavior is not received within a preset time period, determining the feedback information corresponding to the real-time behavior as no feedback and low risk.

[0027] Based on the above possible implementation manner, the electronic device collects the user's feedback behavior, generates real samples based on the feedback information corresponding to the feedback behavior, and provides data support for the subsequent service device to update the inference prediction model.

[0028] In a third aspect, an embodiment of the present application further provides a risk behavior recognition device, which can be applied to a service device. The functions of the device can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, for example, an acquisition module, an augmentation module, a training module, and a sending module.

[0029] Among them, the acquisition module can be used to acquire an initial sample set and an online real sample set;

[0030] The augmentation module can be used to augment the initial sample set according to the online real sample set to obtain an offline enhanced sample set;

[0031] The training module can be used to train a classification model according to the offline enhanced sample set and the online real sample set to obtain an inference prediction model;

[0032] The sending module can be used to send the inference prediction model to an electronic device, so that the electronic device uses the inference prediction model to perform risk recognition on the user's behavior.

[0033] In a fourth aspect, an embodiment of the present application further provides a risk behavior recognition device, which can be applied to an electronic device. The functions of the device can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, for example, an acquisition module, a processing module, and an output module.

[0034] Among them, the acquisition module can be used to acquire the behavior characteristics corresponding to the user's historical behavior when it is collected that the user's real-time behavior is entering a payment behavior;

[0035] The processing module can be used to process the behavior characteristics by using an inference prediction model to obtain a prediction result, and the inference prediction model is trained by a service device based on an offline enhanced sample set and an online real sample set;

[0036] The output module can be used to output a prompt message when the prediction result is that there is a risk, and the prompt message is used to prompt the user that the real-time behavior is risky.

[0037] In a fifth aspect, the present application provides a service device, which includes a memory and at least one processor; the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the service device is made to execute the risk behavior recognition method provided in the first aspect and any one of its possible design manners.

[0038] In a sixth aspect, the present application provides an electronic device, which includes a display screen, a memory, and one or more processors; the display screen, the memory are coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, when the computer instructions are executed by the processor, the electronic device is caused to execute the risk behavior recognition method provided by the second aspect and any possible design manner thereof.

[0039] In a seventh aspect, the present application provides a computer-readable storage medium, which includes computer instructions, when the computer instructions run on a service device, the service device is caused to execute the risk behavior recognition method provided by the first aspect and any possible design manner thereof.

[0040] In an eighth aspect, the present application provides a computer-readable storage medium, which includes computer instructions, when the computer instructions run on an electronic device, the electronic device is caused to execute the risk behavior recognition method provided by the second aspect and any possible design manner thereof.

[0041] In a ninth aspect, the present application provides a computer program product, when the computer program product runs on a service device, the service device is caused to execute the risk behavior recognition method provided by the first aspect and any possible design manner thereof.

[0042] In a tenth aspect, the present application provides a computer program product, when the computer program product runs on an electronic device, the electronic device is caused to execute the risk behavior recognition method provided by the second aspect and any possible design manner thereof.

[0043] It can be understood that for the beneficial effects that can be achieved by the technical solutions provided in the third aspect, the fifth aspect, the seventh aspect, and the ninth aspect above, reference can be made to the beneficial effects in the first aspect and any possible design manner thereof. For the beneficial effects that can be achieved by the technical solutions provided in the fourth aspect, the sixth aspect, the eighth aspect, and the tenth aspect above, reference can be made to the beneficial effects in the second aspect and any possible design manner thereof, which will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of the network architecture of a risk behavior recognition system provided in the related art;

[0045] Figure 2 It is a schematic diagram of the usage scenario of a risk behavior recognition method provided in the related art;

[0046] Figure 3 It is a schematic diagram of the network architecture of a risk behavior recognition system provided by an embodiment of the present application;

[0047] Figure 4 Schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application;

[0048] Figure 5A Schematic flow chart of a risk behavior recognition method provided by an embodiment of the present application;

[0049] Figure 5B Schematic diagram of the processing of the risk behavior recognition method provided by an embodiment of the present application;

[0050] Figure 5C Schematic diagram of obtaining an offline enhanced sample set in the risk behavior recognition method provided by an embodiment of the present application;

[0051] Figure 6A Schematic diagram of the electronic device outputting a prompt message in the risk behavior recognition method provided by an embodiment of the present application;

[0052] Figure 6B Schematic diagram of the user performing a feedback behavior in the risk behavior recognition method provided by an embodiment of the present application;

[0053] Figure 7 Schematic flow chart of another risk behavior recognition method provided by an embodiment of the present application;

[0054] Figure 8 Schematic flow chart of yet another risk behavior recognition method provided by an embodiment of the present application;

[0055] Figure 9 Schematic flow chart of still another risk behavior recognition method provided by an embodiment of the present application;

[0056] Figure 10 Schematic diagram of the structure of a risk behavior recognition device provided by an embodiment of the present application;

[0057] Figure 11 Schematic diagram of the structure of another risk behavior recognition device provided by an embodiment of the present application. Detailed implementation manners

[0058] The terms used in the following embodiments of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. As used in the specification and appended claims of this application, the singular forms "a", "an", "the", "above-mentioned", "said", and "this" are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that " / " means "or". For example, A / B can mean A or B; "and / or" in the text is only a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone.

[0059] Referring to "embodiments" in this application means that the specific features, structures, or characteristics described in connection with the embodiments can be included in at least one embodiment of this application. The occurrence of this phrase at various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described in this application can be combined with other embodiments.

[0060] The terms "first" and "second" in the following embodiments of this application are only for descriptive purposes and cannot be construed as implying or suggesting relative importance or implicitly indicating the quantity of the indicated technical features. Thus, features defined with "first" and "second" can explicitly or implicitly include one or more of such features. In the description of the embodiments of this application, unless otherwise stated, the meaning of "a plurality" is two or more.

[0061] Before further elaborating on the embodiments of this application, the nouns and terms involved in the embodiments of this application are first explained.

[0062] A fraud chain refers to the fraud journey when conducting fraud based on the fraud type and involves multiple risky behaviors. A fraud chain can include: channel drainage, building trust, defrauding money, and fraud completion, etc.

[0063] A black sample library refers to a sample library generated based on the fraud information included in the confirmed fraud chain. Among them, the fraud information can include fraud application programs, fraud phone / short message numbers, and fraud Uniform Resource Locators (URLs), etc.

[0064] A white sample library refers to a sample library generated based on the trust information included in the confirmed trust chain. Among them, the trust information can include trust application programs, trust phone / short message numbers, and trust URLs, etc.

[0065] A gray sample library refers to a sample library generated based on feedback information that is uncertain whether it is fraud information or trusted information. In the embodiments of the present application, the feedback information that is uncertain whether it is fraud information or trusted information may specifically refer to the feedback information with a low feedback risk.

[0066] Data Augmentation is a method of using a small amount of data to generate more similar generated data through prior knowledge to expand the training data set.

[0067] With the popularization of the Internet, telecom fraud incidents occur frequently. During the use of electronic devices by users, in the face of a complex and diverse network environment, they may fall into telecom fraud, resulting in losses of personal property. It has become crucial to quickly prevent or identify possible telecom fraud behaviors from large-scale, high-concurrency, and multi-dimensional data. Table 1 is a statistical table of several common fraud cases in telecom fraud:

[0068] Table 1 Statistical Information of Common Fraud Cases in Telecom Fraud

[0069]

[0070] To prevent users from being deceived and avoid economic losses to users, some existing electronic devices (such as mobile phones, computers, etc.) are configured with a risk behavior recognition module. Based on a pre-provided black sample library, it intercepts or reminds risky information or operations, etc., to provide users with an anti-fraud function. For example, when a user uses an electronic device, if the account for communication is a number in the black sample library, or the downloaded application (Application, App) is an App in the black sample library, or the accessed website is a Uniform Resource Locator (URL) in the black sample library, the risk behavior recognition module in the electronic device can recognize that the current information or operation is risky and will intercept it or give a prompt message.

