Abnormality detection method and device for behavior sequence, equipment and storage medium

Abstract

The embodiment of the invention provides a behavior sequence anomaly detection method and device, equipment and a storage medium, which can be applied to scenes such as cloud technology, artificial intelligence, smart traffic and auxiliary driving, and the method comprises the steps of splitting a target behavior sequence into N sub-behavior sequences, and calculating the anomaly of the target behavior sequence based on respective sparse attributes of a plurality of sub-behavior vectors contained in the sub-behavior sequences. And selecting at least one key behavior vector from the plurality of sub-behavior vectors. And based on the respective similarity between each key behavior vector and the plurality of sub-behavior vectors, performing primary fusion on the plurality of sub-behavior vectors to obtain a corresponding behavior sequence vector. And determining a sub-feature map corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector. And finally, based on the obtained N sub-feature maps, obtaining an anomaly detection result of the target behavior sequence, thereby effectively capturing a non-linear relationship and long-term dependence in the behavior sequence, improving the accuracy of anomaly detection of the behavior sequence, and reducing the calculation amount and the memory occupancy rate.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and storage medium for detecting anomalies in a behavior sequence. Background Art

[0002] With the development of internet technology, payment applications are becoming increasingly widespread, and accordingly, their security is attracting increasing attention. To improve the security of payment applications, it is necessary to perform anomaly detection on the behavior sequences of various objects in payment scenarios, identify abnormal behavior sequences, and then, based on these detected abnormal behavior sequences, locate the abnormal objects within each object and intercept their payment requests.

[0003] Related technologies use supervised machine learning algorithms (e.g., logistic regression, decision tree, and random forest algorithms) to train an anomaly detection model based on historical behavior data. The anomaly detection model is then used to detect anomalies in the behavior sequences of each object and identify abnormal behavior sequences.

[0004] The aforementioned supervised machine learning algorithms only learn low-level features, and these low-level features are extracted from the behavior sequence as a whole. In reality, nonlinear relationships and long-term dependencies exist between the various behaviors in a behavior sequence. Therefore, when using these supervised machine learning algorithms for anomaly detection in behavior sequences, they have difficulty capturing these nonlinear relationships and long-term dependencies, resulting in low anomaly detection accuracy. Summary of the Invention

[0005] The embodiments of the present application provide a method, apparatus, device, and storage medium for detecting anomalies in a behavior sequence, for improving the accuracy of anomaly detection in a behavior sequence.

[0006] On the one hand, an embodiment of the present application provides a method for detecting anomalies in a behavior sequence, comprising:

[0007] Split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1;

[0008] For the N sub-behavior sequences, perform the following operations respectively:

[0009] Selecting at least one key behavior vector from a plurality of sub-behavior vectors included in a sub-behavior sequence based on a sparse attribute of each of the plurality of sub-behavior vectors, wherein the sparse attribute is used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors;

[0010] Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector;

[0011] Determining a sub-feature graph corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector;

[0012] Based on the obtained N sub-feature graphs, an anomaly detection result of the target behavior sequence is obtained.

[0013] On the one hand, an embodiment of the present application provides a behavior sequence anomaly detection device, comprising:

[0014] A segmentation module is used to split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1;

[0015] The feature extraction module is used to perform the following operations on the N sub-behavior sequences:

[0016] Selecting at least one key behavior vector from a plurality of sub-behavior vectors included in a sub-behavior sequence based on a sparse attribute of each of the plurality of sub-behavior vectors, wherein the sparse attribute is used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors;

[0017] Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector;

[0018] Determining a sub-feature graph corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector;

[0019] The prediction module is used to obtain an anomaly detection result of the target behavior sequence based on the obtained N sub-feature graphs.

[0020] Optionally, the target behavior sequence is represented by a target matrix with M rows and L columns, wherein M represents the number of target behavior vectors included in the target behavior sequence, and L represents the dimension of each target behavior vector, wherein M is greater than 1 and L is greater than 1;

[0021] The segmentation module is specifically used for:

[0022] The target matrix is ​​split vertically into N sub-matrices, each sub-matrix representing a sub-behavior sequence.

[0023] Optionally, the segmentation module is further configured to:

[0024] Before splitting the target behavior sequence into N sub-behavior sequences, obtaining M original behavior data of the target object;

[0025] For the M original behavior data, the following operations are respectively performed: multiple behavior features contained in one original behavior data are respectively binned and encoded, and the multiple encoding results obtained are spliced ​​to obtain a target behavior representation;

[0026] Embedding coding is performed on the target behavior representation to obtain a target behavior vector.

[0027] Optionally, the feature extraction module is specifically used to:

[0028] Obtaining similarities between a sub-behavior vector and each of the plurality of sub-behavior vectors;

[0029] Selecting a maximum similarity from the obtained multiple similarities; and averaging the multiple similarities to obtain an average similarity;

[0030] Based on the association relationship between the maximum similarity and the average similarity, a sparse attribute of the sub-behavior vector is obtained.

[0031] Optionally, the feature extraction module is specifically used to:

[0032] Obtaining attention weights of the multiple sub-behavior vectors based on similarities between a key behavior vector and each of the multiple sub-behavior vectors;

[0033] The multiple sub-behavior vectors are fused using the obtained multiple attention weights to obtain a behavior sequence vector.

[0034] Optionally, the feature extraction module is specifically used to:

[0035] Performing dot product processing on the one key behavior vector and the multiple sub-behavior vectors to obtain similarities between the one key behavior vector and the multiple sub-behavior vectors;

[0036] A normalization operation is performed on the obtained multiple similarities to obtain the attention weights of the multiple sub-behavior vectors.

[0037] Optionally, the feature extraction module is specifically used to:

[0038] averaging the sub-behavior vectors other than the key behavior vector in the plurality of sub-behavior vectors to obtain a filling sequence vector;

[0039] The at least one behavior sequence vector and the filling sequence vector are concatenated to obtain the sub-feature map.

[0040] Optionally, the prediction module is specifically configured to:

[0041] Splicing the N sub-feature maps to obtain an initial feature map;

[0042] Performing a dimensionality reduction operation on the initial feature map to obtain a target feature map;

[0043] Based on the target feature map, an anomaly detection result of the target behavior sequence is obtained.

[0044] Optionally, the prediction module is specifically configured to:

[0045] Performing a convolution operation on the initial feature map to obtain a key feature map;

[0046] Performing nonlinear mapping on the key feature map to obtain a nonlinear feature map;

[0047] A dimensionality reduction operation is performed on the nonlinear feature map to obtain a target feature map.

[0048] Optionally, the prediction module is specifically configured to:

[0049] Using a deep neural network to perform feature combination and feature extraction on the target feature map to obtain a deep feature map;

[0050] Mapping the deep feature map to corresponding abnormality probabilities through an activation function;

[0051] Based on the abnormality probability, an abnormality detection result of the target behavior sequence is obtained.

[0052] On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned behavior sequence anomaly detection method when executing the program.

[0053] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of the above-mentioned behavior sequence anomaly detection method.

[0054] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned behavior sequence anomaly detection method.

[0055] In this embodiment of the present application, the target behavior sequence is split into N sub-behavior sequences, and then the sub-feature graphs of each of the multiple sub-behavior sequences are extracted. Based on the obtained N sub-feature graphs, anomaly detection results for the target behavior sequence are obtained. By combining the sub-feature graphs of the multiple sub-behavior sequences to capture the correlation between the sub-behavior sequences, and combining the correlation between the sub-behavior sequences, anomaly detection is performed on the behavior sequence, thereby effectively improving the accuracy of anomaly detection.

[0056] Secondly, this application uses sparse attributes to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors. Then, based on the sparse attributes of each of the multiple sub-behavior vectors contained in the sub-behavior sequence, when selecting at least one key behavior vector from multiple sub-behavior vectors, the key information in the sub-behavior sequence is effectively extracted and the non-key information in the sub-behavior sequence is removed.

