User behavior risk detection method and system based on incremental single-class support vector machine

Abstract

The invention provides a user behavior risk detection method and system based on an incremental single-class support vector machine. The method comprises the following steps: collecting current multi-dimensional behavior data and historical multi-dimensional behavior data of interaction between a user and an operator; according to the current multi-dimensional behavior data and the historical multi-dimensional behavior data, whether the condition of needing to update the model is met or not is judged, if yes, incremental updating is conducted on the incremental single-class support vector machine model to obtain the incremental single-class support vector machine model, and if not, updating is not conducted, and the current multi-dimensional behavior data are input into the incremental single-class support vector machine model to obtain the multi-dimensional behavior data. Obtaining a current decision score; using a dynamic quantile estimation method to detect the user behavior based on the decision score to obtain a detection result; the incremental single-class support vector machine method can continuously absorb new data and update the model, and good adaptability of the model to data distribution drift is ensured; the accuracy of abnormal behavior detection is improved; and reliable behavior risk assessment and coping strategies are provided for operators.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning and data analysis, and in particular to a user behavior risk detection method and system based on an incremental single-class support vector machine. Background Art

[0002] User behavior risk detection is a core requirement in key infrastructure scenarios such as smart grids, connected vehicles, and energy services. With the advancement of intelligent terminal devices and diversified services, interactions between users and operators are becoming increasingly frequent and multimodal, including charging behavior logs, device operation sequences, network communication data, payment traces, and geographic location information. While this data improves system response efficiency and user service experience, it also hides behavioral risks such as account abuse, abnormal operations, and fraudulent transactions, necessitating an efficient and generalizable detection mechanism.

[0003] Existing anomaly detection methods mostly rely on static statistical modeling or supervised learning algorithms. These methods typically assume a fixed data distribution and that the training samples contain a large number of anomaly-labeled behaviors. However, in real-world scenarios, anomaly samples are extremely scarce, and behavioral patterns evolve over time, geography, policy adjustments, and other factors. As a result, traditional methods suffer from limitations such as poor generalization, high maintenance costs, and high false positive rates when faced with data distribution drift, behavioral evolution, and cold start issues.

[0004] To address these issues, first-class support vector machines (SVMs), a classic unsupervised anomaly detection method, construct data boundaries using only normal samples, thereby identifying anomalous behaviors that deviate from the normal distribution. Their independence from anomalous samples significantly reduces modeling costs and has been widely used in fields such as financial risk control, network security, and equipment status monitoring. However, standard first-class support vector machines are static models that are fixed after training and cannot adapt to new data. Their performance significantly degrades when faced with long-term evolution of user behavior and the need for real-time updates, making them difficult to support high-reliability detection tasks in dynamic environments.

[0005] In recent years, incremental learning has been gradually introduced into the field of anomaly detection as an important means of addressing the dynamic evolution of data. However, these methods still have significant shortcomings in processing complex, multi-dimensional behavioral data, achieving high-precision risk grading, and dynamically adjusting detection thresholds. In the absence of anomalous samples, dynamic risk level determination is difficult to accurately model, and traditional fixed threshold strategies are prone to misjudgments. Summary of the Invention

[0006] In order to solve the problems in the prior art of risk detection of user-operator interaction behavior, such as the inability to adapt to changes in behavior patterns and insufficient real-time risk assessment, the present invention provides a user behavior risk detection method based on an incremental single-class support vector machine. The improvement lies in that the method comprises:

[0007] Collect current and historical multi-dimensional behavioral data of users' interactions with operators;

[0008] Based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, it is determined whether the conditions for updating the model are met. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated, and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score.

[0009] Based on the decision score, the dynamic quantile estimation method is used to detect user behavior and obtain the detection results.

[0010] Preferably, the determining whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data includes:

[0011] Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

[0012] Preferably, the incremental updating of the incremental single-class support vector machine model includes:

[0013] The Gaussian kernel function parameters and regularization parameters of the incremental one-class support vector machine model are dynamically adjusted through the Bayesian optimization method. The classification boundary and support vector set of the incremental one-class support vector machine model are incrementally updated according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, and the updated incremental one-class support vector machine model is obtained.