[0071] Figure 1 It is a schematic diagram of the network architecture of a risk behavior recognition system provided in the related art. As Figure 1 shown, the risk behavior recognition system in the related art includes at least one electronic device 101 ( Figure 1 shown as two electronic devices 101-1 and 101-2 here), a service device 102, and a network 103. The service device 102 first trains an inference model based on the existing black sample library and white sample library, and sends the trained inference model to the electronic device 101 through the network 103.

[0072] The electronic device 101 receives a trained inference model. Based on this recommendation model, the risk behavior recognition module in the electronic device 101 provides anti-fraud services for users: First, obtain the behavior data generated by the user during the use of the electronic device 101, and then use the received inference model to infer the behavior data to obtain an inference result, which includes a first inference result and a second inference result. Among them, the first inference result indicates that there is a risk in the user behavior data, that is, the behavior data includes risk behavior data. The second inference result indicates that there is no risk in the user behavior data, that is, the behavior data does not include risk behavior data.

[0073] Exemplarily, Figure 2 It is a schematic diagram of the usage scenario of a risk behavior recognition method provided in the related art. When the user is using the electronic device 101, they see fraud content published by fraudsters through media such as search engines or websites. Based on the guidance of the fraud content, a download behavior of downloading an App is triggered. Then, after using the downloaded App to place an order for brushing orders and triggering the entry into the payment App, the risk behavior recognition module uses the inference model to perform risk identification on the user's behavior data within a preset duration to obtain an inference result. Suppose the App is a fraud App in the black sample library, the inference result is that the user's behavior is risky. Suppose the App is an App repackaged based on the fraud App in the black sample library. Since this repackaged App is not in the black sample library, the existing inference model cannot identify that this App is a fraud App, and the inference result is that the user's behavior is not risky.

[0074] It can be seen that when the existing risk behavior recognition module performs risk behavior recognition, it mainly relies on the existing black samples in the database. Due to the continuous evolution of fraud means, the black samples are highly time-sensitive. After a sample is included in the black sample library, fraudsters will redeploy it in the short term by changing numbers, repackaging Apps, or changing websites, etc., and this black sample will become invalid, while the new sample does not exist in the black sample library. The existing inference model cannot perform risk identification on the gray samples that do not exist in the black sample library, and can only provide the ability to identify risk behaviors after the fact for users based on the existing black sample library, resulting in poor fraud risk recognition effect and lagging risk control in the big data scenario with a large number of gray samples.

[0075] To solve the above problems, the embodiments of the present application provide a risk behavior recognition method. By constructing an anti-fraud full-link dynamic risk recognition framework, various risk behaviors can be recognized, achieving the purpose of identifying fraud-related risk behaviors during the process and providing timely and effective anti-fraud services for users.

[0076] First, the risk behavior recognition system provided by the embodiments of the present application will be described. Figure 3The figure is a schematic diagram of the network architecture of a risk behavior recognition system provided by an embodiment of the present application. As Figure 3 shown, the risk behavior recognition system provided by the embodiment of the present application includes at least one electronic device 201 ( Figure 3 two electronic devices 201-1 and 201-2 are shown in the figure), a service device 202, and a network 203. The electronic device 201 and the service device 202 can communicate through the network 203.

[0077] The service device 202 trains an initial inference prediction model according to the existing black sample library and white sample library, and sends the trained initial inference prediction model to the electronic device 201 through the network 203.

[0078] The electronic device 201 receives the trained initial inference prediction model. When the user uses the electronic device 201, it obtains the behavior data generated during the use of the user, determines the behavior characteristics based on the behavior data, uses the initial inference prediction model to perform prediction and inference on the behavior characteristics, and obtains a prediction result. This inference result is used to predict whether there is a risk in the user's behavior. In the case where the prediction result is that there is a risk, a prompt message is output, and this prompt message is used to prompt that there is a risk in the user's real-time behavior. Then, feedback information is obtained, and real samples are generated based on the behavior characteristics, prediction results, and feedback information; the real samples are added to a new real sample set and sent to the service device 202.

[0079] The service device 202 collects the new real sample set and stores it in the online real sample set, expands the initial sample set based on the online real sample set to obtain an offline enhanced sample set. Then, according to the offline enhanced sample set and the online sample set, the classification model is trained to obtain an updated inference prediction model. Then, the updated inference prediction model is sent to the electronic device 201 to continue risk behavior recognition. The risk recognition system provided by the embodiment of the present application can ensure that the inference prediction model takes into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors through the iterative mixing and training method that combines the online real samples on the electronic device side and the offline enhanced samples on the service device side, can improve the accuracy of risk behavior recognition, and provide timely and effective anti-fraud services for users.

[0080] In some implementation manners, a cold database is configured in the electronic device 201. After obtaining the prediction result, the prediction result is stored in the cold database. According to the preset reporting conditions, some or all of the prediction results are selected to generate online real samples and sent to the service device 202.

[0081] A server database is configured in the service device 202. The server database is used to store multiple online real samples sent by different electronic devices 201. The service device 202 expands the initial sample set according to the online real sample set to ensure that the number of enhanced sample sets is within a suitable range, which can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, and provide support for improving the learning ability and accuracy of the inference prediction model to capture fraud-related behaviors.

[0082] In the risk behavior recognition method provided by the embodiment of the present application, the service device expands the initial sample set based on the online real sample set to ensure that the number of enhanced sample sets is within a suitable range. In this way, training based on the expanded offline enhanced sample set and the online real sample set can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, improve the accuracy of the inference prediction model, and improve the ability of the inference prediction model to identify and learn fraud-related behaviors. The electronic device uses the inference prediction model to perform risk recognition on user behaviors, which can improve the recognition accuracy of risk behaviors and provide timely and effective anti-fraud services for users.

[0083] The electronic device 201 described in the embodiment of the present application includes, but is not limited to, mobile phones, laptop computers, tablet computers, laptop computers, personal computers (PCs), personal digital assistants (PDAs), or wearable devices (such as smart watches or bracelets), etc. In addition, the above various electronic devices 201 include, but are not limited to, those equipped with Apple (IOS), Android, Microsoft, or other operating systems.

[0084] The service device 202 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server.

[0085] The network 203 includes, but is not limited to, a Wireless Local Area Network (WLAN), a global system for mobile communications (GSM) system, a code division multiple access (CDMA) system, a wide band code division multiple access (WCDMA) system, a general packet radio service (GPRS), a long term evolution (LTE) system, an LTE frequency division duplex (FDD) system, an LTE time division duplex (TDD), a universal mobile telecommunication system (UMTS), a worldwide interoperability for microwave access (WiMAX) communication system, a future fifth generation (5G) system, or a new radio (NR), etc.

[0086] The method provided in the embodiments of the present application will be described below in conjunction with the device for implementing the embodiments of the present application.

[0087] The technical solution provided by the present application can be applied to an electronic device. In some embodiments, the electronic device may be a mobile phone, a tablet computer, a handheld computer, a personal computer (PC), an ultra-mobile personal computer (UMPC), a netbook, as well as a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a wearable device, a vehicle-mounted device, a smart home device, and / or a smart city device, etc. The specific type of the electronic device is not particularly limited in the embodiments of the present application.

[0088] Exemplarily, taking the electronic device as a mobile phone as an example, Figure 4The figure shows a schematic structural diagram of an electronic device provided by an embodiment of the present application.

[0089] Referring Figure 4 As shown, the electronic device may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a display screen 193, a subscriber identification module (SIM) card interface 194, and a camera 195, etc. Among them, the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0090] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0091] The controller may be the nerve center and command center of the electronic device. The controller may generate operation control signals according to the instruction operation code and timing signal to complete the control of fetching instructions and executing instructions.

[0092] A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory may store instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0093] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, etc.

[0094] In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0095] The external memory interface 120 may be used to connect to an external non-volatile memory to implement the storage capacity expansion of the electronic device. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to implement the data storage function. For example, files such as music and videos are saved in the external non-volatile memory.