[0057] In addition, the present application fuses multiple sub-behavior vectors based on the similarity between each key behavior vector and each of the multiple sub-behavior vectors to obtain a corresponding behavior sequence vector, and then determines the sub-feature graph corresponding to the sub-behavior sequence based on at least one obtained behavior sequence vector. In other words, the present application uses the extracted key behavior vector to guide the fusion of multiple sub-behavior vectors, which effectively captures the nonlinear relationship and long-term dependence in the behavior sequence and improves the accuracy of anomaly detection of the behavior sequence; on the other hand, it avoids using non-critical information in the sub-behavior sequence to guide the fusion of multiple sub-behavior vectors, which not only reduces the amount of calculation and memory usage, but also reduces the time complexity and space complexity of behavior sequence anomaly detection, allowing the model to process longer behavior sequence data, thereby improving the scope of application of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 A schematic diagram of the structure of a system architecture provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of an application scenario provided in an embodiment of the present application;

[0061] Figure 3 A schematic diagram of an application scenario provided in an embodiment of the present application;

[0062] Figure 4A schematic diagram of the structure of an anomaly detection model provided in an embodiment of the present application;

[0063] Figure 5 A flowchart of a method for detecting anomalies in a behavior sequence provided in an embodiment of the present application;

[0064] Figure 6 A flowchart of a method for selecting key behavior vectors provided in an embodiment of the present application;

[0065] Figure 7 A flowchart of a method for extracting behavior sequence vectors provided in an embodiment of the present application;

[0066] Figure 8 A schematic diagram of a flow chart of a vector splicing method provided in an embodiment of the present application;

[0067] Figure 9 A schematic diagram of the structure of an anomaly detection model provided in an embodiment of the present application;

[0068] Figure 10 A schematic diagram of the structure of an anomaly detection model provided in an embodiment of the present application;

[0069] Figure 11 A flowchart of a method for detecting anomalies in a behavior sequence provided in an embodiment of the present application;

[0070] Figure 12 A schematic diagram of the structure of a behavior sequence anomaly detection device provided in an embodiment of the present application;

[0071] Figure 13 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solutions and beneficial effects of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0073] For ease of understanding, the terms involved in the embodiments of the present invention are explained below.

[0074] The embodiments of the present application relate to artificial intelligence (AI) technology, and are mainly designed based on machine learning (ML) technology in artificial intelligence technology.

[0075] Artificial Intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also studies the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making.

[0076] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, pre-trained models, operating / interaction systems, and mechatronics. Pre-trained models, also known as large models or basic models, can be fine-tuned and widely applied to downstream tasks across various AI disciplines. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0077] Machine learning (ML) is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of AI. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning. Pretrained models are the latest development in deep learning, integrating these techniques.

[0078] Deep Neural Network: A type of machine learning model used to handle complex nonlinear data modeling tasks.

[0079] Self-attention (Attention): A computational method that mimics the human ability to selectively pay attention. It allows neural networks to automatically focus on relevant and important information when processing input data, thereby improving the model's performance and generalization capabilities. This mechanism is often applied to sequential data (such as text, speech, or image sequences). By assigning weights to each element in the input sequence, the model can more effectively capture long-range dependencies.

[0080] The core idea of ​​the self-attention mechanism is to assign a weight to each element in the input sequence. These weights determine the degree of attention the model pays to the input sequence. The weights are calculated by a learnable function, typically a neural network. When calculating the attention weights, a query vector and a key vector are considered. These two vectors are derived from the current target sequence position and the hidden state of each element in the input sequence, respectively. The query vector determines which positions in the input sequence should receive more attention, while the key vector contains information about every position in the input sequence. A scoring function (such as dot product attention or additive attention) compares the query and key vectors to produce a raw attention score. These scores are normalized to produce attention weights, which are then multiplied by the value vector of the input sequence to produce a weighted sum, which serves as the output of the attention mechanism.

[0081] Probabilistic sparsity refers to the situation where, within a given dataset, only a subset of the data is statistically significant, while the contribution of the remaining data is negligible. For example, in an article, only a very small number of words are crucial to conveying the main theme, while the rest may be insignificant details. Probabilistic sparsity can more efficiently filter out significant data.

[0082] Probabilistic Sparse Self-Attention: This method combines probabilistic sparseness with the self-attention mechanism. Based on the self-attention mechanism, it adjusts the attention coefficient. This method can save computing resources without affecting model accuracy.

[0083] Model distillation: A model compression technique that extracts the most important information through distillation operations and reduces the dimensionality of feature maps to reduce the input dimensions of subsequent layers.

[0084] Behavior sequence: Behavior information recorded in chronological order.

[0085] Binning coding: Divide continuous data into several data segments, that is, discretization.

[0086] With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, autonomous driving, drones, digital twins, virtual humans, robots, artificial intelligence generated content (AIGC), conversational interaction, smart medical care, smart customer service, game AI, etc. It is believed that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0087] The solution provided by the embodiment of the present application mainly relates to the application of artificial intelligence in payment security scenarios, and specifically relates to anomaly detection scenarios for behavior sequences in payment security scenarios, such as anomaly detection scenarios for payment behavior sequences, transfer behavior sequences, etc. When performing anomaly detection on behavior sequences, it is necessary to adopt an artificial neural network model based on deep learning, that is, the embodiment of the present application combines machine learning and methods related to anomaly detection architecture to obtain an anomaly detection model for anomaly detection on behavior sequences. The feature extraction network in the anomaly detection model is obtained by domain adaptive training based on machine learning methods, and the reference features of the anomaly detection model are extracted based on normal behavior sequences. Then, in actual scenarios, the features of the actual behavior sequence can be extracted through the feature extraction network of the anomaly detection model and compared with the reference features to achieve the purpose of anomaly detection on the behavior sequence.

[0088] Specifically, the anomaly detection process in the embodiment of the present application can be divided into two parts, including a training part and an application part. The training part involves the technical field of machine learning. In the training part, historical behavior data is collected and preprocessed to obtain a data set. The preprocessing process specifically includes: cleaning the historical behavior data, extracting features related to anomaly detection, and ensuring data quality; and labeling the historical behavior data to distinguish between normal behavior sequences and abnormal behavior sequences, and provide labels for model training. It should be noted that historical behavior data is not only data from payment scenarios, but can also include different types of data such as behavior data in other scenarios and geographic location data to provide more comprehensive information to identify abnormal behavior sequences.

[0089] Split the dataset into a training set and a test set. Use the training set to train the anomaly detection model, and use the test set to evaluate the training results. Evaluation metrics may include accuracy, recall, precision, and F1 score. Based on the evaluation results, adjust the hyperparameters of the anomaly detection model to achieve optimal performance.

[0090] In the application phase, the trained anomaly detection model is deployed in a production environment (such as a payment system) to detect anomalies in behavioral sequences in payment scenarios and identify anomalous objects. Subsequently, relevant interception strategies can be set to intercept payment requests from anomalous objects, thereby improving payment security.

[0091] In addition, the best strategy for identifying abnormal behavior sequences is learned through interaction with the environment. That is, after the anomaly detection model is deployed in the production environment, the prediction results based on the anomaly detection model are compared with the actual results, and the comparison results are used as feedback for iterative model training, thereby enhancing the model's recognition effect on abnormal behavior sequences and making the model more adaptable.

[0092] Considering that abnormal behavior may have different characteristics at different times and locations, transfer learning can also be used to train the model. That is, the model trained in one scenario (transfer scenario) is transferred to another scenario (payment scenario) for further training, thereby improving the model's performance.

[0093] It should also be noted that the anomaly detection model in the embodiment of the present application can be trained online or offline, which is not specifically limited here. In this article, offline training is used as an example for illustration.

[0094] The following is an introduction to the design concept of the embodiments of the present application.

[0095] To improve the security of payment applications, it is necessary to perform anomaly detection on the behavior sequences of various objects in the payment scenario, determine the abnormal behavior sequences, and then locate the abnormal objects among the various objects based on the detected abnormal behavior sequences, and intercept the payment requests of the abnormal objects.

[0096] Related technologies provide the following methods for detecting anomalies in behavioral sequences.