[0014] Preferably, the initial training process of the incremental single-class support vector machine includes:

[0015] The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model;

[0016] The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, thereby obtaining the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

[0017] Preferably, the multi-dimensional behavioral data includes one or more of the following:

[0018] Charging behavior, device operation logs, payment data, network interaction data, or user location data.

[0019] Preferably, inputting the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score includes:

[0020] The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

[0021] Preferably, the detecting result obtained by detecting user behavior based on the decision score using a dynamic quantile estimation method includes:

[0022] The exponentially weighted moving average algorithm is used to process the historical decision scores, and the results processed by the exponentially weighted moving average algorithm are input into the autoregressive model for smoothing;

[0023] Based on the distribution characteristics of smoothed historical decision scores, the upper and lower boundaries of the risk threshold are calculated using the dynamic quantile estimation method;

[0024] When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal.

[0025] Preferably, after collecting the multi-dimensional behavior data of the user's interaction with the operator, and before determining whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, the method further includes:

[0026] The collected data are sampled using a sliding window, and the sampled data are converted into continuous time series data. The continuous time series data are preprocessed using a standardization method to eliminate dimensional differences.

[0027] Based on the same inventive concept, the present invention also provides a user behavior risk detection system based on an incremental single-class support vector machine, the system comprising:

[0028] The collection module is used to collect the current and historical multi-dimensional behavior data of users interacting with operators;

[0029] An update module is used to determine whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score.

[0030] The detection module is used to detect user behavior based on the decision score using a dynamic quantile estimation method to obtain a detection result.

[0031] Preferably, the updating module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, including:

[0032] Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

[0033] Preferably, the incremental updating of the incremental single-class support vector machine model in the updating module includes:

[0034] The Gaussian kernel function parameters and regularization parameters of the incremental one-class support vector machine model are dynamically adjusted through the Bayesian optimization method. The classification boundary and support vector set of the incremental one-class support vector machine model are incrementally updated according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, and the updated incremental one-class support vector machine model is obtained.

[0035] Preferably, the initial training process of the incremental single-class support vector machine in the update module includes:

[0036] The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model;

[0037] The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, thereby obtaining the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

[0038] Preferably, the multi-dimensional behavior data in the acquisition module includes one or more of the following:

[0039] Charging behavior, device operation logs, payment data, network interaction data, or user location data.

[0040] Preferably, the updating module inputs the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score, including:

[0041] The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

[0042] Preferably, the detection module detects user behavior based on the decision score using a dynamic quantile estimation method to obtain a detection result, including:

[0043] The exponentially weighted moving average algorithm is used to process the historical decision scores, and the results processed by the exponentially weighted moving average algorithm are input into the autoregressive model for smoothing;

[0044] Based on the distribution characteristics of smoothed historical decision scores, the upper and lower boundaries of the risk threshold are calculated using the dynamic quantile estimation method;

[0045] When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal.

[0046] Preferably, after the acquisition module collects the multi-dimensional behavior data of the user's interaction with the operator, and before the update module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, it also includes a pre-processing module:

[0047] The collected data are sampled using a sliding window, and the sampled data are converted into continuous time series data. The continuous time series data are preprocessed using a standardization method to eliminate dimensional differences.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] The present invention provides a user behavior risk detection method and system based on an incremental single-class support vector machine, including: collecting current multi-dimensional behavior data and historical multi-dimensional behavior data of the user's interaction with the operator; judging whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data; if so, incrementally updating the incremental single-class support vector machine model to obtain the incremental single-class support vector machine model; otherwise, not updating, and inputting the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score; based on the decision score, a dynamic quantile estimation method is used to detect user behavior to obtain a detection result; the incremental single-class support vector machine method can continuously absorb new data and update the model to adapt to the dynamic changes in user behavior and ensure the model's good adaptability to data distribution drift; by dynamically updating the risk threshold and quantile estimation method, the accuracy of abnormal behavior detection is improved and the false alarm and missed alarm rates are reduced; combined with real-time risk assessment and multi-dimensional data processing, it can accurately identify behaviors of different risk levels and provide operators with reliable behavior risk assessment and response strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flow chart of a user behavior risk detection method based on incremental single-class support vector machine provided by the present invention;