[0096] The internal memory 121 may include one or more random access memories (RAMs) and one or more non-volatile memories (NVMs). The random access memory can be directly read and written by the processor 110, and can be used to store the operating system or executable programs of other running programs (such as machine instructions), and can also be used to store data of users and application programs, etc. The non-volatile memory can also store executable programs and store data of users and application programs, etc., and can be pre-loaded into the random access memory for the processor 110 to directly read and write.

[0097] The USB interface 130 is an interface that conforms to the USB standard specification, and can specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device, and can also be used to transfer data between the electronic device and peripheral devices. It can also be used to connect headphones to play audio through the headphones. This interface can also be used to connect other electronic devices, such as AR devices, etc.

[0098] The charging management module 140 is used to receive a charging input from a power supply device (such as a charger, laptop power, etc.). Among them, the charger can be a wireless charger or a wired charger. In some embodiments of wired charging, the charging management module 140 can receive the charging input of the wired charger through the USB interface 130. In some embodiments of wireless charging, the charging management module 140 can receive the wireless charging input through the wireless charging coil of the electronic device.

[0099] While charging the battery 142, the charging management module 140 can also supply power to the electronic device through the power management module 141. Among them, the battery 142 can specifically be composed of multiple batteries connected in series. The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110.

[0100] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives the input of the battery 142 and / or the charging management module 140 and supplies power to the processor 110, the internal memory 121, the display screen 193, the camera 195, the wireless communication module 160, etc. The power management module 141 can also be used to monitor parameters such as the voltage, current, battery cycle times, and battery health status (leakage, impedance) of the battery. In some other embodiments, the power management module 141 can also be set in the processor 110. In some other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0101] The wireless communication function of the electronic device can be implemented by Antenna 1, Antenna 2, Mobile Communication Module 150, Wireless Communication Module 160, modem, baseband processor, etc.

[0102] Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization rate of the antennas. For example, Antenna 1 can be multiplexed as the diversity antenna of the wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0103] Mobile Communication Module 150 can provide solutions for wireless communications such as 2G / 3G / 4G / 5G applied to the electronic device. Mobile Communication Module 150 can receive electromagnetic waves through Antenna 1, and perform filtering, amplification and other processing on the received electromagnetic waves, and then transmit them to the modulation and demodulation processor for demodulation. Mobile Communication Module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves through Antenna 1 and radiate it out. In some embodiments, at least some functional modules of Mobile Communication Module 150 can be arranged in Processor 110. In some embodiments, at least some functional modules of Mobile Communication Module 150 and at least some modules of Processor 110 can be arranged in the same device.

[0104] The modulation and demodulation processor can include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. Subsequently, the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After being processed by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through audio devices (not limited to Speaker 170A, Receiver 170B, etc.), or displays images or videos through Display Screen 193. In some embodiments, the modulation and demodulation processor can be an independent device. In some other embodiments, the modulation and demodulation processor can be independent of Processor 110 and arranged in the same device as Mobile Communication Module 150 or other functional modules.

[0105] The wireless communication module 160 may provide solutions for wireless communications applied to an electronic device, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite systems (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), and the like. The wireless communication module 160 may be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency-modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 may also receive signals to be sent from the processor 110, frequency-modulate them, amplify them, and convert them into electromagnetic waves through the antenna 2 for radiation.

[0106] The electronic device may implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor, etc. For example, music playback, recording, etc.

[0107] The pressure sensor 180A is used to sense pressure signals and can convert the pressure signals into electrical signals. In some embodiments, the pressure sensor 180A may be disposed on the display screen 193. There are many types of pressure sensors 180A, such as resistive pressure sensors 180A, inductive pressure sensors, capacitive pressure sensors, etc. When a touch operation acts on the display screen 193, the electronic device detects the intensity of the touch operation according to the pressure sensor 180A. The electronic device may also calculate the position of the touch according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations with the same touch position but different touch operation intensities may correspond to different operation instructions. For example: When a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, the instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, the instruction to create a new short message is executed.

[0108] The gyroscope sensor 180B may be used to determine the motion posture of the electronic device. In some embodiments, the angular velocity of the electronic device around three axes (i.e., the x, y, and z axes) may be determined through the gyroscope sensor 180B.

[0109] The barometric pressure sensor 180C is used to measure barometric pressure. In some embodiments, the electronic device calculates the altitude based on the barometric pressure value measured by the barometric pressure sensor 180C to assist in positioning and navigation.

[0110] The magnetic sensor 180D includes a Hall sensor. The electronic device can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the electronic device is a folding screen mobile phone, the electronic device can detect the opening and closing of the folding screen mobile phone according to the magnetic sensor 180D.

[0111] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device in various directions (generally three axes). When the electronic device is stationary, the magnitude and direction of gravity can be detected.

[0112] The distance sensor 180F is used to measure distance. The electronic device can measure distance through infrared or laser.

[0113] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode can be an infrared light emitting diode. The electronic device emits infrared light outward through the light emitting diode. The electronic device uses the photodiode to detect the infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device. When insufficient reflected light is detected, the electronic device can determine that there is no object near the electronic device.

[0114] The fingerprint sensor 180H is used to collect fingerprints. The electronic device can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application locks, fingerprint photography, fingerprint answering calls, etc.

[0115] The temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device executes a temperature processing strategy based on the temperature detected by the temperature sensor 180J.

[0116] The touch sensor 180K, also known as a "touch control device". The touch sensor 180K can be disposed on the display screen 193. The touch sensor 180K and the display screen 193 form a touch screen, also known as a "touch control screen". The touch sensor 180K is used to monitor touch operations acting thereon or nearby. The touch sensor 180K can transmit the monitored touch operations to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 193. In some other embodiments, the touch sensor 180K can also be disposed on the surface of the electronic device, at a different position from the display screen 193.

[0117] The ambient light sensor 180L is used to sense the ambient light brightness. For example, the ambient light sensor 180L can measure the light intensities of four channels of ambient light. The ambient light sensor 180L outputs the measured light intensities of the four channels of ambient light to the processor 110. The processor 110 can process the light intensities of the four channels of ambient light output by the ambient light sensor 180L to obtain the light intensity of the ambient light. In the screen-on state, the electronic device can adaptively adjust the display screen brightness according to the obtained light intensity of the ambient light. The ambient light sensor 180L can also be used to automatically adjust the white balance during photography. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device is in the pocket to prevent accidental touch.

[0118] The bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire the vibration signals of the vibrating bone mass of the human vocal tract. The bone conduction sensor 180M can also contact the human pulse to receive the blood pressure pulsation signal. In some embodiments, the bone conduction sensor 180M can also be disposed in the earphone to form a bone conduction earphone. The audio module 170 can parse out the voice signal based on the vibration signal of the vibrating bone mass acquired by the bone conduction sensor 180M to implement the voice function.

[0119] The keys 190 include the power-on key, volume keys, etc. The keys 190 can be mechanical keys or touch keys. The electronic device can receive key inputs and generate key signal inputs related to the user settings and function controls of the electronic device.

[0120] The motor 191 can generate vibration prompts. The motor 191 can be used for incoming call vibration prompts and can also be used for touch vibration feedback. For example, touch operations on different applications (such as photography, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations on different areas of the display screen 194, the motor 191 can also correspond to different vibration feedback effects.

[0121] The indicator 192 can be an indicator light and can be used to indicate the charging state, power change, and can also be used to indicate messages, missed calls, notifications, etc.

[0122] In some embodiments, the electronic device may include one or N cameras 195, where N is a positive integer greater than 1. In the embodiments of the present application, the types of the cameras 195 can be distinguished according to the hardware configuration and physical location. For example, the camera disposed on the side of the display screen 193 of the electronic device can be called a front camera, and the camera disposed on the back cover of the electronic device can be called a rear camera; for another example, a camera with a short focal length and a large viewing angle can be called a wide-angle camera, and a camera with a long focal length and a small viewing angle can be called a normal camera. Among them, the length of the focal length and the size of the viewing angle are relative concepts without specific parameter limitations. Therefore, the wide-angle camera and the normal camera are also relative concepts and can be specifically distinguished according to physical parameters such as the focal length and the viewing angle.