[0097] Method 1: Use supervised machine learning algorithms (such as logistic regression, decision tree, and random forest algorithms) to train an anomaly detection model based on historical behavior data. The anomaly detection model is then used to detect anomalies in the behavior sequences of each subject and identify abnormal behavior sequences.

[0098] However, these supervised machine learning algorithms only learn low-level features, and these low-level features are extracted from the behavior sequence as a whole. In reality, nonlinear relationships and long-term dependencies exist between the various behaviors in a behavior sequence. Therefore, when using these supervised machine learning algorithms for anomaly detection in behavior sequences, they have difficulty capturing these nonlinear relationships and long-term dependencies, resulting in low anomaly detection accuracy.

[0099] The second approach uses a long short-term memory (LSTM) network to detect anomalies in the target object's behavior sequence, identifying whether the behavior sequence is abnormal. However, using a LSTM network for anomaly detection requires extensive computation to capture the complex nonlinear relationships and long-term dependencies within the behavior sequence. This results in high computational resource consumption and low anomaly detection efficiency.

[0100] In order to improve the accuracy of anomaly detection of behavior sequences while avoiding the problems of high consumption of computing resources and low efficiency, an embodiment of the present application provides an anomaly detection method for behavior sequences, which includes: splitting a target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1. Then, the sub-feature graphs of each of the multiple sub-behavior sequences are extracted respectively, and then based on the obtained N sub-feature graphs, the anomaly detection result of the target behavior sequence is obtained. By combining the sub-feature graphs of the multiple sub-behavior sequences to capture the correlation between the sub-behavior sequences, and combining the correlation between the sub-behavior sequences, anomaly detection is performed on the behavior sequence, thereby effectively improving the accuracy of anomaly detection.

[0101] Secondly, this application uses sparse attributes to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors. Then, based on the sparse attributes of each of the multiple sub-behavior vectors contained in the sub-behavior sequence, when selecting at least one key behavior vector from multiple sub-behavior vectors, the key information in the sub-behavior sequence is effectively extracted and the non-key information in the sub-behavior sequence is removed.

[0102] In addition, the present application fuses multiple sub-behavior vectors based on the similarity between each key behavior vector and each of the multiple sub-behavior vectors to obtain a corresponding behavior sequence vector, and then determines the sub-feature graph corresponding to the sub-behavior sequence based on at least one obtained behavior sequence vector. In other words, the present application uses the extracted key behavior vector to guide the fusion of multiple sub-behavior vectors, which effectively captures the nonlinear relationship and long-term dependence in the behavior sequence and improves the accuracy of anomaly detection of the behavior sequence; on the other hand, it avoids using non-critical information in the sub-behavior sequence to guide the fusion of multiple sub-behavior vectors, which not only reduces the amount of calculation and memory usage, but also reduces the time complexity and space complexity of behavior sequence anomaly detection, allowing the model to process longer behavior sequence data, thereby improving the scope of application of anomaly detection.

[0103] The following is a brief introduction to the system architecture diagram applicable to the technical solution of the embodiment of the present application. It should be noted that the system architecture diagram introduced below is only used to illustrate the embodiment of the present application and is not limiting.

[0104] refer to Figure 1 , which is a system architecture diagram applicable to an embodiment of the present application. The system architecture includes at least a terminal device 101 and a server 102. The number of terminal devices 101 can be one or more, and the number of servers 102 can also be one or more. This application does not specifically limit the number of terminal devices 101 and servers 102.

[0105] The terminal device 101 is pre-installed with an application having a payment function, wherein the application is a client application, a web application, a mini-program application, etc. The terminal device 101 can be a smartphone, a tablet computer, a laptop computer, a desktop computer, a smart home appliance, an intelligent voice interaction device, a smart car device, etc., but is not limited thereto.

[0106] Server 102 is the background server of the application. Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0107] In the embodiment of the present application, the terminal device 101 and the server 102 can be directly or indirectly connected to each other through one or more networks. The network can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wireless Fidelity (WIFI) network. Of course, other possible networks are also possible, and the embodiment of the present application does not limit this.

[0108] It should be noted that the anomaly detection model in the embodiment of the present application can be deployed on the terminal device 101 or on the server 102. In other words, the anomaly detection method for behavior sequences in the embodiment of the present application can be executed online by the terminal device 101 or offline by the server 102, and this application does not make any specific restrictions on this.

[0109] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios described below are only used to illustrate the embodiments of the present application and are not limiting. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0110] The solution provided in the embodiments of this application can be applied to anomaly detection of behavior sequences in various application scenarios, such as payment behavior sequences, transfer behavior sequences, and other behavior sequences in payment scenarios. This solution can also be applied as a foundational technology in various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0111] The following is an illustrative description of the application scenarios to which the solution provided in this application is applicable.

[0112] Application scenario 1: Social payment scenario, that is, payment through social media or communication applications.

[0113] See also Figure 2 , obtain multiple behavior records of subject A sending virtual red envelopes to friends via a messaging app. Each behavior record includes payment method, location, and sending time. Convert each behavior record into a behavior vector. The behavior vectors corresponding to the multiple behavior records constitute the behavior sequence of subject A.

[0114] The method of the present application is used to perform anomaly detection on the behavior sequence of object A. When the anomaly detection result obtained is: the behavior sequence is abnormal, object A is marked as an abnormal object.

[0115] When person A sends a virtual red envelope to a friend again through the messaging app, the terminal device sends a request to the server, which intercepts the request and returns a message indicating "Red envelope sending failed" to the terminal device. The terminal device then displays the message in the messaging app indicating "Red envelope sending failed."

[0116] Application scenario 2: Mobile payment scenario, which is the scenario of making payments or transferring money through payment applications.

[0117] See also Figure 3 Obtain payment records for object B using the payment app. Each payment record includes payment method, payment amount, and payment time. Convert each payment record into a behavior vector. The behavior vectors corresponding to multiple transfer records constitute object B's behavior sequence.

[0118] The method of the present application is used to perform anomaly detection on the behavior sequence of object B. When the anomaly detection result obtained is: the behavior sequence is normal, object B is marked as a normal object.

[0119] When person B triggers a payment to platform W in the payment app, the terminal device sends a payment request to the server. The server determines that person B is a legitimate user, executes the payment, and returns a response message to the terminal device. The terminal device displays the response message in the payment method section. The response message includes: platform W, payment amount, and payment method.

[0120] In addition, it should be noted that in the specific implementation of this application, data related to behavior sequences, payments, transfers, etc. are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0121] Below, in combination with the application scenarios and system architecture described above, the method provided by the exemplary embodiment of the present application is described with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this respect.

[0122] Since the behavior sequence anomaly detection method provided by the present application is based on a trained anomaly detection model, before introducing the actual anomaly detection process, the structure of the anomaly detection model is first introduced here.

[0123] See also Figure 4 , provides a structural diagram of an anomaly detection model for an embodiment of the present application, the anomaly detection model including: an input layer, Q self-attention mechanism layers, and a classification layer, where Q is greater than or equal to 1.

[0124] The target behavior sequence is input into the anomaly detection model through the input layer. The self-attention mechanism layer can be a single-head self-attention mechanism or a multi-head self-attention mechanism. The self-attention mechanism layer extracts features from the target behavior sequence to obtain a target feature map. The target feature map is input into the classification layer for classification, resulting in anomaly detection results for the target behavior sequence.

[0125] When the self-attention mechanism layer adopts a multi-head self-attention mechanism scheme, multiple sets of value vectors V, query vectors Q, and key vectors K are mapped to different subspaces for calculation, and finally the calculation results of multiple subspaces are merged to obtain the correlation between sequences at different angles.

[0126] The following combination Figure 4 The structural diagram of the anomaly detection model shown in Figure 1 introduces the anomaly detection process of the behavior sequence. Figure 5 , is a flow chart of a method for detecting anomalies in a behavior sequence provided by an embodiment of the present application. The flow of the method is executed by a computer device, which may be Figure 1 The terminal device 101 and / or server 102 shown includes the following steps:

[0127] Step 501: split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1.