[0051] Figure 2 Flowchart of incremental single-class support vector machine model training provided by the present invention;

[0052] Figure 3 A schematic diagram of the framework of a user behavior risk detection method based on an incremental single-class support vector machine provided by the present invention;

[0053] Figure 4 This is a structural diagram of a user behavior risk detection system based on an incremental single-class support vector machine provided by the present invention. DETAILED DESCRIPTION

[0054] The purpose of the present invention is to address the shortcomings of the existing technology in the risk detection of interactive behavior between users and operators, such as the inability to adapt to changes in behavior patterns and real-time risk assessment. This invention proposes a user behavior risk detection method and system based on an incremental single-class support vector machine, which effectively improves detection accuracy and adaptability, reduces false alarm and missed alarm rates, and realizes accurate behavior risk assessment.

[0055] The beneficial effects of the present invention are: (1) the incremental One-Class SVM method can continuously absorb new data and update the model to adapt to the dynamic changes in user behavior, ensuring the model's good adaptability to data distribution drift; (2) by dynamically updating the risk threshold and quantile estimation method, the accuracy of abnormal behavior detection is improved, and the false alarm and missed alarm rates are reduced; (3) combined with real-time risk assessment and multi-dimensional data processing, it can accurately identify behaviors of different risk levels and provide operators with reliable behavioral risk assessment and response strategies.

[0056] The specific embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

[0057] Example 1

[0058] The present invention provides a user behavior risk detection method based on incremental single-class support vector machine, such as Figure 1 ,include:

[0059] Collect current and historical multi-dimensional behavioral data of users' interactions with operators;

[0060] Based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, it is determined whether the conditions for updating the model are met. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated, and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score.

[0061] Based on the decision score, the dynamic quantile estimation method is used to detect user behavior and obtain the detection results.

[0062] Preferably, determining whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data include:

[0063] Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

[0064] Preferably, incrementally updating the incremental single-class support vector machine model includes:

[0065] Dynamically adjust the γ parameter and regularization parameter of the Gaussian kernel function parameters of the incremental one-class support vector machine model through the Bayesian optimization method, and incrementally update the classification boundary and support vector set of the incremental one-class support vector machine model according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, thereby obtaining an updated incremental one-class support vector machine model;

[0066] Based on the optimized parameters, the system incrementally updates the model's classification boundaries and support vector set instead of retraining the entire model. During the update process, the kernel function parameters are adjusted to adapt to the new feature distribution, the importance of the support vectors is re-evaluated, and the updated model is returned to continue real-time anomaly detection, achieving efficient and continuous model optimization.

[0067] Preferably, the initial training process of the incremental single-class support vector machine includes:

[0068] The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model;

[0069] The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, enhance the model's adaptability to complex data distribution, and obtain the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

[0070] The initial training process and the overall process of incremental update of the incremental single-class support vector machine model are as follows: Figure 2 shown.

[0071] Preferably, the multi-dimensional behavioral data includes one or more of the following:

[0072] Charging behavior, device operation logs, payment data, network interaction data, or user location data.

[0073] Preferably, the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score including:

[0074] The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

[0075] Preferably, the user behavior is detected based on the decision score using a dynamic quantile estimation method to obtain a detection result, including:

[0076] An exponentially weighted moving average algorithm is used to process historical decision scores, giving more weight to recent data. The results of the exponentially weighted moving average algorithm are then input into an autoregressive model for smoothing, effectively eliminating the impact of short-term fluctuations.

[0077] Based on the distribution characteristics of smoothed historical decision scores, a dynamic quantile estimation method is used to calculate the upper and lower bounds of the risk threshold. This dynamic threshold mechanism ensures that risk judgments maintain appropriate sensitivity and specificity across different time periods, user groups, and business scenarios.