[0123] The electronic device realizes the display function through the GPU, the display screen 193, and the application processor, etc. The GPU is a microprocessor for image editing, which is connected to the display screen 193 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change the display information.

[0124] The electronic device can realize the shooting function through the ISP, the camera 195, the video codec, the GPU, the display screen 193, and the application processor, etc. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change the display information. In the embodiments of the present application, during the frame drawing process of each image frame, the function of the GPU will be used to make the finally displayed picture obtain better display effects and performance.

[0125] The ISP is used to process the data fed back by the camera 195. For example, when taking a photo, the shutter is opened, and the light passes through the lens and is transmitted to the camera sensor. The optical signal is converted into an electrical signal, and the camera sensor transmits the electrical signal to the ISP for processing and converts it into an image visible to the naked eye. The ISP can also perform algorithm optimization on the noise and brightness of the image. The ISP can also optimize parameters such as the exposure and color temperature of the shooting scene. In some embodiments, the ISP can be disposed in the camera 195. The camera 195 is used to capture static images or videos.

[0126] The display screen 193 is used to display images, videos, etc. The display screen 193 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a Mini Light-Emitting Diode (MiniLED), a Micro Light-Emitting Diode (MicroLED), a Micro-OLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device may include one or N display screens 193, where N is a positive integer greater than 1.

[0127] In the embodiments of the present application, the display screen 193 can be used to display the pages required by the electronic device (for example, wizard pages (including recommendation pages and external module access pages), etc.), and display the images captured by any one or more cameras 195 on this interface.

[0128] The SIM card interface 194 is used to connect the SIM card. The SIM card can be inserted into or pulled out from the SIM card interface 194 to achieve contact and separation from the electronic device. The electronic device can support one or more SIM card interfaces. The SIM card interface 194 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 194 at the same time. The SIM card interface 194 can also be compatible with external memory cards. The electronic device interacts with the network through the SIM card to achieve functions such as calls and data communication. One SIM card corresponds to one user number.

[0129] It can be understood that the interface connection relationships between the modules illustrated in the embodiments of the present application are only illustrative and do not constitute a structural limitation on the electronic device. In other embodiments of the present application, the electronic device can also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0130] Of course, it can be understood that the above Figure 4The above is only an exemplary illustration when the form of the electronic device is a mobile phone. When the electronic device is in other forms such as a tablet computer, a handheld computer, a PC, a PDA, a wearable device (such as a smart watch, a smart bracelet), etc., the structure of the electronic device may include fewer structures than those shown in Figure 4 or may include more structures than those shown in Figure 4 , which is not limited herein.

[0131] It can be understood that generally, in addition to the support of hardware, the realization of the functions of an electronic device also requires the cooperation of software. The software system of the electronic device can adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservices architecture, or a cloud architecture. In the embodiments of this application, taking the system as an example, the software structure of the electronic device is exemplarily described.

[0132] All the technical solutions provided in the embodiments of this application can be implemented in an electronic device having the above hardware architecture or software architecture.

[0133] Based on the above Figure 4 shown hardware architecture, the risk behavior recognition method provided in the embodiments of this application will be introduced below in combination with Figures 5A to 5C . Figure 5A FIG. is a schematic flow chart of a risk behavior recognition method provided in an embodiment of this application.

[0134] Referring to Figure 5A shown, the risk behavior recognition method may include steps S501 to S521:

[0135] Step S501, the service device obtains an initial inference and prediction model.

[0136] The initial inference and prediction model is trained by the service device according to the existing black sample library and white sample library, and the black samples in the existing black sample library and the white samples in the white sample library can be obtained through expert experience analysis.

[0137] Step S502, the service device sends the initial inference and prediction model to the electronic device.

[0138] In the embodiments of this application, the electronic device is taken as a mobile phone as an example. In practical applications, the initial inference and prediction model can be packaged in the anti-fraud App. The user installs the anti-fraud App on the electronic device (such as a mobile phone), and the anti-fraud App provides anti-fraud services for the user to identify risk behaviors.

[0139] Step S503, the electronic device collects the current behavior of the user.

[0140] See Figure 5B, the system manager based on the mobile phone collects the user's current behavior, which may include various behaviors performed by the user during the use of the mobile phone, including but not limited to touch, single-finger click, double-finger double-click, gesture, payment, jump, enabling the anti-fraud reminder function, enabling screen sharing, enabling do not disturb, enabling call interception, enabling text message interception, enabling call forwarding and other various behaviors.

[0141] Step S504, the electronic device determines whether the current behavior is an entry into a payment behavior.

[0142] The entry into a payment behavior refers to the behavior of launching a payment application App, where the payment App may include various Apps capable of conducting transactions.

[0143] If the current behavior is an entry into a payment behavior, go to step S506; if the current behavior is not an entry into a payment behavior, go to step S505.

[0144] Step S505, the electronic device stores the current behavior as a historical behavior in the historical behavior table.

[0145] Storing the current behavior as a historical behavior in the hot database of the mobile phone, specifically, it can be stored in the historical behavior table of the hot database. The historical behaviors in this historical behavior table are arranged in the order of storage time. The latest stored historical behavior is the closest to the current time. In the embodiment of the present application, after step S505 is executed, return to execute S503 to continue collecting the user's behavior at the next moment.

[0146] Step S506, the electronic device obtains the historical behavior sequence from the historical behavior table.

[0147] In the embodiment of the present application, the historical behavior sequence may include the historical behaviors operated by the user within a preset duration. The preset duration can be set to 1 hour, 6 hours, 24 hours, 2 days, etc. For example, obtain the historical behaviors recorded in the past 1 hour in the historical behavior table, and these historical behaviors are sorted by time.

[0148] Step S507, the electronic device determines the behavior characteristics according to the historical behavior sequence.

[0149] In the embodiment of the present application, the behavior characteristics corresponding to the historical behavior sequence can be determined according to the preset rules. The preset rules can be as shown in Table 2 below:

[0150] Table 2 Preset Rules Table

[0151]

[0152] Determine the characteristic values of each risk behavior in the historical behavior sequence according to the preset rules, and then determine the behavior characteristics based on the characteristic values of each risk behavior.

[0153] For example, based on the historical behavior sequence, it is determined that the user has suspicious call records within the past 1 hour (the characteristic value of the corresponding risk behavior is 1), there are no overseas call records that can be considered suspicious within the past 1 hour (the characteristic value of the corresponding risk behavior is 0), there are overseas suspicious call records within the past 6 hours (the characteristic value of the corresponding risk behavior is 1), there is no payment record within the past 1 hour (the characteristic value of the corresponding risk behavior is 0), screen sharing is not enabled (the characteristic value of the corresponding risk behavior is 0), do not disturb is not enabled (the characteristic value of the corresponding risk behavior is 0), call interception is not enabled (the characteristic value of the corresponding risk behavior is 0), text message interception is not enabled (the characteristic value of the corresponding risk behavior is 0), and call forwarding is not enabled (the characteristic value of the corresponding risk behavior is 0). Then the determined behavior characteristic is 101000000.

[0154] In some embodiments, when determining the characteristic value of the historical behavior, if there is a certain risk behavior, the number of occurrences of the risk behavior within a preset duration can be further counted.

[0155] Step S508, the electronic device uses the initial inference prediction model to perform inference and prediction on the behavior characteristic to obtain a prediction result.

[0156] Input the behavior characteristic into the initial inference sub - model of the initial inference prediction model to obtain a suspicious score. The value range of the suspicious score can be from 0 to 100. The higher the suspicious score, the more suspicious the payment behavior is and the higher the risk.

