Risk behavior identification method, device and computer readable storage medium

Abstract

The application provides a risk behavior identification method, device and computer readable storage medium, relates to the technical field of information security, and can improve the identification and learning ability of fraud-related behaviors and provide timely and effective fraud prevention services for users. The method comprises the following steps: obtaining an initial sample set and an online real sample set; according to the online real sample set, the initial sample set is expanded to obtain an offline enhanced sample set; according to the offline enhanced sample set and the online real sample set, a classification model is trained to obtain an inference prediction model; and the inference prediction model is sent to an electronic device, so that the electronic device uses the inference prediction model to identify the risk of the user's behavior.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, device and computer-readable storage medium for identifying risky behaviors. Background Technology

[0002] With the popularization and development of the internet, telecommunications fraud has become increasingly rampant, causing huge economic losses to users. Existing anti-fraud technologies mainly rely on existing blacklist data to provide users with fraud prevention services. Fraud analysis methods and techniques are constantly being upgraded in anti-fraud efforts, making the identification of fraudulent activities more difficult. Current anti-fraud identification methods have very limited effectiveness in preventing variant and new types of fraud, failing to provide users with timely and effective fraud prevention services. Summary of the Invention

[0003] This application provides a risk behavior identification method, device, and computer-readable storage medium, which can improve the ability to identify and learn fraudulent behaviors and provide users with timely and effective fraud prevention services.

[0004] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0005] In a first aspect, embodiments of this application provide a risk behavior identification method applied to a service device. The method includes: the service device acquiring an initial sample set and an online real sample set; expanding the initial sample set based on the online real sample set to obtain an offline enhanced sample set; training a classification model based on the offline enhanced sample set and the online real sample set to obtain an inference prediction model; and sending the inference prediction model to an electronic device so that the electronic device can use the inference prediction model to identify the risk of a user's behavior.

[0006] Based on the technical solution provided in this application, the service device expands the initial sample set based on the online real sample set to ensure that the number of enhanced sample sets is within an appropriate range. In this way, training based on the expanded offline enhanced sample set and the online real sample set can reduce the deviation between the sampling results and the true level caused by unreasonable sample sampling, improve the accuracy of the inference prediction model, and enhance the inference prediction model's ability to identify and learn fraudulent behavior.

[0007] In one possible implementation of the first aspect, the service device acquires an initial sample set by: acquiring risk behaviors of a fraud link; constructing a basic sample type based on the risk behaviors; and constructing an initial sample set based on the basic sample type.

[0008] Based on the above possible implementation methods, the service device constructs basic sample types through the risk behaviors of the fraud chain, and then constructs an initial sample set. This ensures that various possible types of initial samples are obtained, avoiding the problem that if real fraud cases are directly used to generate samples, it is impossible to ensure that all types of fraud cases can be collected because fraud cases are relatively sparse compared to non-fraud cases. The multi-type sample data provides data support for improving the accuracy of the inference prediction model and the ability to capture fraudulent behaviors.

[0009] In one possible implementation of the first aspect, the risky behavior includes preset area telephone behavior, preset risk status behavior, and redirect payment behavior;

[0010] The preset risk status behaviors include enabling screen sharing, enabling Do Not Disturb, enabling call blocking, enabling SMS blocking, and enabling call forwarding.

[0011] Based on the above possible implementation methods, service devices can construct different types of basic samples based on various risk behaviors, providing data support for constructing initial samples.

[0012] In one possible implementation of the first aspect, the service device expands the initial sample set according to the online real sample set to obtain an offline enhanced sample set, including: determining the number of real samples in the online real sample set; and resampling and expanding the initial sample set according to the number of real samples and a preset ratio threshold to obtain the offline enhanced sample set.

[0013] Based on the above possible implementation methods, the service device expands the initial sample set based on the number of online real sample sets, ensuring that the number of enhanced sample sets is within an appropriate range. This can reduce the deviation between the sampling results and the true level caused by unreasonable sample sampling, and provide support for improving the learning ability and accuracy of the inference prediction model in capturing fraudulent behavior.

[0014] In one possible implementation of the first aspect, the method further includes: a service device receiving a new real sample set sent by the electronic device; when the number of the new real sample set reaches a preset threshold, expanding the initial sample set according to the online real sample set and the new real sample set to obtain a new offline enhanced sample set; training a classification model according to the new offline enhanced sample set, the online real sample set, and the new real sample set to obtain a new inference prediction model; and sending the new inference prediction model to the electronic device so that the electronic device can use the new inference prediction model to identify risks in user behavior.

[0015] Based on the above possible implementation methods, the service device, with its significant security attack and defense characteristics, continuously collects real sample sets and updates the inference and prediction model to ensure that the inference and prediction model maintains the learning ability of the latest data distribution and the learning ability of capturing fraudulent behavior.

[0016] Secondly, this application also provides a risk behavior identification method applied to an electronic device. The method includes: when a user's real-time behavior is detected as an initiation of payment, acquiring behavioral features corresponding to the user's historical behavior; processing the behavioral features using an inference prediction model to obtain a prediction result, wherein the inference prediction model is trained by a service device based on an offline enhanced sample set and an online real sample set; and outputting a prompt message when the prediction result indicates a risk, wherein the prompt message is used to alert the user that the real-time behavior is risky.

[0017] Based on the technical solution provided in this application, electronic devices determine whether user behavior is risky behavior based on the inference prediction model trained by the service device. The inference prediction model is trained based on the expanded offline enhanced sample set and the online real sample set. By combining the online real samples on the electronic device side and the offline enhanced samples on the service device side through iterative mixing and training methods, the inference prediction model can be ensured to take into account both the learning ability of the latest data distribution and the ability to capture fraudulent behavior. This can improve the accuracy of risk behavior identification and provide users with timely and effective anti-fraud services.

[0018] In one possible implementation of the second aspect, the method further includes: an electronic device acquiring feedback information corresponding to the real-time behavior; generating real samples based on the behavior features, the prediction results, and the feedback information; adding the real samples to a new set of real samples; and sending the new set of real samples to the service device when the new set of real samples meets preset conditions, so that the service device determines a new inference prediction model based on the new set of real samples.

[0019] Based on the above possible implementation methods, electronic devices generate real samples online and report the real samples to the service device according to preset conditions, so that the service device can update the inference prediction model based on the latest data distribution, thereby providing support for improving the accuracy of risk behavior identification.

[0020] In one possible implementation of the second aspect, when the electronic device detects that the user's real-time behavior is an initiation of payment, it acquires behavioral features corresponding to the user's historical behavior, including: when the user's real-time behavior is an initiation of payment, acquiring the user's historical behavior performed within a preset time period; and determining the behavioral features corresponding to the historical behavior according to preset rules.

[0021] Based on the above possible implementation methods, when an entry payment behavior is detected, the electronic device determines the behavioral characteristics corresponding to the historical behavior based on the user's historical behavior and preset rules. By analyzing the behavioral characteristics corresponding to the historical behavior, it can identify whether the current behavior has any risks.

[0022] In one possible implementation of the second aspect, the method further includes: when the electronic device detects that the user's real-time behavior is not an initiation of payment, it adds the real-time behavior to a historical behavior table.

[0023] Based on the above possible implementation methods, if the current behavior is not a payment behavior, it is stored in the historical behavior table to provide a basis for judging whether subsequent payment behaviors are risky behaviors.

[0024] In one possible implementation of the second aspect, the electronic device acquires feedback information corresponding to the real-time behavior, including: when the prediction result is that the prediction is risk-free, determining the feedback information corresponding to the real-time behavior as no feedback and no risk; when the prediction result is that the prediction is risky, acquiring the feedback behavior performed by the user based on the prompt information; and determining the feedback information corresponding to the real-time behavior based on the feedback behavior.

[0025] Based on the aforementioned possible implementation methods, if the prediction result determined by the inference prediction model indicates a risk, a prompt message is output to remind the user that their current behavior carries a risk. This method enables risk warnings to be issued during the transaction (before payment), helping users to mitigate losses in a timely manner and effectively providing anti-fraud services.

[0026] In one possible implementation of the second aspect, the electronic device determines the feedback information corresponding to the real-time behavior based on the feedback behavior, including: when the feedback behavior is a risk-free marking behavior, determining the feedback information corresponding to the real-time behavior as having feedback and no risk; when the feedback behavior is a risk-marking behavior, determining the feedback information corresponding to the real-time behavior as having feedback and risk; and when no feedback behavior is received within a preset time period, determining the feedback information corresponding to the real-time behavior as having no feedback and low risk.