[0078] When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal;

[0079] Based on the real-time updated risk threshold and the decision score calculated from the current multi-dimensional behavioral data, user behavior is precisely divided into four levels: normal (score below the lower threshold), low risk (score between the lower and middle thresholds), medium risk (score between the middle and upper thresholds), and high risk (score above the upper threshold), allowing for accurate risk assessment.

[0080] Based on the abnormal decision score and dynamic risk threshold of user behavior, the corresponding response mechanism is triggered to carry out the next step of abnormal behavior detection and processing;

[0081] Automatically or manually execute corresponding response strategies based on the risk level, such as issuing warnings to users or performing automatic risk management operations;

[0082] The incremental single-class support vector machine model continuously optimizes its own parameters based on behavioral results, ensuring that abnormal behaviors can be more accurately identified and handled in the future, and improving the model's adaptability and robustness.

[0083] Preferably, after collecting the multi-dimensional behavior data of the user's interaction with the operator, and before determining whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, the method further includes:

[0084] Perform sliding window sampling on the collected data, segment the data using a set time window, such as 5 minutes, and convert the sampled data into continuous time series data. Use standardization methods to preprocess the continuous time series data so that each feature has zero mean and unit variance, eliminating dimensional differences.

[0085] During the standardization process, ensure that each feature has a balanced impact on the model to avoid bias in model training due to some features being too large or too small in dimension.

[0086] Example 2

[0087] Based on the same inventive concept, the present invention also provides a specific example of a user behavior risk detection method based on an incremental single-class support vector machine, such as Figure 3 ,include:

[0088] Step 1: Collect various behavioral data of users interacting with operators, including charging behavior data, device operation logs, payment data, network interaction data, user geographic location data, etc.

[0089] Step 2: normalize the collected time series data to eliminate dimensional differences, and then input it into an incremental One-Class SVM model for training;

[0090] Step 3: Train the incremental One-Class SVM model to build a classification boundary that can surround normal data and continuously update it to adapt to changes in data distribution;

[0091] Step 4: Receive user behavior data in real time, input it into the trained One-Class SVM model, calculate the abnormal deviation, and perform risk assessment on the behavior;

[0092] Step 5: Update the risk threshold in real time by combining the dynamic quantile estimation method, and smooth the anomaly score using the exponentially weighted moving average model and the autoregressive model. Finally, risk level classification is performed based on the smoothed anomaly score.

[0093] Step 6: Based on the risk level classification results, trigger the corresponding response mechanism to accurately detect and handle abnormal behaviors in real time.

[0094] The specific process of step 1 is:

[0095] Step 11: Collect multi-dimensional behavioral data on the user's interaction with the operator to ensure the integrity and representativeness of the data. Data types include but are not limited to charging behavior, device operation logs, payment data, network interaction data, etc.;

[0096] Step 12: Sliding window sampling is performed on the collected data, and the data is segmented using a set time window (e.g., 5 minutes) and preprocessed;

[0097] In step 13, the real-time collected data is integrated with the historical interaction data to form continuous time series data for online training and real-time detection of the incremental One-Class SVM model.

[0098] The specific process of step 2 is:

[0099] Step 21, using the Z-score normalization method to process the continuous time series data in step 13 so that each feature has zero mean and unit variance to eliminate dimensional differences;

[0100] Step 22: During the standardization process, ensure that each feature has a balanced impact on the model to avoid bias in model training due to some features being too large or too small in size.

[0101] In step 23, the standardized data is input into the incremental One-Class SVM model for training, so that the model can better learn normal behavior patterns.

[0102] The specific process of step 3 is:

[0103] Step 31: Z-score normalization is performed on the historical continuous time series data to eliminate dimensional differences between different features and ensure that each feature contributes to the model in a balanced manner. The normalized data is used to train the initial One-Class SVM model. This stage determines the initial regularization parameter (ν) and RBF kernel function parameter (γ) to establish the initial classification boundary for normal behavior.