[0157] In some embodiments, for different risk behaviors, the corresponding risk weights in the initial inference sub - model are different. Among them, the risk weights corresponding to each risk behavior can be preset fixed values or variable values determined according to the number of occurrences of the risk behavior within a preset duration.

[0158] After obtaining the suspicious score, input the suspicious score into the initial prediction sub - model of the initial inference prediction model, that is, compare the size of the suspicious score and the preset threshold to obtain a prediction result. When the suspicious score is greater than the preset threshold, the prediction result is determined to be a prediction of risk; when the suspicious score is less than or equal to the preset threshold, the prediction result is determined to be a prediction of no risk.

[0159] Step S509, the electronic device determines whether the prediction result is a prediction of risk.

[0160] If the prediction result is a prediction of risk, it indicates that the payment behavior is a risk behavior, and proceed to step S510. If the prediction result is not a prediction of risk, that is, the prediction result is a prediction of no risk, it indicates that the payment behavior is not a risk behavior, and proceed to step S511.

[0161] Step S510, the electronic device outputs a prompt message.

[0162] The prompt message is used to remind the user that there is a risk in the real-time behavior. For example, in a fraud-related behavior, the output prompt message can be as Figure 6A shown.

[0163] Step S511, the electronic device obtains feedback information.

[0164] When the prediction result is predicting no risk, indicating that the payment behavior entered is not a risky behavior, no prompt message will be output. At this time, it is considered that the payment behavior entered is risk-free, and the feedback information is determined to be no feedback and no risk.

[0165] When the prediction result is predicting risk, indicating that the payment behavior entered is a risky behavior, a prompt message is output. The user learns that there is a risk in the current payment behavior according to the prompt message. If the user directly closes the prompt message (such as clicking Figure 6A the "Got it" as shown) after learning that there is a risk in the payment behavior, the feedback information is determined to be no feedback and low risk. If the user performs the risk-free marking behavior for the current call as shown in Figure 6B 601, that is, it is considered that the user marks this payment behavior as not a risky behavior. At this time, the feedback information is determined to be feedback and no risk. If the user performs the risky marking behavior for the current call as shown in Figure 6B 602 after learning that there is a risk in the payment behavior, the feedback information is determined to be feedback and risk.

[0166] In the embodiments of the present application, in the case where the user learns that there is a risk in the payment behavior, the marking behavior performed by the user as shown in Figure 6B is called an explicit feedback behavior. The feedback information corresponding to the explicit feedback behavior is called explicit feedback information, including feedback and no risk and feedback and risk.

[0167] In the case where the user learns that there is a risk in the payment behavior, the closing behavior of directly closing the prompt message performed by the user is called an implicit feedback behavior. The feedback information corresponding to the implicit feedback behavior and the feedback information determined in the case where the prediction result indicates that the payment behavior entered is not a risky behavior are called implicit feedback information, including no feedback and no risk and no feedback and low risk.

[0168] Step S512, the electronic device generates a real sample based on the behavior characteristics, prediction result, and feedback information, and adds the generated real sample to the real sample set.

[0169] In some embodiments, the real sample set can be stored in a cold database.

[0170] Step S513, the electronic device determines whether a preset condition is met.

[0171] In the embodiments of the present application, when the number of real sample sets reaches a certain amount or the mobile phone is in a preset state (such as the display screen is turned off and charging), it is considered that the preset condition is met, and step S514 is entered; otherwise, return to execute S503 to continue collecting the user's behavior at the next moment.

[0172] In step S514, the electronic device sends the real sample set to the service device.

[0173] Sending the real sample set in the cold database to the service device according to the preset conditions can ensure that each real sample data can be sent to the service device. Moreover, sending the real sample set to the service device when the mobile phone is charging and the screen is off can minimize power consumption as much as possible.

[0174] In step S515, the service device constructs a basic sample type according to the number of behaviors in the fraud chain.

[0175] In the embodiments of the present application, the basic sample type may include the following six types:

[0176] 1) The first basic sample type corresponding to the random arrangement of three behaviors: 1 overseas call behavior or 1 suspicious state behavior + 1 entry into the payment App behavior. Here, "or" indicates that the order of the behaviors is not limited.

[0177] 2) The second basic sample type corresponding to the random arrangement of four behaviors: 1 overseas call behavior or 1 suspicious state behavior or 1 entry into the payment App behavior + 1 entry into the payment App behavior.

[0178] 3) The third basic sample type corresponding to the random arrangement of five behaviors: 1 overseas call behavior or 2 suspicious state behaviors or 1 entry into the payment App behavior + 1 entry into the payment App behavior.

[0179] 4) The fourth basic sample type corresponding to the random arrangement of five behaviors: 2 overseas call behaviors or 1 suspicious state behavior or 1 entry into the payment App behavior + 1 entry into the payment App behavior.

[0180] 5) The fifth basic sample type corresponding to the random arrangement of seven behaviors: 2 overseas call behaviors + 1 suspicious state behavior + 2 entry into the payment App behaviors + 2 suspicious state behaviors + 1 entry into the payment App behavior.

[0181] 6) The sixth basic sample type corresponding to the random arrangement of eight behaviors: 2 overseas call behaviors + 2 suspicious state behaviors + 2 entry into the payment App behaviors + 1 suspicious state behavior + 1 entry into the payment App behavior.

[0182] Among them, suspicious status behaviors include: turning on screen sharing, turning on do not disturb, turning on call interception, turning on text message interception, and turning on call forwarding.

[0183] Since fraud cases are sparser than non-fraud cases, if real fraud cases are directly used to generate real samples, there is a problem that it is impossible to ensure that all types of fraud cases are collected. In the embodiments of the present application, the service device constructs basic sample types through the risk behaviors of the fraud link, and then constructs an initial sample set, which can ensure that various possible types of initial samples are obtained. The multi-type sample data provides data support for improving the accuracy of the inference prediction model and the ability to capture fraud-related behaviors.

[0184] Step S516, the service device constructs an initial sample set according to the basic sample types.

[0185] See Figure 5C , the service device constructs a certain proportion of positive samples and negative samples based on 6 types of basic samples to obtain an initial sample set. Among them, the positive sample index label is a sample with risk, and the negative sample index label is a sample without risk.

[0186] Although the basic sample types are constructed based on suspicious behaviors, in practice, there will still be a large number of non-fraud links with similar behaviors. In the anti-fraud scenario, it is necessary to ensure high accuracy. Therefore, when constructing the initial sample set, a certain proportion of them is randomly selected as positive samples, and the remaining part is used as negative samples to form the initial sample set.

[0187] It should be noted that steps S515 and S516 are exemplarily executed after step S514 in the present application. In practice, they can be executed after any step before step S517, and the present application does not make a limitation.

[0188] Step S517, the service device stores the real sample set sent by the electronic device into the online real sample set.

[0189] The service device aggregates the real sample sets sent by at least one electronic device and stores them as the online real sample set in the server database configured in the service device.

[0190] Step S518, the service device determines whether the update condition is reached.

[0191] The service device accumulates the online real samples. When the number of real samples in the online real sample set reaches the preset number or the accumulation duration reaches the preset duration, it is considered that the update condition is reached, and step S519 is entered; otherwise, it returns to step S517 to continue waiting for the electronic device to send more real samples.

[0192] Step S519, the service device expands the initial sample set according to the online real sample set to obtain an offline enhanced sample set.

[0193] As shown Figure 5C in the figure, the service device resamples and expands the initial sample set based on online real samples according to the number of real samples and a preset ratio threshold to obtain an offline enhanced sample set.

[0194] For example, the number of real samples is denoted as Q, the preset ratio threshold is r, the number of initial samples in the initial sample set is denoted as P. Resample and expand the initial sample set until the number of the offline enhanced sample set reaches Q*r, and then stop the expansion. In this way, the offline enhanced sample set is obtained. By expanding the initial sample set, the number of the enhanced sample set is within a suitable range, which can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, and provide support for improving the learning ability and accuracy of the inference prediction model to capture fraud-related behaviors.