[0027] Based on the above possible implementation methods, electronic devices collect user feedback behavior, generate real samples based on the feedback information corresponding to the feedback behavior, and provide data support for subsequent service devices to update the inference and prediction model.

[0028] Thirdly, embodiments of this application also provide a risk behavior identification device, which can be applied to service equipment. The functions of this device can be implemented through hardware or through hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, such as an acquisition module, an expansion module, a training module, and a transmission module.

[0029] The acquisition module can be used to acquire an initial sample set and an online real sample set;

[0030] The expansion module can be used to expand the initial sample set based on the online real sample set to obtain an offline enhanced sample set;

[0031] The training module can be used to train a classification model based on the offline augmented sample set and the online real sample set to obtain an inference prediction model;

[0032] The sending module can be used to send the inference prediction model to the electronic device, so that the electronic device can use the inference prediction model to identify risks in the user's behavior.

[0033] Fourthly, embodiments of this application also provide a risk behavior recognition device, which can be applied to electronic devices. The functions of this device can be implemented through hardware or through hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, such as an acquisition module, a processing module, and an output module.

[0034] The acquisition module can be used to acquire behavioral features corresponding to the user's historical behavior when the user's real-time behavior is detected as entering a payment behavior.

[0035] The processing module can be used to process the behavioral features using an inference prediction model to obtain prediction results. The inference prediction model is trained by the service device based on an offline augmented sample set and an online real sample set.

[0036] The output module can be used to output a prompt message when the prediction result indicates that the prediction is risky. The prompt message is used to remind the user that the real-time behavior is risky.

[0037] Fifthly, this application provides a service device including a memory and at least one processor; the memory is coupled to the processor; wherein the memory stores computer program code including computer instructions, which, when executed by the processor, cause the service device to perform a risk behavior identification method as provided in the first aspect and any possible design thereof.

[0038] In a sixth aspect, this application provides an electronic device including a display screen, a memory, and one or more processors; the display screen, the memory, and the processors are coupled; wherein the memory stores computer program code, the computer program code including computer instructions, which, when executed by the processor, cause the electronic device to perform the risk behavior identification method provided by the second aspect and any of its possible design embodiments.

[0039] In a seventh aspect, this application provides a computer-readable storage medium including computer instructions that, when executed on a service device, cause the service device to perform a risk behavior identification method as provided in the first aspect and any of its possible design embodiments.

[0040] Eighthly, this application provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform a risk behavior identification method as provided in the second aspect and any of its possible design embodiments.

[0041] Ninthly, this application provides a computer program product that, when run on a service device, causes the service device to perform the risk behavior identification method provided by the first aspect and any of its possible design methods.

[0042] In a tenth aspect, this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the risk behavior identification method provided by the second aspect and any of its possible design methods.

[0043] Understandably, the beneficial effects that the technical solutions provided in the third, fifth, seventh and ninth aspects above can achieve can be referenced to the beneficial effects of the first aspect and any of its possible design methods, and the beneficial effects that the technical solutions provided in the fourth, sixth, eighth and tenth aspects above can be referenced to the beneficial effects of the second aspect and any of its possible design methods, which will not be repeated here. Attached Figure Description

[0044] Figure 1 A schematic diagram of the network architecture of a risk behavior recognition system provided in related technologies;

[0045] Figure 2 This is a schematic diagram illustrating a use case of a risk behavior identification method provided in related technologies.

[0046] Figure 3 A schematic diagram of the network architecture of a risk behavior recognition system provided in this application embodiment;

[0047] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application;

[0048] Figure 5A A flowchart illustrating a risk behavior identification method provided in an embodiment of this application;

[0049] Figure 5B A schematic diagram illustrating the processing of the risk behavior identification method provided in the embodiments of this application;

[0050] Figure 5C A schematic diagram illustrating the acquisition of an offline enhanced sample set in the risk behavior identification method provided in this application embodiment;

[0051] Figure 6A This is a schematic diagram illustrating the output of prompt information by an electronic device in the risk behavior identification method provided in this application embodiment;

[0052] Figure 6B A schematic diagram illustrating user feedback behavior in the risk behavior identification method provided in this application embodiment;

[0053] Figure 7 A flowchart illustrating another risk behavior identification method provided in this application embodiment;

[0054] Figure 8 A flowchart illustrating another risk behavior identification method provided in this application embodiment;

[0055] Figure 9 A flowchart illustrating another risk behavior identification method provided in this application embodiment;

[0056] Figure 10 This is a schematic diagram of the structure of a risk behavior recognition device provided in an embodiment of this application;

[0057] Figure 11 This is a schematic diagram of another risk behavior recognition device provided in an embodiment of this application. Detailed Implementation

[0058] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that “ / ” means “or,” for example, A / B can mean A or B; “and / or” in the text is merely a description of the relationship between related objects, indicating that three relationships can exist, for example, A and / or B can mean: A alone, A and B simultaneously, and B alone.

[0059] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0060] The terms "first" and "second" in the following embodiments of this application are for descriptive purposes only and should not be construed as implying relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0061] Before providing a more detailed description of the embodiments of this application, the nouns and terms used in the embodiments of this application will be explained.

[0062] A fraud chain refers to the journey of a scam based on a specific type of fraud, involving multiple risky behaviors. A fraud chain can include: lead generation, building trust, obtaining money, and completing the scam.

[0063] A blacklist is a database of samples generated based on fraudulent information contained in confirmed fraud schemes. This fraudulent information can include fraudulent applications, fraudulent phone / SMS numbers, and fraudulent Uniform Resource Locators (URLs).

[0064] A white sample library refers to a sample library generated based on trust information contained in an established trust chain. This trust information may include trusted applications, trusted phone / SMS numbers, and trusted URLs, among others.

[0065] A gray sample library refers to a sample library generated based on feedback information that is uncertain whether it is fraudulent or trustworthy. In this embodiment of the application, feedback information that is uncertain whether it is fraudulent or trustworthy can specifically refer to feedback information that has a low risk of being detected.

[0066] Data augmentation is a method that uses a small amount of data to generate more similar generated data based on prior knowledge to expand the training dataset.

[0067] With the widespread use of the internet, telecommunications fraud incidents are frequent. Users, while using electronic devices, may fall victim to telecommunications fraud due to the complex and diverse network environment, resulting in financial losses. Therefore, quickly preventing or identifying potential telecommunications fraud from large-scale, high-concurrency, and multi-dimensional data has become crucial. Table 1 presents statistics on several common types of telecommunications fraud cases:

[0068] Table 1. Statistical information on common telecommunications fraud cases.

[0069]

[0070] To prevent users from being scammed and avoiding financial losses, some electronic devices (such as mobile phones and computers) are equipped with risk behavior recognition modules. Based on a pre-provided blacklist database, these modules intercept or alert users to potentially risky information or operations, providing anti-fraud functionality. For example, if a user is using an electronic device and the account they are communicating with is a number from the blacklist database, or the application they are downloading is also from the blacklist database, or the website they are visiting uses a Uniform Resource Locator (URL) from the blacklist database, the risk behavior recognition module in the electronic device can identify that the information or operation is risky and will intercept it or provide a warning message.

[0071] Figure 1 This is a schematic diagram of the network architecture of a risk behavior recognition system provided in related technologies. For example... Figure 1 As shown, the risk behavior recognition system in the related art includes at least one electronic device 101 ( Figure 1 The diagram shows two electronic devices 101-1 and 101-2, a service device 102, and a network 103. The service device 102 first trains an inference model based on existing black sample and white sample libraries, and then sends the trained inference model to the electronic device 101 through the network 103.

[0072] Electronic device 101 receives a trained inference model. Based on this recommendation model, the risk behavior recognition module in electronic device 101 provides anti-fraud services to users: First, it acquires behavioral data generated by the user during use of electronic device 101, then uses the received inference model to infer the behavioral data, obtaining an inference result. This inference result includes a first inference result and a second inference result. The first inference result indicates that the user's behavioral data contains risk, meaning the behavioral data includes risky behavioral data. The second inference result indicates that the user's behavioral data does not contain risky behavioral data, meaning the behavioral data does not contain risky behavioral data.