[0128] Specifically, when the self-attention mechanism layer adopts a single-head self-attention mechanism scheme, N is 1, that is, the subsequent feature extraction process is performed on the target behavior sequence to obtain the target feature map.

[0129] When the self-attention layer uses a multi-headed attention scheme, N is equal to the number of attention heads in the multi-headed attention mechanism. The target behavior sequence is split into N sub-behavior sequences based on the number of attention heads. The subsequent feature extraction process is performed on each sub-behavior sequence to obtain the corresponding sub-feature map. These N sub-feature maps are then concatenated to obtain the target feature map.

[0130] In some embodiments, the target behavior sequence is represented by a target matrix with M rows and L columns, where M represents the number of target behavior vectors contained in the target behavior sequence and L represents the dimension of each target behavior vector, where M is greater than 1 and L is greater than 1.

[0131] The following describes the process of obtaining the target behavior sequence:

[0132] First, obtain M raw behavior data of the target object. For each of the M raw behavior data, perform the following operations: bin-encode the multiple behavior features contained in each raw behavior data, concatenate the multiple encoding results to obtain a target behavior representation, and then embed-code the target behavior representation to obtain a target behavior vector.

[0133] Specifically, we first collect M historical behavior data of the target person. Then, we clean each historical behavior data and extract behavioral characteristics relevant to anomaly detection to obtain the original behavior data to ensure its quality. In practical applications, the behavioral characteristics of the original behavior data include one or more of the following: payment method, payment amount, geographic location, time information, and basic information about the target person.

[0134] Combining business logic and data analysis, each behavioral feature in the raw behavioral data is bin-encoded (also known as bin mapping) to obtain the corresponding encoding results. Multiple encoding results are concatenated to obtain the target behavior representation. The target behavior representation is converted into an embedding vector (i.e., an L-dimensional target behavior vector) through the input layer.

[0135] After performing the above operations on M historical behavior data, M L-dimensional target behavior vectors can be obtained. The M L-dimensional target behavior vectors are arranged in sequence according to time information to form a target behavior sequence (i.e., an M*L target matrix).

[0136] For example, the target object's recent 45 payment records are collected. For each payment record, the following behavioral feature information is extracted from the payment record: payment method, payment amount, geographic location, payment time, and the time interval between the current payment operation and the previous payment operation. Each behavioral feature information is then bin-encoded to obtain bin-encoded results. Multiple bin-encoded results are concatenated to obtain a payment behavior representation. The input layer (i.e., embedding layer) is used to convert the payment behavior representation into a 10-dimensional payment behavior vector. The 45 10-dimensional payment behavior vectors are arranged according to the payment time, forming the target object's behavior sequence. The behavior sequence can be represented using a 45*10 matrix for subsequent calculations.

[0137] In the embodiment of the present application, by performing bin encoding and embedding encoding on the original behavior data, key information in the behavior data is extracted for subsequent calculations, while reducing the computational complexity of subsequent processing, thereby effectively improving the anomaly detection effect of the behavior sequence.

[0138] In some embodiments, after obtaining the target matrix corresponding to the target behavior sequence, the target matrix is ​​split vertically into N sub-matrices, each sub-matrix representing a sub-behavior sequence.

[0139] In the actual splitting process, the target matrix can be split into N sub-matrices of the same size, that is, the size of each sub-matrix is: (M)*(L / N), where M represents the number of sub-behavior vectors in the sub-behavior sequence, and L / N represents: the dimension of the sub-behavior vector.

[0140] Of course, the target matrix can also be split into N sub-matrices of different sizes, and this application does not make specific limitations on this. In addition, in addition to splitting the target matrix into N sub-matrices vertically, other methods can also be used to split the target matrix into N sub-matrices, for example, splitting the target matrix into N sub-matrices horizontally, etc., and this application does not make specific limitations on this.

[0141] In an embodiment of the present application, according to the number of heads in the multi-head attention mechanism scheme, the target behavior sequence is split into multiple sub-behavior sequences, and then the multiple sub-behavior sequences are mapped to different subspaces for calculation. Finally, the subspace structures are merged to obtain the correlation relationship between sequences at different angles, thereby effectively improving the accuracy of anomaly detection of behavior sequences.

[0142] Step 502: For each of the N sub-behavior sequences, execute the following steps 5021 to 5023:

[0143] Step 5021: Select at least one key behavior vector from the multiple sub-behavior vectors included in a sub-behavior sequence based on the sparse properties of each of the multiple sub-behavior vectors.

[0144] The attention mechanism adopted in this application can be an improved probabilistic sparse self-attention mechanism, which reduces the complexity of self-attention calculation through probabilistic sparseness while maintaining the ability to capture sequential dependencies.

[0145] The probabilistic sparse self-attention mechanism selectively focuses on a subset of key elements in a behavior sequence, which are considered to be most influential for anomaly detection. Specifically, at least one key behavior vector is selected from multiple sub-behavior vectors using a sparse attribute. The sparse attribute characterizes the degree of difference between a sub-behavior vector and other sub-behavior vectors. Sparse attributes can be represented using a sparsity score.

[0146] In some embodiments, the sparse property of each sub-behavior vector is obtained in the following manner:

[0147] Obtain similarities between a sub-behavior vector and multiple sub-behavior vectors; then select the maximum similarity from the obtained multiple similarities; and average the multiple similarities to obtain an average similarity. Based on the correlation between the maximum similarity and the average similarity, obtain the sparse property of the sub-behavior vector.

[0148] Specifically, the sub-behavior vector is used as the value vector V, and then the value vector V is copied to obtain the query vector Q and the key vector K, where the query vector Q is used to measure the importance of each sub-behavior vector in the sub-behavior sequence, and the key vector K contains each sub-behavior vector in the sub-behavior sequence.

[0149] The process of calculating the similarity between a sub-behavior vector and multiple sub-behavior vectors is converted into a process of calculating the similarity between each query vector Q and multiple key vectors K.

[0150] For each query vector Q, perform dot product processing on the query vector Q and each key vector K to obtain the similarity between the query vector Q and each key vector K. The specific process of dot product processing is: multiply the corresponding bit elements in the query vector Q and the key vector K, and then sum up the multiplication results of all the elements to obtain the dot product result.

[0151] To avoid numerical stability issues, after calculating the dot product of the query vector Q and the key vector K, the dot product result is divided by the square root of the dimension of the key vector K to achieve scaling of the dot product result. The scaled result is used as the similarity between the query vector Q and the key vector K, as shown in the following formula (1):

[0152]

[0153] Among them, s (i,j) Represents the query vector q i With key vector kj , d represents the dimension of the key vector K (i.e., the dimension of the sub-behavior vector), and i and j are both positive integers less than M.

[0154] The query vector q is calculated using the above formula (1) i After obtaining the similarity of each of the M key vectors, the maximum similarity is selected from the M similarities, and the average similarity of the M similarities is calculated. The difference between the maximum similarity and the average similarity is used as the query vector q i The sparsity score of is as shown in the following formula (2):

[0155]

[0156] Among them, M(q i ,K) represents the query vector q i The sparsity score of the query vector q i The corresponding sub-behavior is a sparse attribute vector.

[0157] For the query vector q i The maximum similarity among the similarities of the M key vectors and the query vector q i The average similarity with the similarities of each of the M key vectors. The larger the difference between the maximum similarity and the average similarity, the higher the sparsity score, indicating that the query vector q i The further away from the even distribution of similarity, the query vector q i The greater the difference between the corresponding sub-behavior vector and other sub-behavior vectors, these sub-behavior vectors with large differences are often the key feature vectors for anomaly detection.

[0158] Based on this, this application selects u key behavior vectors from multiple sub-behavior vectors based on their sparsity scores. Specifically, M query vectors are sorted in descending order of sparsity scores to obtain a sorted result. The query vectors that rank in the top u positions in the sorted result are then selected as key behavior vectors, where u is a hyperparameter of the anomaly detection model used to control the sparsity level.