[0195] Step S520: The service device trains a classification model based on the offline enhanced sample set and the online sample set to obtain an updated inference prediction model.

[0196] The offline samples in the offline enhanced sample set and the real samples in the online real sample set are comprehensively used as training samples to train the classification model. After the training is completed, the trained inference prediction model is obtained. In the embodiments of the present application, iterative hybrid training is performed by combining the online real samples collected on the electronic device side and the offline enhanced samples on the service device side to ensure that the model can take into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors.

[0197] Step S521: The service device sends the updated inference prediction model to the electronic device.

[0198] The mobile phone continues to perform risk identification on the user's behavior by using the updated inference prediction model, and repeats the above steps S503 to S514 and steps S517 to S521 to realize iterative hybrid model update.

[0199] Considering the significant offensive and defensive characteristics of security, the inference prediction model needs to be continuously updated. For example, after obtaining model M through training on day T1, starting from day T1+1, new online real samples reported to the service device are accumulated day by day. When the magnitude of the real samples accumulated on day T2 is greater than the preset quantity threshold, perform offline enhanced sample operations, mix the new offline enhanced samples with the accumulated real samples, train a new model M' to replace the existing model M, and update the training date. The newly trained model M' is sent to the mobile phone, and inference prediction is performed using the new model M'.

[0200] In the embodiments of the present application, online real samples are combined with offline samples for expansion to enhance the classification samples, which can improve the learning ability of the model to capture fraud-related behaviors; iteratively mixing and training the model with online real samples and offline enhanced samples can ensure that the model takes into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors, achieving the effects of improving the accuracy of risk behavior recognition and reducing user losses.

[0201] Based on the above embodiments, the embodiments of the present application further provide a risk behavior recognition method applied to a service device, as Figure 7 shown, the risk behavior recognition method includes the following steps:

[0202] Step S701, obtain an initial sample set and an online real sample set.

[0203] In the embodiments of the present application, the initial sample set can be determined according to the fraud chain provided by the expert system. Specifically: first, obtain the risk behaviors of the fraud chain; then construct the basic sample types according to the risk behaviors; finally, construct the initial sample set according to the basic sample types.

[0204] In some embodiments, the risk behaviors may include preset regional telephone behaviors, preset risk status behaviors, and jump payment behaviors.

[0205] The preset risk status behaviors may include turning on screen sharing, turning on do not disturb, turning on call blocking, turning on text message blocking, and turning on call forwarding.

[0206] Exemplarily, the basic sample types constructed according to the risk behaviors may include the following 6 types:

[0207] 1) The first basic sample type corresponding to the random arrangement of three behaviors: 1 overseas call behavior or 1 preset risk status behavior + 1 behavior of entering the payment App. Here, "or" means that the order of the behaviors is not limited.

[0208] 2) The second basic sample type corresponding to the random arrangement of four behaviors: 1 overseas call behavior or 1 preset risk status behavior or 1 behavior of entering the payment App + 1 behavior of entering the payment App.

[0209] 3) The third basic sample type corresponding to the random arrangement of five behaviors: 1 overseas call behavior or 2 preset risk status behaviors or 1 behavior of entering the payment App + 1 behavior of entering the payment App.

[0210] 4) The fourth basic sample type corresponding to the random arrangement of five behaviors: 2 overseas call behaviors or 1 preset risk status behavior or 1 behavior of entering the payment App + 1 behavior of entering the payment App.

[0211] 5) The fifth type of basic sample corresponding to randomly arranged seven behaviors: 2 overseas call behaviors + 1 preset risk status behavior + 2 behaviors of entering the payment App + 2 preset risk status behaviors + 1 behavior of entering the payment App.

[0212] 6) The sixth type of basic sample corresponding to randomly arranged eight behaviors: 2 overseas call behaviors + 2 preset risk status behaviors + 2 behaviors of entering the payment App + 1 preset risk status behavior + 1 behavior of entering the payment App.

[0213] Among them, the preset risk status behaviors include: turning on screen sharing, turning on Do Not Disturb, turning on call blocking, turning on text message blocking, and turning on call forwarding.

[0214] Since fraud cases are relatively sparse compared to non-fraud cases, if real fraud cases are directly used to generate real samples, there is a problem that it is impossible to ensure that all types of fraud cases are collected. In the embodiments of the present application, the service device constructs basic sample types through risk behaviors of the fraud link, and then constructs an initial sample set, which can ensure that various possible types of initial samples are obtained. The multi-type sample data provides data support for improving the accuracy of the inference prediction model and the ability to capture fraud-related behaviors.

[0215] Although the basic sample types are constructed based on suspicious behaviors, in practice, there will still be a large number of non-fraud links with similar behaviors. In the anti-fraud scenario, high precision needs to be ensured. Therefore, in the embodiments of the present application, when constructing the initial sample set according to the basic sample types, a certain proportion of them is randomly selected as positive samples, and the remaining part is used as negative samples to form the initial sample set.

[0216] It can be understood that the method for obtaining the online real sample set in the embodiments of the present application will not be described in detail, and specific reference can be made to the foregoing steps S503 to S514 and step S517.

[0217] Step S702, expand the initial sample set according to the online real sample set to obtain an offline enhanced sample set.

[0218] In some embodiments, the offline enhanced sample set can be determined through Figure 8 the steps shown: determine the number of real samples in the online real sample set; resample and expand the initial sample set according to the number of real samples and a preset proportion threshold to obtain the offline enhanced sample set.

[0219] It can be understood that the method for expanding the initial sample set in the embodiments of the present application will not be described in detail, and specific reference can be made to the foregoing step S519.

[0220] Step S703: Train a classification model based on the offline enhanced sample set and the online real sample set to obtain an inference prediction model.

[0221] Use the offline samples in the offline enhanced sample set and the real samples in the online real sample set as training samples to train the classification model. After training, a trained inference prediction model is obtained. In the embodiments of the present application, iterative hybrid training is performed by combining the online real samples collected on the electronic device side and the offline enhanced samples on the service device side to ensure that the model can take into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors.

[0222] Step S704: Send the inference prediction model to the electronic device so that the electronic device uses the inference prediction model to identify the risks of the user's behavior.

[0223] It can be understood that in the embodiments of the present application, the process of the electronic device using the inference prediction model to identify the risks of the user's behavior will not be described in detail. For details, reference can be made to the foregoing steps S503 to S510.

[0224] In the risk behavior identification method provided by the embodiments of the present application, the service device expands the initial sample set based on the online real sample set to ensure that the number of the enhanced sample set is within a suitable range. In this way, training based on the expanded offline enhanced sample set and the online real sample set can reduce the deviation between the sampling result and the real level caused by unreasonable sample sampling, improve the accuracy of the inference prediction model, and improve the ability of the inference prediction model to identify and learn fraud-related behaviors.

[0225] Based on the above embodiments, the embodiments of the present application further provide a risk behavior identification method applied to an electronic device, as Figure 8 shown. The risk behavior identification method includes the following steps:

[0226] Step S801: When it is detected that the user's real-time behavior is entering a payment behavior, obtain the behavior characteristics corresponding to the user's historical behavior.

[0227] During the process of the user using an electronic device (such as a mobile phone), for the real-time behavior of the mobile phone user, when it is detected that the user's real-time behavior is entering a payment behavior, obtain the historical behavior executed by the user within a preset time period; determine the behavior characteristics corresponding to the historical behavior according to the preset rules.

[0228] In the embodiments of the present application, the obtained historical behavior may include the historical behavior operated by the user within a preset time period. The preset time period can be set to 1 hour, 6 hours, 24 hours, 2 days, etc. For example, obtain the historical behavior recorded in the historical behavior table in the past 1 hour, and these historical behaviors are sorted by time.

[0229] Determine the characteristic values corresponding to each historical behavior according to preset rules, and then determine the behavior characteristics corresponding to the historical behavior based on the characteristic values of each historical behavior.