[0073] For example, Figure 2 This diagram illustrates a usage scenario for a risk behavior identification method provided in related technologies. While using electronic device 101, a user sees fraudulent content posted by scammers through search engines or websites. Guided by this fraudulent content, the user is prompted to download an app. After submitting an order through the downloaded app, the user is then directed to a payment app. The risk behavior identification module uses an inference model to assess the user's behavior data within a preset timeframe and obtains an inference result. If the app is a fraudulent app from a blacklist, the inference result indicates that the user's behavior poses a risk. If the app is a repackaged version of a fraudulent app from the blacklist, since this repackaged app is not in the blacklist, the existing inference model cannot identify it as a fraudulent app, and the inference result indicates that the user's behavior poses no risk.

[0074] It is evident that existing risk behavior identification modules primarily rely on existing black samples in their databases. However, due to the continuous evolution of fraud methods, black samples are highly time-sensitive. Once a sample is added to the black sample database, fraudsters can quickly redeploy it by changing phone numbers, repackaging apps, or switching websites, rendering the black sample ineffective. New samples, however, are not present in the black sample database. Existing inference models cannot identify risks from gray samples not in the black sample database; they can only provide users with post-event risk behavior identification capabilities based on the existing black sample database. In big data scenarios with a large number of gray samples, the effectiveness of fraud risk identification is poor, leading to lagging risk management.

[0075] To address the aforementioned issues, this application provides a risk behavior identification method. By constructing a dynamic risk identification framework across the entire anti-fraud chain, it enables the identification of various risk behaviors, achieving the goal of identifying fraudulent risk behaviors during the process and providing users with timely and effective anti-fraud services.

[0076] First, the risk behavior identification system provided in the embodiments of this application will be described. Figure 3This is a schematic diagram of the network architecture of a risk behavior recognition system provided in an embodiment of this application. Figure 3 As shown, the risk behavior recognition system provided in this application embodiment includes at least one electronic device 201. Figure 3 The device is shown in two electronic devices 201-1 and 201-2, a service device 202, and a network 203. Electronic device 201 and service device 202 can communicate through network 203.

[0077] Service device 202 trains an initial inference prediction model based on the existing black sample library and white sample library, and sends the trained initial inference prediction model to electronic device 201 through network 203.

[0078] Electronic device 201 receives a pre-trained initial inference prediction model. When a user uses electronic device 201, it acquires behavioral data generated during the user's use, determines behavioral characteristics based on the behavioral data, and uses the initial inference prediction model to predict and infer the behavioral characteristics to obtain a prediction result. This prediction result is used to predict whether the user's behavior poses a risk. If the prediction result indicates a risk, a prompt message is output to alert the user to the risk of their real-time behavior. Then, feedback information is acquired, and real samples are generated based on the behavioral characteristics, prediction result, and feedback information. The real samples are added to a new real sample set and sent to service device 202.

[0079] Service device 202 collects new real sample sets and stores them in an online real sample set. Based on the online real sample set, it expands the initial sample set to obtain an offline enhanced sample set. Then, it trains a classification model using the offline enhanced sample set and the online sample set to obtain an updated inference prediction model. The updated inference prediction model is then sent to electronic device 201 for further risk behavior identification. The risk identification system provided in this application, by combining an iterative mixing and training method of online real samples from the electronic device side and offline enhanced samples from the service device side, ensures that the inference prediction model has both the ability to learn from the latest data distribution and the ability to capture fraudulent behavior, thereby improving the accuracy of risk behavior identification and providing users with timely and effective fraud prevention services.

[0080] In some implementations, the electronic device 201 is equipped with a cold database. After obtaining the prediction results, the prediction results are stored in the cold database. According to pre-set reporting conditions, some or all of the prediction results are selected to generate online real samples and sent to the service device 202.

[0081] The service device 202 is equipped with a server-side database, which stores multiple online real samples sent by different electronic devices 201. The service device 202 expands the initial sample set based on the online real sample set, ensuring that the number of enhanced samples is within an appropriate range. This reduces the deviation between the sampling results and the true level caused by unreasonable sample sampling, and provides support for improving the learning ability and accuracy of the inference prediction model in detecting fraudulent behavior.

[0082] The risk behavior identification method provided in this application expands the initial sample set based on an online real sample set, ensuring that the number of augmented sample sets is within an appropriate range. Training based on the expanded offline augmented sample set and the online real sample set reduces the deviation between sampling results and the true level caused by unreasonable sample sampling, improves the accuracy of the inference prediction model, and enhances the inference prediction model's ability to identify and learn fraudulent behaviors. Electronic devices using the inference prediction model to identify user behavior risks can improve the accuracy of risk behavior identification and provide users with timely and effective fraud prevention services.

[0083] The electronic device 201 described in this application includes, but is not limited to, mobile phones, laptops, tablets, laptop computers, personal computers (PCs), personal digital assistants (PDAs), or wearable devices (such as smartwatches or wristbands). Furthermore, the various electronic devices 201 described above include, but are not limited to, those running Apple (iOS), Android, Microsoft, or other operating systems.

[0084] Service equipment 202 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server.

[0085] Network 203 includes, but is not limited to, Wireless Local Area Network (WLAN), Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), General Packet Radio Service (GPRS), Long Term Evolution (LTE), LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), and future 5th Generation (5G) systems or new radio (NR).

[0086] The method provided in the embodiments of this application will be described below with reference to the apparatus for implementing the embodiments of this application.

[0087] The technical solutions provided in this application can be applied to electronic devices. In some embodiments, the electronic device may be a mobile phone, tablet computer, handheld computer, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, in-vehicle device, smart home device and / or smart city device, etc. The embodiments of this application do not impose any special limitations on the specific type of electronic device.

[0088] For example, taking a mobile phone as an electronic device, Figure 4A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown.

[0089] Reference Figure 4 As shown, the electronic device may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, a sensor module 180, buttons 190, a motor 191, an indicator 192, a display screen 193, a subscriber identification module (SIM) card interface 194, and a camera 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0090] Processor 110 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0091] A controller can be the nerve center and command center of an electronic device. Based on the instruction opcode and timing signals, the controller generates operation control signals to control the fetching and execution of instructions.

[0092] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0093] Digital signal processors (DSPs) are used to process digital signals. Besides digital image signals, they can also process other digital signals. For example, when an electronic device is selecting a frequency, a DSP can perform a Fourier transform on the frequency energy.

[0094] In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0095] The external memory interface 120 can be used to connect to external non-volatile memory, thereby expanding the storage capacity of the electronic device. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to perform data storage functions. For example, music, video, and other files can be stored in the external non-volatile memory.

[0096] Internal memory 121 may include one or more random access memory (RAM) and one or more non-volatile memory (NVM). The RAM can be directly read and written by the processor 110 and can be used to store executable programs (e.g., machine instructions) of the operating system or other running programs, as well as user and application data. The NVM can also store executable programs and user and application data, and can be pre-loaded into the RAM for direct read and write operations by the processor 110.

[0097] USB port 130 is a USB standard compliant interface, which can be a Mini USB port, Micro USB port, USB Type-C port, etc. USB port 130 can be used to connect a charger to charge electronic devices, and can also be used for data transfer between electronic devices and peripheral devices. It can also be used to connect headphones for audio playback. This interface can also be used to connect other electronic devices, such as AR devices.

[0098] The charging management module 140 is used to receive charging input from a power supply device (such as a charger, laptop power supply, etc.). The charger can be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 can receive charging input from the wired charger via the USB interface 130. In some wireless charging embodiments, the charging management module 140 can receive wireless charging input via the wireless charging coil of the electronic device.

[0099] While charging the battery 142, the charging management module 140 can also supply power to the electronic device through the power management module 141. Specifically, the battery 142 can be composed of multiple batteries connected in series. The power management module 141 is used to connect the battery 142, the charging management module 140, and the processor 110.

[0100] The power management module 141 connects the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, providing power to the processor 110, internal memory 121, display screen 193, camera 195, and wireless communication module 160, etc. The power management module 141 can also monitor parameters such as battery voltage, current, battery cycle count, and battery health status (leakage current, impedance). In some other embodiments, the power management module 141 may also be located within the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may be located in the same device.

[0101] The wireless communication function of electronic devices can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem, and baseband processor.

[0102] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover one or more communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0103] The mobile communication module 150 can provide wireless communication solutions, including 2G / 3G / 4G / 5G, for use in electronic devices. The mobile communication module 150 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 can be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 can be housed in the same device.

[0104] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through audio devices (not limited to speaker 170A, receiver 170B, etc.) or displays images or videos through the display screen 193. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 150 or other functional modules.