[0104] Step 32: Use the processed historical data to train an initial One-Class SVM model, employing a Gaussian kernel function to implement nonlinear mapping of the feature space and enhance the model's adaptability to complex data distributions. After initial training, the model establishes the classification boundaries for normal behavior and determines the set of support vectors, laying the foundation for subsequent incremental learning.

[0105] In step 33, the system continuously receives new data samples through a sliding window mechanism and applies the same normalization process to these new samples as the initial data. The processed new data is first used for anomaly detection and then added to the training set for model update evaluation to maintain data processing consistency.

[0106] In step 34, the system calculates the Kullback-Leibler divergence (KL divergence) between the new data and the original data distribution to determine whether the data distribution has changed significantly. When the KL divergence exceeds a preset threshold or the amount of accumulated new data reaches a specific threshold, the model's incremental update process is triggered to ensure that the model can adapt to environmental changes in a timely manner;

[0107] Step 35: During the incremental update process, the system dynamically adjusts the Gaussian kernel function's γ parameter and regularization parameter ν. The optimal parameter combination is automatically selected using Bayesian optimization, and cross-validation is used to evaluate parameter performance, ensuring that the model maintains good detection and generalization capabilities under the new data distribution.

[0108] In step 36, the system incrementally updates the model's classification boundaries and support vector set based on the optimized parameters, rather than retraining the entire model. This update process adjusts the kernel function parameters to accommodate the new feature distribution, reassesses the importance of the support vectors, and returns the updated model to continue real-time anomaly detection, achieving efficient and continuous model optimization.

[0109] The specific process of step 4 is as follows:

[0110] Step 41: Integrate the real-time user behavior data with recent historical interaction data through a sliding window mechanism to form continuous time series data. After Z-score normalization, the data is input into the trained incremental one-class support vector machine (SVM) model for anomaly detection.

[0111] Step 42: Calculate the abnormal deviation of the input data using the decision function of the model to obtain a decision score, and compare it with a preset risk threshold;

[0112] In step 43, if the decision score is greater than or equal to zero, the behavior is considered normal; if it is less than zero, the behavior is abnormal, and the subsequent risk level classification step is entered.

[0113] The specific process of step 5 is as follows:

[0114] In step 51, the system first applies an exponentially weighted moving average algorithm to the raw decision scores output by the One-Class SVM model, giving more weight to recent data. The result processed by the exponentially weighted moving average algorithm is then input into the autoregressive model for further smoothing, effectively eliminating the impact of short-term fluctuations.

[0115] In step 52, based on the distribution characteristics of historical decision scores, the system uses the dynamic quantile estimation (DQE) method to calculate the upper and lower bounds of the risk threshold. This dynamic threshold mechanism ensures that risk judgment maintains appropriate sensitivity and specificity across different time periods, user groups, and business scenarios.

[0116] Step 53 , based on the real-time updated risk threshold and the decision score calculated from real-time data, accurately classifies user behavior into four levels: normal (score below the lower threshold), low risk (score between the lower and middle thresholds), medium risk (score between the middle and upper thresholds), and high risk (score above the upper threshold), allowing for accurate risk assessment.

[0117] The specific process of step 6 is as follows:

[0118] Step 61: triggering a corresponding response mechanism based on the abnormality score of the user behavior and the dynamic risk threshold to perform further abnormal behavior detection and processing;

[0119] Step 62: Based on the risk level, automatically or manually execute corresponding response strategies, such as issuing warnings to users or performing automatic risk management operations;

[0120] In step 63, the model continuously optimizes its own parameters based on the behavioral results to ensure that abnormal behaviors can be more accurately identified and handled in the future, thereby improving the model's adaptability and robustness.

[0121] Example 3

[0122] Based on the same inventive concept, the present invention also provides a user behavior risk detection system based on incremental single-class support vector machine, such as Figure 4 , the system comprising:

[0123] The collection module is used to collect the current and historical multi-dimensional behavior data of users interacting with operators;

[0124] An update module is used to determine whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score.

[0125] The detection module is used to detect user behavior based on the decision score using a dynamic quantile estimation method to obtain a detection result.