[0230] In some embodiments, when the real-time behavior collected from the user is not a payment entry behavior, the real-time behavior is added to the historical behavior table to provide a judgment basis for whether the subsequent payment entry behavior is a risky behavior.

[0231] Step S802: Process the behavior characteristics using the inference prediction model to obtain a prediction result.

[0232] In the embodiments of the present application, the inference prediction model is trained by the service device based on an offline enhanced sample set and an online real sample set.

[0233] Input the behavior characteristics into the initial inference sub-model of the initial inference prediction model to obtain a suspicious score. For different risky behaviors, the corresponding risk weights in the initial inference sub-model are different. The value range of the suspicious score can be from 0 to 100. The higher the suspicious score, the more suspicious the payment entry behavior is and the higher the risk.

[0234] After obtaining the suspicious score, input the suspicious score into the initial prediction sub-model of the initial inference prediction model, that is, compare the size of the suspicious score and a preset threshold to obtain a prediction result. When the suspicious score is greater than the preset threshold, the prediction result is determined to be a predicted risk; when the suspicious score is less than or equal to the preset threshold, the prediction result is determined to be a predicted non-risk.

[0235] Step S803: Output a prompt message when the prediction result is a predicted risk.

[0236] The prompt message is used to prompt the user that the real-time behavior is risky.

[0237] If the prediction result is a predicted risk, it indicates that the payment entry behavior is a risky behavior. Control the display screen to output a prompt message, which is used to remind the user that the real-time behavior is risky. This method can issue a risk prompt during the event (before payment), help the user stop losses in time, and effectively provide anti-fraud services for the user.

[0238] The risk behavior recognition method provided by the embodiments of the present application determines whether the user behavior is a risky behavior based on the inference prediction model trained by the service device, where the inference prediction model is trained based on an offline enhanced sample set and an online real sample set obtained by expansion. Combining the iterative mixing and training method of the online real samples on the electronic device side and the offline enhanced samples on the service device side can ensure that the inference prediction model takes into account the learning ability of the latest data distribution and the ability to capture fraud-related behaviors, improve the accuracy of risk behavior recognition, and provide timely and effective anti-fraud services for users.

[0239] Based on Figure 8 the embodiment shown, the risk behavior recognition method may further include the following steps as Figure 9 shown:

[0240] Step S804: Obtain the feedback information corresponding to the real-time behavior.

[0241] In some embodiments, when the electronic device obtains the feedback information corresponding to the real-time behavior, in the case where the prediction result is predicted to be risk-free, the feedback information corresponding to the real-time behavior is determined to be no feedback and no risk; in the case where the prediction result is predicted to be risky, obtain the feedback behavior executed by the user based on the prompt information; determine the feedback information corresponding to the real-time behavior according to the feedback behavior.

[0242] In the case where the feedback behavior is a risk-free marking behavior, the feedback information corresponding to the real-time behavior is determined to be feedback and risk-free; in the case where the feedback behavior is a risky marking behavior, the feedback information corresponding to the real-time behavior is determined to be feedback and risky; in the case where no feedback behavior is received within the preset time period, the feedback information corresponding to the real-time behavior is determined to be no feedback and low risk.

[0243] Step S805: Generate a real sample based on the behavior characteristics, prediction result, and feedback information.

[0244] Step S806: Add the real sample to the new real sample set.

[0245] In some embodiments, the real sample set may be stored in a cold database.

[0246] Step S807: In the case where the new real sample set meets the preset conditions, send the new real sample set to the service device so that the service device determines a new inference prediction model based on the new real sample set.

[0247] For the risk behavior recognition method provided by the embodiments of the present application, the electronic device online generates real samples and reports the real samples to the service device according to the preset conditions, so that the service device updates the inference prediction model based on the latest data distribution, providing support for improving the accuracy of risk behavior recognition.

[0248] It can be understood that, in order to implement the above functions, the above electronic device includes the corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this article, the embodiments of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the manner of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of this application.

[0249] The embodiments of this application can divide the functional modules of the above electronic device according to the above method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. It should be noted that the division of modules in the embodiments of the present invention is illustrative, only a logical function division, and there can be other division methods in actual implementation.

[0250] In the case of dividing each functional module corresponding to each function, referring to Figure 10 As shown, the embodiments of this application also provide a risk behavior recognition device applied to a service device. The risk behavior recognition device 1000 may include: an acquisition module 1001, an expansion module 1002, a training module 1003, and a sending module 1004.

[0251] Among them, the acquisition module 1001 can be used to acquire an initial sample set and an online real sample set;

[0252] The expansion module 1002 can be used to expand the initial sample set according to the online real sample set to obtain an offline enhanced sample set;

[0253] The training module 1003 can be used to train a classification model according to the offline enhanced sample set and the online real sample set to obtain an inference prediction model;

[0254] The sending module 1004 can be used to send the inference prediction model to the electronic device so that the electronic device can use the inference prediction model to perform risk identification on the user's behavior.

[0255] In some embodiments, the acquisition module 1001 can specifically be used to: acquire the risk behaviors of the fraud link; construct a basic sample type according to the risk behaviors; and construct an initial sample set according to the basic sample type.

[0256] In some embodiments, the risk behaviors include preset area call behaviors, preset risk status behaviors, and jump payment behaviors;

[0257] The preset risk status behaviors include turning on screen sharing, turning on do not disturb, turning on call intercept, turning on text message intercept, and turning on call forwarding.

[0258] In some embodiments, the expansion module 1002 can be specifically configured to: determine the number of real samples in the online real sample set; resample and expand the initial sample set according to the number of real samples and a preset ratio threshold to obtain an offline enhanced sample set.

[0259] In some embodiments, the risk behavior recognition device 1000 may further include: a receiving module.

[0260] The receiving module can be used to receive a new real sample set sent by the electronic device;

[0261] The expansion module 1002 can also be used to expand the initial sample set according to the online real sample set and the new real sample set to obtain a new offline enhanced sample set when the number of the new real sample set reaches a preset number threshold;

[0262] The training module 1003 can also be used to train a classification model according to the new offline enhanced sample set, the online real sample set, and the new real sample set to obtain a new inference and prediction model;

[0263] The sending module 1004 can also be used to send the new inference and prediction model to the electronic device so that the electronic device uses the new inference and prediction model to perform risk identification on the user's behavior.

[0264] When each functional module is divided according to the corresponding functions, referring to Figure 11 As shown, an embodiment of the present application further provides a risk behavior recognition device applied in an electronic device. The risk behavior recognition device 1100 may include: an acquisition module 1101, a processing module 1102, and an output module 1103.

[0265] Among them, the acquisition module 1101 can be used to obtain the behavior characteristics corresponding to the user's historical behavior when it is collected that the user's real-time behavior is entering a payment behavior;

[0266] The processing module 1102 can be used to process the behavior characteristics by using the inference and prediction model to obtain a prediction result. The inference and prediction model is trained by the service device based on the offline enhanced sample set and the online real sample set;

[0267] The output module 1103 can be used to output a prompt message when the prediction result indicates a predicted risk, and the prompt message is used to prompt the user that there is a risk in the real-time behavior.

[0268] In some embodiments, the risk behavior recognition device 1100 may further include: a generation module, a storage module, and a sending module.

[0269] The acquisition module 1101 can also be used to obtain feedback information corresponding to the real-time behavior;

[0270] The generation module can be used to generate a real sample based on the behavior characteristics, prediction result, and feedback information;

[0271] The storage module can be used to add the real sample to a new real sample set;

[0272] The sending module can be used to send the new real sample set to the service device when the new real sample set meets the preset conditions, so that the service device determines a new inference and prediction model based on the new real sample set.

[0273] In some embodiments, the acquisition module 1101 can specifically be used to: when the real-time behavior of the user collected is a payment behavior, obtain the historical behavior executed by the user within a preset duration; determine the behavior characteristics corresponding to the historical behavior according to the preset rules.