[0105] The wireless communication module 160 can provide solutions for wireless communication applications in electronic devices, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signals, and sends the processed signal to processor 110. The wireless communication module 160 can also receive signals to be transmitted from processor 110, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0106] Electronic devices can implement audio functions such as music playback and recording through audio modules 170, speakers 170A, receivers 170B, microphones 170C, headphone jacks 170D, and application processors.

[0107] Pressure sensor 180A is used to sense pressure signals and convert them into electrical signals. In some embodiments, pressure sensor 180A can be disposed on display screen 193. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, and capacitive pressure sensors. When a touch operation is applied to display screen 193, the electronic device detects the intensity of the touch operation based on pressure sensor 180A. The electronic device can also calculate the touch position based on the detection signal from pressure sensor 180A. In some embodiments, touch operations applied to the same touch position but with different intensities can correspond to different operation commands. For example, when a touch operation with an intensity less than a first pressure threshold is applied to the SMS application icon, a command to view an SMS message is executed. When a touch operation with an intensity greater than or equal to the first pressure threshold is applied to the SMS application icon, a command to create a new SMS message is executed.

[0108] The gyroscope sensor 180B can be used to determine the motion attitude of an electronic device. In some embodiments, the angular velocity of the electronic device about three axes (i.e., the x, y, and z axes) can be determined by the gyroscope sensor 180B.

[0109] The barometric pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device calculates altitude using the air pressure value measured by the barometric pressure sensor 180C to assist in positioning and navigation.

[0110] The magnetic sensor 180D includes a Hall effect sensor. The electronic device can use the magnetic sensor 180D to detect the opening and closing of a flip case. In some embodiments, when the electronic device is a foldable phone, the electronic device can detect the opening and closing of the foldable phone based on the magnetic sensor 180D.

[0111] The 180E accelerometer can detect the magnitude of acceleration in various directions (typically three axes) of electronic devices. When the electronic device is stationary, it can detect the magnitude and direction of gravity.

[0112] The 180F distance sensor is used to measure distance. Electronic devices can measure distance using infrared or laser.

[0113] The proximity sensor 180G may include, for example, a light-emitting diode (LED) and a light detector, such as a photodiode. The LED may be an infrared LED. The electronic device emits infrared light outward through the LED. The electronic device uses the photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that an object is near the electronic device. When insufficient reflected light is detected, the electronic device can determine that no object is near the electronic device.

[0114] The fingerprint sensor 180H is used to collect fingerprints. Electronic devices can utilize the characteristics of the collected fingerprints to achieve fingerprint unlocking, app access locks, fingerprint photography, fingerprint answering of calls, etc.

[0115] Temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device uses the temperature detected by temperature sensor 180J to execute a temperature processing strategy.

[0116] Touch sensor 180K, also known as a "touch device," can be located on display screen 193. The touch sensor 180K and display screen 193 together form a touchscreen, also known as a "touchscreen." Touch sensor 180K is used to detect touch operations applied to or near it. Touch sensor 180K can transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through display screen 193. In other embodiments, touch sensor 180K may also be located on the surface of the electronic device, in a different position than display screen 193.

[0117] The ambient light sensor 180L is used to sense ambient light brightness. For example, the ambient light sensor 180L can measure the light intensity of four channels of ambient light. The ambient light sensor 180L outputs the measured light intensity of the four channels of ambient light to the processor 110. The processor 110 can process the light intensity of the four channels of ambient light output by the ambient light sensor 180L to obtain the ambient light intensity. In the screen-on state, the electronic device can adaptively adjust the display brightness according to the obtained ambient light intensity. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also be used in conjunction with the proximity sensor 180G to detect whether the electronic device is in a pocket to prevent accidental touches.

[0118] The bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire vibration signals from the vibrating bone segments of the human vocal cords. The bone conduction sensor 180M can also contact the human pulse to receive blood pressure signals. In some embodiments, the bone conduction sensor 180M can also be incorporated into headphones to form bone conduction headphones. The audio module 170 can analyze the voice signals based on the vibration signals from the vibrating bone segments of the vocal cords acquired by the bone conduction sensor 180M to realize voice functionality.

[0119] Buttons 190 include a power button, volume buttons, etc. Buttons 190 can be mechanical buttons or touch-sensitive buttons. The electronic device can receive button input and generate key signal inputs related to user settings and function control of the electronic device.

[0120] Motor 191 can generate vibration alerts. Motor 191 can be used for incoming call vibration alerts or for touch vibration feedback. For example, different vibration feedback effects can be corresponding to touch operations performed on different applications (such as taking photos, playing audio, etc.). Motor 191 can also correspond to different vibration feedback effects for touch operations performed on different areas of the display screen 194.

[0121] Indicator 192 can be an indicator light, used to indicate charging status, power changes, or to indicate messages, missed calls, notifications, etc.

[0122] In some embodiments, an electronic device may include one or N cameras 195, where N is a positive integer greater than 1. In this application embodiment, the type of camera 195 can be distinguished based on hardware configuration and physical location. For example, a camera located on the side of the electronic device's display screen 193 can be called a front-facing camera, and a camera located on the side of the electronic device's back cover can be called a rear-facing camera; another example is that a camera with a short focal length and a wide field of view can be called a wide-angle camera, while a camera with a long focal length and a narrow field of view can be called a regular camera. Here, focal length and field of view are relative concepts and are not specifically limited by parameters. Therefore, wide-angle cameras and regular cameras are also relative concepts, and can be specifically distinguished based on physical parameters such as focal length and field of view.

[0123] The electronic device implements display functions through a GPU, a display screen 193, and an application processor. The GPU is a microprocessor for image editing, connected to the display screen 193 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0124] Electronic devices can achieve shooting functions through ISP, camera 195, video codec, GPU, display 193, and application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information. In this embodiment, the GPU's functions are used during the frame rendering process of each image frame to achieve better display effects and performance in the final displayed image.

[0125] The Information Service Provider (ISP) is used to process data fed back from the camera 195. For example, when taking a picture, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, and the camera's photosensitive element transmits the electrical signal to the ISP for processing, transforming it into an image visible to the naked eye. The ISP can also perform algorithmic optimization on image noise and brightness. The ISP can also optimize parameters such as exposure and color temperature of the shooting scene. In some embodiments, the ISP can be integrated into the camera 195. The camera 195 is used to capture still images or videos.

[0126] Display screen 193 is used to display images, videos, etc. Display screen 193 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a sub-millimeter light-emitting diode (MiniLED), a micro light-emitting diode (MicroLED), a micro-OLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device may include one or N displays 193, where N is a positive integer greater than 1.

[0127] In this embodiment of the application, the display screen 193 can be used to display pages required by the electronic device (e.g., wizard pages (including recommendation pages and external module access pages), etc.), and display images captured by any one or more cameras 195 in the interface.

[0128] The SIM card interface 194 is used to connect a SIM card. The SIM card can be inserted into or removed from the SIM card interface 194 to make contact with and detach from the electronic device. The electronic device can support one or more SIM card interfaces. The SIM card interface 194 supports Nano SIM cards, Micro SIM cards, and other SIM cards. Multiple cards can be inserted into the same SIM card interface 194 simultaneously. The SIM card interface 194 is also compatible with external memory cards. The electronic device interacts with the network through the SIM card to achieve functions such as calls and data communication. One SIM card corresponds to one user number.

[0129] It is understood that the interface connection relationships between the modules illustrated in the embodiments of this application are merely illustrative and do not constitute a limitation on the structure of the electronic device. In other embodiments of this application, the electronic device may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0130] Of course, this is understandable. Figure 4The illustration shown is merely an example when the electronic device is in the form of a mobile phone. If the electronic device is in the form of a tablet, handheld computer, PC, PDA, wearable device (such as a smartwatch, smart bracelet), or other similar device, the structure of the electronic device may include more advanced features. Figure 4 The fewer structures shown can also include more than Figure 4 The structures shown are not limited here.

[0131] It is understandable that, generally speaking, the implementation of electronic device functions requires not only hardware support but also software cooperation. The software system of electronic devices can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. This application's embodiment uses a layered architecture... Taking the system as an example, the software structure of the electronic device is illustrated.

[0132] The technical solutions provided in the embodiments of this application can all be implemented in electronic devices with the above-described hardware or software architecture.

[0133] Based on the above Figure 4 The hardware architecture shown below, combined with Figures 5A to 5C The risk behavior identification method provided in the embodiments of this application will be introduced. Figure 5A This is a flowchart illustrating a risk behavior identification method provided in an embodiment of this application.

[0134] Reference Figure 5A As shown, the risk behavior identification method may include steps S501 to S521:

[0135] Step S501: The service device acquires the initial inference prediction model.