[0159] For example, see Figure 6 Assume that the sub-behavior sequence includes five sub-behavior vectors. Each sub-behavior vector is used as a value vector. This yields five value vectors: value vector v1 through value vector v5. Each value vector is copied to obtain the corresponding query vector and key vector, resulting in five query vectors and five key vectors. The five query vectors are: query vector q1 through query vector q5; the five key vectors are: key vector k1 through key vector k5.

[0160] First calculate the similarity between the query vector q1 and the five key vectors to obtain the similarity s(1,1) , similarity s (1,2) , similarity s (1,3) , similarity s (1,4) , similarity s (1,5) Among the above five similarities, the maximum similarity is similarity s (1,3) , the average similarity of the above 5 similarities is s AV . Using similarity s (1,3) Subtract the average similarity to get s AV , obtain the sparsity score M(q1,K) of the query vector q1.

[0161] The same method is used to obtain the sparsity score M(q2,K) of the query vector q2, the sparsity score M(q3,K) of the query vector q3, the sparsity score M(q4,K) of the query vector q4, and the sparsity score M(q5,K) of the query vector q5.

[0162] The five query vectors are sorted in descending order according to the sparsity scores, and the sorting results are: query vector q1, query vector q3, query vector q5, query vector q2, and query vector q4.

[0163] If u=3, query vector q1, query vector q3, and query vector q5 are selected as key behavior vectors.

[0164] In an embodiment of the present application, sparse attributes are used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors. Then, based on the sparse attributes of each of the multiple sub-behavior vectors contained in the sub-behavior sequence, when at least one key behavior vector is selected from the multiple sub-behavior vectors, the key information in the sub-behavior sequence is effectively extracted and the non-key information in the sub-sequence is removed. This not only reduces the amount of calculation and memory occupancy, but also reduces the time complexity and space complexity of behavior sequence anomaly detection.

[0165] Step 5022: Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector.

[0166] In some embodiments, each behavior sequence vector is obtained in the following manner:

[0167] Based on the similarity between a key behavior vector and multiple sub-behavior vectors, attention weights of the sub-behavior vectors are obtained. The sub-behavior vectors are fused using the obtained attention weights to obtain a behavior sequence vector.

[0168] Specifically, for each selected query vector (i.e., key behavior vector), the attention weights of multiple value vectors (i.e., sub-behavior vectors) are obtained based on the similarity between the query vector and multiple key vectors (i.e., sub-behavior vectors). Then, using the attention weights of the multiple value vectors, a weighted sum is performed on the multiple value vectors to obtain a behavior sequence vector.

[0169] For example, see Figure 7 , assuming that 3 query vectors (i.e., key behavior vectors) are selected from 5 query vectors, namely query vector q1, query vector q3 and query vector q5.

[0170] Calculate the similarity between the query vector q1 and the five key vectors to obtain the similarity s (1,1) , similarity s (1,2) , similarity s (1,3) , similarity s (1,4) , similarity s (1,5) The five similarities obtained above are used as the attention weights of the five value vectors respectively.

[0171] Using the five obtained attention weights, the five value vectors (i.e., value vector v1 to value vector v5) are weighted summed to obtain a behavior sequence vector E1.

[0172] Calculate the similarity between the query vector q3 and the five key vectors to obtain the similarity s (3,1) , similarity s (3,2) , similarity s (3,3) , similarity s (3,4) , similarity s (3,5) The five similarities obtained above are used as the attention weights of the five value vectors respectively.

[0173] Using the five obtained attention weights, the five value vectors (i.e., value vector v1 to value vector v5) are weighted summed to obtain a behavior sequence vector E3.

[0174] Calculate the similarity between the query vector q5 and the five key vectors to obtain the similarity s (5,1) , similarity s (5,2) , similarity s (5,3) , similarity s (5,4) , similarity s (5,5) The five similarities obtained above are used as the attention weights of the five value vectors respectively.

[0175] Using the five obtained attention weights, the five value vectors (i.e., value vector v1 to value vector v5) are weighted summed to obtain a behavior sequence vector E5.

[0176] In the embodiments of the present application, the probabilistic sparse self-attention mechanism selectively focuses on a subset of key elements, which are considered to be the most influential behavioral vectors for anomaly detection. By using a probability distribution to determine which query vectors are dot-producted with the key vector, the dot product operation on all query vectors is avoided. This allows the model to focus on the most relevant information, maintains the ability to capture sequential dependencies, reduces computational effort, and thus improves the efficiency of the self-attention mechanism.

[0177] In some implementations, a key action vector is dot-producted with each of the multiple sub-action vectors to obtain similarities between the key action vector and each of the multiple sub-action vectors. The obtained similarities are normalized to obtain attention weights for each of the multiple sub-action vectors.

[0178] Specifically, the key action vector and the corresponding elements in the sub-action vectors are multiplied, and the sum of all the multiplication results is calculated to obtain the dot product result. This dot product result is the similarity between the key action vector and the sub-action vector. The multiple similarities obtained are normalized using the softmax function to obtain the attention weights of each sub-action vector.

[0179] In an embodiment of the present application, a key behavior vector is subjected to dot product processing and normalization operations with multiple sub-behavior vectors to determine the attention weights of each of the multiple sub-behavior vectors, and then the multiple sub-behavior vectors are fused based on the obtained attention weights. This effectively captures the nonlinear relationships and long-term dependencies in the behavior sequence, and improves the accuracy of anomaly detection in the behavior sequence.

[0180] Step 5023: Determine a sub-feature graph corresponding to a sub-behavior sequence based on the obtained at least one behavior sequence vector.

[0181] Specifically, the obtained behavior sequence vectors are concatenated to obtain the sub-feature graphs corresponding to the sub-behavior sequences.

[0182] In some embodiments, when the sub-behavior sequence is an M*n matrix, it is assumed that u key behavior vectors are selected from the M sub-behavior vectors, and the u key behavior vectors are used to guide the fusion of the M sub-behavior vectors to obtain u behavior sequence vectors. In this case, the u behavior sequence vectors can be represented by a u*n matrix, where n is a positive integer. In this case, the size of the input matrix (M*n) and the size of the output matrix (u*n) are inconsistent.

[0183] In order to ensure the consistency of the size of the input matrix and the size of the output matrix, the sub-behavior vectors other than the key behavior vector are averaged to obtain a filling sequence vector; at least one behavior sequence vector and the filling sequence vector are spliced ​​to obtain a sub-feature map.

[0184] Specifically, after selecting u key behavior vectors from the M sub-behavior vectors, the elements of corresponding positions in the remaining (Mu) sub-behavior vectors are averaged to obtain a filling sequence vector.

[0185] After obtaining u behavior sequence vectors, the u behavior sequence vectors are concatenated with (Mu) padding sequence vectors to obtain a sub-feature map, which is an M*n matrix.

[0186] For example, see Figure 8 , set according to Figure 6 The calculation process selects 3 query vectors (i.e. key behavior vectors) from 5 query vectors, namely query vector q1, query vector q3 and query vector q5. Figure 7 The calculation process obtains the behavior sequence vector E1, the behavior sequence vector E3 and the behavior sequence vector E5.

[0187] The query vector q2 and the query vector q4 are averaged to obtain the filling sequence vector T. The behavior sequence vector E1, the behavior sequence vector E3, the behavior sequence vector E5, and the two filling sequence vectors T are concatenated to obtain a sub-feature map.

[0188] In the embodiment of the present application, the extracted key behavior vector is used to guide the fusion of multiple sub-behavior vectors, which effectively captures the nonlinear relationships and long-term dependencies in the behavior sequence and improves the accuracy of anomaly detection in the behavior sequence. The sub-behavior vectors other than the key behavior vector are averaged to obtain the padding sequence vector, which significantly reduces the number of dot product operations, can reduce the time complexity and space complexity of the algorithm, and enable the model to process longer sequence data. The behavior sequence vector and the padding sequence vector are spliced ​​to obtain a sub-feature map, ensuring the consistency of the size of the input matrix and the size of the output matrix.

[0189] Step 503: Obtain anomaly detection results of the target behavior sequence based on the obtained N sub-feature graphs.