[0274] In some embodiments, the storage module can also be used to add the real-time behavior to the historical behavior table when the real-time behavior of the user collected is not a payment behavior.

[0275] In some embodiments, the acquisition module 1101 can specifically be used to: when the prediction result is a predicted risk-free, determine the feedback information corresponding to the real-time behavior as no feedback and no risk; when the prediction result is a predicted risk, obtain the feedback behavior executed by the user based on the prompt message; determine the feedback information corresponding to the real-time behavior according to the feedback behavior.

[0276] In some embodiments, the acquisition module 1101 can specifically be used to: when the feedback behavior is a risk-free marking behavior, determine the feedback information corresponding to the real-time behavior as having feedback and no risk; when the feedback behavior is a risk marking behavior, determine the feedback information corresponding to the real-time behavior as having feedback and having risk; when no feedback behavior is received within the preset time period, determine the feedback information corresponding to the real-time behavior as no feedback and low risk.

[0277] Regarding the risk behavior recognition device in the above embodiments, the specific manners in which each module performs operations have been described in detail in the embodiments of the risk behavior recognition method in the foregoing embodiments, and will not be specifically elaborated herein. The relevant beneficial effects can also be referred to the relevant beneficial effects of the foregoing risk behavior recognition method, and will not be elaborated herein.

[0278] An embodiment of the present application further provides a service device, which includes: a memory and at least one processor; the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, when the computer instructions are executed by the processor, the service device is caused to execute the risk behavior recognition method provided in the foregoing embodiments.

[0279] An embodiment of the present application further provides an electronic device, which includes: a display screen, a memory, and one or more processors; the display screen, the memory are coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, when the computer instructions are executed by the processor, the electronic device is caused to execute the risk behavior recognition method provided in the foregoing embodiments. The specific structure of the electronic device can be referred to Figure 4 the structure of the electronic device shown in

[0280] An embodiment of the present application further provides a computer-readable storage medium, which includes computer instructions, when the computer instructions run on the service device, the service device is caused to execute the risk behavior recognition method provided in the foregoing embodiments.

[0281] An embodiment of the present application further provides a computer-readable storage medium, which includes computer instructions, when the computer instructions run on the electronic device, the electronic device is caused to execute the risk behavior recognition method provided in the foregoing embodiments.

[0282] An embodiment of the present application further provides a computer program product, which includes executable instructions, when the computer program product runs on the service device, the service device is caused to execute the risk behavior recognition method provided in the foregoing embodiments.

[0283] An embodiment of the present application further provides a computer program product, which includes executable instructions, when the computer program product runs on the electronic device, the electronic device is caused to execute the risk behavior recognition method provided in the foregoing embodiments.

[0284] Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0285] In several embodiments provided in the present application, it should be understood that the disclosed device / equipment and method can be implemented in other ways. For example, the device / equipment embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in electrical, mechanical or other forms.

[0286] The unit described as a separated component may or may not be physically separated. The component displayed as a unit can be a physical unit or multiple physical units, that is, it can be located in one place, or can be distributed to multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0287] In addition, in each embodiment of the present application, the functional units can be integrated in a processing unit, or each unit exists physically alone, or two or more units are integrated in one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0288] If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on such an understanding, the technical solution of the embodiments of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The software product is stored in a storage medium and includes several instructions for causing a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: USB flash drive, mobile hard disk, read only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other various media that can store program codes.

[0289] The above content is only a specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered by the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

1. A risk behavior recognition method, applied to a service device, characterized by The method includes: Obtaining an initial sample set and an online real sample set; Expanding the initial sample set according to the online real sample set to obtain an offline enhanced sample set; Training a classification model according to the offline enhanced sample set and the online real sample set to obtain an inference prediction model; Sending the inference prediction model to an electronic device so that the electronic device uses the inference prediction model to identify risks in the user's behavior.

2. The method according to claim 1, wherein The obtaining of the initial sample set includes: Obtaining risk behaviors of a fraud chain; Constructing a basic sample type according to the risk behaviors; Constructing an initial sample set according to the basic sample type.

3. The method according to claim 2, wherein The risk behaviors include preset regional call behaviors, preset risk status behaviors, and jump payment behaviors; The preset risk status behaviors include turning on screen sharing, turning on do not disturb, turning on call blocking, turning on text message blocking, and turning on call forwarding.

4. The method according to claim 2, wherein The expanding of the initial sample set according to the online real sample set to obtain an offline enhanced sample set includes: Determining the number of real samples in the online real sample set; Resampling and expanding the initial sample set according to the number of real samples and a preset ratio threshold to obtain an offline enhanced sample set.

5. The method according to claim 2, characterized in that, The method further includes: Receiving a new real sample set sent by the electronic device; When the number of the new real sample set reaches a preset number threshold, expanding the initial sample set according to the online real sample set and the new real sample set to obtain a new offline enhanced sample set; Training a classification model according to the new offline enhanced sample set, the online real sample set, and the new real sample set to obtain a new inference prediction model; Sending the new inference prediction model to the electronic device so that the electronic device uses the new inference prediction model to identify risks in the user's behavior.

6. A risk behavior identification method, applied to an electronic device, characterized in that, The method includes: When it is collected that the user's real-time behavior is entering a payment behavior, obtaining the behavior characteristics corresponding to the user's historical behavior; Processing the behavior characteristics by using an inference prediction model, where the inference prediction model is trained by a service device based on an offline enhanced sample set and an online real sample set to obtain a prediction result; When the prediction result is that there is a risk, outputting a prompt message for prompting the user that the real-time behavior is risky.

7. The method according to claim 6, characterized in that, The method further includes: Obtaining feedback information corresponding to the real-time behavior; Generating a real sample based on the behavior characteristics, the prediction result, and the feedback information; Adding the real sample to a new real sample set; When the new real sample set meets a preset condition, sending the new real sample set to the service device so that the service device determines a new inference prediction model based on the new real sample set.

8. The method according to claim 6, wherein The obtaining of the behavior characteristics corresponding to the user's historical behavior when it is collected that the user's real-time behavior is entering a payment behavior includes: When it is collected that the user's real-time behavior is entering a payment behavior, obtaining the historical behavior executed by the user within a preset time period; Determine the behavior characteristics corresponding to the historical behavior according to the preset rules.

9. The method according to claim 6, wherein The method further includes: When the real-time behavior of the user collected is not a payment behavior, add the real-time behavior to the historical behavior table.

10. The method according to claim 7, characterized in that The obtaining of the feedback information corresponding to the real-time behavior includes: When the prediction result is a predicted risk-free situation, determine the feedback information corresponding to the real-time behavior as no feedback and risk-free; When the prediction result is a predicted risky situation, obtain the feedback behavior executed by the user based on the prompt information; Determine the feedback information corresponding to the real-time behavior according to the feedback behavior.

11. The method according to claim 10, characterized in that, The determining of the feedback information corresponding to the real-time behavior according to the feedback behavior includes: When the feedback behavior is a risk-free marking behavior, determine the feedback information corresponding to the real-time behavior as having feedback and risk-free; When the feedback behavior is a risky marking behavior, determine the feedback information corresponding to the real-time behavior as having feedback and risky; When the feedback behavior is not received within the preset time period, determine the feedback information corresponding to the real-time behavior as no feedback and low risk.

12. A service device, characterized in that, Includes: A memory and at least one processor; the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions. When the computer instructions are executed by the processor, the service device executes the risk behavior recognition method according to any one of claims 1-5.

13. An electronic device, characterized in that, Includes: A display screen, a memory, and one or more processors; the display screen, the memory are coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions. When the computer instructions are executed by the processor, the electronic device executes the risk behavior recognition method according to any one of claims 6-11.

14. A computer-readable storage medium, characterized in that, Includes computer instructions. When the computer instructions run on the service device, the service device executes the risk behavior recognition method according to any one of claims 1-5; when the computer instructions run on the electronic device, the electronic device executes the risk behavior recognition method according to any one of claims 6-11.

Images