[0136] The initial inference prediction model is trained by the service device based on the existing black sample library and white sample library. The black samples in the existing black sample library and the white samples in the white sample library can be obtained through expert experience analysis.

[0137] In step S502, the service device sends the initial inference prediction model to the electronic device.

[0138] In this embodiment, a mobile phone is used as an example of an electronic device. In practical applications, the initial inference prediction model can be packaged in an anti-fraud app. Users install the anti-fraud app on their electronic devices (such as mobile phones), and the app provides users with anti-fraud services that identify risky behaviors.

[0139] Step S503: The electronic device collects the user's current behavior.

[0140] See Figure 5BThe system manager collects the user's current behavior based on the phone. This current behavior can include various actions performed by the user while using the phone, including but not limited to touching, single-finger tap, double-finger tap, gestures, payment, navigation, enabling anti-fraud alerts, enabling screen sharing, enabling do-not-disturb, enabling call blocking, enabling SMS blocking, enabling call forwarding, and other similar actions.

[0141] Step S504: The electronic device determines whether the current action is an initiation of a payment action.

[0142] Entering a payment activity refers to the act of using a payment application (App), which can include various Apps capable of conducting transactions.

[0143] If the current action is to initiate a payment, proceed to step S506; if the current action is not to initiate a payment, proceed to step S505.

[0144] In step S505, the electronic device stores the current behavior as a historical behavior in the historical behavior table.

[0145] The current behavior is stored as historical behavior in the phone's hot database. Specifically, it can be stored in a historical behavior table within the hot database, where each historical behavior is arranged in chronological order. The most recently stored historical behavior is the most recent to the current time. In this embodiment, after step S505 is completed, the process returns to step S503 to continue collecting the user's behavior at the next moment.

[0146] Step S506: The electronic device obtains the historical behavior sequence from the historical behavior table.

[0147] In this embodiment, the historical behavior sequence may include the user's historical actions within a preset time period. The preset time period may be set to 1 hour, 6 hours, 24 hours, or 2 days, etc. For example, historical behaviors recorded in the past hour can be retrieved from the historical behavior table, and these historical behaviors are sorted by time.

[0148] Step S507: The electronic device determines behavioral characteristics based on the historical behavior sequence.

[0149] In this embodiment, behavioral features corresponding to historical behavior sequences can be determined according to preset rules. These preset rules are shown in Table 2 below:

[0150] Table 2 Preset Rules Table

[0151]

[0152] The characteristic values ​​of each risk behavior in the historical behavior sequence are determined according to the preset rules, and then the behavior characteristics are determined based on the characteristic values ​​of each risk behavior.

[0153] For example, based on historical behavior sequences, if it is determined that a user has suspicious call records in the past hour (corresponding risk behavior characteristic value is 1), no overseas call records in the past hour (corresponding risk behavior characteristic value is 0), suspicious overseas call records in the past six hours (corresponding risk behavior characteristic value is 1), no payment records in the past hour (corresponding risk behavior characteristic value is 0), screen sharing is not enabled (corresponding risk behavior characteristic value is 0), do not disturb is not enabled (corresponding risk behavior characteristic value is 0), call blocking is not enabled (corresponding risk behavior characteristic value is 0), SMS blocking is not enabled (corresponding risk behavior characteristic value is 0), and call forwarding is not enabled (corresponding risk behavior characteristic value is 0), then the determined behavior characteristic is 101000000.

[0154] In some embodiments, when determining the characteristic values ​​of historical behavior, if a certain risky behavior exists, the number of times the risky behavior occurs within a preset time period can be further counted.

[0155] In step S508, the electronic device uses the initial inference prediction model to infer and predict the behavioral characteristics, and obtains the prediction result.

[0156] Behavioral features are input into the initial inference sub-model of the initial inference prediction model to obtain a suspiciousness score. The suspiciousness score can range from 0 to 100. The higher the suspiciousness score, the more suspicious the payment behavior is, and the higher the risk.

[0157] In some embodiments, different risk behaviors have different risk weights in the initial inference sub-model. The risk weight for each risk behavior can be a preset fixed value or a variable value determined based on the number of times the risk behavior occurs within a preset time period.

[0158] After obtaining the suspicious score, the suspicious score is input into the initial prediction sub-model of the initial inference prediction model, that is, the suspicious score is compared with the preset threshold to obtain the prediction result. When the suspicious score is greater than the preset threshold, the prediction result is determined to be risky; when the suspicious score is less than or equal to the preset threshold, the prediction result is determined to be risk-free.

[0159] Step S509: The electronic device determines whether the prediction result is risky.

[0160] If the prediction result indicates that the prediction is risky, it means that proceeding to payment is a risky behavior, and proceed to step S510. If the prediction result does not indicate that the prediction is risky, that is, if the prediction result is risk-free, it means that proceeding to payment is not a risky behavior, and proceed to step S511.

[0161] In step S510, the electronic device outputs a prompt message.

[0162] The alert message is used to remind users that their real-time actions pose a risk. For example, in a case involving fraud, the alert message might look like this: Figure 6A As shown.

[0163] Step S511: The electronic device obtains feedback information.

[0164] When the prediction result is that there is no risk, indicating that the payment behavior is not a risky behavior, no prompt message will be output. At this time, the payment behavior is considered to be risk-free, and the feedback message will be determined as no feedback and no risk.

[0165] When the prediction indicates a risk, signifying that proceeding with the payment is a risky action, a warning message is displayed. The user is then informed of the risk associated with the current payment action based on this message. If the user immediately closes the warning message (e.g., by clicking...) upon becoming aware of the risk, the warning message can be ignored. Figure 6A After the user responds with "OK" (as shown), the feedback information is determined to be low risk with no feedback. If the user executes the action knowing that the payment behavior involves risk, ... Figure 6B As shown in section 601, marking the current incoming call as risk-free means that the user has labeled the payment transaction as risk-free, and the feedback information is then confirmed as risk-free. If the user is aware that the payment transaction involves risk, then... Figure 6B As shown in section 602, the current incoming call is marked as risky, and the feedback information is then determined to be risky.

[0166] In this embodiment of the application, when the user is aware that the payment behavior involves risks, the user performs the following actions: Figure 6B The marked behavior shown is called explicit feedback behavior. The feedback information corresponding to explicit feedback behavior is called explicit feedback information, which includes "no risk with feedback" and "risk with feedback".

[0167] When a user is aware that a payment transaction carries a risk, the action of directly closing the notification is called an implicit feedback action. The feedback information corresponding to the implicit feedback action, and the feedback information determined by the prediction result if the payment transaction is not risky, are called implicit feedback information, including no feedback (no risk) and no feedback (low risk).

[0168] In step S512, the electronic device generates real samples based on behavioral features, prediction results, and feedback information, and adds the generated real samples to the real sample set.

[0169] In some embodiments, the real sample set may be stored in a cold database.

[0170] In step S513, the electronic device determines whether the preset conditions have been met.

[0171] In this embodiment, the mobile phone can consider the preset condition met when the real sample set reaches a certain number or when the mobile phone is in a preset state (such as the screen is off and it is charging), and proceed to step S514; otherwise, it returns to execute S503 and continues to collect the user's behavior at the next moment.

[0172] In step S514, the electronic device sends the real sample set to the service device.

[0173] Sending the real sample set from the cold database to the service device according to preset conditions ensures that every real sample data point is delivered. Furthermore, sending the real sample set to the service device while the phone is charging and the screen is off minimizes power consumption.

[0174] Step S515: The service device constructs a basic sample type based on the number of behaviors in the fraud link.

[0175] In this embodiment of the application, the basic sample type may include the following six types:

[0176] 1) The first basic sample type corresponds to the random arrangement of the three behaviors: 1 overseas phone call behavior OR 1 suspicious status behavior + 1 entry into a payment app behavior. Here, OR indicates that the order of the behaviors is not limited.

[0177] 2) The second basic sample type corresponding to the random arrangement of the four behaviors: 1 overseas phone call behavior, 1 suspicious status behavior, or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0178] 3) The third basic sample type corresponding to the random arrangement of the five behaviors: 1 overseas phone call behavior or 2 suspicious status behaviors or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0179] 4) The fourth basic sample type corresponding to the random arrangement of the five behaviors: 2 overseas phone calls or 1 suspicious status behavior or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0180] 5) The fifth basic sample type corresponding to the random arrangement of the seven behaviors: 2 overseas call behaviors + 1 suspicious status behavior + 2 behaviors of entering the payment app + 2 suspicious status behaviors + 1 behavior of entering the payment app.