[0190] Specifically, the N sub-feature maps are concatenated to obtain the target feature map, which is then classified by the classification layer to obtain anomaly detection results for the target behavior sequence.

[0191] If the anomaly detection result for a target behavior sequence is: "The behavior sequence is abnormal," the target object is marked as an abnormal object. A relevant interception policy is set for the abnormal object. Subsequent payment behavior detected by the abnormal object is intercepted to ensure payment security.

[0192] In this embodiment of the present application, the target behavior sequence is split into N sub-behavior sequences, where N is greater than or equal to 1. Sub-feature graphs are then extracted from each of the multiple sub-behavior sequences, and anomaly detection results for the target behavior sequence are obtained based on the N sub-feature graphs obtained. By combining the sub-feature graphs of the multiple sub-behavior sequences to capture the correlation between the sub-behavior sequences, and combining the correlation between the sub-behavior sequences, anomaly detection is performed on the behavior sequence, thereby effectively improving the accuracy of anomaly detection.

[0193] Secondly, this application uses sparse attributes to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors. Then, based on the sparse attributes of each of the multiple sub-behavior vectors contained in the sub-behavior sequence, when selecting at least one key behavior vector from multiple sub-behavior vectors, the key information in the sub-behavior sequence is effectively extracted and the non-key information in the sub-behavior sequence is removed.

[0194] In addition, the present application fuses multiple sub-behavior vectors based on the similarity between each key behavior vector and each of the multiple sub-behavior vectors to obtain a corresponding behavior sequence vector, and then determines the sub-feature graph corresponding to the sub-behavior sequence based on at least one obtained behavior sequence vector. In other words, the present application uses the extracted key behavior vector to guide the fusion of multiple sub-behavior vectors, which effectively captures the nonlinear relationship and long-term dependence in the behavior sequence and improves the accuracy of anomaly detection of the behavior sequence; on the other hand, it avoids using non-critical information in the sub-behavior sequence to guide the fusion of multiple sub-behavior vectors, which not only reduces the amount of calculation and memory usage, but also reduces the time complexity and space complexity of behavior sequence anomaly detection, allowing the model to process longer behavior sequence data, thereby improving the scope of application of anomaly detection.

[0195] In some embodiments, see Figure 9 In anomaly detection models, each self-attention layer is connected to a distillation layer. After the self-attention layer extracts the feature map of the target behavior sequence, the distillation layer performs dimensionality reduction on the feature map to reduce the input dimension of subsequent layers. Specifically, operations such as max pooling and average pooling can be used to reduce the dimensionality of the feature map. In addition to reducing the dimensionality of the feature map, the distillation layer can also be used to extract key features from the feature map.

[0196] Through the probabilistic sparse selection of the self-attention mechanism layer and the distillation operation of the distillation layer, the anomaly detection model reduces computing resources and memory consumption while maintaining high performance, allowing the model to run efficiently even in resource-limited environments.

[0197] exist Figure 9 Based on the structure of the anomaly detection model shown, this application proposes the following anomaly detection method:

[0198] The N sub-feature maps are concatenated to obtain an initial feature map. A dimensionality reduction operation is performed on the initial feature map to obtain a target feature map. Based on the target feature map, anomaly detection results for the target behavior sequence are obtained.

[0199] Specifically, N sub-feature maps are concatenated to obtain an M*N initial feature map. The self-attention mechanism layer outputs the initial feature map to the distillation layer. The distillation layer performs a maximum pooling or average pooling operation on the initial feature map to reduce its dimensionality and obtain the target feature map. The classification layer classifies the target feature map to obtain anomaly detection results for the target behavior sequence.

[0200] It should be noted that when a distillation layer is subsequently connected to the next self-attention layer, the target feature map is processed again by the next self-attention layer to extract a new feature map. After extracting the new feature map, it can be input into the distillation layer for further distillation. The number of self-attention and distillation layers in an anomaly detection model can be set based on actual conditions and can be adjusted as needed.

[0201] In this embodiment, as the number of model layers increases, the output of each position in the behavior sequence already contains information about other elements in the behavior sequence. By performing a dimensionality reduction operation on the initial feature map to reduce the dimensionality of the initial feature map, the model computational complexity is reduced, which helps improve the model's generalization ability.

[0202] In some embodiments, in addition to reducing the dimensionality of the feature map, the distillation layer can also be used to extract key features, feature nonlinear mapping, etc.

[0203] Specifically, a convolution operation is performed on the initial feature map to obtain a key feature map. A nonlinear mapping operation is performed on the key feature map to obtain a nonlinear feature map. A dimensionality reduction operation is performed on the nonlinear feature map to obtain a target feature map.

[0204] In practical applications, a convolutional layer is used to extract features from the initial feature map to obtain a key feature map. This process involves matrix downsampling and feature extraction through one-dimensional convolution. The key feature map is then input into the activation function for nonlinear mapping to obtain a nonlinear feature map. Finally, the nonlinear feature map is input into the maximum pooling layer for data dimensionality reduction to obtain the target feature map, as shown in the following formula (3):

[0205] X = MaxPool(ELU(Conv1d([X]) AB )))………………(3)

[0206] Among them, [X] ABRepresents the initial feature map, Conv1d represents the one-dimensional convolution layer, MaxPool represents the maximum pooling layer, and ELU represents the activation function. The formula of ELU is shown in the following formula (4):

[0207]

[0208] Among them, α is a fixed parameter.

[0209] In this application, convolution operations, nonlinear mapping, and dimensionality reduction operations are performed on the initial feature map to extract and enhance key features in the behavior sequence, while discarding redundant or unimportant information, which helps improve the model's generalization ability on new data. After the feature map undergoes the data dimensionality reduction process, the data dimension is reduced by half, which greatly reduces the subsequent computational effort and improves the training and inference speed. Adding a distillation layer to the anomaly detection model enables the model to efficiently process long sequence data, improving training and prediction efficiency while increasing information input, which is particularly important for anomaly detection scenarios containing a large amount of historical transaction records.

[0210] In some embodiments, see Figure 10 ,Anomaly detection models also include: deep neural networks.

[0211] The final distillation layer outputs the target feature map to a deep neural network, which then performs feature combination and extraction on the target feature map to obtain a deep feature map. An activation function then maps the deep feature map to corresponding anomaly probabilities. Based on these anomaly probabilities, anomaly detection results for the target behavior sequence are obtained.

[0212] Specifically, the deep neural network further combines and mines high-order features on the target feature map to obtain a deep feature map. The deep feature map is then input into the classification layer. A binary classification task is performed based on an activation function (Sigmoid function), outputting the probability of abnormality of the target behavior sequence.

[0213] When the abnormal probability is greater than the preset threshold, the target behavior sequence is determined to be abnormal. When the abnormal probability is less than or equal to the preset threshold, the target behavior sequence is determined to be normal.

[0214] In the embodiment of the present application, a multi-head probabilistic sparse self-attention mechanism is used to capture richer features and patterns in the behavior sequence, and then combined with a deep neural network to further learn complex nonlinear relationships, thereby improving the accuracy of the overall prediction.

[0215] In order to better explain the embodiment of the present application, the following describes a behavior sequence anomaly detection method provided by the embodiment of the present application in combination with a specific implementation scenario. The process of the method can be as follows: Figure 1 Server 102 executes. First, the structure of the anomaly detection model for anomaly detection of behavior sequences is introduced, such as Figure 11 As shown, it includes: embedding layer, multi-head probabilistic sparse self-attention layer, distillation layer, multi-head probabilistic sparse self-attention layer, distillation layer, deep neural network and output layer.

[0216] The following describes the process of anomaly detection for behavior sequences, combining the structure of the anomaly detection model. The process includes the following steps:

[0217] The target user's five recent payment records are collected. For each payment record, the following behavioral characteristics are extracted: payment method, payment amount, location, payment time, and the time interval between the current and previous payment operations. Each behavioral characteristic is then bin-coded to obtain bin-coded results. Multiple bin-coded results are concatenated to obtain a payment behavior representation. An embedding layer is used to convert the payment behavior representation into a 10-dimensional payment behavior vector. Five 10-dimensional payment behavior vectors, arranged by payment time, form the target user's payment behavior sequence (i.e., a 5*10 target matrix).