[0126] Preferably, the updating module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, including:

[0127] Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

[0128] Preferably, the incremental updating of the incremental single-class support vector machine model in the updating module includes:

[0129] The Gaussian kernel function parameters and regularization parameters of the incremental one-class support vector machine model are dynamically adjusted through the Bayesian optimization method. The classification boundary and support vector set of the incremental one-class support vector machine model are incrementally updated according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, and the updated incremental one-class support vector machine model is obtained.

[0130] Preferably, the initial training process of the incremental single-class support vector machine in the update module includes:

[0131] The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model;

[0132] The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, thereby obtaining the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

[0133] Preferably, the multi-dimensional behavior data in the acquisition module includes one or more of the following:

[0134] Charging behavior, device operation logs, payment data, network interaction data, or user location data.

[0135] Preferably, the updating module inputs the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score, including:

[0136] The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

[0137] Preferably, the detection module detects user behavior based on the decision score using a dynamic quantile estimation method to obtain a detection result, including:

[0138] The exponentially weighted moving average algorithm is used to process the historical decision scores, and the results processed by the exponentially weighted moving average algorithm are input into the autoregressive model for smoothing;

[0139] Based on the distribution characteristics of smoothed historical decision scores, the upper and lower boundaries of the risk threshold are calculated using the dynamic quantile estimation method;

[0140] When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal.

[0141] Preferably, after the acquisition module collects the multi-dimensional behavior data of the user's interaction with the operator, and before the update module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, it also includes a pre-processing module:

[0142] The collected data are sampled using a sliding window, and the sampled data are converted into continuous time series data. The continuous time series data are preprocessed using a standardization method to eliminate dimensional differences.

[0143] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0147] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A user behavior risk detection method based on incremental single-class support vector machine, characterized in that: include: Collect current and historical multi-dimensional behavioral data of users' interactions with operators; Based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, it is determined whether the conditions for updating the model are met. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated, and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score. Based on the decision score, the dynamic quantile estimation method is used to detect user behavior and obtain the detection results.

2. The user behavior risk detection method based on incremental single-class support vector machine according to claim 1, characterized in that: The determination of whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data includes: Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

3. The user behavior risk detection method based on incremental single-class support vector machine according to claim 2, characterized in that: The incremental updating of the incremental single-class support vector machine model includes: The Gaussian kernel function parameters and regularization parameters of the incremental one-class support vector machine model are dynamically adjusted through the Bayesian optimization method. The classification boundary and support vector set of the incremental one-class support vector machine model are incrementally updated according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, and the updated incremental one-class support vector machine model is obtained.

4. The user behavior risk detection method based on incremental single-class support vector machine according to claim 3, characterized in that: The initial training process of the incremental single-class support vector machine includes: The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model; The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, thereby obtaining the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

5. The user behavior risk detection method based on incremental single-class support vector machine according to claim 1, characterized in that: The multi-dimensional behavior data includes one or more of the following: Charging behavior, device operation logs, payment data, network interaction data, or user location data.

6. The user behavior risk detection method based on incremental single-class support vector machine according to claim 1, characterized in that: Inputting the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score includes: The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

7. The user behavior risk detection method based on incremental single-class support vector machine according to claim 1, characterized in that: The detection results obtained by detecting user behavior using a dynamic quantile estimation method based on the decision score include: The exponentially weighted moving average algorithm is used to process the historical decision scores, and the results processed by the exponentially weighted moving average algorithm are input into the autoregressive model for smoothing; Based on the distribution characteristics of smoothed historical decision scores, the upper and lower boundaries of the risk threshold are calculated using the dynamic quantile estimation method; When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal.

8. The user behavior risk detection method based on incremental single-class support vector machine according to claim 1, characterized in that: After collecting the multi-dimensional behavior data of the user's interaction with the operator, and before determining whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, the method further includes: The collected data are sampled using a sliding window, and the sampled data are converted into continuous time series data. The continuous time series data are preprocessed using a standardization method to eliminate dimensional differences.