[0181] 6) The sixth basic sample type corresponding to the random arrangement of the eight behaviors: 2 overseas call behaviors + 2 suspicious status behaviors + 2 behaviors of entering the payment app + 1 suspicious status behavior + 1 behavior of entering the payment app.

[0182] Suspicious behaviors include: enabling screen sharing, enabling Do Not Disturb, enabling call blocking, enabling SMS blocking, and enabling call forwarding.

[0183] Since fraud cases are much sparser than non-fraud cases, directly using real fraud cases to generate real samples may not guarantee the collection of all types of fraud cases. In this embodiment, the service device constructs basic sample types based on the risk behaviors of the fraud chain, and then constructs an initial sample set. This ensures that various possible types of initial samples are obtained. The diverse sample data provides data support for improving the accuracy of the inference and prediction model and the ability to detect fraudulent behavior.

[0184] Step S516: The service device constructs an initial sample set based on the basic sample type.

[0185] See Figure 5C The service equipment constructs an initial sample set by combining a certain proportion of positive and negative samples based on six basic sample categories. Positive samples are those labeled as risky, while negative samples are those labeled as risk-free.

[0186] Although the basic sample types are constructed based on suspicious behavior, a large number of non-fraudulent links with similar behavior still occur in reality. Anti-fraud scenarios require high accuracy; therefore, when constructing the initial sample set, a portion is randomly selected as positive samples, and the remainder as negative samples, forming the initial sample set.

[0187] It should be noted that steps S515 and S516 are exemplaryly executed after step S514 in this application, but in practice they can be executed after any step before step S517. This application does not limit them.

[0188] In step S517, the service device stores the real sample set sent by the electronic device into the online real sample set.

[0189] The service device collects a set of real samples sent by at least one electronic device and stores it as an online real sample set in a server-side database configured within the service device.

[0190] Step S518: The service device determines whether the update conditions have been met.

[0191] The service device accumulates online real samples. When the number of real samples in the online real sample set reaches a preset number or the accumulation time reaches a preset time, it is considered that the update condition has been met and proceeds to step S519; otherwise, it returns to step S517 and continues to wait for the receiving electronic device to send more real samples.

[0192] In step S519, the service device expands the initial sample set based on the online real sample set to obtain an offline enhanced sample set.

[0193] like Figure 5C As shown, the service device resamples and expands the initial sample set based on online real samples, according to the number of real samples and a preset ratio threshold, to obtain an offline enhanced sample set.

[0194] For example, let Q be the number of real samples, r be the preset ratio threshold, and P be the number of initial samples in the initial sample set. The initial sample set is resampled and expanded until the number of samples in the offline augmented sample set reaches Q*r, at which point expansion stops. This yields the offline augmented sample set. By expanding the initial sample set, ensuring the number of augmented samples is within an appropriate range, the deviation between the sampling results and the true level caused by unreasonable sampling can be reduced, thus supporting the improvement of the learning ability and accuracy of the inference prediction model in detecting fraudulent behavior.

[0195] In step S520, the service device trains the classification model based on the offline augmented sample set and the online sample set to obtain an updated inference prediction model.

[0196] The classification model is trained by combining offline samples from the offline augmented sample set and real samples from the online real sample set. After training, a trained inference and prediction model is obtained. In this embodiment, online real samples collected from the electronic device side and offline augmented samples from the service device side are combined for iterative hybrid training to ensure that the model can learn from the latest data distribution and capture fraudulent behavior.

[0197] In step S521, the service device sends the updated inference prediction model to the electronic device.

[0198] The mobile phone continues to identify risks in user behavior by using the updated inference prediction model, repeating the above steps S503 to S514 and S517 to S521 to achieve an iterative hybrid update model.

[0199] Considering the significant offensive and defensive characteristics of security, the inference and prediction model needs to be continuously updated. For example, after training model M on day T1, new online real samples reported to the service device are accumulated starting from day T1+1, accumulating daily. When the amount of real samples accumulated on day T2 exceeds a preset threshold, offline sample augmentation is performed. The new offline augmented samples are mixed with the accumulated real samples to train a new model M' to replace the existing model M, and the training date is updated. The newly trained model M' is then distributed to the mobile phone, and inference and prediction are performed using the new model M'.

[0200] This application's embodiments combine online real samples from electronic devices to expand offline samples, thereby enhancing the classification samples and improving the model's ability to capture fraudulent behavior. By iteratively mixing and training the model with online real samples and offline enhanced samples, the model can ensure that it has both the ability to learn from the latest data distribution and the ability to capture fraudulent behavior, thus improving the accuracy of risk behavior identification and reducing user losses.

[0201] Based on the above embodiments, this application further provides a risk behavior identification method applied to service equipment, such as... Figure 7 As shown, the risk behavior identification method includes the following steps:

[0202] Step S701: Obtain the initial sample set and the online real sample set.

[0203] In this embodiment, the initial sample set can be determined based on the fraud chain provided by the expert system. Specifically, the risk behaviors of the fraud chain are first obtained; then, a basic sample type is constructed based on the risk behaviors; and finally, an initial sample set is constructed based on the basic sample type.

[0204] In some embodiments, risky behaviors may include preset area phone calls, preset risk status behaviors, and redirection payment behaviors.

[0205] Preset risk status behaviors can include enabling screen sharing, enabling Do Not Disturb, enabling call blocking, enabling SMS blocking, and enabling call forwarding.

[0206] For example, the basic sample types constructed based on risky behavior can include the following six types:

[0207] 1) The first basic sample type corresponds to the random arrangement of the three behaviors: 1 overseas phone call behavior or 1 behavior with a preset risk status + 1 behavior of entering a payment app. Here, "or" indicates that the order of the behaviors is not limited.

[0208] 2) The second basic sample type corresponding to the random arrangement of the four behaviors: 1 overseas phone call behavior or 1 behavior with a preset risk status or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0209] 3) The third basic sample type corresponding to the random arrangement of the five behaviors: 1 overseas phone call behavior or 2 preset risk status behaviors or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0210] 4) The fourth basic sample type corresponding to the random arrangement of the five behaviors: 2 overseas phone calls or 1 pre-set risk status behavior or 1 behavior of entering the payment app + 1 behavior of entering the payment app.

[0211] 5) The fifth basic sample type corresponding to the random arrangement of the seven behaviors: 2 overseas phone calls + 1 behavior with a preset risk status + 2 behaviors of entering the payment app + 2 behaviors with a preset risk status + 1 behavior of entering the payment app.

[0212] 6) The sixth basic sample type corresponding to the random arrangement of the eight behaviors: 2 overseas phone call behaviors + 2 preset risk status behaviors + 2 behaviors of entering the payment app + 1 preset risk status behavior + 1 behavior of entering the payment app.

[0213] The preset risk status behaviors include: enabling screen sharing, enabling Do Not Disturb, enabling call blocking, enabling SMS blocking, and enabling call forwarding.

[0214] Since fraud cases are much sparser than non-fraud cases, directly using real fraud cases to generate real samples may not guarantee the collection of all types of fraud cases. In this embodiment, the service device constructs basic sample types based on the risk behaviors of the fraud chain, and then constructs an initial sample set. This ensures that various possible types of initial samples are obtained. The diverse sample data provides data support for improving the accuracy of the inference and prediction model and the ability to detect fraudulent behavior.

[0215] Although the basic sample types are constructed based on suspicious behavior, a large number of non-fraudulent links with similar behavior still occur in reality. High accuracy is required in anti-fraud scenarios; therefore, in this embodiment, when constructing the initial sample set based on the basic sample types, a portion is randomly selected as positive samples, and the remaining portion is selected as negative samples to form the initial sample set.

[0216] It is understood that the method of obtaining the online real sample set will not be described in detail in the embodiments of this application. For details, please refer to the aforementioned steps S503 to S514 and step S517.

[0217] Step S702: Based on the online real sample set, the initial sample set is expanded to obtain the offline enhanced sample set.

[0218] In some embodiments, offline augmentation of the sample set can be achieved through... Figure 8 The steps shown are as follows: determine the number of real samples in the online real sample set; based on the number of real samples and a preset ratio threshold, resample and expand the initial sample set to obtain the offline enhanced sample set.

[0219] It is understood that the method of expanding the initial sample set in this application embodiment will not be described in detail, but can be referred to the aforementioned step S519.