[0218] The number of attention heads in the multi-head probabilistic sparse self-attention layer is 2. Therefore, after the target matrix is ​​input into the multi-head probabilistic sparse self-attention layer, the multi-head probabilistic sparse self-attention layer divides the target matrix into 2 5*5 sub-matrices (i.e., a sub-behavior sequence consisting of 5 5-dimensional sub-behavior vectors).

[0219] For each sub-behavior sequence, the sparsity scores of the five sub-behavior vectors are calculated, and three key behavior vectors are selected from the five sub-behavior vectors based on the obtained sparsity scores. Next, for each key behavior vector, the attention weights of the five sub-behavior vectors are determined based on the similarity between the key behavior vector and the five sub-behavior vectors. The five sub-behavior vectors are then weighted fused based on the obtained attention weights to obtain a behavior sequence vector. The sub-behavior vectors excluding the key behavior vector are averaged to obtain a padding sequence vector. The three obtained behavior sequence vectors and the two identical padding sequence vectors are concatenated to obtain a sub-feature map.

[0220] The sub-feature maps corresponding to the two sub-behavior sequences are concatenated to obtain the first feature map, and the first feature map is input into the distillation layer.

[0221] In the distillation layer, the convolution layer is used to extract features from the first feature map to obtain the key feature map. This process includes matrix downsampling through one-dimensional convolution to extract features. The key feature map is then input into the activation function for nonlinear mapping to obtain a nonlinear feature map. Finally, the nonlinear feature map is input into the maximum pooling layer for data dimensionality reduction to obtain the second feature map.

[0222] The second feature map is input again into the multi-head probabilistic sparse self-attention layer and distillation layer for processing, and the target feature map is output to the deep neural network.

[0223] The deep neural network further combines and mines high-order features on the target feature map to obtain a deep feature map. The deep feature map is input into the classification layer. A binary classification task is performed based on the activation function (Sigmoid function), and the abnormal probability of the payment behavior sequence is output.

[0224] When the probability of anomaly exceeds a preset threshold, the target object's payment behavior sequence is determined to be abnormal and the target object is marked as an abnormal object. For abnormal objects, relevant interception strategies are set. When the payment behavior of abnormal objects is subsequently detected, the payment behavior is intercepted to ensure payment security.

[0225] In the embodiment of the present application, a multi-head probabilistic sparse self-attention mechanism is used to capture richer features and patterns of behavior sequences, and a deep neural network is combined to learn the complex nonlinear relationships in the behavior sequences, thereby improving the accuracy of the overall prediction.

[0226] Secondly, the probabilistic sparse self-attention mechanism selectively focuses on some key information in the input behavior sequence through probabilistic sparsity, and reduces the amount of computation through the distillation layer, so that the anomaly detection model can efficiently process long sequence data, while increasing the information input and improving the efficiency of model training and model prediction. This is especially important for payment security scenarios containing a large number of historical transaction records.

[0227] Furthermore, through probabilistic sparse selection and distillation operations, the anomaly detection model reduces computing resources and memory consumption while maintaining high performance, allowing the model to run efficiently in resource-limited environments.

[0228] Based on the same technical concept, the embodiment of the present application provides a structural diagram of an abnormality detection device for a behavior sequence, such as Figure 12 As shown, the behavior sequence anomaly detection device 1200 includes:

[0229] A segmentation module 1201 is used to split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1;

[0230] The feature extraction module 1202 is configured to perform the following operations on the N sub-behavior sequences:

[0231] Selecting at least one key behavior vector from a plurality of sub-behavior vectors included in a sub-behavior sequence based on a sparse attribute of each of the plurality of sub-behavior vectors, wherein the sparse attribute is used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors;

[0232] Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector;

[0233] Determining a sub-feature graph corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector;

[0234] The prediction module 1203 is used to obtain an anomaly detection result of the target behavior sequence based on the obtained N sub-feature graphs.

[0235] Optionally, the target behavior sequence is represented by a target matrix with M rows and L columns, wherein M represents the number of target behavior vectors included in the target behavior sequence, and L represents the dimension of each target behavior vector, wherein M is greater than 1 and L is greater than 1;

[0236] The segmentation module 1201 is specifically used for:

[0237] The target matrix is ​​split vertically into N sub-matrices, each sub-matrix representing a sub-behavior sequence.

[0238] Optionally, the segmentation module 1201 is further configured to:

[0239] Before splitting the target behavior sequence into N sub-behavior sequences, obtaining M original behavior data of the target object;

[0240] For the M original behavior data, the following operations are respectively performed: multiple behavior features contained in one original behavior data are respectively binned and encoded, and the multiple encoding results obtained are spliced ​​to obtain a target behavior representation;

[0241] Embedding coding is performed on the target behavior representation to obtain a target behavior vector.

[0242] Optionally, the feature extraction module 1202 is specifically configured to:

[0243] Obtaining similarities between a sub-behavior vector and each of the plurality of sub-behavior vectors;

[0244] Selecting a maximum similarity from the obtained multiple similarities; and averaging the multiple similarities to obtain an average similarity;

[0245] Based on the association relationship between the maximum similarity and the average similarity, a sparse attribute of the sub-behavior vector is obtained.

[0246] Optionally, the feature extraction module 1202 is specifically configured to:

[0247] Obtaining attention weights of the multiple sub-behavior vectors based on similarities between a key behavior vector and each of the multiple sub-behavior vectors;

[0248] The multiple sub-behavior vectors are fused using the obtained multiple attention weights to obtain a behavior sequence vector.

[0249] Optionally, the feature extraction module 1202 is specifically configured to:

[0250] Performing dot product processing on the one key behavior vector and the multiple sub-behavior vectors to obtain similarities between the one key behavior vector and the multiple sub-behavior vectors;

[0251] A normalization operation is performed on the obtained multiple similarities to obtain the attention weights of the multiple sub-behavior vectors.

[0252] Optionally, the feature extraction module 1202 is specifically configured to:

[0253] averaging the sub-behavior vectors other than the key behavior vector in the plurality of sub-behavior vectors to obtain a filling sequence vector;

[0254] The at least one behavior sequence vector and the filling sequence vector are concatenated to obtain the sub-feature map.

[0255] Optionally, the prediction module 1203 is specifically configured to:

[0256] Splicing the N sub-feature maps to obtain an initial feature map;

[0257] Performing a dimensionality reduction operation on the initial feature map to obtain a target feature map;

[0258] Based on the target feature map, an anomaly detection result of the target behavior sequence is obtained.

[0259] Optionally, the prediction module 1203 is specifically configured to:

[0260] Performing a convolution operation on the initial feature map to obtain a key feature map;

[0261] Performing nonlinear mapping on the key feature map to obtain a nonlinear feature map;

[0262] A dimensionality reduction operation is performed on the nonlinear feature map to obtain a target feature map.

[0263] In the embodiment of the present application, the probabilistic sparse self-attention mechanism selectively focuses on some key information in the input behavior sequence through probabilistic sparsity, and reduces the amount of computation through the distillation layer, so that the anomaly detection model can efficiently process long sequence data, while increasing the information input and improving the efficiency of model training and model prediction, which is particularly important for payment security scenarios containing a large number of historical transaction records.

[0264] Optionally, the prediction module 1203 is specifically configured to:

[0265] Using a deep neural network to perform feature combination and feature extraction on the target feature map to obtain a deep feature map;

[0266] Mapping the deep feature map to corresponding abnormality probabilities through an activation function;

[0267] Based on the abnormality probability, an abnormality detection result of the target behavior sequence is obtained.

[0268] In this embodiment of the present application, the target behavior sequence is split into N sub-behavior sequences, where N is greater than or equal to 1. Sub-feature graphs are then extracted from each of the multiple sub-behavior sequences, and anomaly detection results for the target behavior sequence are obtained based on the N sub-feature graphs obtained. By combining the sub-feature graphs of the multiple sub-behavior sequences to capture the correlation between the sub-behavior sequences, and combining the correlation between the sub-behavior sequences, anomaly detection is performed on the behavior sequence, thereby effectively improving the accuracy of anomaly detection.