9. A user behavior risk detection system based on incremental single-class support vector machine, characterized in that: include: The collection module is used to collect the current and historical multi-dimensional behavior data of users interacting with operators; An update module is used to determine whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data. If so, the incremental single-class support vector machine model is incrementally updated to obtain the incremental single-class support vector machine model. Otherwise, the model is not updated and the current multi-dimensional behavior data is input into the incremental single-class support vector machine model to obtain the current decision score. The detection module is used to detect user behavior based on the decision score using a dynamic quantile estimation method to obtain a detection result.

10. The user behavior risk detection system based on incremental single-class support vector machine according to claim 9, characterized in that: The updating module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, including: Determine whether the KL divergence between the current multi-dimensional behavior data and the historical multi-dimensional behavior data exceeds the preset threshold, and determine whether the accumulated current multi-dimensional behavior data volume reaches a specific threshold. If any one of the items is yes, the conditions for updating the model are met; otherwise, the conditions for updating the model are not met.

11. The user behavior risk detection system based on incremental single-class support vector machine according to claim 10, characterized in that: The incremental update of the incremental single-class support vector machine model in the update module includes: The Gaussian kernel function parameters and regularization parameters of the incremental one-class support vector machine model are dynamically adjusted through the Bayesian optimization method. The classification boundary and support vector set of the incremental one-class support vector machine model are incrementally updated according to the optimized Gaussian kernel function and regularization parameters until cross-validation is used to ensure that the incremental one-class support vector machine model can still maintain good detection ability and generalization performance under the new multi-dimensional behavioral data distribution, and the updated incremental one-class support vector machine model is obtained.

12. The user behavior risk detection system based on incremental single-class support vector machine according to claim 11, characterized in that: The initial training process of the incremental single-class support vector machine in the update module includes: The collected historical multi-dimensional behavioral data of the user's interaction with the operator is used as input data, the decision score corresponding to the input data is used as output data, and the input data and output data are used as training samples to train a first-class support vector machine model; The initial classification boundary of normal behavior is established through the initial regularization parameters and Gaussian kernel function parameters, and the Gaussian kernel function is used to realize the nonlinear mapping of the feature space, thereby obtaining the determined classification boundary of normal behavior and the incremental single-class support vector machine model of the support vector set.

13. The user behavior risk detection system based on incremental single-class support vector machine according to claim 9, characterized in that: The multi-dimensional behavior data in the acquisition module includes one or more of the following: Charging behavior, device operation logs, payment data, network interaction data, or user location data.

14. The user behavior risk detection system based on incremental single-class support vector machine according to claim 9, characterized in that: The update module inputs the current multi-dimensional behavior data into the incremental single-class support vector machine model to obtain the current decision score including: The current multi-dimensional behavior data is input into the incremental one-class support vector machine model, and the abnormal deviation of the current multi-dimensional behavior data is calculated through the decision function of the incremental one-class support vector machine model to obtain the current decision score.

15. The user behavior risk detection system based on incremental single-class support vector machine according to claim 9, characterized in that: The detection module detects user behavior based on the decision score using a dynamic quantile estimation method to obtain the detection results, including: The exponentially weighted moving average algorithm is used to process the historical decision scores, and the results processed by the exponentially weighted moving average algorithm are input into the autoregressive model for smoothing; Based on the distribution characteristics of smoothed historical decision scores, the upper and lower boundaries of the risk threshold are calculated using the dynamic quantile estimation method; When the current decision score is less than the set value, the user behavior is detected based on the current decision score, and the risk level divided according to the current decision score and the upper and lower boundaries of the risk threshold is used as the detection result. Otherwise, the user behavior is considered normal.

16. The user behavior risk detection system based on incremental single-class support vector machine according to claim 9, characterized in that: After the acquisition module collects the multi-dimensional behavior data of the user's interaction with the operator, and before the update module determines whether the conditions for updating the model are met based on the current multi-dimensional behavior data and the historical multi-dimensional behavior data, a pre-processing module is also included: The collected data are sampled using a sliding window, and the sampled data are converted into continuous time series data. The continuous time series data are preprocessed using a standardization method to eliminate dimensional differences.

Images