[0220] Step S703: Train the classification model based on the offline augmented sample set and the online real sample set to obtain the inference prediction model.

[0221] The classification model is trained using offline samples from the offline augmented sample set and real samples from the online real sample set. After training, a trained inference and prediction model is obtained. In this embodiment, online real samples collected from the electronic device side and offline augmented samples from the service device side are combined for iterative hybrid training to ensure that the model can both learn from the latest data distribution and detect fraudulent behavior.

[0222] Step S704: Send the inference prediction model to the electronic device so that the electronic device can use the inference prediction model to identify risks in the user's behavior.

[0223] It is understood that the use of inference prediction models by electronic devices to identify risks in user behavior will not be described in detail in this application embodiment. For details, please refer to the aforementioned steps S503 to S510.

[0224] The risk behavior identification method provided in this application expands the initial sample set based on the online real sample set, ensuring that the number of enhanced sample sets is within an appropriate range. In this way, training based on the expanded offline enhanced sample set and the online real sample set can reduce the deviation between the sampling results and the true level caused by unreasonable sample sampling, improve the accuracy of the inference prediction model, and enhance the inference prediction model's ability to identify and learn fraudulent behaviors.

[0225] Based on the above embodiments, this application further provides a method for identifying risky behaviors applied to electronic devices, such as... Figure 8 As shown, the risk behavior identification method includes the following steps:

[0226] Step S801: If the user's real-time behavior is detected as entering a payment behavior, obtain the behavioral characteristics corresponding to the user's historical behavior.

[0227] During the use of electronic devices (such as mobile phones), the real-time behavior of mobile phone users is monitored. If the real-time behavior of a user is detected as entering a payment behavior, the historical behavior performed by the user within a preset time period is obtained. Based on preset rules, the behavioral characteristics corresponding to the historical behavior are determined.

[0228] In this embodiment, the acquired historical behavior may include the user's actions within a preset time period. The preset time period may be set to 1 hour, 6 hours, 24 hours, or 2 days, etc. For example, the historical behavior recorded in the past hour may be acquired from the historical behavior table, and these historical behaviors are sorted by time.

[0229] The feature values ​​corresponding to each historical behavior are determined according to the preset rules, and then the behavioral features corresponding to each historical behavior are determined based on the feature values ​​of each historical behavior.

[0230] In some embodiments, if the user's real-time behavior is not a payment action, the real-time behavior is added to the historical behavior table to provide a basis for judging whether subsequent payment actions are risky behaviors.

[0231] Step S802: Process the behavioral features using the inference prediction model to obtain the prediction results.

[0232] In this embodiment of the application, the inference prediction model is trained by the service device based on an offline augmented sample set and an online real sample set.

[0233] Behavioral features are input into the initial inference sub-model of the initial inference prediction model to obtain a suspiciousness score. Different risky behaviors correspond to different risk weights in the initial inference sub-model. The suspiciousness score can range from 0 to 100. The higher the suspiciousness score, the more suspicious the payment behavior is, and the higher the risk.

[0234] After obtaining the suspicious score, the suspicious score is input into the initial prediction sub-model of the initial inference prediction model, that is, the suspicious score is compared with the preset threshold to obtain the prediction result. When the suspicious score is greater than the preset threshold, the prediction result is determined to be risky; when the suspicious score is less than or equal to the preset threshold, the prediction result is determined to be risk-free.

[0235] Step S803: If the prediction result indicates that the prediction is risky, output a prompt message.

[0236] The notification message is used to alert users that their real-time actions pose a risk.

[0237] If the prediction indicates a risk, then proceeding with the payment is a risky action. The control display shows a prompt message to alert the user of the risk in real time. This method enables risk warnings to be issued before payment, helping users mitigate losses and effectively providing fraud prevention services.

[0238] The risk behavior identification method provided in this application embodiment determines whether a user's behavior is risky based on an inference prediction model trained by the service device. The inference prediction model is trained based on an expanded offline augmented sample set and an online real sample set. By combining the iterative mixing and training method of online real samples from the electronic device side and offline augmented samples from the service device side, the inference prediction model can ensure that it has both the ability to learn from the latest data distribution and the ability to capture fraudulent behavior, thereby improving the accuracy of risk behavior identification and providing users with timely and effective anti-fraud services.

[0239] exist Figure 8 Based on the illustrated embodiment, the risk behavior identification method may further include, for example: Figure 9 The following steps are shown:

[0240] Step S804: Obtain feedback information corresponding to the real-time behavior.

[0241] In some embodiments, when an electronic device obtains feedback information corresponding to a real-time behavior, if the prediction result is that the prediction is risk-free, the feedback information corresponding to the real-time behavior is determined as no feedback and no risk; if the prediction result is that the prediction is risky, the feedback behavior performed by the user based on the prompt information is obtained; and the feedback information corresponding to the real-time behavior is determined based on the feedback behavior.

[0242] If the feedback behavior is marked as risk-free, the feedback information corresponding to the real-time behavior is determined as having feedback but no risk; if the feedback behavior is marked as risky, the feedback information corresponding to the real-time behavior is determined as having feedback but risk; if no feedback behavior is received within a preset time period, the feedback information corresponding to the real-time behavior is determined as having no feedback and low risk.

[0243] Step S805: Generate real samples based on behavioral characteristics, prediction results, and feedback information.

[0244] Step S806: Add real samples to the new real sample set.

[0245] In some embodiments, the real sample set may be stored in a cold database.

[0246] Step S807: If the new real sample set meets the preset conditions, the new real sample set is sent to the service device so that the service device can determine a new inference prediction model based on the new real sample set.

[0247] The risk behavior identification method provided in this application involves an electronic device generating real samples online and reporting the real samples to a service device according to preset conditions. This allows the service device to update its inference and prediction model based on the latest data distribution, thereby supporting the improvement of the accuracy of risk behavior identification.

[0248] It is understood that, in order to achieve the aforementioned functions, the electronic device includes corresponding hardware structures and / or software modules for performing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in a hardware-driven or software-driven manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments of this application.

[0249] This application embodiment can divide the above-described electronic device into functional modules based on the method example described above. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division; in actual implementation, there may be other division methods.

[0250] When dividing each function into modules according to its corresponding function, refer to Figure 10 As shown in the figure, this application embodiment also provides a risk behavior identification device applied in a service device. The risk behavior identification device 1000 may include: an acquisition module 1001, an expansion module 1002, a training module 1003, and a sending module 1004.

[0251] Among them, the acquisition module 1001 can be used to acquire the initial sample set and the online real sample set;

[0252] The expansion module 1002 can be used to expand the initial sample set based on the online real sample set to obtain an offline enhanced sample set;

[0253] Training module 1003 can be used to train a classification model based on an offline augmented sample set and an online real sample set to obtain an inference prediction model;

[0254] The sending module 1004 can be used to send an inference prediction model to an electronic device so that the electronic device can use the inference prediction model to identify risks in the user's behavior.

[0255] In some embodiments, the acquisition module 1001 may be specifically used to: acquire risk behaviors of the fraud chain; construct a basic sample type based on the risk behaviors; and construct an initial sample set based on the basic sample type.

[0256] In some embodiments, risky behaviors include preset area phone calls, preset risk status behaviors, and payment redirection behaviors;

[0257] Preset risk status behaviors include enabling screen sharing, enabling Do Not Disturb, enabling call blocking, enabling SMS blocking, and enabling call forwarding.

[0258] In some embodiments, the expansion module 1002 may be specifically used to: determine the number of real samples in the online real sample set; and resample and expand the initial sample set according to the number of real samples and a preset ratio threshold to obtain an offline enhanced sample set.

[0259] In some embodiments, the risk behavior identification device 1000 may further include a receiving module.

[0260] The receiving module can be used to receive new real sample sets sent by electronic devices;

[0261] The expansion module 1002 can also be used to expand the initial sample set according to the online real sample set and the new real sample set when the number of new real sample sets reaches a preset threshold, so as to obtain a new offline enhanced sample set.

[0262] Training module 1003 can also be used to train a classification model based on a new offline augmented sample set, an online real sample set, and a new real sample set to obtain a new inference prediction model.

[0263] The sending module 1004 can also be used to send a new inference prediction model to an electronic device so that the electronic device can use the new inference prediction model to identify risks in the user's behavior.

[0264] When dividing each function into modules according to its corresponding function, refer to Figure 11 As shown in the figure, this application embodiment also provides a risk behavior recognition device applied in an electronic device. The risk behavior recognition device 1100 may include: an acquisition module 1101, a processing module 1102 and an output module 1103.