[0269] Secondly, this application uses sparse attributes to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors. Then, based on the sparse attributes of each of the multiple sub-behavior vectors contained in the sub-behavior sequence, when selecting at least one key behavior vector from multiple sub-behavior vectors, the key information in the sub-behavior sequence is effectively extracted and the non-key information in the sub-sequence is removed.

[0270] In addition, the present application fuses multiple sub-behavior vectors based on the similarity between each key behavior vector and each of the multiple sub-behavior vectors to obtain the corresponding behavior sequence vector, and then determines the sub-feature graph corresponding to the sub-behavior sequence based on at least one obtained behavior sequence vector. In other words, the present application uses the extracted key behavior vector to guide the fusion of multiple sub-behavior vectors, which effectively captures the nonlinear relationship and long-term dependence in the behavior sequence and improves the accuracy of anomaly detection of the behavior sequence; on the other hand, it avoids using non-critical information in the sub-behavior sequence to guide the fusion of multiple sub-behavior vectors, which not only reduces the amount of calculation and memory usage, but also reduces the time complexity and space complexity of behavior sequence anomaly detection, allowing the model to process longer behavior sequence data, thereby improving the scope of application of anomaly detection.

[0271] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0272] Based on the same technical concept, the embodiment of the present application provides a computer device, which can be Figure 1 The terminal device and / or server shown, such as Figure 13 As shown, it includes at least one processor 1301 and a memory 1302 connected to the at least one processor. The specific connection medium between the processor 1301 and the memory 1302 is not limited in the embodiment of the present application. Figure 13 For example, the processor 1301 and the memory 1302 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0273] In an embodiment of the present application, the memory 1302 stores instructions that can be executed by at least one processor 1301. The at least one processor 1301 can execute the steps of the above-mentioned behavior sequence anomaly detection method by executing the instructions stored in the memory 1302.

[0274] The processor 1301 is the control center of the computer device. It can connect the various parts of the computer device using various interfaces and lines. By running or executing instructions stored in the memory 1302 and calling data stored in the memory 1302, it can achieve abnormal detection of behavioral sequences. Optionally, the processor 1301 may include one or more processing units. The processor 1301 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understood that the modem processor may not be integrated into the processor 1301. In some embodiments, the processor 1301 and the memory 1302 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0275] The processor 1301 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0276] Memory 1302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1302 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Memory 1302 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 1302 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0277] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned behavior sequence anomaly detection method.

[0278] Based on the same inventive concept, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned behavior sequence anomaly detection method.

[0279] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0280] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer device or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0281] These computer program instructions may also be stored in a computer readable memory that can direct a computer device or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0282] These computer program instructions can also be loaded onto a computer device or other programmable data processing device so that a series of operating steps are executed on the computer device or other programmable device to produce a process implemented by the computer device, thereby providing instructions for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0283] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0284] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for detecting anomalies in behavior sequences, characterized in that: include; Split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1; For the N sub-behavior sequences, perform the following operations respectively: Selecting at least one key behavior vector from a plurality of sub-behavior vectors included in a sub-behavior sequence based on a sparse attribute of each of the plurality of sub-behavior vectors, wherein the sparse attribute is used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors; Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector; Determining a sub-feature graph corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector; Based on the obtained N sub-feature graphs, an anomaly detection result of the target behavior sequence is obtained.

2. The method according to claim 1, wherein The target behavior sequence is represented by a target matrix of M rows and L columns, wherein M represents the number of target behavior vectors included in the target behavior sequence, and L represents the dimension of each target behavior vector, wherein M is greater than 1 and L is greater than 1; The step of splitting the target behavior sequence into N sub-behavior sequences includes: The target matrix is ​​split vertically into N sub-matrices, each sub-matrix representing a sub-behavior sequence.

3. The method according to claim 2, wherein Before splitting the target behavior sequence into N sub-behavior sequences, the method further includes: Obtain M raw behavior data of the target object; For the M original behavior data, the following operations are respectively performed: multiple behavior features contained in one original behavior data are respectively binned and encoded, and the multiple encoding results obtained are spliced ​​to obtain a target behavior representation; Embedding coding is performed on the target behavior representation to obtain a target behavior vector.

4. The method according to claim 1, wherein The sparse property of each sub-behavior vector is obtained in the following way: Obtaining similarities between a sub-behavior vector and each of the plurality of sub-behavior vectors; Selecting a maximum similarity from the obtained multiple similarities; and averaging the multiple similarities to obtain an average similarity; Based on the association relationship between the maximum similarity and the average similarity, a sparse attribute of the sub-behavior vector is obtained.

5. The method according to claim 1, wherein Each behavior sequence vector is obtained in the following way: Obtaining attention weights of the multiple sub-behavior vectors based on similarities between a key behavior vector and each of the multiple sub-behavior vectors; The multiple sub-behavior vectors are fused using the obtained multiple attention weights to obtain a behavior sequence vector.

6. The method according to claim 5, wherein The obtaining of attention weights of the plurality of sub-behavior vectors based on the similarities between a key behavior vector and each of the plurality of sub-behavior vectors includes: Performing dot product processing on the one key behavior vector and the multiple sub-behavior vectors to obtain similarities between the one key behavior vector and the multiple sub-behavior vectors; A normalization operation is performed on the obtained multiple similarities to obtain the attention weights of the multiple sub-behavior vectors.

7. The method according to claim 1, wherein The determining, based on the obtained at least one behavior sequence vector, a sub-feature graph corresponding to the sub-behavior sequence includes: averaging the sub-behavior vectors other than the key behavior vector in the plurality of sub-behavior vectors to obtain a filling sequence vector; The at least one behavior sequence vector and the filling sequence vector are concatenated to obtain the sub-feature map.

8. The method according to any one of claims 1 to 7, characterized in that: Obtaining an anomaly detection result of the target behavior sequence based on the obtained N sub-feature graphs includes: Splicing the N sub-feature maps to obtain an initial feature map; Performing a dimensionality reduction operation on the initial feature map to obtain a target feature map; Based on the target feature map, an anomaly detection result of the target behavior sequence is obtained.

9. The method according to claim 8, wherein The performing a dimensionality reduction operation on the initial feature map to obtain a target feature map includes: Performing a convolution operation on the initial feature map to obtain a key feature map; Performing nonlinear mapping on the key feature map to obtain a nonlinear feature map; A dimensionality reduction operation is performed on the nonlinear feature map to obtain a target feature map.

10. The method according to claim 8, wherein The obtaining of anomaly detection results of the target behavior sequence based on the target feature graph includes: Using a deep neural network to perform feature combination and feature extraction on the target feature map to obtain a deep feature map; Mapping the deep feature map to corresponding abnormality probabilities through an activation function; Based on the abnormality probability, an abnormality detection result of the target behavior sequence is obtained.

11. A device for detecting anomalies in a behavior sequence, characterized in that: include; A segmentation module is used to split the target behavior sequence into N sub-behavior sequences, where N is greater than or equal to 1; The feature extraction module is used to perform the following operations on the N sub-behavior sequences: Selecting at least one key behavior vector from a plurality of sub-behavior vectors included in a sub-behavior sequence based on a sparse attribute of each of the plurality of sub-behavior vectors, wherein the sparse attribute is used to characterize the degree of difference between a sub-behavior vector and other sub-behavior vectors; Based on the similarity between each key behavior vector and the multiple sub-behavior vectors, the multiple sub-behavior vectors are fused to obtain a corresponding behavior sequence vector; Determining a sub-feature graph corresponding to the sub-behavior sequence based on the obtained at least one behavior sequence vector; The prediction module is used to obtain an anomaly detection result of the target behavior sequence based on the obtained N sub-feature graphs.

12. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium, characterized in that It stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of any one of the methods according to claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer device, the computer device is caused to perform the steps of the method according to any one of claims 1 to 10.

Images