[0265] The acquisition module 1101 can be used to acquire the behavioral characteristics corresponding to the user's historical behavior when the user's real-time behavior is the payment behavior.

[0266] Processing module 1102 can be used to process behavioral features using an inference prediction model to obtain prediction results. The inference prediction model is trained by the service device based on an offline augmented sample set and an online real sample set.

[0267] The output module 1103 can be used to output a prompt message when the prediction result indicates that the prediction is risky. The prompt message is used to remind the user that there is a risk in real-time behavior.

[0268] In some embodiments, the risk behavior identification device 1100 may further include: a generation module, a storage module, and a transmission module.

[0269] The acquisition module 1101 can also be used to acquire feedback information corresponding to real-time behavior;

[0270] The generation module can be used to generate real samples based on behavioral features, prediction results, and feedback information;

[0271] The storage module can be used to add real samples to a new set of real samples;

[0272] The sending module can be used to send a new real sample set to the service device when the new real sample set meets the preset conditions, so that the service device can determine a new inference prediction model based on the new real sample set.

[0273] In some embodiments, the acquisition module 1101 may be specifically used to: acquire the user's historical behavior within a preset time period when the user's real-time behavior is detected as entering payment behavior; and determine the behavioral characteristics corresponding to the historical behavior according to preset rules.

[0274] In some embodiments, the storage module can also be used to add the real-time behavior to the historical behavior table if the collected real-time behavior of the user does not result in a payment behavior.

[0275] In some embodiments, the acquisition module 1101 may be specifically used to: determine the feedback information corresponding to the real-time behavior as no feedback and no risk when the prediction result is no risk; acquire the feedback behavior performed by the user based on the prompt information when the prediction result is risky; and determine the feedback information corresponding to the real-time behavior based on the feedback behavior.

[0276] In some embodiments, the acquisition module 1101 may be specifically used to: determine the feedback information corresponding to the real-time behavior as having feedback and no risk when the feedback behavior is a risk-marked behavior; determine the feedback information corresponding to the real-time behavior as having feedback and risk when the feedback behavior is a risk-marked behavior; and determine the feedback information corresponding to the real-time behavior as having no feedback and low risk when no feedback behavior is received within a preset time period.

[0277] Regarding the risk behavior recognition device in the above embodiments, the specific methods by which each module performs its operation have been described in detail in the embodiments of the risk behavior recognition method described above, and will not be elaborated here. The related beneficial effects can also be referred to the related beneficial effects of the aforementioned risk behavior recognition method, and will not be repeated here.

[0278] This application also provides a service device, which includes: a memory and at least one processor; the memory is coupled to the processor; wherein the memory stores computer program code, the computer program code including computer instructions, and when the computer instructions are executed by the processor, the service device performs the risk behavior identification method provided in the foregoing embodiments.

[0279] This application also provides an electronic device, which includes: a display screen, a memory, and one or more processors; the display screen, the memory, and the processors are coupled; wherein, the memory stores computer program code, which includes computer instructions, and when the computer instructions are executed by the processor, the electronic device performs the risk behavior identification method provided in the foregoing embodiments. The specific structure of this electronic device can be referred to... Figure 4 The structure of the electronic device shown is illustrated.

[0280] This application also provides a computer-readable storage medium including computer instructions that, when executed on a service device, cause the service device to perform the risk behavior identification method provided in the foregoing embodiments.

[0281] This application also provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform the risk behavior identification method provided in the foregoing embodiments.

[0282] This application also provides a computer program product containing executable instructions that, when run on a service device, cause the service device to perform the risk behavior identification method provided in the foregoing embodiments.

[0283] This application also provides a computer program product containing executable instructions that, when run on an electronic device, cause the electronic device to perform the risk behavior identification method provided in the foregoing embodiments.

[0284] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0285] In the several embodiments provided in this application, it should be understood that the disclosed apparatus / device and method can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0286] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0287] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0288] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0289] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A risk behavior identification method applied to an electronic device, comprising: The method comprises: In the case that the real-time behavior of the user is collected as entering payment behavior, the behavior characteristics corresponding to the historical behavior of the user are acquired; The behavior characteristics are processed by using an inference prediction model to obtain a prediction result, the inference prediction model being obtained by training, based on an offline enhanced sample set and an online real sample set, by a service device; In the case that the prediction result is prediction of no risk, it is determined that the real-time behavior is no feedback no risk; In the case that the prediction result is prediction of risk, prompt information is output, the prompt information being used for prompting the user that the real-time behavior has risk; The feedback behavior executed by the user based on the prompt information is acquired; The feedback information corresponding to the real-time behavior is determined according to the feedback behavior; Based on the behavior characteristics, the prediction result and the feedback information, a real sample is generated; The real sample is added to a new real sample set; In the case that the new real sample set reaches a preset condition, the new real sample set is sent to the service device, so that the service device determines a new inference prediction model based on the new real sample set.

2. The method of claim 1, wherein, The method comprises: In the case that the real-time behavior of the user is collected as entering payment behavior, the behavior characteristics corresponding to the historical behavior of the user are acquired; In the case that the real-time behavior of the user is collected as entering payment behavior, the historical behavior executed by the user within a preset time length is acquired; 3. The method of claim 1, wherein, According to a preset rule, the behavior characteristics corresponding to the historical behavior are determined. The method further comprises:

4. The method of claim 1, wherein, In the case that the real-time behavior of the user is not collected as entering payment behavior, the real-time behavior is added to a historical behavior table. The feedback information corresponding to the real-time behavior is determined according to the feedback behavior, comprising: In the case that the feedback behavior is a no-risk marking behavior, the feedback information corresponding to the real-time behavior is determined as having feedback no risk; In the case that the feedback behavior is a risk marking behavior, the feedback information corresponding to the real-time behavior is determined as having feedback risk; 5. A method of risk behavior identification, the method comprising: In the case that the feedback behavior is not received within a preset time period, the feedback information corresponding to the real-time behavior is determined as no feedback low risk. The service device is applied to, the service device serving an electronic device, the electronic device being used for executing the method according to any one of claims 1-4, the method comprising: An initial sample set and an online real sample set are acquired; According to the online real sample set, the initial sample set is expanded to obtain an offline enhanced sample set; According to the offline enhanced sample set and the online real sample set, a classification model is trained to obtain an inference prediction model; 6. The method of claim 5, wherein, The inference prediction model is sent to the electronic device, so that the electronic device uses the inference prediction model to identify the risk of the behavior of the user. The initial sample set is acquired, comprising: A risk behavior of a fraud link is acquired; A basic sample type is constructed according to the risk behavior; 7. The method of claim 6, wherein, An initial sample set is constructed according to the basic sample type. The risk behavior comprises a preset area telephone behavior, a preset risk state behavior and a jump payment behavior; The preset risk state behavior includes starting screen sharing, starting do-not-disturb, starting phone interception, starting message interception, and starting call forwarding.

8. The method of claim 6, wherein, The method further includes: determining the number of real samples in the online real sample set; resampling and expanding the initial sample set according to the number of real samples and a preset proportion threshold to obtain an offline enhanced sample set.

9. The method of claim 6, wherein, The method further includes: receiving a new real sample set sent by the electronic device; in a case where the number of the new real sample set reaches a preset number threshold, expanding the initial sample set according to the online real sample set and the new real sample set to obtain a new offline enhanced sample set; training a classification model according to the new offline enhanced sample set, the online real sample set, and the new real sample set to obtain a new inference prediction model; sending the new inference prediction model to the electronic device, so that the electronic device performs risk identification on the behavior of a user by using the new inference prediction model.

10. An electronic device, comprising: The electronic device comprises: a display screen, a memory, and one or more processors; the display screen, the memory, and the processors are coupled; the memory stores computer program code, the computer program code comprises computer instructions, and the computer instructions, when executed by the processors, cause the electronic device to perform the risk behavior identification method according to any one of claims 1-4.

11. A service device, characterized by The service device comprises: a memory and at least one processor; the memory and the processor are coupled; the memory stores computer program code, the computer program code comprises computer instructions, and the computer instructions, when executed by the processor, cause the service device to perform the risk behavior identification method according to any one of claims 5-9.

12. A computer-readable storage medium, characterized in that, The computer instructions, when executed on the service device, cause the service device to perform the risk behavior identification method according to any one of claims 5-9; and when executed on the electronic device, cause the electronic device to perform the risk behavior identification method according to any one of claims 1-4.

Images